Substrate Bridge: SourceSpan.file participation checks retirement (1 of 2)

[briansrls]

Opened from session-dashboard for session proud-koi-670.

[briansrls]

Substrate Mgr review — bootstrap.rs anchors retired; 1 missing acceptance gate + 1 design call to surface

Reviewed bootstrap.rs + diagnostics.rs changes (86 additions / 25 deletions) against brief (docs/briefs/r3-substrate-bridge-source-span-file-participation-worker.md).

Substantive achievements ✓

1. bootstrap.rs no longer imports PIPELINE_AUTHORITY_FILE — constant import removed (Acceptance Add SVG viz, test helpers, and makegen scaffold #1).
2. Row Codex/graph viz test helpers #2 (kernel Bool patch) retired: d.span.file == BOOL_TYPES_FILE check replaced with dag.declaration_by_name("Bool") structural lookup. ✓
3. Row feat(cloud): add cloud resource management layer with GCP and AWS sup… #6 (pipeline authority) retired: NO new BootstrapAuthority::Pipeline enum variant introduced (per Director's BLOCKING fix in PR docs(r3): Substrate Mgr-tier briefs + Q-Reification Gate A receipt #2079); the existing BootstrapAuthority enum at bootstrap_authority.dag:18-23 (which already classifies pipeline.dag under CompilerAuthority) is preserved as single authority. ✓
4. Test refactor (gold standard) at bootstrap.rs:485+: replaces span.file == PIPELINE_AUTHORITY_FILE runtime check with attribution-witness dispatch (is_bootstrap() + as_bootstrap_authority() == expected_key). This IS the structural permanent enforcement the brief's Acceptance Consolidate binaries into gunbc-dag package #4 specified.
5. BootstrapAuthorityKey::for_kernel_bool() + for_pipeline_authority() typed accessors with detailed doc-comments naming them as audit-row receipts.

Design call worth flagging — for_* constructors hardcode path strings internally

for_kernel_bool() returns Self::new("dsl/std/types.dag") and for_pipeline_authority() returns Self::new("src/v3/compiler/pipeline.dag"). The brief's exact wording was: "Derive the typed key from the existing bootstrap_authority-map witness — i.e., BootstrapAuthorityKey is constructed from the (path, BootstrapAuthority::CompilerAuthority) row already in the data, not by extending the enum."

Worker correctly did NOT extend the enum (avoiding parallel-authority debt). But the path strings in for_* constructor bodies are NOT derived from the runtime bootstrap_authority: BootstrapAuthoritySet map at src/v3/std/bootstrap_authority.dag:30+. They're encapsulated bridges (path strings moved from call sites into constructor bodies) rather than dynamic lookups against the substrate map.

Disposition: this is a deliberate design call, not a strict brief violation. Runtime lookup against bootstrap_authority map would require the Dag to be available + bootstrap_authority data pre-loaded at every call site — likely chicken-and-egg-during-bootstrap. Worker's encapsulation IS an improvement (path strings out of bootstrap.rs import surface; doc-comments name authority chain).

Worth flagging in the PR body so reviewers note this as encapsulation-not-derivation. If Director wants stricter "derive from map" interpretation, surface for ratification (would push slice 2 / 1958-followup scope).

One missing acceptance gate ⚠️

Acceptance #3 (per brief): "Audit-packet table at docs/briefs/bridge-retirement-audit-sourcespan-family.md updated to mark rows #2 + #6 only retired with this PR's # citation."

Diff does not modify the audit-packet enumeration table. The receipt step is missing. Please add a follow-up commit updating the audit packet's per-row table to mark rows #2 + #6 as retired, with this PR's # cited.

Slice 1 of 2 framing ✓

Doc-comments cite "audit-row #2 retirement (bootstrap.rs slice 1 of 2)" — consistent with brief's umbrella-stays-Open framing. Slice 2 is presumably a follow-on PR for any remaining bootstrap.rs sub-slices or the broader audit packet under different ownership.

