R1 split DAG operator authority from v3 projection

[briansrls]

Summary

Restores dsl/extdeps/languages/dag/syntax.dag::dag_operators as the broader external .dag syntax authority, including the ?? null-coalescing row and % modulo row called out by the STOP audit.

Adds v3_supported_dag_operators as an explicit v3 capability projection without duplicating operator semantics: it carries only supported symbols, and v3 parse-table validation derives left_bp / right_bp / binop facts from the corresponding dag_operators rows. This keeps P1/M3 single-authority discipline while fencing current v3 tokenizer/parser/operator drift against the supported subset only.

Updates SG-2 parse-table/operator cross-validation to consume the v3-supported projection, and keeps SG-1 tokenizer authority explicit about ?? / % as parser-only debt. This does not make v3 parse % or ??.

Validation

• cargo fmt --all --check
• cargo test -p v3-compiler --test integration sg2c1_parse_tables_authority_test -- --nocapture (passed before the symbol-only projection tightening)
• CARGO_TARGET_DIR=/tmp/gunbc-target-crisp-r1 RUSTC_WRAPPER= cargo test -p v3-compiler --test integration sg2c1_parse_tables_authority_test::dag_operator_authority_keeps_external_rows_split_from_v3_projection -- --nocapture
• CARGO_TARGET_DIR=/tmp/gunbc-target-crisp-r1 RUSTC_WRAPPER= cargo test -p v3-compiler --test integration sg1_tokenize_authority_test::shared_operator_boundary_is_explicit_and_fail_closed -- --nocapture

Note: shared /cargo-target developed a stale lock after interrupted concurrent focused SG-1 runs, so the final focused SG-1/SG-2 validation used an isolated CARGO_TARGET_DIR.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 324b39ab · Trigger: manual
• Comparison: main @ d731a3bd ... codex/r3-row85-v2-ephemeral-source-root @ d6a6871b
• Conversation: View conversation

---

1. Story of the diff

This PR separates two concepts that were previously collapsed: dag_operators now models the external .dag operator universe, while v3_supported_dag_operators models the narrower subset the current v3 tokenizer/parser/operator pipeline can actually consume. syntax.dag adds external rows for ?? and %, then explicitly excludes them from the v3 projection; regen code in regen_parse_tables_emit.rs now validates parse_tables.dag rows against that projection while still reading precedence/binop facts from dag_operators. The tests follow the same split: tokenizer authority tests allow explicit parser-only debt for the new external-but-unsupported operators, and parse-table authority tests assert that ??/% remain in external authority but outside the v3 subset.

The direction is right: the projection avoids forcing current v3 to implement every externally modeled operator while preserving one semantic source for binding power and binop identity. The one gap I see is that the new filtering narrows validation too early and stops checking uniqueness of the external authority rows that are outside the v3 subset.

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Finding — BLOCKING, substrate-facing boundary authority. The diff touches the .dag syntax authority consumed by regen, not just file-local Rust. dsl/extdeps/languages/dag/syntax.dag:94 declares // External .dag operator precedence authority., but the Rust extractor now only inserts and duplicate-checks rows when they are v3-supported: src/v3/compiler/src/regen_parse_tables_emit.rs:1125 if supported_symbols.contains(&symbol) { and src/v3/compiler/src/regen_parse_tables_emit.rs:1135 "duplicate \dag_operatorsrow for v3-supported symbol{symbol}". That means duplicate/conflicting external rows for unsupported-but-authored symbols like ??and%are no longer fail-closed even thoughdag_operatorsis the single external syntax authority. Keep one uniqueness/shape validation pass over alldag_operators, then separately filter to the v3 projection for parse-table validation.

1. INVARIANTS.md + modeling-discipline.md.

Finding — P2 Boundary Discipline / P3 Fail-Closed. The split correctly avoids duplicate semantic authority for binding power by reading projected rows from dag_operators, but the validation boundary no longer fails closed for the full authoritative table. The problematic narrowing is at src/v3/compiler/src/regen_parse_tables_emit.rs:1125 if supported_symbols.contains(&symbol) {; after that, only v3-supported rows reach the duplicate guard at src/v3/compiler/src/regen_parse_tables_emit.rs:1127-1135. Unsupported external operators are now bounded debt, not nonexistent facts, so malformed duplicate rows in dag_operators should still be rejected at the same authority boundary.

1. CODING.md.

Compliant. The implementation stays in the data + free-function style: render_parse_tables_generated_rs calls the pure helper extract_v3_supported_operator_bps at src/v3/compiler/src/regen_parse_tables_emit.rs:96, and the new helper surface is explicit rather than hidden state or method-driven.

1. TESTING.md.

Compliant, with the blocking validation gap above not covered. The tests are behavior-level and targeted: src/v3/compiler/tests/integration/sg2c1_parse_tables_authority_test.rs:229 adds dag_operator_authority_keeps_external_rows_split_from_v3_projection, and src/v3/compiler/tests/integration/sg1_tokenize_authority_test.rs:342-348 documents the per-symbol unsupported boundary for ?? and %. Once the extractor keeps validating all external rows, I would add a small regression around duplicate unsupported dag_operators rows failing closed.

1. LOCKED DESIGN DECISIONS.

N/A — the diff does not cite or alter a locked thesis/design decision; it changes an operator authority/projection boundary and its regen/tests.

1. TRACKED vs UNTRACKED DEBT.

Compliant. The new debt is bounded and has a trigger: src/v3/compiler/tests/integration/sg1_tokenize_authority_test.rs:342-348 names only ?? and % and says they are excluded “until v3 parses it end-to-end”; the raw-source scaffold also keeps its dissolution trigger at src/v3/compiler/src/regen_parse_tables_emit.rs:1079-1080.

3. Verdict

REQUEST_CHANGES

The authority/projection split is the right shape, but the extractor currently validates duplicates only for the v3-supported subset, leaving the newly expanded external dag_operators authority partially unchecked. That is a small implementation fix, but because it sits at a substrate-facing single-authority boundary, I would not merge it as-is.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 447e4f23 · Trigger: schedule
• Thinking: 304s wall

---

BLOCKING (1)

Root Cause

• dsl/extdeps/languages/dag/syntax.dag v3 operator capability was split from external operator semantics only for parse-table regen → make the tokenizer bridge and SG-1 ratchet read v3_supported_dag_operators, leaving only symbol-to-token-kind formatting local.

⚠️ One support-boundary drift remains before this should land.

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: d6a6871b · Trigger: schedule
• Comparison: origin/main @ d731a3bd ... review/pr-1663-d6a6871b @ d6a6871b
• Thinking: 98s wall

---

Findings

None that rise to a rubric violation. The change cleanly separates external dag_operators (full external .dag syntax) from v3_supported_dag_operators (explicit v3 subset), keeps precedence/binop joined from the external list for supported symbols only, and documents parser-only gaps for ?? and % in sg1_tokenize_authority_test.rs with a non-empty reason — consistent with P2 (one semantic source for binding power; the map is a capability fence, not a second precedence table) and P5 scaffold/boundary language (named “until v3 parses it end-to-end” style trigger).

Verdict

APPROVE — The diff is narrowly scoped to operator authority vs v3 projection, fail-closed regen behavior is preserved against the subset, and integration tests are updated so shared operators are either tokenizer-backed or explicitly classified as parser-only debt.

Exploratory observations (optional)

• sg2c1_parse_tables_authority_test.rs:906–917 implements parse_all_string_literals with naive quote splitting, while regen_parse_tables_emit.rs uses escape-aware parse_string_literal for the real extractor. Not wrong for today’s map literals, but if the projection map ever gains escaped strings or odd formatting, the test helper could drift from production parsing behavior.

[briansrls]

Addressed the external-authority validation blocker in head 031595639.

Fix:

• extract_v3_supported_operator_bps now first parses all external dag_operators into a validated map and duplicate-checks every external symbol, including unsupported rows like ?? and %.
• Only after that full-authority validation does it filter by v3_supported_dag_operators for parse-table projection.
• Added unsupported_external_operator_duplicates_fail_closed, which proves a duplicate unsupported ?? row panics before projection filtering.

Validation:

• cargo fmt --all --check
• CARGO_TARGET_DIR=/tmp/gunbc-target-crisp-r1 RUSTC_WRAPPER= cargo test -p v3-compiler regen_parse_tables_emit::tests::unsupported_external_operator_duplicates_fail_closed -- --nocapture
• CARGO_TARGET_DIR=/tmp/gunbc-target-crisp-r1 RUSTC_WRAPPER= cargo test -p v3-compiler --test integration sg2c1_parse_tables_authority_test::dag_operator_authority_keeps_external_rows_split_from_v3_projection -- --nocapture

— sent from crisp-ibex-569

[briansrls]

Addressed the tokenizer-boundary support-authority blocker in head 26520caae.

Fix:

• SG-1 tokenizer generation now reads v3_supported_dag_operators and derives parser-only debt from operators that are present in external dag_operators but absent from that projection.
• Removed independent hard-coded ?? / % parser-only debt classifications from both regen_tokenize.rs and the SG-1 authority test.
• The remaining hard-coded classifier only maps v3-supported operator symbols to existing token variants; if a symbol is added to v3_supported_dag_operators without a tokenizer mapping, it fails closed.

Validation:

• cargo fmt --all --check
• CARGO_TARGET_DIR=/tmp/gunbc-target-crisp-r1 RUSTC_WRAPPER= cargo test -p v3-compiler --test integration sg1_tokenize_authority_test::shared_operator_boundary_is_explicit_and_fail_closed -- --nocapture
• CARGO_TARGET_DIR=/tmp/gunbc-target-crisp-r1 RUSTC_WRAPPER= cargo test -p v3-compiler --test integration sg2c1_parse_tables_authority_test::dag_operator_authority_keeps_external_rows_split_from_v3_projection -- --nocapture

— sent from crisp-ibex-569

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 5c0051bd · Trigger: schedule
• Comparison: origin/main @ a2b65214 ... review/pr-1663-5c0051bd @ 5c0051bd
• Thinking: 61s wall

---

Verdict: APPROVE

Diff looks clean. The new v3_supported_dag_operators projection keeps external .dag operator authority separate from current v3 capability, while the regen/test changes still read precedence and binop facts from dag_operators and fail closed on drift. No concrete violations of the pinned invariants, coding discipline, or testing discipline observed.

I did not run builds or tests, per instruction.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 5c0051bd · Trigger: manual
• Comparison: main @ a2b65214 ... codex/r3-row85-v2-ephemeral-source-root @ 5c0051bd
• Conversation: View conversation

---

1. Story of the diff

This PR splits the external .dag operator model from the narrower set that the current v3 tokenizer/parser/operator chain actually supports. dsl/extdeps/languages/dag/syntax.dag now keeps ?? and % in the external dag_operators authority while adding v3_supported_dag_operators as the explicit v3 capability subset, with comments making clear that unsupported external rows should not force v3 parser support yet (dsl/extdeps/languages/dag/syntax.dag:94-125). The regen paths then consume that split: tokenizer regen classifies only symbols in v3_supported_dag_operators as tokenized and treats the rest as documented parser-only debt (src/v3/compiler/src/bin/regen_tokenize.rs:614-631), while parse-table regen filters through the v3 projection but still joins back to dag_operators for binding power and binop facts (src/v3/compiler/src/regen_parse_tables_emit.rs:20-29, src/v3/compiler/src/regen_parse_tables_emit.rs:1083-1095). The tests are updated to assert both halves of the contract: %/?? remain external rows but are excluded from the current v3 projection, and malformed duplicate external operator rows still fail closed (src/v3/compiler/tests/integration/sg2c1_parse_tables_authority_test.rs:228-254, src/v3/compiler/src/regen_parse_tables_emit.rs:1257-1282).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Compliant — this touches a declared cross-pass authority surface rather than only local Rust; the diff preserves layer separation by declaring external syntax reality in dag_operators and current v3 capability separately in v3_supported_dag_operators, while explicitly saying v3 reads support from the projection and semantics from dag_operators (dsl/extdeps/languages/dag/syntax.dag:120-125).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — Boundary Discipline / single authority is handled: parse-table regen requires operator_symbol to appear in v3_supported_dag_operators, but binding power and binop are still read from the corresponding dag_operators row, avoiding a duplicate precedence/binop authority (src/v3/compiler/src/regen_parse_tables_emit.rs:24-29, src/v3/compiler/src/regen_parse_tables_emit.rs:1089-1095). Fail-closed is also preserved: a projected symbol missing from external dag_operators panics rather than fabricating operator facts (src/v3/compiler/src/regen_parse_tables_emit.rs:1090-1093), and a supported tokenizer symbol without a TokenKind mapping panics rather than silently dropping it (src/v3/compiler/src/bin/regen_tokenize.rs:648-650).

1. CODING.md.

Compliant — the new extraction logic is expressed as small free functions with explicit inputs, e.g. extract_v3_supported_operator_bps(source: &str) and extract_v3_supported_operator_symbols(source: &str), rather than hidden state or object methods (src/v3/compiler/src/regen_parse_tables_emit.rs:1083-1087, src/v3/compiler/src/regen_parse_tables_emit.rs:1158-1160). The generator-side validation uses existing fail-closed assertion/panic style for malformed authority data, including duplicate supported projection rows (src/v3/compiler/src/regen_parse_tables_emit.rs:1166-1170).

1. TESTING.md.

Compliant — the tests target the new behavior directly: the integration test checks that external operator rows for ?? and % exist while the v3 projection excludes them and remains a subset (src/v3/compiler/tests/integration/sg2c1_parse_tables_authority_test.rs:240-252), and the unit test pins the fail-closed duplicate-row path for unsupported external operators (src/v3/compiler/src/regen_parse_tables_emit.rs:1257-1282). The updated tokenizer authority test also keeps the parser-only debt branch behavior-driven by requiring a non-empty boundary reason (src/v3/compiler/tests/integration/sg1_tokenize_authority_test.rs:272-276).

1. LOCKED DESIGN DECISIONS.

N/A — I do not see this diff referencing or altering a locked design surface such as Arrow.body external realization, reflection completeness, or other explicitly locked thesis/design decisions; the change is confined to syntax/operator authority projection and its regen/test enforcement.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the raw-source extractor scaffold is documented with its bounds and dissolution trigger: the comments say the bridge exists because operator-list bodies still lower as ValueBody::Unparsed, and that it dissolves when the shared authority lowers structurally into typed reads (src/v3/compiler/src/regen_parse_tables_emit.rs:31-35, src/v3/compiler/src/regen_parse_tables_emit.rs:1077-1082). The unsupported-operator bridge is also bounded by the explicit projection and names the trigger “until v3 parses it end-to-end” (src/v3/compiler/src/bin/regen_tokenize.rs:626-630).

3. Verdict

APPROVE

The diff cleanly separates external .dag operator authority from current v3 capability without duplicating precedence/binop semantics. The raw-source scaffold remains tracked, fail-closed checks are preserved around projection drift, and the added tests cover the new split rather than only snapshotting implementation details.

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: 149d84d8 · Trigger: schedule
• Comparison: origin/main @ 1ff9385f ... review/pr-1663-149d84d8 @ 149d84d8
• Thinking: 135s wall

---

Verdict: APPROVE — The diff cleanly separates external operator facts (dag_operators + Mod / NullCoalesce in imports) from the v3 capability fence (v3_supported_dag_operators), wires regen and SG-1/SG-2c1 authority tests to that projection, and keeps fail-closed behavior (unsupported symbols go to parser-only debt in tokenizer regen; unknown projected symbols panic with an actionable message). That matches P2 boundary discipline (single authority per fact: external table vs explicit subset) without introducing a second competing precedence table.

Findings: None that tie a rubric violation to a concrete diff line. Nothing here touches substrate modeling in dag.rs in a way that triggers the coproduct-annotation rules; changes are implementation-side regen and .dag authority data.

Exploratory (optional): src/v3/compiler/tests/integration/sg2c1_parse_tables_authority_test.rs adds a naive parse_all_string_literals (pairwise quotes) while regen_parse_tables_emit.rs uses parse_string_literal for the same map (extract_v3_supported_operator_symbols). For the current Map<String, Bool> literal shape they agree; if the map ever gained escaped or oddly quoted keys, the test helper could drift from regen. Worth aligning on a future touch, not a merge blocker.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 149d84d8 · Trigger: manual
• Comparison: main @ 1ff9385f ... codex/r3-row85-v2-ephemeral-source-root @ 149d84d8
• Conversation: View conversation

---

1. Story of the diff

This PR separates two facts that were previously coupled: the external .dag syntax authority and the current v3 parser/tokenizer capability surface. dsl/extdeps/languages/dag/syntax.dag now lets dag_operators model external .dag reality by adding ?? and % (dsl/extdeps/languages/dag/syntax.dag:104, dsl/extdeps/languages/dag/syntax.dag:115), while a new v3_supported_dag_operators map explicitly fences what v3 supports today (dsl/extdeps/languages/dag/syntax.dag:127-132). The tokenizer regen path now treats operators outside that projection as declared-but-unsupported v3 debt instead of requiring every external operator to become a token immediately (src/v3/compiler/src/bin/regen_tokenize.rs:626-630). The parse-table regen path still reads precedence/binop facts from dag_operators, but filters them through v3_supported_dag_operators, so v3 rows remain grounded in the external authority without forcing v3 to support every external operator (src/v3/compiler/src/regen_parse_tables_emit.rs:96, src/v3/compiler/src/regen_parse_tables_emit.rs:1086-1094). Tests then ratchet both sides: unsupported external rows stay present but excluded from the v3 projection, and malformed external authority still fails closed (src/v3/compiler/tests/integration/sg2c1_parse_tables_authority_test.rs:228-253, src/v3/compiler/src/regen_parse_tables_emit.rs:1257-1281).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Compliant — this touches .dag modeling authority but not core Dag/dag.rs substrate storage; the diff preserves separate authorities by naming dag_operators as external syntax reality (dsl/extdeps/languages/dag/syntax.dag:94-96) and v3_supported_dag_operators as the current v3 capability projection (dsl/extdeps/languages/dag/syntax.dag:120-125).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — single authority / facts-flow-forward is handled correctly: v3_supported_dag_operators only chooses the supported symbol subset, while extract_v3_supported_operator_bps still pulls each supported operator’s precedence/binop facts from dag_operators and panics if the projection names an ungrounded symbol (src/v3/compiler/src/regen_parse_tables_emit.rs:1086-1094). Fail-closed is also preserved for duplicate projection rows via the explicit duplicate assertion (src/v3/compiler/src/regen_parse_tables_emit.rs:1167-1169).

1. CODING.md.

Compliant — the new tokenizer boundary keeps dependencies explicit and function-shaped: classify_shared_operator_for_tokenizer takes both pattern and v3_supported: &BTreeSet<String> in the signature (src/v3/compiler/src/bin/regen_tokenize.rs:622-625) instead of reading hidden state or embedding a second per-operator exclusion table.

1. TESTING.md.

Compliant — the tests are behavior-driven and targeted at the new contract: dag_operator_authority_keeps_external_rows_split_from_v3_projection proves ?? and % remain in external authority but out of the v3 projection (src/v3/compiler/tests/integration/sg2c1_parse_tables_authority_test.rs:240-252), while unsupported_external_operator_duplicates_fail_closed proves unsupported external rows are not ignored when the external authority is malformed (src/v3/compiler/src/regen_parse_tables_emit.rs:1257-1281).

1. LOCKED DESIGN DECISIONS.

N/A — I do not see the diff referencing or altering a locked thesis/design decision; it changes the syntax authority/projection split and the corresponding regen/test gates.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the remaining raw-source extractor scaffold is explicitly bounded and has a dissolution trigger: when dag_operators lowers structurally, the extractor folds into a typed read (src/v3/compiler/src/regen_parse_tables_emit.rs:1060-1081). The unsupported-operator bridge is also bounded by the projection and names the trigger condition as “until v3 parses it end-to-end” (src/v3/compiler/src/bin/regen_tokenize.rs:626-630).

3. Verdict

APPROVE

No findings. The PR cleanly splits external DAG operator authority from the narrower v3 capability projection, keeps semantic facts flowing from the external authority rather than duplicating them, and adds focused fail-closed tests for the new boundary.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 149d84d8 · Trigger: schedule
• Thinking: 208s wall

---

Non-blocking — Strengths

• dsl/extdeps/languages/dag/syntax.dag Mixed code/.dag PR: the split keeps external operator semantics in dag_operators and makes v3 capability an explicit projection consumed by tokenizer and parse-table regen.

✅ No blocking concerns; the prior support-boundary drift comments are resolved.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 1846c256 · Trigger: schedule
• Comparison: origin/main @ 1ff9385f ... review/pr-1663-1846c256 @ 1846c256
• Thinking: 53s wall

---

Findings: none.

This diff cleanly splits two concerns: dag_operators is restored as the external .dag authority (with ??, % re-added per the STOP audit), and v3_supported_dag_operators is an explicit symbol-set projection of v3's current capability. v3 validation reads symbol membership from the projection and bp/binop semantics from the underlying dag_operators row — that's "shared reads of one source," not parallel representation, so M3/single-authority discipline holds. The SG-1a raw-text scaffold has a documented, named dissolution trigger ("when dag_operators lowers structurally, swap for typed read"), matching regen_tokenize's lane — tracked debt, not unbounded scaffold. Fail-closed messages are tightened, the regen panic now correctly indicts the projection rather than the external authority, and the tests pin the asymmetry (??, % ∈ external, ∉ v3 subset) plus the subset invariant.

The stage0 generated file edit is consistent with the .dag source change.

Verdict: APPROVE — narrow, principled refactor that turns a previously-conflated authority/capability into a clean projection without duplicating semantics.

[briansrls]

Addressed the legacy v2 CI failure in head 8ea014a8.

Root cause:

• The v2 compile gate failed ci_freshness: stage0 was stale after restoring external dag_operators rows and adding v3_supported_dag_operators.

Fix:

• Updated generated src/v2/stage0/src/extdeps_languages_dag_syntax.rs from the v2 self-compile output. It now includes ??, %, the additional BinOp imports, and the generated v3_supported_dag_operators() map.

Validation:

• cargo fmt --all --check
• CARGO_TARGET_DIR=/tmp/gunbc-target-v2-ci-r1 RUSTC_WRAPPER= cargo test -p v2-compiler-tests ci_freshness -- --ignored --nocapture
• Earlier exact full gate reproduction showed only ci_freshness was relevant to this PR; the local ci_performance_ratchet failure was from cold isolated target timing, while CI's cached timing was under budget.

— sent from crisp-ibex-569

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 8ea014a8 · Trigger: schedule
• Comparison: origin/main @ bfb39ac0 ... review/pr-1663-8ea014a8 @ 8ea014a8
• Thinking: 59s wall

---

Verdict: APPROVE

The diff cleanly separates external .dag operator authority from the current v3 capability projection. The new projection is documented, bounded, and checked back against dag_operators, so I don’t see a concrete single-authority, fail-closed, or testing-discipline violation in the changed lines.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 8ea014a8 · Trigger: schedule
• Thinking: 204s wall

---

Non-blocking — Strengths

• dsl/extdeps/languages/dag/syntax.dag Mixed code/.dag PR: the split preserves external operator authority in dag_operators and makes the current v3 capability boundary explicit and mechanically consumed.

✅ No blocking concerns.