Repository navigation
C2 #13482: the seven review fixes (own-interface entries, lookup-first, one root authority, unavailable is not miss) - #13634
gunbai-bot[bot] wants to merge 26 commits into
Conversation
… the frontier on a unused declaration. C2 now looks up and commits TypecheckModuleRequest from reconcile using content digests, fail-closed prepare/commit/integrity arms, and a family budget derived from the existing per-entry estimate rather than a synthetic interface literal. The durable-budgets frontier stays unbound until that executing consumer is the retirement trigger. Co-authored-by: Cursor <cursoragent@cursor.com>
Review 77087 was right that a function named measured_largest_entry was still an estimate. The family unit is now typed_module_bytes_per_entry_estimate under its own name, and the wet size check no longer claims to be a real typecheck-entry reading. Co-authored-by: Cursor <cursoragent@cursor.com>
The family byte ceiling is still estimate × residency, but the per-entry figure is no longer an untyped authored constant: it carries CitedFigureStanding with a read_obligation naming observed_largest_entry_bytes on the real typecheck commit path, and the budget frontier stays unbound. Drop the live-ladder discharge claim while those frontiers stay open. Co-authored-by: Cursor <cursoragent@cursor.com>
Import the payload type from std.materialization_object, and keep the wet cold/warm millis if-arms as EpochMs so declarations resolve. Co-authored-by: Cursor <cursoragent@cursor.com>
The wet family-budget probe refused because map(... as InterfaceHash) cannot coerce Fnv1a64Structural at eval. Seed hex imports use the same pattern. Co-authored-by: Cursor <cursoragent@cursor.com>
The hermetic floor has no DirWithTemplate/Read mock for those identities; their terminal stays the wet lane. Drop the InterfaceHash runtime cast from the hermetic key claim. Co-authored-by: Cursor <cursoragent@cursor.com>
…hority, typed counted outcomes Entry is the module's own tail (TypecheckModuleOwn); a hit restores via typecheck_module_restore from the imports. Lookup runs before collect_parent_envs. DURABLE_ROOT and durable_volume_present deleted. Unavailable/commit-missed-open/re-entry are counted and reported by store_receipt_line with largest_entry_bytes. Wet-claim route-gap enrollment reverted. InterfaceHash branded at the producer. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ndex; counted unreachable outcomes; commit on nested-hit Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…e default lib run Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ess-hit commit Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…permanently green unbound witnesses; budget frontier stays open Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…te dangling with-provider floor decls Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… stored object size read back from the door Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… whole cold index Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…cluded from the largest-entry reading Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… or writes it (counted not_configured); enroll the three hermetic-unreachable wet claims as the route-gap triple Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…e caller's pool; CI-never-exercises-the-store is a declared frontier; re-entry guard around selector resolve; clippy fix Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…oncile -> lookup -> restore integration Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19c41daf1b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let interface_text = serde_json::to_string(&(&own.items, &own.func_local, &own.item_registry)) | ||
| .map_err(|e| format!("typecheck-store serialize own interface: {e}"))?; | ||
| let diagnostics_text = serde_json::to_string(&own.diagnostics) | ||
| .map_err(|e| format!("typecheck-store serialize own diagnostics: {e}"))?; |
There was a problem hiding this comment.
Canonicalize payloads before concurrent commits
When two compiler processes miss the same key before either publishes, func_local, item_registry, and nested values contain HashMaps, so these serde_json payloads can differ solely because each process has a different randomized iteration order (the test helper itself notes that this text is noncanonical). The local store treats different payload bytes for one request as StoreCommitResultContentConflict, and the durable_typecheck_commit(...)? call then aborts the second compile, making the shared durable cache fail under ordinary concurrent cold writers. Serialize these maps canonically so equivalent results converge.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19c41daf1b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| .map_err(|e| format!("typecheck-store hit interface is not a module tail: {e}"))?; | ||
| let diagnostics = serde_json::from_str(diagnostics_text) |
There was a problem hiding this comment.
Re-intern persisted nodes before restoring them
When a durable hit was written by a process with a different InternTable layout, deserializing items and func_local preserves that writer's numeric Node.ident values. The restore path then grafts those nodes onto a head built with the reader's intern table; subsequent operations such as lookup_type_for treat a present identifier as authoritative and do not fall back to the name, so imported signatures can resolve to the wrong binding or no binding at all. Intern layouts can differ across processes or source-pool parse orders, which is precisely where this durable cache is meant to operate, so the payload must store symbolic identities or re-intern every persisted node against the current table.
Useful? React with 👍 / 👎.
| intern_table.clone(), | ||
| module_symbol_index, | ||
| module_variant_base, | ||
| Rc::new(own), |
There was a problem hiding this comment.
Rebase persisted source spans on durable hits
When identical source content is compiled from a different checkout or source-root path, the content-only request key still hits, but own.items, func_local, and diagnostics retain the writer's serialized SourceSpan.file paths. typecheck_module_restore rebuilds the head with the reader's source_indices and then grafts this payload unchanged, so cached diagnostics and source-located output can point at a nonexistent or unrelated path. Rebind spans to the current resolved module (or include the path identity in the key) before assembling the hit.
