v1 closeout wave 2: merge #13583, #13582, #13615, #13609, gentle-dove-36, #13108 + regen

.gitignore

@@ -77,12 +77,12 @@ __pycache__/
 # regenerable from committed source — symlink to target/release created by codegen
 /bin/
 
-# --- Derived failure-mode roster [owner: gunbc.recurring_failure_mode] ---
-# regenerable from committed source — membership list derived from sibling row files before compile; not a second authored authority
+# --- Retired failure-mode roster file [owner: gunbc.recurring_failure_mode] ---
+# superseded; canonical home: the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader — legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written
 /dag/gunbc/recurring_failure_mode/roster.dag
 
-# --- Derived rung-drop roster [owner: gunbc.rung_drop] ---
-# regenerable from committed source — membership list derived from sibling RungDrop row files before compile; not a second authored authority
+# --- Retired rung-drop roster file [owner: gunbc.rung_drop] ---
+# superseded; canonical home: the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader — legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written
 /dag/gunbc/rung_drop/roster.dag
 
 # --- Generator stamp files [owner: gunbc.generated_artifact] ---

ROADMAP.md

@@ -68,7 +68,7 @@ Every node declares its parent in the functional decomposition: gunbc-project-ro
 - [ ] **DP-M3: extdeps-scope closure halved** — The legacy extdeps scope manifest (dag/gunbc/legacy_extdeps_scope_frontier.tsv via gunbc.extdeps_scope_frontier) halved, and tools.extdeps_scope_placement_gate enrolled on an executing route before anything is counted. The unimported-bare-provider roster the census pairs with this is not on this line (v2.workflow.floor_unimported_bare_provider_debt_roster exists on main only). Why: An undeclared external-authority placement is a §3 citation nobody can check. [authority](dag/gunbc/extdeps_scope_frontier.dag)
 - [ ] **DP-M4: closed matches are total** — gunbc.non_fold_residue non_fold_residue_frontier (about 186 rows on this tree) down to at most 100, draining the nfr_reason_mint_era rows first (82). The six seed-Rust wildcard sites are out of scope. Why: A wildcard arm silently absorbs a new variant, which is the floor-level exhaustiveness guarantee missing. [authority](dag/gunbc/non_fold_residue.dag)
 - [ ] **DP-M5: absence is established, never inferred** — extdeps.filesystem.filesystem_io filesystem_absence_establishment_adoption_standing driven to zero open sites (each routed through filesystem_file_observation / filesystem_entry_presence), and filesystem_read_outcome_adoption_standing re-measured at identity grain. Why: Each unconverted site can report "nothing there" when it could not look. [authority](dag/extdeps/filesystem/filesystem_io.dag)
-- [ ] **DP-M6: v2 native-route walls restored** — The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) exist on main and not on this line, so this milestone's population is re-derived from gunbc.rung_drop once the line carries them. Why: Each standing drop is a known wall down on the path v2 is meant to run on. [authority](dag/gunbc/rung_drop.dag)
+- [ ] **DP-M6: v2 native-route walls restored** — The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) existed on main and not on this line. admit_callers_discarded_on_the_native_route is now retired by its own trigger -- the native route checks caller admission from the fn's declared admit_callers list, with the Arrow carrier and its consumer landing together (v2.compiler body_lowering_fold body_lower_fn_admit_clause_edges; v2.compiler.infer infer_caller_admission_diags) -- so it no longer counts. The other two remain, re-derived from gunbc.rung_drop once the line carries them. Why: Each standing drop is a known wall down on the path v2 is meant to run on. [authority](dag/gunbc/rung_drop.dag)
 - [ ] **The factory: harness, workers, CI/floor and the daily workspace, the machine that lands and verifies work** — The steps every change traverses (orientation, implementation, test, commit, publication, review, verification) are owned by the workflow as durable state, not by an agent's memory. CI and floor verdicts name what they executed and cost what their inputs require. Why: Every obligation left in prose is re-learned per session and dropped under pressure. Every finished candidate that needs hand-integration spends operator time the factory exists to save. [authority](docs/plans/harness-work-lifecycle.md)
 - [ ] **One request travels the whole factory and comes back as an independently reviewed, published candidate** — The dogfood route as one acceptance case: request, immutable subject, shared computation, placement grant, isolated execution, durable result, metering, independent review, candidate published, cleanup, result returned (production order: the belt reviews a head before publishing it) -- each established by its own typed record from the durable records the real srv2 route wrote for ONE attempt (gunbc.roadmap_dogfood_route DogfoodRouteReceipt). The start receipt is the first complete attempt, selected in refname order, by the first successful recorder to observe one (scanning durable attempt history), recorded once, create-only; attempts operated by hand before the route existed do not qualify. Why: Without one executable case the factory is a set of stages that each pass alone while no request has crossed them all, and the operator's confidence -- the gate for the first external customer -- has nothing to rest on. [authority](dag/gunbc/roadmap/roadmap_dogfood_route.dag)
 - [ ] **Publish each attempt's worker events to the fabric event log** — The harness's per-attempt worker events, today appended only to a host-local provider-events.jsonl that gunbc.roadmap_provider_events reads, are appended to gunbc.fabric_event_log as a new payload kind over its existing partitions (product.capacity.event_chain), one partition per attempt. Any consumer then reads an attempt's events from the fabric rather than from a file on the worker's host. Why: Without it, every live view depends on sharing a filesystem with the worker, and streaming cannot go through the fabric as ruled. [authority](dag/gunbc/fabric/fabric_event_log.dag)

