T-16-B SL-3229: openapi.dag WireContractFacts composition with coordination.dag — bind OpenApiOperationWireContractFacts to coordination WireContract + ExchangePattern authority (substrate, no emit)

[briansrls]

Summary

• Compose OpenApiOperationWireContractFacts with coordination.dag WireContractFacts (operation carries coordination: WireContractFacts plus OAS-specific admitted_method / path_template).
• Route exchange authority through coordination_effect_obligation(Http).required_exchange instead of a parallel RequestReply data witness; add openapi_http_wire_contract_facts, openapi_operation_wire_contract_facts, openapi_operation_wire_contract, and openapi_http_coordination_bind morphisms.
• Dissolve SL-3229-OPENAPI-WIRECONTRACT-COORDINATION gate (substrate only; no emit).

Test plan

• cargo test -p v3-compiler v4_extdeps_openapi — parse smoke + composition field receipts (v4_extdeps_openapi_dag_smoke_test.rs)
• CI on ready (draft skipped auto-gates)

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: f7a99b03 · Trigger: schedule
• Thinking: 164s wall

---

BLOCKING (1)

Root Cause

• src/v4/extdeps/formats/openapi.dag OpenAPI derives facts from coordination_effect_obligation(Http) but leaves bind.effect supplied by the caller → make the constructor take BindRef and call openapi_http_coordination_bind, or introduce an Http-specific bind carrier so the effect has one authority.

ROADMAP — Verified

• T-PB-B: The new hand-authored OpenAPI smoke test has the same-PR SG-0 census entry, INVARIANTS_OPS receipt, and PR-body append pairing.

⚠️ One substrate inconsistency remains constructible at the OpenAPI WireContract boundary.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-thinking
• Commit: 98627250 · Trigger: manual
• Comparison: main @ fa6d9900 ... session/valiant-bat-324 @ 98627250
• Conversation: View conversation

---

1. Story of the diff

This PR finishes the OpenAPI operation wire-contract composition that had been left gated in src/v4/extdeps/formats/openapi.dag. The old local data openapi_operation_exchange_request_reply: ExchangePattern = RequestReply witness is deleted, and OpenApiOperationWireContractFacts now embeds the coordination-layer WireContractFacts directly at src/v4/extdeps/formats/openapi.dag:566. The new OpenAPI projection sources the Http obligation from coordination_effect_obligation(effect: Http) at openapi.dag:585-586, projects only the OpenAPI-admitted ImmediateSettlement / NoReplicaConvergence cases at openapi.dag:589-613, and returns Outcome rejection diagnostics for bounded guarantees instead of fabricating steps: 0-style concrete bounds. The operation-level constructor then pairs those facts with a CoordinationBind { effect: Http } at openapi.dag:654-669, while the new Rust smoke ratchet and SG-0 receipts pin that this remains a temporary host-side test until .dag TestClaim / generated harness coverage exists. chatgpt-review-00bc80c0-fffb-4f…

2. Invariant categories

1. LAYER MODEL — Compliant. This touches substrate in src/v4/extdeps/formats/openapi.dag; the key modeling decision is to make OpenApiOperationWireContractFacts.coordination: WireContractFacts the carried substrate fact at openapi.dag:566, rather than maintaining an OpenAPI-local exchange authority. The bind side is likewise typed as BindRef in and CoordinationBind { effect: Http } out at openapi.dag:654-669, so OpenAPI composes with coordination instead of redefining the coordination contract.
2. INVARIANTS.md + modeling-discipline.md — Compliant. Fail-closed and single-authority are handled by routing the required guarantees through Outcome: bounded settlement is rejected with a typed diagnostic at openapi.dag:594-598, bounded consistency is rejected at openapi.dag:607-611, and accepted facts copy exchange from obligation.required_exchange at openapi.dag:623 rather than from a parallel OpenAPI witness. This matches the P2/P3/P5 discipline: one authority for exchange/guarantee facts, typed rejection instead of fabricated plausible values, and dissolution of the old local witness. chatgpt-review-4f28664f-6f2d-4c…
3. CODING.md — Compliant. The new Rust harness is data + free functions: openapi_surface_or_panic, type_record_fields, surface_type_name, and record_field_type are small helpers with explicit inputs at v4_extdeps_openapi_dag_smoke_test.rs:19-68. Panics are limited to test code, which is acceptable; the production .dag code uses Outcome instead of panic/default-style failure.
4. TESTING.md — Compliant. The PR adds a focused integration ratchet at v4_extdeps_openapi_dag_smoke_test.rs:70-125, wires it into integration.rs:292-293, and registers it in the SG-0 census at sg0_census_test.rs:858-859. The test is not pretending to be final structural .dag test coverage: _internal/INVARIANTS_OPS.md:39 and scripts/ci-merge/sg0-pr-body-append.3869.txt:3 both name the dissolution trigger—replace this host Rust parse ratchet when OpenAPI wire-contract facts are exercised by .dag TestClaim rows or a generated harness. That is consistent with the zero-floor direction even though it temporarily adds a hand-authored Rust test.
5. LOCKED DESIGN DECISIONS — Compliant. I did not see a divergence from the locked Pure Bootstrap / zero-floor direction. The PR adds a temporary Rust receipt, but it pairs the SG-0 net +1 with the expected INVARIANTS row and retirement trigger, which is exactly the tracked-hand-path mechanism rather than a permanent carve-out.
6. TRACKED vs UNTRACKED DEBT — Compliant. The only new scaffold is the host Rust smoke test. It has documentation (_internal/INVARIANTS_OPS.md:39), bounds (src/v3/compiler/tests/integration/v4_extdeps_openapi_dag_smoke_test.rs only, registered as a single SG-0 net +1 at scripts/ci-merge/sg0-pr-body-append.3869.txt:1-3), and a named dissolution trigger (.dag TestClaim rows or generated harness coverage) in both the ops row and PR-body append. No untracked TODOs or open-ended bridge comments were introduced.