Useful? React with 👍 / 👎.
|
Closed without folding in the v1 closeout bankruptcy (#13641). Follow-up fixes to the unfinished C2 store (#13482, also closed); it also re-adds the scratch t_tmp.sh (review 78363). Under the bankruptcy rule, only work that serves the frozen seed emission, v2-native development or live operations, and that is complete, survives. The branch is kept for archaeology; no follow-up obligation is created. — sent from neat-wolf-604 |
* dispatch-actuator witness: import the lineage, alignment and ticket names #13622's specimen uses Review 78285 on #13622: the supplied-specimen claims call lineage_walk, lineage_is_rooted and alignment_chain and build TicketLine/TicketFields/NodeParent/AdmittedRoot/RoadmapNodeIdentity without importing them. They resolved only through the flat bare-name tier DESIGN schedules for removal, so they would go red when it is cut. Import each from its declaring module. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Revert "Merge #13548 (session/sharp-deer-755-unimported-type-import-migrate) into integration/sharp-raven-357" This reverts commit 1a22abd, reversing changes made to a04255a. * native_emission_controls: repair integration union (close variant_literal_application_cases, one roster, one composition over all 17 case groups) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Exclude #13604 from integration/eager-gull-22: WIP, open REQUEST_CHANGES (review 78326) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs/design-rung-drops.md: regenerate through tools.docs_projection_gate regen after the #13569 merge Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * grammar: import int_to_decimal_string from std.integer (#13436 moved it; #13379's binding-power row still named v2.std.integer integer_int_to_decimal_string) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * WIP: mtcollins1 runner: boot leg, runner image medium + runner-host-up termin * Realize reviewed kernel dependencies through guarded host maintenance * Rewrite the cross-module record-field pin to the refusal it named as its trigger. Infer now refuses `n: true` against `RcfFar` declared in another module; keeping the counted-Undecidable pin would be a meaning fork of the same claim name. Co-authored-by: Cursor <cursoragent@cursor.com> * Close the post-main census: drop the Map interpolation hole, concat the spatial cast. Merging main reintroduced one implicit stringify (Map Display in the canonical-order witness) and left the spatial_dimension `{o as String}` template as a v1 span mismatch. Named Int/Nat/Symbol routes stay; the Map hole is deleted rather than given a fourth renderer. Co-authored-by: Cursor <cursoragent@cursor.com> * Regenerate fleet-converge.yml via generated_artifact_gate main_wet Replaces the provisional #13359 copy taken at merge, which dropped main's printer mode, WIF provider rename and r2_cache options. Diff vs main is now only the two new custody credential options (cursor_worker_turn_api_key, codex_worker_turn_auth). Regenerated remotely (BuildBuddy invocation 3107c1bf-7c17-4bd4-92ec-53bb6b0be1fe) under a cgroup memory.max, regen exit 0. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Remove scratch witness scripts committed by the close-out flush (review 78354) The wind-down flush committed untracked local files (.runwit*.sh, .probe2.sh, .wit/) as 32dcf74. They are local receipt scaffolding, not part of the boot leg. This restores the tree to 80c24b3. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * cax onboard: enumerate the closed-coproduct arms the floor's non-fold residue check refused approved_grant_policy, plan_against_policy and provider_controlled_host matched closed coproducts with a wildcard arm; each arm is now explicit, so a new variant refuses at compile rather than being absorbed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * v1 closeout: open PR accounting Every open PR, with its owning lane and its disposition in the mega branch. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * v1 closeout accounting: add the side-chat dispositions and wave 2 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Regenerate stage0 emit_rust mirror for the integrated authorities (first_generation_equal=true, 0 installs on pass 2) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * v1 closeout accounting: bold-bee and qwen dispositions Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * v1 closeout accounting: outstanding work, closed PRs, and a re-sweep of all 162 open PRs Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * v1 closeout accounting: #13607, swift-bat-828 branches Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * integration/silent-lark-156: regenerate generated artifacts after merging #13472 and #13610 Produced by main_wet + claim_executor --required-regen on BuildBuddy at fd4421d; second regen round installed nothing (fixed point). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * v1 closeout accounting: silent-lark, gentle-dove, royal-moth, neat-boar, nimble-heron, valiant-crab handoffs Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Second-type OpenRouter Retry-After and quota term (review 78356) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * v1 closeout accounting: lively-ram and silent-lark handoffs, #13460 folded, #13108 and #13330 dispositions Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Regenerate docs/design-rung-drops.md and the v1_compiler_emit_rust stage0 mirror for the integrated tree Generated through docs_projection_gate regen and claim_executor --required-regen on srv1; round 2 reports first_generation_equal=true (a fixed point). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * v1 closeout accounting: #13488, #13574, #13475, #13634 reviews; #13648 closed; archive-flush residue Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * provisional: gentle-dove-36 mirrors for conflicted generated files (seed bootstrap; regen replaces) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Revert "Merge #13574 into integration/gentle-dove-36" This reverts commit 32720e2, reversing changes made to eee50a4. * provisional: v1_rt.rs from silent-lark-156 (carries host_budget_darwin_physical; seed bootstrap, regen replaces) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * provisional: v1_rt.rs = v1-closeout + silent-lark-156 delta (seed bootstrap; regen replaces) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * v1 closeout accounting: sharp-raven report, #13265, #13574 revert decision Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * provisional: append rt_host_budget (HostBudgetJoin*) to v1_rt.rs (seed bootstrap; regen replaces) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Exclude #13595/#13574 from integration/eager-gull-22 (operator decision msg_c695ffcc) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Exclude #13595/#13574 from integration/eager-gull-22 (operator decision msg_c695ffcc) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Fix stderr-capture tests so they hit real routes, not decoys. Delete the rustc program that returned Err before spawn without compiling emit_shell_stderr_policy_binding; absent policy is already refused at the emit diagnostic wall. Drive Complete limits from the live host-budget join and keep drain specimens on the emit_rust authority strings. Co-authored-by: Cursor <cursoragent@cursor.com> * fabric_quota: re-attach the window-start comment to quota_window_start (review 78371) checked_second had been inserted between the comment and the function it documents. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Required CI: withdraw the four v1-judged lanes; the gate is emit-build alone (operator ruling 2026-10-09) The operator's v1 withdrawal: v1 is no longer a validation authority, and the one use left to the seed is emitting v2. gunbc.compiler_gate_workflow drops `floor`, `generated`, `rust-unit-tests` and `seed`; the `witnesses` aggregate reads the one remaining lane, `emit-build`, through the same folded roster (one row). The GateArmSkippedOnPullRequest arm leaves with its only inhabitant. The loss is one declared drop, gunbc.rung_drop v1_required_lanes_withdrawn, stated member by member (witnesses, stage0 mirrors and every generated artifact, lint, v1 unit tests, module resolution outside the two emitted closures, the downstream consumers), with a trigger that names the capability: a binary built from an emission of v2 judging that population on the required path. rust_unit_tests_off_pull_requests is Superseded (its lane runs nowhere; trigger did not fire; the new row holds the loss). gunbc.required_ci_contract_epoch moves to 2026-10-09.1: the name `witnesses` now carries a materially different contract. Consumers repaired rather than left dangling: the lane-resolution census roster (the census now does not hold by design and is the instrument that re-derives the drop's module population), DESIGN section 3's typed required-gate reference (gunbc.documentary_refs, now emitted_subject_build_rows), the Building & checks rows, the onboarding path's run-witnesses step, five recurring_failure_mode evidence rows that cited deleted declarations, and the two gate witness files (the blocking set is asserted as exactly emit-build; a new RED asserts the four withdrawn variables reach neither gate surface). Projections regenerated by tools.generated_artifact_gate main_wet (the run peaked at 15.8 GB RSS, against the 7.55 GiB that module's own note cites for 2026-08-31): witnesses.yml, DESIGN.md, docs/design-rung-drops.md, docs/onboarding.md; every other rostered artifact came out byte-identical. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Drop process-global budget env from stderr-capture tests. review 78373: planting Complete limits through GUNBC_MEMORY_BUDGET_BYTES leaked into parallel tests and did not inhabit the emit bind. Claim the drain strings only; leave the host-budget join uncovered. Co-authored-by: Cursor <cursoragent@cursor.com> * regen round 0: stage0 mirrors from claim_executor --required-regen (supersedes provisional splices) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * provisional: re-append rt_host_budget to v1_rt.rs (round-0 regen emitted v1_rt.rs without it; seed bootstrap) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * regen round 2: stage0 mirrors (v1_rt.rs now emitted with rt_host_budget; hand-appended lines gone) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Regenerate generated artifacts for integration/eager-gull-22 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * required_ci_phase_roster: import std.optional (v2.std.optional moved by #13388; stale import from #13225) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * v1 closeout accounting: all lanes reported; remaining merge plan; closed auto-opened PRs Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Revert #13123 (admit_callers enforcement: mega's AdmitCallersEdge is the one enforcer) * v1 closeout accounting: #13516 folded, #13212 dispositioned; every lane reported Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Drop #13545 transcribed-count red chunk (counts derive from ci_runner_sudo_binaries); retarget caller-admission real-route evidence to exact counts Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * v1 closeout accounting: eager-gull review outcomes, #13608 newer head, updated plan Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Drop the seed-growth citation of the deleted absent-policy decoy. review 78381: hand_authored_declarations still named emitted_absent_policy_refuses_before_spawn after that test was removed. Absent policy stays cited as capture_channels_without_stderr_capture_input_refuse_the_union. Co-authored-by: Cursor <cursoragent@cursor.com> * Revert #13586 (receipt-only, excluded by operator review) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Revert #13453 (base-compiler/floor protocol; excluded by operator review): seed Rust, workflow steps and the script-row refusal API go with it Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * WIP: one required job, fresh products, memory envelope, heal-publish deletion (pre-merge, projections not yet regenerated) * stage0 mirrors: restore generated mirrors to the mega branch's coherent set pending one regen round Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * floor_route_gap: give the belt exit-drain expectations their own chunk_43 Two folded PRs (#13442's seeded_filler rows and #13125's belt exit-drain rows) each added floor_route_gap_expectation_chunk_42. The second silently replaced the first and the native emitter refused (duplicate declaration). The exit-drain chunk becomes chunk_43 and joins the roster, so both expectation sets are read. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * live_deploy: reconcile #13599 with #13583's directory authority #13583 made owned directories the single directory authority (directory demands; host_directories) and removed the directory kinds from the ensured steps and the instance parameter from deployment_ensured_steps. #13599, folded alongside it, still called deployment_ensured_steps(instance:, target:) and its witness matched on the deleted step kinds. The call passes target only, and the lab-vs-production fabric-store claim now counts fabric_storage_store_directories demands in deployment_directory_demands. Same claim, read through the surviving authority. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * roadmap_task_record: JSON codec for a runtime RoadmapNode (piece 1, uncompiled draft) * roadmap_task_record witness * roadmap_task_store: chain-partition roster over the fabric state binding, with wet witness (draft) * roadmap_task_record: parent and centering required on the wire; drop nested optionals Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * managed_host: a superseded rung drop is not a standing citation drop_is_standing_citation matched RungDropStanding with Retired and Standing only. Superseded has existed since the 2026-10-06 supersession, and the closeout's seed refuses the non-exhaustive match, which reaches every closure through managed_host (generated_artifact_gate included). A superseded drop no longer stands, so it is not a citation, the same as Retired. (Found by smart-gull-336.) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * WIP: federation retired-path row below imports; floor_demand pinned envelope rows; managed_host Superseded arm (pre-regen) * Headless Claude dispatch: print argv, systemd unit, stream-json projection. When the harness has no spark, ExecutorDefault can admit Claude if custody is present; events stay in the belt's Codex envelope. Credential converge on srv1 remains an operator decision. Co-authored-by: Cursor <cursoragent@cursor.com> * closeout: complete the #13453 revert -- gunbc.fleet_desired_admission_workflow no longer imports the deleted script-row refusal API 6ee1d21 (integration/v1-closeout) removed fleet_desired_candidate_fetch_script_row and candidate_scripts_refusal from gunbc.fleet_desired_candidate but left their consumer, so every entry whose closure reaches the generated-artifact registry refused to resolve (regen, verify, five gate witnesses). This is origin/main's shape of the file: the admission workflow emits its YAML directly again. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * closeout: complete the #13453 revert -- gunbc.fleet_desired_admission_workflow no longer imports the deleted script-row refusal API 6ee1d21 (integration/v1-closeout) removed fleet_desired_candidate_fetch_script_row and candidate_scripts_refusal from gunbc.fleet_desired_candidate but left their consumer, so every entry whose closure reaches the generated-artifact registry refused to resolve (regen, verify, five gate witnesses). This is origin/main's shape of the file: the admission workflow emits its YAML directly again. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit 94464b1) * roadmap_task_record: balance ticket decode braces Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Address review 78387: one Claude event mapping, explicit executor, transmit effort. parse_codex_jsonl now classifies bounded Claude stream-json via claude_code_line_codex_kind; jq only bounds those lines. ExecutorDefault stays a harness refusal. Print argv carries --effort. Co-authored-by: Cursor <cursoragent@cursor.com> * v2 compiler: reconcile #13438's precedence climbing with #13582 and #12942 Two merge-born references to deleted code, found by emit-build on #13641: - 02_parse: #13438's infix stamp still wrote ParseProvenanceState.frame / FrameMinted, which #13582 deleted with the packrat memo. The write goes; the sibling stamps already carry none. - body_lowering_fold: #12942's sealed body_lower_fold_raw kept the pre-#13438 pipe-tower test (body_lower_is_pipe_tower_root / body_lower_tower_pipes_into_fold), which #13438 deleted. It now uses #13438's replacement predicate, body_lower_application_pipes_into_fold, and keeps #12942's sealed outcome. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fleet_converge_workflow: drop MtCollins1UiBundleObserve from the mode list #13503 removed the UI-bundle-observe mode (AMI-bundle-derived MegaRAC content) from FleetConvergeWorkflowMode but left it in fleet_converge_workflow_modes. Every name in the list now resolves to a declared variant. (Found by smart-gull-336.) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * WIP: trip is a ByteSize derived from the slot envelope (review 78388 item 3); witness claim the_trip_sits_inside_the_slot_envelope * Address review 78389: emit tmux event pipe only for tmux containers. Claude and harness systemd spawn no longer derive readiness from tee/pipe emission or refuse as tmux-event-pipe-emit. Co-authored-by: Cursor <cursoragent@cursor.com> * closeout: two stale references from folded deletions - first_element_of_a_list_has_three_spellings cited v2.std.optional Optional; the module is std.optional (#13388's move). - authorization_pattern_selection_witness imported PastedOperatorToken, which #13568 removed with the pasted-token refusal; the import was unused. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Regenerated projections for the one-job gate, on the merged closeout tree One main_wet of tools.generated_artifact_gate over this branch merged with integration/v1-closeout a925452 (regen 632 s, verify 693 s, both exit 0, on srv1 under capped MemorySwapMax=0 scopes), nine artifacts: - witnesses.yml: both subject steps carry GUNBC_BIND_MEMORY_CGROUP_BYTES (the derived trip, 20 GiB) and the failure notice carries the envelope lines (what 137 means, no larger runner and no retry, the MEMORY RECEIPT). - DESIGN.md, docs/design-rung-drops.md: the CI row and the drop roster. - .gitattributes: the deleted heal-publish.yml leaves the generated-artifact merge list. - fleet-converge.yml: the closeout's authority fix projected. - tools/fabric_ci_fci1_bounded_execution_context.env: the fci1 context follows the slot (22/21 GiB). - provisioning/srv{1,3,4}/gunbc-ghrunner.sudoers: a 22 GiB slot fits more slots per host than a 26 GiB one, so the derived rosters grow (srv1 gains srv1-10 and srv1-11). Desired state; applying it is the converge effect. The witness batch on the same tree: 16 files, green except the two latent reds already recorded in the PR (fci1_bounded_execution_context: a stale envelope-basis expectation; heal_publication_boundary: 23/34). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Enrol roadmap_task_store wet witness on the local-repo wet lane, as the allocation seam witness is Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Land the v2 cutover program as designed roadmap entries: 11 nodes, native_obligation_population plan, edges, RED acceptance witnesses Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * chore: regenerate drifted generated artifacts (ci auto-heal) Ledger-Repair-Judged: docs/design-rung-drops.md Ledger-Rows-Repaired: docs/design-rung-drops.md belt_liveness_publication_answers_unconsumed Ledger-Rows-Repaired: docs/design-rung-drops.md bmc_secure_apply_converge_new_witness_eval_step_cost Ledger-Rows-Repaired: docs/design-rung-drops.md edited_bin_witness_wet_rows_not_executed_by_ci Ledger-Rows-Repaired: docs/design-rung-drops.md fixture_closure_union_unmodeled_stderr_capture Ledger-Rows-Repaired: docs/design-rung-drops.md handoff_observer_is_sol_not_kvm_viewer Ledger-Rows-Repaired: docs/design-rung-drops.md kvm_observer_protocol_wet_witnesses_deleted_with_the_observer Ledger-Rows-Repaired: docs/design-rung-drops.md mtcollins1_boot_matrix_enrolment_dead_band_observed_only Ledger-Rows-Repaired: docs/design-rung-drops.md mtcollins1_boot_matrix_new_witness_eval_step_cost Heal-Candidate-Run: 38000315997 * closeout: regenerate stage0 mirrors and workflows from the folded tree One emission round (operator ruling 2026-10-04) on srv1 at a925452: claim_executor --required-regen, then generated_artifact_gate main_wet. Then on the regenerated tree: seed build OK, gunbc test //gunbc/instruments:v2-native-cli exit 0, //gunbc/instruments:self-host exit 0. Settles the files the folds left provisional (fleet-converge.yml, the std_* and v1_compiler_* mirrors). docs/design-rung-drops.md was already regenerated by CI auto-heal (17a309c). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * WIP: option B -- subject steps require the slot envelope; per-step trip withheld by the declared drop native_step_trip_awaits_fleet_job_cgroup; slot-grain receipt in gunbc test; seed-growth receipt (pre-regen) * Enrol roadmap_task_store wet witness in floor_route_gap and the local-repo wet terminal, as the allocation seam witness is Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Regenerate ROADMAP.md, docs/plans and .gitattributes for the cutover rows; repair updated(...) wrapping Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Describe the envelope as slot-grain (option B) in witnesses-one-required-job; regenerate projections on the merged head Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Type the cutover receipt readings (closed kinds, ByteSize) and make the peak-above-trip control compare against the slot trip Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Subject steps require the slot envelope; the per-step trip waits on a fleet fact; the envelope decision is a .dag fold the seed mirrors The first required run that passed GUNBC_BIND_MEMORY_CGROUP_BYTES (38002497388 on a4b8f78) refused in four seconds: MemoryCgroupBindRefused, the cgroup2 tree is not writable. memory_governor apply_memory_cgroup_bind creates its leaf at the cgroup ROOT (a container-root design; the bind had never been requested on the fleet) and a fleet job runs as the setpriv'd job user under a root unit, so no job process can create the bound. The operator approved the slot-grain arm (escalation 2026-10-09). gunbc.memory_envelope (new) owns the decision and the verdict as folds over supplied inputs -- the sibling of gunbc.memory_cgroup_binding -- and test.claim.memory_envelope_witness_test reaches every arm by supplied value, including the RED an inline decision could not: a slot requirement over a process no numeric memory.max binds REFUSES (MemoryEnvelopeAbsent) rather than running as bounded. The seed mirrors it arm for arm with unit tests; the shells resolve the bounding cgroup through binding_cap_cgroup_dir (never the peak locator), read memory.swap.max/.current/.peak (modeled in extdeps.linux.cgroup_v2_memory) before and after the producer, print a slot-grain MEMORY RECEIPT