dag/extdeps/cache.dag

@@ -25,8 +25,6 @@ import extdeps.cache.types {
   CatalogOpaqueStringKey,
   CatalogCasContentDigest,
 }
-import extdeps.realization.parse_table_memo { parse_table_memo_facts, parse_table_memo_id }
-import extdeps.realization.compile_stage_memo { compile_stage_memo_facts, compile_stage_memo_id }
 import extdeps.realization.reconcile_in_process {
   parse_cache_facts,
   typed_module_cache_facts,
@@ -128,8 +126,6 @@ data sccache_local: CacheInterfaceCatalogFacts = sccache_local_facts
 data buildbuddy_cas: CacheInterfaceCatalogFacts = buildbuddy_cas_facts
 data cargo_target_dir: CacheInterfaceCatalogFacts = cargo_target_dir_facts
 data rustup_toolchain_store: CacheInterfaceCatalogFacts = rustup_toolchain_store_facts
-data parse_table_memo: CacheInterfaceCatalogFacts = parse_table_memo_facts
-data compile_stage_memo: CacheInterfaceCatalogFacts = compile_stage_memo_facts
 
 data cache_catalog: List<CacheInterfaceCatalogFacts> = [
   gha_actions_cache,
@@ -139,26 +135,22 @@ data cache_catalog: List<CacheInterfaceCatalogFacts> = [
   rustup_toolchain_store,
   parse_cache_facts,
   typed_module_cache_facts,
-  parse_table_memo,
-  compile_stage_memo_facts,
   materialization_store_local_facts,
 ]
 
 data cache_catalog_rows: List<CacheInterfaceFacts> = cache_catalog
   |> map(row => cache_interface_facts_from_catalog(row: row))
 
 data sccache_local_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(sccache_local)
-data parse_table_memo_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(parse_table_memo)
+data parse_cache_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(parse_cache_facts)
 data cargo_target_dir_projected: CacheInterfaceFacts = cache_interface_facts_from_catalog(cargo_target_dir)
 
 data cache_layer_default_order: List<CacheInterfaceId> = [
-  parse_table_memo_id,
   parse_cache_id,
   typed_module_cache_id,
   cargo_target_dir_id,
   sccache_local_id,
   rustup_toolchain_store_id,
   buildbuddy_cas_id,
   gha_actions_cache_id,
-  compile_stage_memo_id,
 ]

dag/gunbc/auth/approval_store_receipt.dag

@@ -2,7 +2,7 @@ module gunbc.auth.approval_store_receipt
 
 import std.logic { Bool }
 import std.types { NonEmptyStr, Timestamp, String, Int, List }
-import v2.std.algebra { skip }
+import v2.std.algebra { skip, length }
 import std.optional { Present, Absent }
 import std.scoped_authorization { AttemptIdentity }
 import std.durable_compare_and_set { cas_generation_first }
@@ -249,7 +249,7 @@ fn receipt_line_at(lines: List<String>, i: Int) -> String {
 
 fn request_field(line: String, key: String) -> String {
   let prefix = join([key, "="], "")
-  if starts_with(s: line, prefix: prefix) { substring(s: line, start: string_length(s: prefix), end: string_length(s: line)) } else { "" }
+  if starts_with(s: line, prefix: prefix) { substring(s: line, start: length(xs: prefix), end: length(xs: line)) } else { "" }
 }
 