2.5. Top-down PM intent review

Compliant. The PM-level intent here is to make OpenAPI operation wire-contract facts compose with the coordination substrate rather than carry a local exchange shortcut. The diff does that directly: it removes the local RequestReply witness, embeds WireContractFacts, sources the obligation through coordination_effect_obligation(Http), and turns the former gated footer into a green dissolution receipt at openapi.dag:682. I do not see semantic dilution into postponed composition or permanent scaffolding; the only interim Rust harness is explicitly tracked and paired with a dissolution path.

3. Verdict

APPROVE

I found no blocking invariant violations. The substrate change moves authority in the right direction—coordination owns exchange/settlement/consistency facts, OpenAPI projects Http-specific admissibility fail-closed—and the temporary hand-authored Rust ratchet is properly bounded and paired with SG-0 dissolution receipts.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 98627250 · Trigger: schedule
• Thinking: 209s wall

---

BLOCKING (1)

Root Cause

• src/v4/extdeps/formats/openapi.dag OpenAPI exposes the post-projection coordination facts as the generic carrier instead of an Http-specific carrier or constructor-only Outcome boundary → make the operation contract derive WireContractFacts inside the only exported constructor path, or introduce an OpenAPI/Http fact carrier with no non-Http degrees of freedom.

ROADMAP — Verified

• T-PB-B: The new hand-authored OpenAPI smoke test is paired in the diff with the SG-0 census entry, INVARIANTS_OPS receipt, and PR-body append file.

⚠️ One substrate-level illegal state remains constructible at the OpenAPI wire-contract facts boundary.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 35d31e17 · Trigger: schedule
• Thinking: 273s wall

---

ROADMAP — Verified

• T-PB-B: The new hand-authored OpenAPI smoke test is paired with the SG-0 census entry, INVARIANTS_OPS receipt, and PR-body append deferral citing pb_rust_tests_outside_residual_zero.

✅ The PR resolves the prior substrate authority issues and the added P5 receipt is checkable.

[briansrls]

Investigated ci failure on 35d31e174 (run 26619957172, job 78454132957).

Not a substrate/code RC on this PR. v3, fmt, affected, and self_host_ratchet all pass. The ci job fails on the shared v4 emit path:

1. M1 v4 full-tree rust emit probe — 20m step timeout (exit 143).
2. v4 bootstrap compile — SIGTERM 143; resolve-posture bridge passed (Bootstrap resolve-posture OK).
3. T-22 TestClaim corpus — compile --target rust hit the CI 240s ceiling (V4_TESTCLAIM_TIMEOUT_SECS, exit 143 at ~4m).

This matches the post-#3833 wasm.dag emit regression on main (5× slowdown). #3891 (wasm emit perf revert) is the PM-tracked unblock; still OPEN. Per keen-pike directive: holding 35d31e174 until #3891 lands, then merge main + fresh CI.

No further openapi.dag changes planned for this failure mode.

— sent from valiant-bat-324

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: e226932d · Trigger: schedule
• Thinking: 260s wall

---

ROADMAP — Verified

• T-PB-B / pb_rust_tests_outside_residual_zero: The new OpenAPI smoke test has the same-PR SG-0 census entry, INVARIANTS_OPS receipt, and PR-body append deferral.

✅ No blocking concerns in the changed substrate composition or its P5 receipt surface.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 44278926 · Trigger: schedule
• Thinking: 254s wall

---

BLOCKING (1)

Root Cause

• src/v4/extdeps/formats/openapi.dag OpenApiHttpWireContractFacts records only forgeable empty witness tags after the obligation check → make the coordination projection fail-closed, or carry checked guarantee facts that the final WireContract constructor must consume.

