Gate #62: FileAttachment (Refined-B-1) carrier, ratchet, and demo

INVARIANTS.md

@@ -338,6 +338,7 @@ Per **Dispatch-Discipline Mechanisms (b)** above, each **new** path added to `EX
 | `src/v3/compiler/tests/integration/cementing/cementing_provenance_origin_integration_test.rs` | **ROADMAP:** `ROADMAP.md` — Post-merge debt bullet **v3 lens capability honesty pass** (cementing-test discipline per `regen.dag`; see `docs/v3-lens-capability-register.md`). **Dissolution:** remove when `origin_of` provenance seam checks for gate-#87 regen harnesses live as `.dag` `TestClaim` obligations alongside `tests/dag/cementing_dispatch.dag` (no Rust mirror of the dispatch projection from `std.verification`'s `lens_capability_register_rows`). **Interim ratchet:** narrow slice split from the retired `cementing_lens_registry_dispatch_test.rs` monolith. |
 | `src/v3/compiler/tests/integration/common/wiring_scanner_test.rs` | **ROADMAP:** same **v3 lens capability honesty pass** bullet — Band-C `tests/integration.rs` `#[path]` wiring is enforced by `integration_rs_wiring_scan.rs` + `cementing_dispatch.rs`. **Dissolution:** remove when `integration.rs` wiring can be validated structurally for cementing modules without line scanners. **Interim ratchet:** unit tests for helpers promoted from the retired `cementing_lens_registry_dispatch_test.rs` monolith. |
 | `src/v3/compiler/tests/integration/extdeps_sql_transport_test.rs` | **ROADMAP:** `ROADMAP.md` § **Nine lanes** row `T-PB-B` / `pb_rust_tests_outside_residual_zero`; this Rust integration receipt keeps HTTP/SQL/audit extdeps compiled by the existing v3 parser before downstream emission-target consumers rely on them. **Dissolution:** remove when extdeps transport and Phase 3 emission-target files are covered by a `.dag`-native parse/authority suite or generated test harness rather than per-file Rust `compile_to_dag` probes. **Interim ratchet:** `rest_transport_dag_compiles_cleanly` and `sql_transport_dag_compiles_cleanly` pin `dsl/extdeps/transports/rest.dag` and `dsl/extdeps/transports/sql.dag`; `http_server_extdep_dag_compiles_cleanly`, `sql_migration_extdep_dag_compiles_cleanly`, and `audit_event_extdep_dag_compiles_cleanly` pin `dsl/extdeps/http/server.dag`, `dsl/extdeps/sql/migration.dag`, and `dsl/extdeps/audit/event.dag` as parseable staged emission-target substrate. The field-sensitive companions (`http_server_target_fields_are_authoritative_substrate_edges`, `sql_migration_target_fields_bound_raw_sql_scaffold`, `audit_event_target_fields_preserve_cloudevents_core_names`) consume the new target-contract fields directly so they fail on raw `String`/`Int` regressions, missing SQL scaffold bounds, or CloudEvents alias drift while the first real projection consumer is still staged; the audit ratchet also locks CloudEvents core fields to branded carriers and `std.types.Timestamp` rather than raw strings. |
+| `src/v3/compiler/tests/integration/file_attachment_substrate_carrier_test.rs` | **R3 program plan:** `docs/r3-program-plan.md` §1.8 gate **#62** `substrate_gap_file_ingestion_closed` (T-Workflow-As-Data substrate-gap class; worker brief `docs/briefs/r3-substrate-gate-62-file-attachment-carrier-worker.md`). **Dissolution:** remove when a `.dag` `TestClaim` / PB-B-1 runner receipt can assert `FileAttachment` field names + cross-module nominal wiring against `generated_full_bootstrap_dag()` without this hand-Rust structural ratchet (same dissolution posture as `timing_lens_substrate_carrier_test.rs` for gate #55). **Interim ratchet:** `file_attachment_shape_locked` + `file_attachment_field_types_locked` + `file_attachment_field_count_is_five` pin the ratified Refined-B-1 five-field subset of `WorkflowObservationAnchor` (`NodeId`, `ContentHash`, `WorkflowProducerId`, `WorkflowRunId`, `Nanoseconds`) exactly as declared in `src/v3/std/timing_lens.dag`; existence proof carrier construction stays in-module as `gate_62_file_attachment_demo_record`. |