 // THE WIRE A RECEIPT TRAVELS AS: its signing input, then its tag, one line each. The signing input

dag/gunbc/auth/login_transaction_store.dag

@@ -32,9 +32,8 @@ import extdeps.languages.json.parse {
   JsonDocumentUnreadable, FieldAbsent, FieldRead, FieldMalformed,
 }
 import extdeps.auth.oidc { OidcLoginTransaction, OidcPkceCodeVerifier, RelativeReturnPath }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance }
-
-data login_transaction_store_dir_segment: String = "auth-login-transactions"
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 
 data login_transaction_file_suffix: String = ".json"
 
@@ -44,9 +43,17 @@ type LoginTransactionStoreLayout {
   root: FilePath
 }
 
+// THE DIRECTORY THIS STORE DEMANDS. It used to join its own segment onto the instance root while the
+// provision plan named the same directory a second time, and nothing on the production route created
+// it; now the store declares the target and reads its root off it, and both deployment routes ensure
+// that target (gunbc.roadmap.dashboard_instance_directories).
+fn login_transaction_store_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "auth-login-transactions" as NonEmptyStr, child: "auth-login-transactions")
+}
+
 fn login_transaction_store_layout_for_instance(instance: HostDashboardInstance) -> LoginTransactionStoreLayout {
   LoginTransactionStoreLayout {
-    root: join([instance.instance_root as String, "/", login_transaction_store_dir_segment], "") as FilePath,
+    root: owned_directory_path(t: login_transaction_store_directory(instance: instance)),
   }
 }
 

dag/gunbc/auth/oidc_id_token_verification.dag

@@ -61,7 +61,8 @@ import extdeps.filesystem.filesystem_io {
 import extdeps.gunbc
 import gunbc.output_policy { OutcomeIsData }
 import gunbc.principal_projection { google_oidc_issuer }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_auth_store_root, DashboardAuthJwksCache }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 
 // ── The Google endpoints and cache policy ──────────────────────────────────────────────────────
 // THE GOOGLE REALIZATION FACTS as data rows: the JWKS endpoint this module fetches and the
@@ -801,10 +802,16 @@ type JwksCacheLayout {
   file: String
 }
 
+// THE DIRECTORY THE JWKS CACHE DEMANDS; the layout's directory is read off it (gunbc.owned_directory).
+fn jwks_cache_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "auth-jwks" as NonEmptyStr, child: "auth-jwks")
+}
+
 fn jwks_cache_layout_for_instance(instance: HostDashboardInstance) -> JwksCacheLayout {
+  let dir = owned_directory_path(t: jwks_cache_directory(instance: instance))
   JwksCacheLayout {
-    dir: dashboard_instance_auth_store_root(instance: instance, store: DashboardAuthJwksCache),
-    file: join([(dashboard_instance_auth_store_root(instance: instance, store: DashboardAuthJwksCache) as String), "/", jwks_cache_file_name], ""),
+    dir: dir,
+    file: join([dir as String, "/", jwks_cache_file_name], ""),
   }
 }
 

dag/gunbc/auth/profile_projection.dag

@@ -22,7 +22,8 @@ import extdeps.languages.json.parse {
 import extdeps.uri { Uri, Https, Http, uri_wire }
 import extdeps.tools.sha256sum { sha256sum_stdin_digest_via_shell, Sha256FileDigest, Sha256FileDigestUnavailable }
 import gunbc.principal_projection { PrincipalRef, principal_ref_label, principal_ref_parse_label }
-import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_auth_store_root, DashboardAuthProfiles }
+import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_private_directory }
+import gunbc.owned_directory { OwnedDirectoryTarget, owned_directory_path }
 import gunbc.auth.session { AuthenticatedSession }
 
 // THE PROFILE PROJECTION (Cut 4 plan, docs/plans/google-workspace-identity-convergence.md
@@ -55,9 +56,14 @@ type ProfileStoreLayout {
   root: FilePath
 }
 
+// THE DIRECTORY THIS STORE DEMANDS; the layout's root is read off it (gunbc.owned_directory).
+fn profile_store_directory(instance: HostDashboardInstance) -> OwnedDirectoryTarget {
+  dashboard_instance_private_directory(instance: instance, member: "auth-profiles" as NonEmptyStr, child: "auth-profiles")
+}
+
 fn profile_store_layout_for_instance(instance: HostDashboardInstance) -> ProfileStoreLayout {
   ProfileStoreLayout {
-    root: dashboard_instance_auth_store_root(instance: instance, store: DashboardAuthProfiles),
+    root: owned_directory_path(t: profile_store_directory(instance: instance)),
   }
 }