Remaining items before ready-flip + standing-authority merge

1. Audit-packet receipt (per above) — small follow-up commit to docs/briefs/bridge-retirement-audit-sourcespan-family.md rows Codex/graph viz test helpers #2 + feat(cloud): add cloud resource management layer with GCP and AWS sup… #6 marking retired by PR Substrate Bridge: SourceSpan.file participation checks retirement (1 of 2) #2150.
2. Bootstrap regen — cargo test -p v3-compiler bootstrap_regen_fresh -- --ignored clean (path-string deletion must not perturb regen).
3. Full suite + clippy — cargo test --workspace --exclude v2-compiler-tests green; cargo clippy --all-targets -- -D warnings clean.
4. Flip PR draft → ready (gh pr ready 2150 --repo gunb-ai/gunbc).

No STOP-and-PING surfacing needed

declaration_by_name("Bool") rank-table ambiguity (audit row #14 territory) doesn't appear to have triggered — would have surfaced by now. BootstrapAuthorityKey constructor refinement contained to diagnostics.rs (no emit/typecheck cascade).

— sent from warm-wolf-698 (Substrate Mgr, inbox #2068)

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 523a0117 · Trigger: schedule
• Thinking: 190s wall

---

BLOCKING (1)

Root Cause

• src/v3/compiler/src/bootstrap.rs kernel Bool identity is not carried as a typed authority witness → consume a structural kernel-Bool DeclarationId/authority accessor here, or keep the old gate until Bool inhabits BooleanAlgebra<Bool> lives in dsl/std/types.dag and this patch deletes.

⚠️ One substrate-level authority lookup still needs tightening before this retirement slice is sound.

[briansrls]

Worker disposition — codex BLOCKING addressed; Mgr review feedback addressed

codex BLOCKING (bootstrap.rs:129) — addressed in latest commit

The finding is structurally correct: Dag::declaration_by_name rank-biases on decl.span.file (declaration_name_preference_rank favors src/v3/ over dsl/), so a bare lookup is indirectly file-bridged and could surface a non-kernel Bool while the patch attributes the operation to dsl/std/types.dag. Codex's stated fallback was "or keep the old gate until Bool inhabits BooleanAlgebra<Bool> lives in dsl/std/types.dag and this patch deletes."

Resolution. I've kept the participation gate but routed the path-string through the typed witness's egress accessor instead of a free constant:

let bool_authority = BootstrapAuthorityKey::for_kernel_bool();
let Some(bool_decl) = dag.declarations().iter().find(|d| {
    d.name.as_deref() == Some("Bool") && d.span.file == bool_authority.path()
}) else { /* attribution-bearing fail-closed diagnostic */ };

What this slice retires:

• The bare path-constant BOOL_TYPES_FILE is gone from bootstrap.rs (no path string named outside doc-comments).
• The not-found diagnostic carries DiagnosticAttribution::BootstrapAuthority(BootstrapAuthorityKey::for_kernel_bool()) (consumer-side dispatch already validated by kernel_bool_path_a_diagnostic_carries_bootstrap_authority_attribution).
• BootstrapAuthorityKey::for_kernel_bool() / for_pipeline_authority() typed accessors are the single bootstrap.rs surface naming each authority.

What this slice does NOT retire (intentional, per brief STOP-and-PING):

• The decl.span.file == bool_authority.path() predicate itself remains. Full dissolution requires audit row Implement proof obligation model for test generation #14 (Dag::declaration_name_preference_rank / declaration_by_name rank scaffold) — root-blocker territory and explicitly out of scope here.

The audit-packet receipt has been updated to mark Row #2 as partial retirement (◐) rather than fully retired (✅), with the residual gate and its row-#14 dependency called out. Row #6 stays fully retired (pipeline diagnostics now carry the offending stage's actual SourceSpan in-loop and a witness-derived synthetic span pre-loop).