 | `src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs` | **ROADMAP:** `ROADMAP.md` — **Tier-3 perf-budget Phase-1 hand-Rust mirror benches** / T-Tier3-Dissolution paired-dispatch (`docs/briefs/r3-pb-t-tier3-consumer-slice-worker.md`). **Plan:** `docs/r3-program-plan.md` §1.8 gate **#2** `tier3_computation_mirror_dissolved` (state-check; **CONSUMER_LANDED** = §1.7 executable-consumer sense, not INVARIANTS §P2 generated-consumer — see plan §1.7 “State-check …” paragraph). **Dissolution:** retire remaining Tier3 host mirrors per `docs/r3-structure.md` §Acceptance as Evaluator-backed std bodies land. **Interim ratchet (P5 Mechanism (b)):** `tier3_computation_mirror_trivial_constructors_dissolved` (PR #2789 narrow slice) + `tier3_computation_mirror_kernel_algebra_profile_substrate_authority` with brace-bounded `dag.rs` scan asserting `type_iteration_dimension` delegates through `BOOTSTRAPPED_DAG.kernel_algebra_profile` (forbid parallel hand-maintained type→profile tables); sibling Tier3 rows in this file carry the same lane receipts. |
 | `src/v3/compiler/tests/integration/r3_gate_60_phase2_width_nat_parser_test.rs` | **ROADMAP:** `ROADMAP.md` — **`substrate_gap_parser_grammar_closed`** / R3 gate **#60** (Phase 2.1 parser slice: angle-only width nat in `<…>`, `TypeAngleArg` substrate split, `Compose<Algebra, MachineWidth<N>>` lowering with literal phantom width). **Dissolution:** remove when gate #60 parse/lower/routing receipts are carried by `.dag` `TestClaim` / generated harness without this hand-authored `compile_to_dag` + `parse_for_test` module (per `docs/audit/r3-gate-60-decomposition.md` follow-on slices). **Interim ratchet:** `gate_60_phase2_parse_accepts_algebra_angle_width_nat`, `gate_60_phase2_int_64_lowers_to_compose_int_machine_width_literal`, `gate_60_phase2_nat_8_lowers_via_uint_slot`, `gate_60_integer_routing_witness_accepts_literal_nat_machine_width`, `gate_60_bare_numeric_type_is_parse_rejected`, `gate_60_int_disallowed_width_fails_closed_without_malformed_template_args`. |
 

docs/r3-program-plan.md

@@ -287,7 +287,7 @@ This principle is NOT a separate lane; it's a per-lane gate-shape requirement ap
 | 59 | `recursive_flex_demonstration_landed` | demonstration | T-Lens-Self-Application | DECLARED | narrative thesis claim cashes |
 | 60 | `substrate_gap_parser_grammar_closed` | substrate-gap-class | T-V2-Retirement + T-Numeric-Construction + Substrate (cross-lane) | DECLARED (NEW 2026-05-06) | concept faithfully modeled (per Q-MachineConstraint sub-decision 5): substrate carries algebra + machine-constraint as independent composing axes with `.dag`-generated interaction substrate; min existence-proof = `Int<64>` / `Real<64>` / `Nat<8>` lower without v2-fallback (evidence, not target) |
 | 61 | `substrate_gap_function_valued_data_closed` | substrate-gap-class | T-E-P-Producer-Broadening (Phase 1) + E6-G0d (landed #1813) | DECLARED YELLOW (NEW 2026-05-06; reframed RED→YELLOW 2026-05-06 per option (a) RATIFIED) | chain-break dissolved by Q-Class-2-Chain-Break option (a) gap-test re-pick + Q-LBP-R3-Closeability option (b) narrowing; single-prereq-blocked on T-E-P P1 / S10 |
