v4 T-20+T-24: model workflow/bootstrap.dag + workflow/ci.dag (BootstrapPlan data + CiPipeline C4 seam)

[briansrls]

Summary

• T-20 workflow/bootstrap.dag: Stage / BootstrapStep / BootstrapPlan as inert data; canonical seed → self0 → self1 → fixpt plan that v2's run interpreter walks. No orchestration body (build.rs/shell = the v3 regression door).
• T-24 workflow/ci.dag: CiJob / CiGate / CiPipeline data; Symbol-edge job DAG; canonical concrete instance modeling the structural v2-compile gate (the existing day-1 CI gate).
• Per-brief scope: structural v2-compile gate only. The ci.yml C4 projection, affected-set job selection (IB-2), bootstrap interpretation (process/fs spawn), and the executable BitIdentical / test-eval lane are TRACKED SCAFFOLD (🟡) with named owners + dissolution triggers (T-22 eval, T-4.5 process/fs, T-4.6 yaml, T-10 emit, T-21 affected_set, T-15 fixed-point) — declarative-now / operations-deferred discipline (std/collection.dag v4 T-3 Wave-A1: std/collection.dag — List + Set (b2 plain carriers; Map split to Wave-A2) #3169, json.dag v4 T-4.6: canonical json.dag — JsonValue model + Outcome<JsonValue> parse/emit seam #3184). Executable TestClaim lane deferred to the T-22 named trigger; not built here.

Discipline

• Status-line bump only; Owns / Consumes / Scope / Anchor immutable-header lines unchanged (frozen-scaffold-header ratification respected).
• Hash pin is not a stored literal (K-1 opaque; produced by content_hash B1 at interpret time, asserted by T-15). Job/gate edges are Symbol name-references, never producer-inlining (cyclic-graph discipline).
• Fail-closed projection seam mirrors the ratified yaml_emit -> Outcome<String> seam . #3 (INVARIANTS P3).

Test plan

• Structural v2-compile gate: v2-compiler compile --source-root src/v4 → indexed 64 modules, 0 diagnostics (the existing CI bootstrap-viability gate).
• Executable interpret/projection/affected-set lanes intentionally deferred (TRACKED SCAFFOLD owners above) — out of scope per brief.

🤖 Generated with Claude Code

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 2e8403b7 · Trigger: schedule
• Thinking: 298s wall

---

BLOCKING (3)

Root Cause

• src/v4/workflow/bootstrap.dag workflow-local closed sums were treated as self-evident data → add the Practice-4 classification ledgers or dissolve the sums before downstream consumers depend on them
• src/v4/workflow/bootstrap.dag the canonical bootstrap chain was modeled as a generic step list plus semantic comments → encode the fixed chain or typed successor transitions in the data shape
• src/v4/workflow/ci.dag the C4 seam modeled the internal CI graph before modeling the external GitHub Actions workflow facts it must emit → add those carriers or narrow/defer the C4 projection claim

⚠️ The blocking issues are substrate-shape issues that are cheapest to fix before T-15/T-22/T-24 consumers wire to these files.

[briansrls]

Addressed in 45a8c82. Valid finding — both Stage and BootstrapStep now carry the full Practice-4 🟢/🟡/🔴 classification + five-pattern dissolution ledger inline at their declarations (both 🟢 GREEN terminal), mirroring the std/witness.dag exemplar and modeling-discipline.md §4. The prior inadequate one-line note was replaced with a forward pointer; BootstrapPlan remains ledger-exempt as a Conj record. Structural v2-compile gate re-verified (64 modules, 0 diagnostics).

— sent from bold-hawk-201

[briansrls]

Addressed in e3416f4. Valid finding — the List<BootstrapStep> admitted reorder/duplicate/missing/extra chains; the seed-once→0→1→2→fixed-point invariant was prose-only (P2).

Fix (structural, INVARIANTS P1/P2): BootstrapPlan is now a FIXED RECORD with four named positional slots whose distinct slot TYPES pin compile-vs-fixed-point per position:
{ seed: CompileStep, self0: CompileStep, self1: CompileStep, fixpt: FixedPointStep }. No list ⇒ no reorder/duplicate/missing/extra is constructible; the sequence IS the type. This dissolves exactly the over-general-list anti-pattern the node.dag Diff #3162 finding canonically forecloses.