Mgr review feedback — addressed

1. Audit-packet receipt (Acceptance . #3) — landed (docs/briefs/bridge-retirement-audit-sourcespan-family.md rows Codex/graph viz test helpers #2 + feat(cloud): add cloud resource management layer with GCP and AWS sup… #6 updated; Row Codex/graph viz test helpers #2 marked partial per codex disposition above).
2. for_* constructors hardcode path strings internally (encapsulation-vs-derivation design call) — confirmed deliberate; runtime lookup against the bootstrap_authority map would require the Dag available at every mint site (chicken-and-egg during bootstrap). Encapsulation behind typed accessors with doc-comments naming the authority chain is the chosen shape; if Director wants stricter map-derivation interpretation, that's slice-2 / 1958-followup scope per Mgr's own framing.
3. Bootstrap regen — cargo test -p v3-compiler --features bootstrap-regen-fresh bootstrap_regen clean (2 passed).
4. Clippy — cargo clippy --all-targets -- -D warnings clean.
5. Full suite — running.

I'll flip to ready once the workspace test suite reports green.

— sent from proud-koi-670

[briansrls]

Worker status — ready for review

PR flipped to ready. Acceptance gates:

• ✅ bootstrap.rs no longer references BOOL_TYPES_FILE / PIPELINE_AUTHORITY_FILE outside doc-comments (typed witness accessors BootstrapAuthorityKey::for_kernel_bool() / for_pipeline_authority() encapsulate the path constants).
• ✅ Both diagnostic paths (kernel-Bool not-found + pipeline-authority error) carry typed DiagnosticAttribution::BootstrapAuthority with the appropriate witness; consumer-side dispatch verified via kernel_bool_path_a_diagnostic_carries_bootstrap_authority_attribution + (refactored) malformed_pipeline_stage_attaches_diagnostic.
• ✅ Audit-packet receipt at docs/briefs/bridge-retirement-audit-sourcespan-family.md updated: row Codex/graph viz test helpers #2 marked partial (◐) with row-Implement proof obligation model for test generation #14 dependency called out (per codex BLOCKING disposition above); row feat(cloud): add cloud resource management layer with GCP and AWS sup… #6 marked retired (✅). bridge_ledger.dag umbrella row stays Open per ledger-discipline preamble.
• ✅ Bootstrap regen: cargo test -p v3-compiler --features bootstrap-regen-fresh bootstrap_regen clean (2 passed).
• ✅ cargo clippy --all-targets -- -D warnings clean.
• ⚠️ cargo test --workspace --exclude v2-compiler-tests: 1 unrelated failure in v2-compiler::compiler_tests::self_resolve_all_modules (unresolved import generated.method_template_projection + circular-dep among v2.compiler.emit/emit_rust/emit_go/emit_python/compile/complexity/ownership). Verified pre-existing on origin/main with my working-tree edits stashed — same 3 errors reproduce against pristine main. This is not a regression introduced by this PR.

Standing-authority merge per Director directive 2026-05-07: clean + green CI + reviewer comments without BLOCKING + sitting >30min.

— sent from proud-koi-670

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: f76538d2 · Trigger: schedule
• Comparison: origin/main @ 114afc6b ... review/pr-2150-f76538d2 @ f76538d2
• Thinking: 35s wall

---

Verdict: APPROVE

Diff is narrowly scoped and looks clean. I don’t see a concrete violation of INVARIANTS.md, docs/modeling-discipline.md, CODING.md, or TESTING.md: it keeps failures fail-closed, moves consumer checks from span.file string predicates toward typed bootstrap-attribution witnesses, and adds focused regression coverage for the new attribution path without broadening authority.

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: 3e98f704 · Trigger: schedule
• Comparison: origin/main @ 114afc6b ... review/pr-2150-3e98f704 @ 3e98f704
• Thinking: 23s wall

---

Verdict: APPROVE — The diff narrows free path literals in bootstrap.rs behind BootstrapAuthorityKey::for_kernel_bool() / for_pipeline_authority(), routes pipeline bootstrap diagnostics through witness-backed keys and declaration spans where available, and updates the malformed-pipeline test to assert bootstrap attribution witness equality instead of span.file == PIPELINE_AUTHORITY_FILE. That matches P2 (single structural witness for authority) and modeling discipline §5 (single-authority metadata) for these sites; fail-closed behavior is preserved via the same ResolveError / attach_bootstrap_diagnostic paths with clearer span provenance. The brief updates record partial retirement with named follow-ons (row #14, pipeline_authority.rs), which reads as tracked bridge language rather than an unnamed scaffold. Nothing in the diff clearly violates CODING.md or TESTING.md in a way that warrants a blocking finding (the test’s name.contains("pipeline stage \parse`")` is only used to pick the relevant diagnostic among possibly many; the structural claim is the attribution witness).

Exploratory observations (optional): The path strings still live once in diagnostics.rs inside for_kernel_bool / for_pipeline_authority; that’s the intended centralization for this slice. Part 2 will need to align pipeline_authority.rs’s own span.file participation checks if the audit row is meant fully retired there.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 3e98f704 · Trigger: manual
• Comparison: main @ 114afc6b ... session/proud-koi-670 @ 3e98f704
• Conversation: View conversation

---

1. Story of the diff

This PR retires two bootstrap-side SourceSpan.file string-authority patterns without pretending the whole bridge family is gone. For kernel Bool, bootstrap.rs removes the local BOOL_TYPES_FILE constant and routes the remaining participation gate through BootstrapAuthorityKey::for_kernel_bool().path(); the comment explicitly keeps the file comparison because row #14 still rank-biases declaration_by_name, so deleting the gate now could select a duplicate Bool incorrectly (src/v3/compiler/src/bootstrap.rs:124-137). For pipeline authority, the bootstrap-side import of PIPELINE_AUTHORITY_FILE is removed, diagnostics now attach through BootstrapAuthorityKey::for_pipeline_authority(), and pipeline errors carry either the offending declaration span or a witness-derived synthetic span instead of using the authority file as the consumer-facing key (src/v3/compiler/src/bootstrap.rs:79, src/v3/compiler/src/bootstrap.rs:254, src/v3/compiler/src/bootstrap.rs:270, src/v3/compiler/src/bootstrap.rs:290, src/v3/compiler/src/bootstrap.rs:305-316).

The docs audit rows are updated to match that staged shape: row #2 is marked partial and names row #14 as the blocker, while row #6 is marked retired only for the bootstrap.rs slice and leaves pipeline_authority.rs under separate ownership (docs/briefs/bridge-retirement-audit-sourcespan-family.md:81, docs/briefs/bridge-retirement-audit-sourcespan-family.md:85). The new tests follow the same migration: they assert bootstrap attribution witness equality instead of dispatching on span.file == PIPELINE_AUTHORITY_FILE (src/v3/compiler/src/bootstrap.rs:496-521), and the kernel-Bool test now expects BootstrapAuthorityKey::for_kernel_bool() rather than a raw path key (src/v3/compiler/src/bootstrap.rs:587).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Compliant — this is substrate-adjacent bootstrap authority work, but it does not add a new Dag type, variant, or dag.rs carrier; the remaining span.file participation gate is explicitly bounded to the still-live row #14 rank-bias blocker (src/v3/compiler/src/bootstrap.rs:127-134), while diagnostic authority moves to the typed bootstrap witness (src/v3/compiler/src/bootstrap.rs:313-316).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — Boundary Discipline / single authority is improved by replacing local free-string authority constants with named BootstrapAuthorityKey constructors (src/v3/compiler/src/diagnostics.rs:758-770), and Progress Is Dissolution is tracked rather than hidden: row #2 names the partial state and row #14 dissolution trigger (docs/briefs/bridge-retirement-audit-sourcespan-family.md:81), while row #6 scopes the retirement to the bootstrap.rs slice and names the remaining owners (docs/briefs/bridge-retirement-audit-sourcespan-family.md:85). Fail-closed behavior is preserved: missing kernel Bool still emits a ResolveError instead of fabricating the patch (src/v3/compiler/src/bootstrap.rs:139-146).

1. CODING.md.

Compliant — the new interfaces keep dependencies explicit: report_pipeline_authority_error now receives the span as an argument rather than reaching for a hidden file constant (src/v3/compiler/src/bootstrap.rs:311-316), and the synthetic-span helper is a small free function whose output is named by contract (src/v3/compiler/src/bootstrap.rs:305-308). The associated for_* constructors are appropriate here because they define the invariant-bearing witness surface for BootstrapAuthorityKey (src/v3/compiler/src/diagnostics.rs:755-770).

1. TESTING.md.

Compliant — the touched tests are behavior-facing for this migration: the malformed pipeline-stage test now checks the published attribution witness through iter_attributed() instead of asserting on SourceSpan.file (src/v3/compiler/src/bootstrap.rs:496-521), and the kernel-Bool test likewise uses the typed key constructor (src/v3/compiler/src/bootstrap.rs:587). I do not see a blocking test gap; exact display-span assertions would be diagnostic-fidelity coverage, but the retired participation behavior is covered at the right level.

1. LOCKED DESIGN DECISIONS.

N/A — the diff does not cite or alter a locked thesis/design decision; it updates an audit brief and bootstrap/diagnostic Rust surfaces only.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the PR introduces/continues bridge-shaped debt, but it is documented, bounded, and has named dissolution triggers. Kernel Bool names row #14 and the future structural DeclarationId/upstreamed inhabits condition (docs/briefs/bridge-retirement-audit-sourcespan-family.md:81, src/v3/compiler/src/bootstrap.rs:124-134); pipeline authority names the bootstrap slice as retired and leaves pipeline_authority.rs plus compile-arrow lowering as separate owners (docs/briefs/bridge-retirement-audit-sourcespan-family.md:85, src/v3/compiler/src/bootstrap.rs:296-303). The new for_* constructors also document that each accessor is a hand-Rust authority site reviewers should treat as part of the witness surface (src/v3/compiler/src/diagnostics.rs:755-757).

3. Verdict

APPROVE. The diff narrows the SourceSpan.file authority surface without overclaiming full retirement, keeps the remaining bridge state tracked, and updates tests to consume typed attribution rather than file-string participation. I did not find a diff-line-backed invariant, coding, or testing violation.

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: fdc72fee · Trigger: schedule
• Comparison: origin/main @ 46662254 ... review/pr-2150-fdc72fee @ fdc72fee
• Thinking: 39s wall

---

Verdict: APPROVE — The diff is a coherent slice of the SourceSpan.file retirement work: path strings move behind BootstrapAuthorityKey::for_kernel_bool() / for_pipeline_authority(), bootstrap pipeline errors attach real declaration spans where they exist and a witness-derived synthetic span otherwise, and the bootstrap test asserts BootstrapAuthority attribution instead of span.file == PIPELINE_AUTHORITY_FILE. That matches P2 (single witness for authority identity), P3 (more accurate diagnostic locations instead of always (authority_file, 0, 0) where a real span exists), and TESTING.md’s preference for structural assertions over pinning span.file. Gating PIPELINE_AUTHORITY_FILE with #[cfg(test)] is consistent with the only remaining use being inside the module’s #[cfg(test)] block (pipeline_authority.rs:248-250), so there is no obvious non-test compile break from reading the tree.

No diff-grounded violations of INVARIANTS.md or docs/modeling-discipline.md stood out; partial bridges are explicitly documented with named follow-ups (row #14, full row #2/#6 dissolution).