-| 62 | `substrate_gap_file_ingestion_closed` | substrate-gap-class | T-Workflow-As-Data | DECLARED-with-ratified-shape-and-carrier-internals-ratified (2026-05-13 per Director top-level ratification msg_09df44c6 + carrier-internals sub-canvas ratification msg_61e302c6 on PR #2820 commits + §4.3 line 505 verbatim "T-Workflow-As-Data file-ingestion substrate (`workflow_substrate_carriers_landed` extended to file-attachment)") | `.dag` program ingests external file w/o include_str!. **Ratified top-level shape**: workflow-substrate `FileAttachment` carrier extending gate #53 (sibling-carrier pattern with WorkflowSecret + CronExpression β-ratified via PR #2160). **Ratified carrier-internals** (Refined-B-1 — strict 5-of-7 subset of #55 `WorkflowObservationAnchor` at `src/v3/std/timing_lens.dag:98-106`): `FileAttachment { subject_node: NodeId, content_digest: ContentHash, producer_id: WorkflowProducerId, workflow_run_id: WorkflowRunId, attached_at_ns: Nanoseconds }`. Drops observer_id + prover_id (timing-observation-specific epistemological roles; not applicable to file attachment). **Q1-Q6 dispositions** (Director verbatim): Q2 encoding ABSENT default (if needed, `Encoding` from `dsl/std/encoding.dag` — NEVER novel `AttachmentEncoding`); Q3 `WorkflowAssetPath` NOT introduced (digest-only canonical); Q4 workflow-coupling deferred to worker brief / consumer evidence (#55 `TimingObservationSet = List<TimingObservationEntry>` is own carrier, not embedded; analogy: no preemptive `List<FileAttachment>` on Job/Step); Q5 eager confirmed; Q6 `AttachmentEncoding` Practice-4 🔴 RED — dissolved to existing `dsl/std/encoding.dag` 6-variant `Encoding` BoundedLattice. **Disqualified top-level candidates** (per Director original disposition): (a) compile-time `read_utf8_file` — P5-style intrinsic, doesn't match §4.3 framing, re-introduces `include_str!` semantics under new syntax (PR #2819 STAND DOWN); (c) precedent-mirror — no precedent enumerated, §4.3 already names answer; (d) A+B bundle — creates parallel-authority violating §P1. **Disqualified carrier-shape candidates** (per Director sub-canvas disposition): B-2 path+digest — parallel-representation (two canonical identifiers for same fact); B-3 anchor+entry-pair — over-engineered (no separate payload to split). **Anti-patterns post-ratification** (Director-enumerated 7 total — 3 from top-level + 4 from sub-canvas): (1) compile-time `read_utf8_file`-equivalent additions; (2) FileAttachment landed without #55/#53 sibling-carrier alignment; (3) bridge variants alongside FileAttachment violating §P5 atomic-migration; (4) any `AttachmentEncoding` or equivalent encoding sum-type duplicating `dsl/std/encoding.dag`; (5) path field on FileAttachment (parallel-rep vs canonical digest); (6) `List<FileAttachment>` on Job/Step preemptively (consumer-evidence-required); (7) carrier-pattern deviation from Refined-B-1 5-field structure (no novel field-name renames; producer_id stays producer_id). **Director grep-verified at HEAD**: #55 anchor 7 fields at `timing_lens.dag:98-106`; 5 branded nominals (`ContentHash` :324, `WorkflowProducerId` :328, `WorkflowObserverId` :329, `WorkflowProverId` :330, `WorkflowRunId` :331) at `dsl/std/types.dag`; `dsl/std/encoding.dag` exists with `Encoding = ASCII \| UTF8 \| Latin1 \| Text \| Binary \| Unknown` BoundedLattice (compile-time narrowing); no `FileAttachment` / `AttachmentEncoding` / `WorkflowAssetPath` at HEAD (no parallel-authority risk). **Sub-canvas-2 trigger** (follow-on, not blocking this carrier-internals ratification): workflow blob-store substrate — Refined-B-1 requires `content_digest → bytes` resolution; substrate may not exist at HEAD per sub-canvas §3.B-1.Cons; Substrate Mgr authors as separate canvas after Refined-B-1 lands. **Worker brief next** (proceeds without further canvas): carrier definition (5 fields exactly) + sibling-alignment receipt (#55 5-of-7-field subset rationale) + bootstrap ratchet test mirroring `timing_lens_substrate_carrier_test.rs` + existence-proof use case (worker enumerates). **`include_str!` audit at HEAD** (Director-verified `grep -rn "include_str!" dsl/`): no matches — gate is forward-looking (model the carrier so future file-ingestion sites have first-class workflow-substrate form), not retire-existing-side-channel. |