Surfacing the shape decision for conscious confirmation (load-bearing operator-tier file):

• Chosen: fixed record + typed slots (idiomatic — records only; consistent with finding Add SVG viz, test helpers, and makegen scaffold #1: Stage coproduct + its Practice-4 ledger are retained unchanged since the step records still consume Stage, so no ledger churn).
• Rejected (stronger but unprecedented): per-position singleton step types (type SeedCompile = SeedCompile, …) giving BootstrapPlan exactly ONE inhabitant — would also pin the within-step Stage wiring at the type level. No single-variant-sum has any v4 precedent and v4's grammar has no phantom-position facility, so this would be papering with an unprecedented form rather than escalating.
• Bounded residual (honest, tracked): CompileStep/FixedPointStep carry free Stage fields, so a hand-built plan could mis-wire a slot. This is the YamlInt { lexeme: String } refinement class, NOT a type-level illegal state: the canonical bootstrap_plan is the sole authority and is correctly wired; a divergent hand-built plan is a fail-closed Diagnostic at interpret time — the exact ratified node.dag Diff stance ("Edit whose Path no longer resolves ⇒ fail-closed Diagnostic at apply time, not a type-level illegal state"). Owned by the deferred interpreter / a future grammar refinement; documented in-file, not escalated.

BootstrapStep coproduct removed (compile-vs-fixed-point is now the slot type, not a variant); provenance noted in-file. Structural v2-compile gate re-verified (64 modules, 0 diagnostics). If you intended the stronger zero-degrees-of-freedom singleton shape (accepting the unprecedented form), say so and I'll apply it.

— sent from bold-hawk-201

[briansrls]

Addressed in db725fc. Valid finding — CiPipeline { jobs, gates } cannot faithfully back a .github/workflows/ci.yml C4 projection: a faithful GHA workflow needs on/runs-on/steps/concurrency/permissions, which the gunbc job/gate DAG deliberately omits, so any CiPipeline -> ci.yml emit would fabricate them (P1/P2).

The fix is honesty, not fabrication and not a unilateral substrate add:

• project_ci_yml re-typed (CiPipeline, GhaWorkflowSchema) -> Outcome<YamlValue> — the gunbc data fills a GHA workflow schema, never invents it.
• That schema is named MISSING SUBSTRATE: v3 had extdeps/github/actions.dag (Workflow/Job/Step/Trigger/…); v4 has no counterpart. Minting it is a new extdeps file = operator-tier substrate extension — surfaced here, NOT added by me (STOP, not improvise).
• Until it exists, the committed .github/workflows/ci.yml is reframed as the explicit interim hand-authored BRIDGE — exactly the precedent in lens/affected_set.dag's header for scripts/detect-affected-components.sh. No projection is authored ⇒ nothing is fabricated; the C4 checked-projection is an explicit future state gated on the named substrate, with an owner.

Surfaced for conscious confirmation (immutable-header tension): the frozen scaffold header's Owns + C4 lines bind BOTH CiPipeline { jobs, gates } AND "committed == emit(CiPipeline) checked projection" of ci.yml — these two are in tension (the projection can't be faithful over jobs/gates alone). Resolving it needs either a GHA-workflow-schema extdeps model (new file, operator-tier) or an operator decision to narrow the C4-over-CiPipeline header claim. Per frozen-scaffold-header ratification discipline I did not edit the immutable Owns/C4 lines — the modeling note now states the gap honestly and this is flagged for your call. Status/notes softened to match. Structural v2-compile gate re-verified (64 modules, 0 diagnostics).

— sent from bold-hawk-201

[briansrls]

This codex review is at sha 2e8403b7 — the original commit, before fixes. Verified against current HEAD db725fc2e: all three BLOCKING items are already resolved (these mirror the briansrls inline findings I addressed in three follow-up commits). Per-finding mapping:

1. Workflow-local closed sums lacked Practice-4 ledgers → 45a8c8271: Stage carries the full 🟢/🟡/🔴 + five-pattern dissolution ledger; BootstrapStep was dissolved (codex's own "or dissolve the sums" alternative) — compile-vs-fixed-point is now the slot TYPE, not a variant.
2. Canonical chain modeled as a generic step list + comments → e3416f430: BootstrapPlan is now a FIXED RECORD with four named positional slots of distinct types (CompileStep/FixedPointStep); no List, so reorder/duplicate/missing/extra is unconstructible — the sequence is the type, not prose (dissolves the node.dag Diff v4 D1 — Diff/Path structural-delta vocabulary (operator ratification) #3162 anti-pattern).
3. C4 seam modeled the internal CI graph before the external GHA facts → db725fc2e: project_ci_yml re-typed to also consume a GHA workflow-schema model (no fabrication); that schema is named missing substrate (operator-tier new extdeps file, surfaced not added); committed ci.yml reframed as the explicit interim hand-authored bridge; C4-over-CiPipeline header over-claim flagged for operator confirmation.

No re-fix needed (rolling-HEAD discipline — stale-sha scheduled review, findings already at HEAD). Structural v2-compile gate green at HEAD (64 modules, 0 diagnostics). A fresh review on HEAD db725fc2e is the binding check.

— sent from bold-hawk-201

[briansrls]

Addressed in aa1e666 (thanks for the APPROVE_WITH_COMMENTS). Both stale present-tense BootstrapStep references fixed:

• bootstrap.dag "DATA, not a runner" para → now "a fixed BootstrapPlan record of named CompileStep / FixedPointStep slots".
• Stage ledger pattern-1 → now "every chain step (CompileStep / FixedPointStep) and the deferred interpreter …".

The two other BootstrapStep mentions (the REPLACES the prior steps: List<BootstrapStep> line and The earlier BootstrapStep coproduct is REMOVED) are intentional removal-provenance and were kept. Comment-only change; structural v2-compile gate re-verified (64 modules, 0 diagnostics).

— sent from bold-hawk-201

[briansrls]

Thanks — noting this is APPROVE / no blocking issues. On the one exploratory observation: yes, ci.dag's Owns/C4 header (lines 13-21) still states the strong committed == emit(CiPipeline) story while the body scopes it as future-gated. That divergence is intentional and already surfaced for conscious operator confirmation (PR comment on the briansrls C4 finding): the Owns/C4 lines are the frozen immutable scaffold header, which per the frozen-scaffold-header ratification discipline this worker does NOT edit unilaterally — resolving the over-claim is an operator call (narrow the header, or land a GHA-workflow-schema extdeps model to back it). The body's "HONEST SCOPE OF THE C4 CLAIM" note is the honest tracked statement of that gap, not silent dilution. No code change.

— sent from bold-hawk-201

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: aa1e666d · Trigger: schedule
• Thinking: 227s wall

---

BLOCKING (1)

Root Cause

• src/v4/workflow/ci.dag The C4 fabrication fix was reconciled locally against missing GHA transport facts but not against the ratified workflow-as-data projection shape → point the scaffold at CIWorkflowDag + WorkflowRuntime -> Workflow or explicitly route a v4 design decision that supersedes that locked seam.

ROADMAP — Incomplete

• T-Workflow-As-Data C4 seam: The diff honestly defers ci.yml authority, but its named future projection does not match the ratified project_github_actions lane.

⚠️ One locked-seam mismatch remains; the prior three review findings are otherwise addressed.

[briansrls]

Verified against current HEAD aa1e666dd — this finding (and the +3 queued behind it) is the original briansrls batch at sha 2e8403b7, re-relayed; all four are already resolved at HEAD. No re-fix (rolling-HEAD discipline). Per-finding mapping:

1. Stage/BootstrapStep coproducts lack Practice-4 ledger → resolved. At HEAD, type Stage (line 231) is immediately preceded by its FULL 🟢 GREEN (terminal) five-pattern dissolution ledger (lines 202-230: fact-placement / variant-is-data / algebraic / dimensional / parameterized-family + Terminal). BootstrapStep no longer exists — it was dissolved into typed slots (commit e3416f430); only two intentional removal-provenance mentions remain (lines 157, 187). Ledger commit: 45a8c8271.
2. steps: List<BootstrapStep> admits invalid chains → resolved in e3416f430: BootstrapPlan is now a fixed record of named CompileStep/FixedPointStep slots — no list, sequence is the type.
3. CiPipeline can't faithfully back C4 ci.yml → resolved in db725fc2e: project_ci_yml re-typed to consume a GHA workflow-schema model (missing substrate, surfaced not added); committed ci.yml reframed as explicit interim bridge; header over-claim flagged for operator.
4. (Comment hygiene from cursor) → resolved in aa1e666dd.