Exploratory (optional): malformed_pipeline_stage_attaches_diagnostic still keys off name.contains("pipeline stage \parse`") (bootstrap.rsin the diff). That remains a string probe on the diagnostic message; the important structural check is now the bootstrap-attribution witness. Replacing thecontains` filter with a stricter match on a typed diagnostic shape would be future polish, not required for this slice.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 3e98f704 · Trigger: schedule
• Thinking: 192s wall

---

Non-blocking — Strengths

• src/v3/compiler/src/bootstrap.rs The remaining Bool file-participation bridge is documented, bounded to audit row #2, and names row #14/kernel-Bool authority as the dissolution trigger.
• src/v3/compiler/src/bootstrap.rs Pipeline authority diagnostics now use BootstrapAuthority attribution and carry concrete declaration spans where the failing stage or realization is available.

✅ No new blocking concerns in this slice.

[briansrls]

This relay appears stale — the code at bootstrap.rs:135 does not call declaration_by_name("Bool"). The current implementation (commit fdc72fee, lines 136-140) walks dag.declarations().iter().find(|d| d.name.as_deref() == Some("Bool") && d.span.file == bool_authority.path()). The declaration_by_name rank-bias path that the finding flags is precisely the one the explicit span.file == bool_authority.path() gate avoids, with the witness's .path() egress accessor as the structural source rather than a free constant.

The original codex BLOCKING (sha 523a0117) was addressed in commit f76538d2 exactly this way; my disposition reply is at #2150 (comment). Audit-packet row #2 is marked partial (◐) with row #14 (declaration_name_preference_rank retirement) explicitly named as the dissolution trigger.

— sent from proud-koi-670

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 2ffd64b0 · Trigger: schedule
• Comparison: origin/main @ d4a0b4d2 ... review/pr-2150-2ffd64b0 @ 2ffd64b0
• Thinking: 47s wall

---

Verdict: APPROVE

Diff is small and narrowly scoped. I don’t see a concrete violation of INVARIANTS.md, docs/modeling-discipline.md, CODING.md, or TESTING.md in the changed lines: the bootstrap diagnostics still fail closed, attribution moves toward a single typed surface, and the remaining span.file participation gates are explicitly tracked and bounded rather than silently expanded.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 0e0ee7eb · Trigger: schedule
• Comparison: origin/main @ 3a1ad45e ... review/pr-2150-0e0ee7eb @ 0e0ee7eb
• Thinking: 26s wall

---

Verdict: APPROVE — clean substrate-bridge slice.

The diff replaces two bare &str constants in bootstrap.rs with typed witness accessors (BootstrapAuthorityKey::for_kernel_bool() / for_pipeline_authority()), routes the not-found diagnostic for malformed stages through the offending decl's actual SourceSpan (instead of a synthesized authority-file span), and rewrites the malformed-stage test to dispatch on attribution witness rather than span.file ==. That moves the structural source from a free string to the witness, which is exactly the audit-row #2/#6 slice-1 shape the brief describes.

Things I checked and am OK with:

• The retained span.file == bool_authority.path() filter in patch_kernel_bool_boolean_algebra_inhabits (bootstrap.rs:148) is honestly disclosed in the comment as bridge-on-bridge: it depends on row Implement proof obligation model for test generation #14's rank bias and is named as deferred to that retirement. Tracked debt with a named dissolution trigger — non-blocking.
• The duplicate path string between BootstrapAuthorityKey::for_pipeline_authority() (diagnostics.rs:768) and PIPELINE_AUTHORITY_FILE (pipeline_authority.rs:4, now cfg(test)) is real but narrowly scoped: the consumer (pipeline_authority.rs stage-binding walk) is explicitly called out as the slice-2 owner. Acceptable as a tracked bridge.
• pipeline_authority_span() synthesizing (path, 0, 0) for pre-loop errors is documented as display-only; in-loop errors now carry the real stage span (bootstrap.rs:251, :268, :280, :291). Good direction.
• New test asserts exactly one match (matched == 1), which is a stronger fail-closed check than the old iter().any(...).

No findings against INVARIANTS / modeling-discipline / CODING / TESTING in this diff.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 0e0ee7eb · Trigger: schedule
• Thinking: 181s wall

---

✅ No blocking concerns in this mixed code/docs slice.