+| 62 | `substrate_gap_file_ingestion_closed` | substrate-gap-class | T-Workflow-As-Data | **CONSUMER_LANDED** (`src/v3/std/timing_lens.dag` `FileAttachment` + `gate_62_file_attachment_demo_record`; `src/v3/compiler/tests/integration/file_attachment_substrate_carrier_test.rs` — ratified shape unchanged per msg_09df44c6 / msg_61e302c6 / PR #2820) | `.dag` program ingests external file w/o include_str!. **Ratified top-level shape**: workflow-substrate `FileAttachment` carrier extending gate #53 (sibling-carrier pattern with WorkflowSecret + CronExpression β-ratified via PR #2160). **Ratified carrier-internals** (Refined-B-1 — strict 5-of-7 subset of #55 `WorkflowObservationAnchor` at `src/v3/std/timing_lens.dag:98-106`): `FileAttachment { subject_node: NodeId, content_digest: ContentHash, producer_id: WorkflowProducerId, workflow_run_id: WorkflowRunId, attached_at_ns: Nanoseconds }`. Drops observer_id + prover_id (timing-observation-specific epistemological roles; not applicable to file attachment). **Q1-Q6 dispositions** (Director verbatim): Q2 encoding ABSENT default (if needed, `Encoding` from `dsl/std/encoding.dag` — NEVER novel `AttachmentEncoding`); Q3 `WorkflowAssetPath` NOT introduced (digest-only canonical); Q4 workflow-coupling deferred to worker brief / consumer evidence (#55 `TimingObservationSet = List<TimingObservationEntry>` is own carrier, not embedded; analogy: no preemptive `List<FileAttachment>` on Job/Step); Q5 eager confirmed; Q6 `AttachmentEncoding` Practice-4 🔴 RED — dissolved to existing `dsl/std/encoding.dag` 6-variant `Encoding` BoundedLattice. **Disqualified top-level candidates** (per Director original disposition): (a) compile-time `read_utf8_file` — P5-style intrinsic, doesn't match §4.3 framing, re-introduces `include_str!` semantics under new syntax (PR #2819 STAND DOWN); (c) precedent-mirror — no precedent enumerated, §4.3 already names answer; (d) A+B bundle — creates parallel-authority violating §P1. **Disqualified carrier-shape candidates** (per Director sub-canvas disposition): B-2 path+digest — parallel-representation (two canonical identifiers for same fact); B-3 anchor+entry-pair — over-engineered (no separate payload to split). **Anti-patterns post-ratification** (Director-enumerated 7 total — 3 from top-level + 4 from sub-canvas): (1) compile-time `read_utf8_file`-equivalent additions; (2) FileAttachment landed without #55/#53 sibling-carrier alignment; (3) bridge variants alongside FileAttachment violating §P5 atomic-migration; (4) any `AttachmentEncoding` or equivalent encoding sum-type duplicating `dsl/std/encoding.dag`; (5) path field on FileAttachment (parallel-rep vs canonical digest); (6) `List<FileAttachment>` on Job/Step preemptively (consumer-evidence-required); (7) carrier-pattern deviation from Refined-B-1 5-field structure (no novel field-name renames; producer_id stays producer_id). **Ratification-time Director grep (PR #2820 snapshot, pre-`FileAttachment` land):** #55 anchor 7 fields at `timing_lens.dag:98-106`; 5 branded nominals (`ContentHash` :324, `WorkflowProducerId` :328, `WorkflowObserverId` :329, `WorkflowProverId` :330, `WorkflowRunId` :331) at `dsl/std/types.dag`; `dsl/std/encoding.dag` exists with `Encoding = ASCII \| UTF8 \| Latin1 \| Text \| Binary \| Unknown` BoundedLattice (compile-time narrowing); at ratification time none of `FileAttachment` / `AttachmentEncoding` / `WorkflowAssetPath` were present under those names (parallel-authority collision avoided). **Current tree (post gate-62 land):** `FileAttachment` is authored in `timing_lens.dag`; `AttachmentEncoding` / `WorkflowAssetPath` remain unauthored per Director Q2/Q3. **Sub-canvas-2 trigger** (follow-on, not blocking this carrier-internals ratification): workflow blob-store substrate — Refined-B-1 requires `content_digest → bytes` resolution; substrate may not exist at HEAD per sub-canvas §3.B-1.Cons; Substrate Mgr authors as separate canvas after Refined-B-1 lands. **PR #2823 land:** carrier (`FileAttachment`) + sibling-alignment / bootstrap ratchet (`file_attachment_substrate_carrier_test.rs`) + existence proof (`gate_62_file_attachment_demo_record`) per worker brief. **`include_str!` audit (ratification snapshot)** (Director-verified `grep -rn "include_str!" dsl/` on PR #2820 canvas): no matches — gate is forward-looking (model the carrier so future file-ingestion sites have first-class workflow-substrate form), not retire-existing-side-channel. |
 | 63 | `substrate_gap_workflow_scheduling_closed` | substrate-gap-class | T-Workflow-As-Data + T-Lens-Self-Application | DECLARED (NEW 2026-05-06) | CI workflow as `.dag` data; substrate prereqs in §4.4 |
 | 64 | `substrate_gap_reflection_closure_closed` | substrate-gap-class | T-LensProducer-Retirement | **DECLARED** (substrate-plumbing receipt via PR #2694 — `src/v3/compiler/tests/fixtures/r3_substrate_gap_reflection_closure.dag` adds non-canonical claim `substrate_gap_reflection_residual_census_receipt` over the live `CensusSubsetCount` lens-producer residual predicate; `r3_substrate_gap_reflection_closure_test.rs` proves the state-check receipt executes and reports residual count 3 while residuals remain. This is **NOT** the canonical reflection-closure consumer.) | `lens_apply.rs` reflection via PB-Runtime; canonical Pass-condition per `r3-structure.md:181`: `lens_apply.rs` reflection routes via PB-Runtime interpreter-as-data and reflection-as-data substrate is exercised end-to-end. Status re-promotes only when PB-Runtime + T-LensProducer-Retirement land that consumer; census state-check is one half of the conjunctive class closure and remains a placeholder per PR #2657 / `feedback_grep_consumer_surfaces_for_lane_completeness`. P5 deferral receipts: non-test residual tracked under `ROADMAP.md` §"Lane acceptance — .dag gates" / T-PB-A row `lens_producer_files_remaining` (anchor `#lane-acceptance--dag-gates`), whose dissolution target is the priority lens-producer non-test census reaching zero; new host test harness tracked under `ROADMAP.md` §"Lane acceptance — .dag gates" / T-PB-B row `pb_rust_tests_outside_residual_zero` plus `EXPECTED_HAND_AUTHORED_TEST` in `sg0_census_test.rs`, dissolving when the generic TestClaim runner can execute the receipt without this harness. |
 | 65 | `tier3_dissolution_demonstration_executes` | demonstration | T-Tier3-Dissolution | PASSING | `src/v3/compiler/tests/dag/t_r3_tier3_dissolution_demonstration.dag` runs through `t_pb_b_1_dag_runner_test::r3_tier3_dissolution_demonstration_suite_passes_through_runner` |

scripts/ci-merge/sg0-pr-body-append.2823.txt

@@ -0,0 +1,3 @@
+SG-0 hand-path delta: +1
+
+SG-0 pairing: (c) dispatch via docs/briefs/r3-substrate-gate-62-file-attachment-carrier-worker.md (gate #62 `substrate_gap_file_ingestion_closed`); INVARIANTS.md §SG-0 hand-authored integration test receipt lands same PR as the `EXPECTED_HAND_AUTHORED_TEST` census line (P5 paired dispatch).