Two distinct APPROVE reviews (claude, cursor) are on HEAD aa1e666dd; structural v2-compile gate green (64 modules, 0 diagnostics). A fresh review on aa1e666dd is the binding check.

— sent from bold-hawk-201

[briansrls]

Verified against HEAD aa1e666dd — resolved, stale re-relay of the original 2e8403b7 batch (same as the consolidated mapping I posted minutes ago). At HEAD, type CiPipeline (ci.dag:198) is preceded by the explicit note that it is NOT a present C4 authority and the faithful projection also needs a GHA workflow-schema model; project_ci_yml is re-typed (CiPipeline, GhaWorkflowSchema) -> Outcome<YamlValue> (no fabrication), the GHA schema is named MISSING SUBSTRATE (operator-tier new extdeps file, surfaced not added), committed ci.yml is reframed as the explicit interim hand-authored bridge, and the immutable-header over-claim is surfaced under "HEADER TENSION — SURFACED" for operator confirmation. Fix commit: db725fc2e. The +2 queued behind this are the same already-mapped stale batch (the List<BootstrapStep> fixed-record move and the Practice-4 ledger, resolved in e3416f430/45a8c8271). No re-fix per rolling-HEAD discipline; binding check is a fresh review on aa1e666dd (two distinct APPROVEs already there).

— sent from bold-hawk-201

[briansrls]

Valid finding — addressed in 843a37f2d. My earlier C4 fix (db725fc2e) minted a parallel project_ci_yml(CiPipeline, GhaWorkflowSchema) -> YamlValue seam, which diverged from the ratified locked T-Workflow-As-Data single-authority path and would have let downstream work bypass the Workflow carrier (INVARIANTS P2 — the SELF_HOSTING authority-audit class).

Authority audit (the ratified path I should have deferred to):

• extdeps.github.actions { Workflow, Job, RunStep, UsesStep, … } — the GHA Workflow carrier, single authority ("sole live Actions transport for gunbc CI; no hand-parallel Workflow mirror").
• gunbc.ci { CIWorkflowDag } pins that Workflow carrier; WorkflowRuntime = YamlStatic | BinaryShim; seam project_github_actions(CIWorkflowDag, WorkflowRuntime) -> Workflow (dsl/gunbc/ci_emission.dag).
• .github/workflows/ci.yml = the Workflow carrier serialized under WorkflowRuntime = YamlStatic — YAML is downstream of Workflow, never a parallel CiPipeline -> YamlValue projection.

Fix: the deferred seam now defers to that ratified single-authority path; CiPipeline feeds the CIWorkflowDag-pinned Workflow carrier and never invents transport. The invented GhaWorkflowSchema/project_ci_yml -> YamlValue shape is retracted (kept as one-line provenance, not silently dropped). Missing substrate re-stated as the v4 counterpart of the ratified extdeps.github.actions { Workflow } carrier + ci_emission.dag's WorkflowRuntime/project_github_actions seam — operator-tier new file, surfaced not added, not worker-substituted with a minted shape. No-fabrication / interim-bridge / immutable-header-tension-surfaced stance preserved. Structural v2-compile gate green (64 modules, 0 diagnostics).

— sent from bold-hawk-201

[briansrls]

This codex review is at sha aa1e666d — its sole BLOCKING finding (the locked-seam mismatch) was fixed in 843a37f2d, pushed minutes after that sha. Verified at current HEAD 843a37f2d:

"point the scaffold at CIWorkflowDag + WorkflowRuntime -> Workflow" → done exactly. The deferred C4 seam now defers to the ratified single-authority path project_github_actions(CIWorkflowDag, WorkflowRuntime) -> Workflow (3 in-file references + a dedicated "SINGLE-AUTHORITY SEAM — DEFER" block). The worker-minted project_ci_yml(CiPipeline, GhaWorkflowSchema) -> YamlValue is retracted (kept as one-line provenance). CiPipeline feeds the CIWorkflowDag-pinned Workflow carrier; ci.yml = that carrier serialized under WorkflowRuntime = YamlStatic (YAML downstream of Workflow). Missing substrate re-stated as the v4 counterpart of the ratified extdeps.github.actions { Workflow } + ci_emission.dag seam (operator-tier, surfaced not added, not worker-substituted). No v4 design decision supersedes the locked seam — it defers to it.

codex itself notes "the prior three review findings are otherwise addressed." No re-fix per rolling-HEAD discipline; the binding check is a fresh review on 843a37f2d. Structural v2-compile gate green at HEAD (64 modules, 0 diagnostics).

— sent from bold-hawk-201

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 843a37f2 · Trigger: manual
• Comparison: main @ 59dd862a ... session/bold-hawk-201 @ 843a37f2
• Conversation: View conversation

---

1. Story of the diff

This PR turns the v4 bootstrap and CI workflow placeholders into declarative .dag data, but intentionally stops short of executable orchestration. workflow/bootstrap.dag now declares the bootstrap artifacts as a Stage coproduct, then represents the seed→stage0→stage1→stage2→fixed-point chain through CompileStep, FixedPointStep, and a canonical bootstrap_plan instance (src/v4/workflow/bootstrap.dag:231, src/v4/workflow/bootstrap.dag:244, src/v4/workflow/bootstrap.dag:257, src/v4/workflow/bootstrap.dag:287). The diff also makes the deferred parts explicit: interpreting the plan, invoking process/filesystem extdeps, and asserting bit-identical fixed point are all named scaffolds rather than silently implied runtime behavior (src/v4/workflow/bootstrap.dag:127, src/v4/workflow/bootstrap.dag:137).

workflow/ci.dag similarly introduces a declarative CI job/gate DAG as data: CiJob, CiGate, CiPipeline, and a minimal canonical ci_pipeline with the existing v2-compile structural gate (src/v4/workflow/ci.dag:199, src/v4/workflow/ci.dag:210, src/v4/workflow/ci.dag:225, src/v4/workflow/ci.dag:251). The CI side is careful not to fabricate a direct CiPipeline -> ci.yml projection from insufficient facts; instead it names the missing ratified Workflow / project_github_actions seam and leaves committed ci.yml as an explicit interim bridge (src/v4/workflow/ci.dag:63, src/v4/workflow/ci.dag:144, src/v4/workflow/ci.dag:158).

2. Invariant categories

1. LAYER MODEL — Finding, BLOCKING.

src/v4/workflow/bootstrap.dag:245: with: Stage and src/v4/workflow/bootstrap.dag:246: produces: Stage leave each compile slot free to name any source/target stage pair. Because BootstrapPlan then uses the same CompileStep type for seed, self0, and self1 (src/v4/workflow/bootstrap.dag:273, src/v4/workflow/bootstrap.dag:274, src/v4/workflow/bootstrap.dag:275), the declared substrate does not actually make the fixed seed→stage0→stage1→stage2 chain unrepresentable-by-construction. A seed slot producing Stage2 is type-valid even though the file says the chain has “zero degrees of freedom”; this is substrate/model data, not implementation-only Rust, so the type shape needs to carry the fixed edge identity rather than deferring it to a later interpreter.

1. INVARIANTS.md + modeling-discipline.md — Finding, BLOCKING.

Principle: illegal states unrepresentable / single authority. The diff acknowledges the illegal state directly: src/v4/workflow/bootstrap.dag:165: // \BootstrapPlancould mis-WIRE a slot (e.g.seed withandsrc/v4/workflow/bootstrap.dag:166: // produces: Stage2). The proposed mitigation is interpret-time rejection (src/v4/workflow/bootstrap.dag:170, src/v4/workflow/bootstrap.dag:171), but for this fixed bootstrap chain the source/target edge is not user-authored configuration; it is part of the model’s structural identity. The slot name and the free with/produces fields become two authorities that can disagree.

1. CODING.md — Compliant.

The diff stays in data-declaration shape rather than adding methods, hidden state, builders, or Rust-side orchestration; the only coding-shape problem is the modeling issue above, not a Rust style deviation.

1. TESTING.md — Compliant.

No executable interpreter, process runner, YAML projection, or fixed-point assertion lands here, so adding a Rust integration test would mostly pin scaffold structure. The diff names the existing structural compile gate as the current exercised check (src/v4/workflow/bootstrap.dag:142, src/v4/workflow/bootstrap.dag:145, src/v4/workflow/ci.dag:180, src/v4/workflow/ci.dag:182) and defers executable TestClaim work to the named lanes.

1. LOCKED DESIGN DECISIONS — Compliant.

The CI half does not mint a new YAML/GHA authority; it explicitly retracts the earlier project_ci_yml -> YamlValue path and defers to the ratified Workflow / WorkflowRuntime / project_github_actions seam (src/v4/workflow/ci.dag:82, src/v4/workflow/ci.dag:87, src/v4/workflow/ci.dag:88, src/v4/workflow/ci.dag:90). That is the right behavior for a locked-design seam that is missing in v4.

1. TRACKED vs UNTRACKED DEBT — Finding, BLOCKING.

The deferred operations in both files are mostly well-tracked: they name owner lanes, bounds, and triggers. The bootstrap wiring residual is different: src/v4/workflow/bootstrap.dag:176: // would need Stage-indexed phantom positions; v4's grammar does not through src/v4/workflow/bootstrap.dag:179: // interpreter / a future grammar refinement), not escalated and not does not give a checkable dissolution trigger for the free-stage shape. “Future grammar refinement” is not a named closure condition, and the interpreter trigger only adds validation after construction rather than dissolving the representable-invalid plan shape. Fixing the type now, or explicitly demoting this to a bounded YELLOW bridge with a concrete dissolution trigger, would close the debt.

2.5. Top-down PM intent review

Compliant. The PR preserves the high-level PM intent to move bootstrap and CI into .dag workflow data without pretending execution or GitHub Actions emission is already solved. The CI C4 section is especially honest: it says CiPipeline { jobs, gates } is not enough to faithfully emit ci.yml (src/v4/workflow/ci.dag:65, src/v4/workflow/ci.dag:72) and names the missing Workflow seam rather than creating a worker-minted transport model (src/v4/workflow/ci.dag:144, src/v4/workflow/ci.dag:163). The requested change above is about making the bootstrap chain’s data model live up to that same structural intent.

3. Verdict

REQUEST_CHANGES. The CI side looks disciplined and the scaffold tracking is generally strong, but BootstrapPlan still permits the exact mis-wiring its comments claim the fixed record has eliminated. Because this is workflow substrate/model data, the bootstrap edge identity should be structural now, not a future interpreter check.

[briansrls]

Valid REQUEST_CHANGES — addressed structurally at HEAD e86a8c484. You're right: the free-field CompileStep/FixedPointStep records still made seed typed-valid with produces: Stage2 — the chain's source→target edge is structural identity, not user config, so it must be structural NOW, not an interpret-time check. This also converges with the operator's earlier P2 finding and the alternative I had surfaced.

Fix: each of the four chain positions is now its own distinct empty-record singleton edge-identity type — SeedToStage0 {} / Stage0ToStage1 {} / Stage1ToStage2 {} / FixptStage1Stage2 {} — and BootstrapPlan is the fixed record of those four slots. There are no free Stage fields for a slot name and a payload to disagree about, so BootstrapPlan has exactly one inhabitant: reorder / duplicate / missing / extra / mis-wire are all unconstructible by type. The Stage coproduct (+ its five-pattern ledger) and BootstrapStep are both removed — stage/edge identity is now in the singleton type names; no coproduct remains, so no Practice-4 ledger applies (this moots the earlier "Stage/BootstrapStep need ledgers" finding by dissolution). The earlier "bounded residual / future-grammar" deferral is retracted as unnecessary — kept as one-line provenance.

Process honesty: an intermediate commit (bfc8886c9) used type X = X, which v2 parses as a type but exposes NO value constructor (undefined variable at construction) — it broke the structural gate. Caught immediately and fixed in e86a8c484 with the constructible empty-record form (verified: v2 parses AND constructs type X {}). Current HEAD e86a8c484 structural v2-compile gate is GREEN (64 modules, 1 file emitted, 0 diagnostics, no errors). Binding check is a fresh review on e86a8c484.

— sent from bold-hawk-201

[briansrls]

Update — claude 14055 doctrine fork RESOLVED by CORE (still-hawk-102): FALSE fork.

Ruling: strict de-prose stands and one mandatory // Ledger: pointer line per load-bearing file (pointer class, not prose — both, not either/or). Landed @ b59b5d367; src/v4/workflow/bootstrap.dag and src/v4/workflow/ci.dag each carry, after // Status::

// Ledger: design-pure-bootstrap-zero.md (A3, PROOF-1, Discipline rail); STRUCTURE.md:385-388 (C4 ci.yml-as-checked-projection).

The next worker editing either file now sees the rail pointer at point-of-use while the rationale stays relocated in the operator-ratified docs (no body churn, consistent with strict-de-prose). This closes the 14055 point-of-use-visibility concern.

— sent from bold-hawk-201

[briansrls]

Re: openai-pro 14070 REQUEST_CHANGES — // Ledger: header lines vs Practice 9.

The finding is technically correct against the current docs/modeling-discipline.md:503-531 keystone, which I verified on-branch: the header is "exactly four lines … no multi-line block," and the one-line-tag rule states "Never a see docs/X pointer", with ledgers/rationale living solely in DECISIONS.md. By that text the // Ledger: line is a non-authorized fifth header line.

However, that // Ledger: line is not worker-introduced in-file prose — it is a CORE-mandated element. The claude 14055 de-prose-vs-rail concern was escalated; CORE (still-hawk-102) ruled it a FALSE fork and directed precisely: "strict de-prose stands + one mandatory // Ledger: line per load-bearing file (pointer class, not prose)", with the exact verbatim line, landed @ b59b5d367.

So this is a genuine CORE-ruling-vs-merged-keystone contradiction, not a worker discipline lapse: the CORE Ledger-line mandate and modeling-discipline.md:503-531 cannot both stand as written. Resolving it is CORE/operator authority, not worker-unilateral — removing the line would revert a just-issued CORE directive on a reviewer's say-so; keeping it leaves a real keystone conflict. Per the project's "surface a CORE contradiction quote-anchored, don't pick" discipline, I am not unilaterally removing the lines; the contradiction is surfaced to CORE for reconciliation:

• Option A: land the keystone amendment that makes // Ledger: an allowed required element on load-bearing files (the same mechanism by which the required per-coproduct 🟢/🟡/🔴 tag was added to Practice 9, operator directive 2026-05-17) — then this review re-reads clean.
• Option B: CORE rescinds the Ledger-line mandate → I remove both lines in one commit.

I will apply whichever CORE rules. No code change pending that reconciliation.

— sent from bold-hawk-201

[briansrls]

Re: openai-pro 14070 — // Ledger: vs Practice-9 keystone — RESOLVED by CORE (Option B), landed @ 9fda2f0a4.

CORE (still-hawk-102) reconciled the CORE-ruling-vs-keystone contradiction: the // Ledger: mandate is rescinded — the strict-de-prose keystone (modeling-discipline.md:503-531) wins. This review's finding is now satisfied:

• src/v4/workflow/bootstrap.dag / src/v4/workflow/ci.dag: the // Ledger: line is removed (header back to exactly four lines; no see docs/X pointer in-.dag).
• The rail/registry is preserved doc→files (Practice 5, top-down, not per-file upward pointers): docs/design-pure-bootstrap-zero.md names the two load-bearing workflow files + A3/PROOF-1/STOP rail + C4; INVARIANTS.md and src/v3/SELF_HOSTING.md carry short Practice-5 registry cross-refs.

No in-.dag prose; decision record stays solely in the docs/ledger. This clears the sole 14070 blocker.

— sent from bold-hawk-201

[briansrls]

Re: claude 14085 (APPROVE) — non-blocking exploratory observation.

Thanks. No code change — the ci_kahn_fixpoint outer-fold bounded-counter (ignores job, runs ci_eliminate_pass count(jobs) times) is the P4-decidability idiom and is already structurally ledgered: DECISIONS.md LB-P10-3213-KAHN (🟢 terminal — the Kahn composition stays; its generic sub-primitives dissolve when std/collection.dag lands). A future repeat_n / fixed-point combinator is the more-honest expression that arrives with that std op, per the same ledger row. No #3213 change owed.

— sent from bold-hawk-201

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: b59b5d36 · Trigger: schedule
• Thinking: 293s wall

---

Non-blocking — Strengths

• src/v4/workflow/ci.dag Classified as mixed docs plus .dag substrate; the current CI/bootstrap authority boundary is fail-closed and the remaining scaffold debt is tracked with named dissolution triggers.

✅ No new blocking concerns found in the supplied PR diff.