with event deltas and the peak labelled by whether it rose, and refuse the run on any OOM kill or swap. gunbc.emitted_subject_build_gate carries two envelope inputs and ONE decision over them, native_step_memory_inputs(ownership): every subject step REQUIRES the slot envelope (GUNBC_MEMORY_ENVELOPE_REQUIRED=slot, the projection of EnvelopeSlotRequired) and the bind input at the derived trip is withheld while gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership is JobOwnsNoBoundedCgroup. That is a fleet fact, not a rung drop -- nothing on the required path ever held the trip -- so the climb is rostered as gunbc.guarantee_stall native_step_trip_awaits_fleet_job_cgroup_stall (grounding: unit delegation with DelegateSubgroup=, a per-job cgroup staged by the root JIT wrapper, the governor's already-bound arm). The workflow and the failure notice consume the fact; the witness exercises both arms by supplied value, reads the live row, and asserts the bind KEY is absent. The slot wall follows the ruling too: gunbc.runner_slot_allocation gunbc_runner_slot_allocation_wall_holds drops its three floor conjuncts (a slot sized to a tenant that no longer runs in it) and requires MemorySwapMax == 0 instead of a swap above the maximum; the floor-fit drop slot_row_pinned_below_demonstrated_demand_unrefused is Superseded with v1_required_lanes_withdrawn as its loss holder; the slot witness re-pins the row to 22/21/0 and its width alarms to the smaller slot's derivation (srv1 12, srv3/srv4 21). The slot's demand oracle from here is the first cold required run's MEMORY RECEIPT, a declared frontier. The trip stays a ByteSize derived from the slot (review 78388 item 3). The seed growth is receipted as gunbc.memory_envelope_receipt_seed_growth (review 78391). The design document's CI row and the slot row's note say the same. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * emit_rust: locate module via ModuleIndex.by_name; is_known_variant reads carried variant_to_enum (port of #13608 23f2d08, 8ff94ca; mirrors pending regen) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * decimal_digit_of_units: construct the units digit via the successor table; no D9 default for out-of-range Int * closeout: bind variant_to_enum correctly at three #13665 call sites import_variant_parent_for_name has no emit_info parameter; emit_specific_import_use_lines has no variant_to_enum binding. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Regenerate ROADMAP.md on the merged head; re-cite the envelope fact and stall Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Take sold Group B (srv9-srv12) out of everything that reaches hardware; declare fixture residue as a rung drop Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Supply sold Group B (srv9-srv12) as in-witness fixture population; production rosters stay empty Chain: the scoped cut emptied dgx_spark_reserved_identities and the router bindings, so witnesses that discriminated on the Group B population (commitment standings, admissibility, rail rows, topology membership, reach labels) read nothing. spark_host_commitment_witness now folds the production placement, claim and reservation rows over a local four-host fixture, with one inhabitance claim that the production roster is empty; the topology, reach and site-locale witnesses are re-derived to the emptied rosters. Under rung drop serving_fixtures_name_sold_group_b_hosts. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Regenerate std_integer stage0 mirror (remote required-regen candidate) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * closeout: revert #13662's fold (operator decision 2026-10-10) #13662 (headless Claude worker) stays outside the closeout. A child re-lands it into main after #13641, with its review findings resolved. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Recut to five durable outcomes: cold-run envelope receipt rename, acceptance-receipt framing, derived-universe denominator, stable frontier subject; six chores moved to runtime tasks; no red witnesses Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * roadmap: split the event carrier's directory demand into a leaf module gunbc.roadmap.dashboard_instance_directories imported gunbc.roadmap.roadmap_event_carrier for one directory function, and through it the dispatch actuator. With #13625's host_standup -> host_effect import (c390a49), that closed a 13-module cycle (materialized_secret -> host_phase_status -> host_standup -> host_effect -> live_deploy.spec -> dashboard_instance_directories -> roadmap_event_carrier -> roadmap_dispatch_actuator -> cursor_harness_credential -> ...), and main_wet refused to resolve. The demand moves unchanged to gunbc.roadmap.roadmap_event_carrier_directory; the carrier, the directory list and the owned-directory witness import it from there. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Address review 78405: delete the never-red frontier-count decoration; eligibility and disjointness controls run over supplied members Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * closeout: five merge-born refusals that main_wet found - managed_host: HostnameAllocation no longer carries canonical_hostname; read it through allocated_canonical_hostname (hostname_allocation's name scheme, #13625). - host_control_route: handle ManagedHostFoundUnderDeclaredDrop the way managed_host's own account lookup does: the standing still decides the BMC route. - mtjade1_arrival_federation_provision: DedicatedFederation's principal_set became impersonation: FederationImpersonation; the arrival pool is a standing-pool impersonation. - fleet_workflow_steps: ci_fleet_wif_auth_step_when passed if_condition twice (a merge of #13607 and #13625). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Make fleet-converge branch-agnostic and parseable. GitHub refused the workflow on every push after the mode input description crossed ~10k characters. Shorten that description to an authority citation, pin WIF to the workflow file on any heads ref plus workflow_dispatch (not pull_request), and admit a deploy from the current branch when --candidate-branch is empty. expected_revision stays a check when supplied and otherwise is the dispatched sha. Co-authored-by: Cursor <cursoragent@cursor.com> * Name the branch-dispatch ruling; type malformed expected_revision. Comments no longer claim reviewed-main file trust. Absent vs malformed expected_revision are separate arms so admit_optional cannot parse prose. Co-authored-by: Cursor <cursoragent@cursor.com> * Declare the named-revision and deploy-branch drop. Those two refusals are a different subject from the WIF main pin; §4b(3) needs its own population and trigger. Co-authored-by: Cursor <cursoragent@cursor.com> * Recut #13660: restore privileged WIF to reviewed-main equality. A rung drop does not substitute for the trust boundary. Privileged fleet-converge federations pin workflow_ref and ref at main again; session-branch admission lives only on the development pin list, which is not bound to fleet-cloud-convergence. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop leftover census conflict markers and project the named-revision drop. The recut commit had kept rebase markers in gcp_iam_approval_enforced_in_reviewed_code; the projection now carries fleet_converge_named_revision_and_branch against closeout. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix OidcClaimPin inhabitance and the privileged-pin wording fork. branch_dispatch_claim_pins now constructs event_name via oidc_equals. Privileged jobs are described as reviewed-main equality; the development pin list is named as a frontier, not a live federation. Co-authored-by: Cursor <cursoragent@cursor.com> * Split presented OIDC claims from pins; printer session-branch is a red. Privileged printer pins equal reviewed main, so a concatenated session-branch workflow_ref must refuse. Admission now takes OidcPresentedClaim (name and value only); relation lives only on the pin. Co-authored-by: Cursor <cursoragent@cursor.com> * Regenerate fleet-converge.yml (21 inputs) and pin dashboard-deploy to main. GitHub refused the hand-edited 30-input file; emission from fleet_converge_dispatch_inputs is the repair. dashboard-deploy now requires refs/heads/main and environment srv1-production so a branch dispatch cannot wet-deploy production. Co-authored-by: Cursor <cursoragent@cursor.com> * closeout: revert #13663's fold (operator ruling: #13662 and #13663 stay outside the closeout) deep-cat-540 recuts it onto main after #13641. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Omit Spark dispatch when the administrator roster is empty. Review 78408: regeneration had folded a sold-out Spark roster into target options: [] while spark_* modes stayed selectable. Restoring srv5-srv12 would invent enrolled hosts. Emission now drops the target input and spark_* mode options, and refuses any remaining empty InputChoice. Co-authored-by: Cursor <cursoragent@cursor.com> * Treat srv1-production environment protection as the root-mutation boundary. A branch dispatch runs that branch's YAML, so a github.ref if is not a trust boundary. dashboard-deploy, approval-broker-dark-install and microvm-controller-install now name srv1-production; the required GitHub setting (main-only deployment branches, required reviewers) is modeled with an unobserved readback. Checkout is the event sha. Co-authored-by: Cursor <cursoragent@cursor.com> * closeout: stage0 mirrors and projections regenerated at a fixed point on 5c0d9d5 The composed closeout tip (the #13663 revert and #13664's fixed head folded) could not regenerate itself: claim_executor --required-regen refused with Stage0EmittedEdgesNotCovered (62 emitted edge endpoints with no stage0 crate) and the committed mirrors did not build a seed. Two generation-1 facts explain both, and both are repaired in this set rather than worked around. First, the regen's coverage check reads the host-shell roster from the TREE's src/v1/stage0/src/lib.rs (required_regen_host: closure_modules(lib.rs)), not from the seed. The integration-side regen from the d9368e8 seed, an emitter predating the crate planner (#13597), rewrote lib.rs without the three pub mod lines #13597's head 3674580 carried for gunbc_crate_partition, gunbc_emitted_crate_workspace and v1_compiler_emitted_workspace, while their mirrors and .dag sources stayed. Restoring the three declarations lets the regen run; the regenerated lib.rs then lists them canonically, which is the only change this set makes to lib.rs. Second, --required-regen renders v1_rt.rs from the SEED's compiled-in runtime rows, so a boot seed older than the tree's runtime_rust.dag emits a candidate without the host-budget join that the tree's memory_governor mirror consumes, and generation 1 does not build (the closeout history records the same provisional step at 42954d2). The committed v1_rt.rs is kept for generation 1; generation 2, whose seed carries the tip's rows, emits it identically, so v1_rt.rs is unchanged here. Recipe, on a shallow clone of 5c0d9d5 on srv1, each step under systemd-run --user --scope -p MemoryMax=80G -p MemorySwapMax=0: boot seed built from 3674580; main_wet; lib.rs roster repair; required-regen with the boot seed (first_generation_equal=false, 244-file candidate); install; v1_rt.rs restored; then the tip's own seed: build, main_wet, required-regen (generation 1: divergent, candidate installed; generation 2: first_generation_equal=true). No .dag file changes. The projections are main_wet's output over the composed tree: fleet-converge.yml regenerated from its 21-row authority (the committed 30-input file was drift), ROADMAP.md and docs/plans/native-obligation-population.md for #13664's recut, docs/design-rung-drops.md for the supersession, .gitattributes for the plan projection's merge driver. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fleet-converge: omit the Spark target input and spark_* modes while the administrator roster is empty; refuse an empty choice at emission (port of ffe8a90) The fixed-point regeneration on 5c0d9d5 faithfully emitted .github/workflows/fleet-converge.yml with `target: type: choice, options: []`, because gunbc.spark.credential_workflow spark_administrator_credential_roster has been empty since 2026-10-10 (every Spark sold) and gunbc.fleet_converge_workflow had no wall for an empty closed choice. GitHub rejects a choice input without options, so the regenerated workflow would have been undispatchable in every mode, not only the seven spark_* modes that read inputs.target; the previously committed file was drift the other way (hand-kept srv5..srv12 options for hosts no longer enrolled). Review 78408 on gunbc#13660 found this, and snappy-stag-26 fixed the authority there at ffe8a90; that PR is ruled outside the closeout at its WIF scope, so this commit ports exactly the empty-roster hunk and nothing of the WIF or environment changes. What changes in the authority: fleet_converge_spark_target_modes names the seven modes that consume the target; fleet_converge_dispatchable_modes() drops them while fleet_converge_spark_target_options is empty, and fleet_converge_mode_options is derived from it; the dispatch inputs are now fleet_converge_dispatch_input_rows filtered by fleet_converge_dispatch_inputs, which omits `target` while the roster is empty; fleet_converge_empty_choice_input_names() enumerates every InputChoice with no options over the four DispatchInputType variants, and expected_fleet_converge_yml() refuses emission with those names before the input-count check (DESIGN section 5: refuse, do not emit options: []). The witness every_dispatch_option_is_a_wire_value_of_the_vocabulary joins the options to the dispatchable modes, and empty_spark_roster_does_not_emit_an_empty_choice_or_spark_dispatch_modes pins the current roster state. The fleet_workflow_steps.dag hunk of ffe8a90 is not needed here: the closeout's ci_fleet_wif_auth_step_when already passes if_condition by name. The regenerated fleet-converge.yml is main_wet's output over this authority with the fixed-point seed; the stage0 mirrors are unchanged (the module is not in the emitted population) and required-regen stays at first_generation_equal=true. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * closeout: delete the accounting doc; the terminal ledger lives in #13641's body (review 5474794145) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * closeout: revert the #13664 fold (5c0d9d5) per the operator's review 5477471759: close #13664 without folding, branch preserved; projections regenerated next * deployment environments: model the branch policy as GitHub returns it (name + branch-or-tag rules), so the srv1-production standing can be discharged by a faithful GET (review 78420) Review 78420 on gunbc#13660 (folded here at 60c9457) found that extdeps.github.deployment_environments modeled the deployment-branch policy as SelectedRefs { refs: ["refs/heads/main"] }, while the API carries no refs: the environment object's deployment_branch_policy is null or { protected_branches, custom_branch_policies }, and the custom rules live at GET /repos/{owner}/{repo}/environments/{name}/deployment-branch-policies as branch_policies rows { name, type } with type "branch" or "tag". A reading of the real API can therefore never match the modeled refs, so gunbc.auth.github_deployment_environment's standing could never move from Unobserved to Holds (DESIGN section 3: model what the API actually returns; section 5: a check that cannot be discharged is not a boundary). The model now carries DeploymentBranchPolicyRule { name, ref_type: PolicyRefBranch | PolicyRefTag } under SelectedBranchesAndTags { rules }, the srv1-production requirement is the single branch rule named main with required reviewers, the restriction predicate requires exactly one rule that is a branch named main, and the read obligation names both GETs and the shapes they return. The witness gains a supplied-value control: a tag rule named main and a two-rule policy are not the main-branch boundary, the single branch rule is. Standing stays Unobserved until the operator applies the setting and its readback lands; that flip is the first follow-up on main. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * closeout: regenerate at the fixed point on composition A (revert of #13664, fold of #13660) Same recipe as f8c3fa4, on a shallow clone of dbdc9d2 with the previous fixed-point seed as the boot seed (srv1, logs8): main_wet exit 0; required-regen generation 0 drifted gunbc_cli_dispatch_surface.rs (gunbc.cli_dispatch_surface is touched by #13660), generation 1 drifted gunbc_cli_dispatch_generated.rs, generation 2 first_generation_equal=true planned=169 executed=169 adjudicated=169 declared_divergent=1 [main.rs]; verify (dry main) exit 0; rebuild; gunbc test //gunbc/instruments:v2-native-cli exit 0 (emit and build exit_status=0 warning_count=0 wall_s=611, discriminating red on v2_cli_compile_cli) and //gunbc/instruments:self-host exit 0 (wall_s=716, red on v2_compiler_compile). The projections resolved toward #13660's side in the merge (ROADMAP.md, fleet-converge.yml, docs/design-rung-drops.md) were byte-identical to main_wet's output, so only .gitattributes and the two cli_dispatch mirrors change here. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: gunbc-ci-auto-heal <briansrls@gmail.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: x <x@x> Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
Auto-opened by session-dashboard for session
neat-carp-75.Pushing to
session/neat-carp-75advances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan