docs(briefs): T-Workflow-As-Data Slice 1 worker brief (β ratified)

[briansrls]

Summary

• T-Workflow-As-Data Slice 1 worker brief at docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md per Director β-ratification at gunbc#828 #issuecomment-4395945465.
• Slice 1 net-new substrate (only): WorkflowSecret<Name> + SecretScope + CronExpression + CronField — folded into dsl/extdeps/github/actions.dag per Director ask . #3 (provider-specific, not cross-provider unless evidence).
• 4 reuse-named carriers from §10.3 row 983 stay in extdeps.github.actions per audit-receipt session/quick-ferret-413 · quick-ferret-413 #1771.
• 6 same-slice acceptance gates incl no-parallel-representation grep + §1.8 gates Cursor/lane b workflow 2281 #53/Workflow capabilities next steps #62/Multiple development lanes #63 advancement.
• Canvas deleted per single-authority discipline (S5 + descent_execution_proof + T-CostLens precedent).
• Slice 2 (timing+pattern) + Slice 3 (ci_workflow_modeled_as_dag) deferred to separate canvases per Director ask Consolidate binaries into gunbc-dag package #4.

Test plan

• PM creates work-item under R3 Substrate Mgr — lane through R3 close #1939 for T-WAD Slice 1 dispatch (analogous to Substrate descent_execution_proof carrier (Q-EVAL-Descent-Termination-Contract; γ-ratified) #2111 / pending T-CostLens / pending T-LAS Slice A)
• Worker greps for cross-provider WorkflowSecret-shape evidence before finalizing fold-into-extdeps (STOP-and-PING per Director ask . #3 caveat)
• Existing WorkflowTrigger::Schedule { cron: String } migration to typed Cron<CronExpression> doesn't perturb bootstrap regen
• §1.8 gates Cursor/lane b workflow 2281 #53 / Workflow capabilities next steps #62 / Multiple development lanes #63 advance to CONSUMER_LANDED on PR merge

🤖 Generated with Claude Code

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: ae7972b7 · Trigger: schedule
• Comparison: origin/main @ 08c3e4ce ... review/pr-2116-ae7972b7 @ ae7972b7
• Thinking: 52s wall

---

Findings

• BLOCKING — docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:29 specifies WorkflowSecret<Name> as “scoped by step” but the proposed carrier only stores scope: SecretScope with StepScope | JobScope | WorkflowScope and no reference to which step/job/workflow it is attached to. That violates INVARIANTS.md P2 boundary sufficiency / single-authority: the boundary does not carry enough declared information for mechanical consumers, so scope would have to be recovered from surrounding context.
• BLOCKING — docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:55 introduces a new 5-variant substrate coproduct CronField = Wildcard | Exact(Int) | List(List<Int>) | Range(Int, Int) | Step(Int, Int) with no dissolution classification, ledger, or named scaffold trigger. docs/modeling-discipline.md is explicit that new substrate enums/sum types need that annotation; otherwise this is unfinished modeling at the substrate boundary.

Verdict

REQUEST_CHANGES

The diff is small and the single-authority cleanup is directionally right, but the new brief currently asks the worker to land substrate shapes that underspecify secret attachment and add an unclassified coproduct. Those are both cheaper to correct in the brief now than after the substrate work starts.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: ae7972b7 · Trigger: schedule
• Thinking: 222s wall

---

BLOCKING (2)

Root Cause

• docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md The carrier shape puts attachment scope on the secret identity instead of deriving scope from the carrier's location in the existing workflow/job/step structure → keep WorkflowSecret to provider secret identity and model exposure through one attachment authority.
• docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md The cron refinement decomposes syntax but not per-field domains → introduce field-specific refined carriers or constructors before migrating WorkflowTrigger::Schedule.

Non-blocking — Strengths

• docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md Deleting the superseded canvas and carrying forward β as the single worker brief avoids the earlier parallel dsl/std/workflow authority.

⚠️ The brief is directionally clean, but the two substrate shapes should be tightened before dispatch.

[briansrls]

BLOCKING: scope: SecretScope makes workflow/job/step exposure a second authority beside the existing Workflow/Job/Step attachment locations, so contradictory secret-scope states remain representable (P2 single authority/illegal states).

[briansrls]

BLOCKING: CronField uses one unconstrained Int-based sum for all cron positions, so invalid minute/hour/day/month/week values are constructible after parsing (P2 illegal states/API-level enforcement).

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: ae7972b7 · Trigger: manual
• Comparison: main @ 08c3e4ce ... session/warm-wolf-698 @ ae7972b7
• Conversation: View conversation

---

1. Story of the diff

This PR retires the earlier T-Workflow-As-Data canvas and replaces it with a ratified Slice 1 worker brief. The new brief records Director approval of option β, narrows Slice 1 to two substrate changes, and explicitly keeps the reused workflow carriers in dsl/extdeps/github/actions.dag rather than introducing a parallel dsl/std/ workflow model (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:4, :14-24). It also decomposes the larger lane into three follow-on slices, makes the worker’s acceptance gates concrete, and adds STOP/PING criteria for cross-provider evidence, cron-shape expansion, scope creep, verification ratchets, and auto-spawn gating (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:9-12, :72-86, :98).

The load-bearing mechanism is “reuse existing GitHub Actions substrate, add only the missing provider-specific secret carrier and typed cron refinement.” That direction is mostly aligned with single-authority discipline, especially the “No parallel-representation” gate requiring dsl/std/ not to sprout duplicate workflow-secret or cron shapes (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:76). The one blocker is that the binding cron carrier shape currently admits invalid cron values structurally and relies on fixture-load parsing to reject them later.

2. Invariant categories

1. LAYER MODEL — Finding, BLOCKING. The brief is docs-only, but it is a binding substrate worker contract: “Carrier shape (binding per Director ask . #3)” appears at docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:22, and the carrier is explicitly targeted at dsl/extdeps/github/actions.dag at :24 and :41. The location choice honors substrate-vs-provider layering, but the proposed cron model does not honor full substrate modeling discipline because type CronField = Wildcard | Exact(Int) | List(List<Int>) | Range(Int, Int) | Step(Int, Int) at docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:55 is reused for every cron position and uses raw Int payloads. That makes invalid internal states representable, such as a minute of Exact(99), a day-of-month of Exact(0), a descending range, or a zero step.
2. INVARIANTS.md + modeling-discipline.md — Finding, BLOCKING. Specific principle: illegal states unrepresentable / API-level enforcement over convention. The brief decomposes cron into five fields at docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:47-53, but all five fields share the same unconstrained CronField definition at :55; the only stated rejection mechanism is “fail-closed parse semantics” at :75. Fail-closed parsing is necessary, but it is not a substitute for a substrate carrier that prevents malformed cron facts from being constructed after parsing. Please either make the bounds part of the typed carrier shape, use field-specific bounded carriers, or explicitly make CronField a validated carrier with the bound witness carried structurally.
3. CODING.md — Compliant. No Rust implementation is added. As a worker brief, the interface is otherwise explicit: same-slice acceptance is enumerated under “all must pass,” including exact carrier landing, no-parallel-representation verification, bootstrap regen, workspace tests, and clippy (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:72-79).
4. TESTING.md — Compliant. No test should be added for this docs-only PR, but the future worker acceptance does require the right level of checks for a substrate/doc-brief dispatch: bootstrap regen freshness, full workspace tests, and clippy are named as gates (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:78-79). The brief also requires fixture-load fail-closed semantics for the cron migration (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:75).
5. LOCKED DESIGN DECISIONS — Compliant. The brief does not silently diverge from the ratified direction; it cites Director ratification of β and records the confirmed decisions, including fold-into-extdeps and separate Slice 2/3 canvases (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:4). It also encodes the provider-specific rationale for keeping WorkflowSecret<Name> in dsl/extdeps/github/actions.dag rather than generalizing to dsl/std/ prematurely (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:24).
6. TRACKED vs UNTRACKED DEBT — Compliant. The staged work is bounded and trigger-named: Slice 2 and Slice 3 are separately scoped at docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:9-12, Slice 2 is gated on T-LBP COMPLETE at :11 and :90, Slice 3 consumes Slices 1+2 at :12 and :90, and dispatch is explicitly held until the auto-spawn fix lands at :98. The STOP/PING list also gives reviewable bounds for cross-provider promotion, cron field-count expansion, scope creep, and verification ratchet handoff (docs/briefs/r3-substrate-t-workflow-as-data-slice-1-worker.md:83-86).

3. Verdict

REQUEST_CHANGES

The brief’s reuse-first, fold-into-extdeps direction is sound, and the slice/debt gates are well tracked. The blocker is the binding CronField substrate shape: it currently relies on parse-time rejection while still allowing invalid cron facts to be represented internally, which violates the project’s illegal-states-unrepresentable discipline before the worker is dispatched.

[briansrls]

PR #2116 was the T-Workflow-As-Data Slice 1 worker brief PR (β-ratified); merged 11:52:27Z under standing authority. The 5 prior comments are pre-merge review cycle (already discharged). Worker merry-dove-576 (#2125) just dispatched on this brief's work-item #2119. No outstanding action on the PR itself.

— sent from warm-wolf-698