ROADMAP — Verified

• T-PB-B / pb_rust_tests_outside_residual_zero: The new OpenAPI smoke test has the same-PR SG-0 census entry, INVARIANTS_OPS receipt row, and PR-body append deferral.

⚠️ The prior authority issues are resolved, but the final WireContract projection still has a direct success path around the new fail-closed obligation checks.

[briansrls]

BLOCKING: openapi_http_wire_contract_facts_to_coordination returns WireContractFacts directly and hard-codes accepted settlement/consistency, so callers can bypass the Outcome checks and fabricate a successful contract when the Http obligation row requires bounded guarantees, violating INVARIANTS P3 fail-closed and P2 API-level enforcement.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-thinking
• Commit: 44278926 · Trigger: manual
• Comparison: main @ df91abc2 ... session/valiant-bat-324 @ 44278926
• Conversation: View conversation

---

1. Story of the diff

This PR closes the OpenAPI wire-contract coordination gate by replacing the previous standalone openapi_operation_exchange_request_reply data witness with an OpenApiHttpWireContractFacts carrier, then threading that carrier into OpenApiOperationWireContractFacts and finally into a WireContract. The intended mechanism is: OpenAPI operation facts remain Http-only, coordination’s coordination_effect_obligation(Http) remains the authority for the required exchange/settlement/consistency row, bounded settlement or convergence requirements reject through typed Outcome, and the SG-0 receipt/test census grows by one hand-authored parse ratchet while the future generated/.dag test path is named. The load-bearing hunks are the new OpenAPI .dag functions at src/v4/extdeps/formats/openapi.dag:601-701, the new smoke harness at src/v3/compiler/tests/integration/v4_extdeps_openapi_dag_smoke_test.rs:1-140, and the same-PR SG-0/INVARIANTS_OPS pairing. chatgpt-review-a34265cf-e799-49…

2. Invariant categories

1. LAYER MODEL (substrate vs implementation). Finding — substrate / single authority / fail-closed. In src/v4/extdeps/formats/openapi.dag:631-641, openapi_http_wire_contract_facts_to_coordination reads coordination_effect_obligation(Http) only for exchange, but then authors settlement: ImmediateSettlement and consistency: NoReplicaConvergence directly at src/v4/extdeps/formats/openapi.dag:639-640. That makes the OpenAPI projection a second authority for the Http settlement/consistency facts: if the coordination obligation row changes to a bounded required settlement/convergence, openapi_http_wire_contract_facts() would reject, but this projection can still fabricate a valid-looking WireContractFacts from any manually constructed OpenApiHttpWireContractFacts. Because OpenApiHttpWireContractFacts is a public record with empty witness fields at src/v4/extdeps/formats/openapi.dag:567-579, the constructor path is not the only possible entry point. Fix by making the coordination projection consume the accepted projected values, or by returning Outcome<WireContractFacts> and re-checking the obligation at projection time, so settlement and consistency are never authored outside the coordination authority. chatgpt-review-a34265cf-e799-49…
2. INVARIANTS.md + modeling-discipline.md. Finding — P2 Boundary Discipline + P3 Fail-Closed. The new INVARIANTS_OPS receipt says this lane derives WireContractFacts via openapi_http_wire_contract_facts_to_coordination / Outcome constructors sourcing coordination_effect_obligation(Http), with bounded required guarantees failing closed. The implementation partly honors that in openapi_http_settlement_from_obligation and openapi_http_consistency_from_obligation, but the final WireContractFacts projection drops those accepted values and re-authors the concrete terminal guarantees at src/v4/extdeps/formats/openapi.dag:639-640. That is the exact parallel-authority shape the receipt is supposed to prevent. chatgpt-review-a34265cf-e799-49…
3. CODING.md. Compliant. The new Rust harness uses small free functions (openapi_surface_or_panic, type_record_fields, surface_type_name, record_field_type) and keeps the parser/tokenizer dependencies explicit rather than adding hidden state or method-heavy helpers. The module header is a load-bearing SG-0/P5 receipt, which is an accepted comment category. chatgpt-review-a34265cf-e799-49…
4. TESTING.md. Compliant with a caveat tied to the finding. The PR adds the expected hermetic parse/shape ratchet and wires it through integration.rs, EXPECTED_HAND_AUTHORED_TEST, and _internal/INVARIANTS_OPS.md. The test correctly catches the intended removal of the old parallel RequestReply witness and the presence of the new constructor/projection surfaces, but it does not catch the projection-time re-authoring issue above because it only checks textual presence of the projection and terminal constants. chatgpt-review-a34265cf-e799-49…
5. LOCKED DESIGN DECISIONS. N/A — the diff does not alter a locked design document or knowingly diverge from a locked thesis/design decision; it adds an operational receipt and substrate implementation for an existing T-4.6/SL-3229 lane.
6. TRACKED vs UNTRACKED DEBT. Compliant. The new hand-authored Rust test path is tracked as SG-0 debt with the same-PR _internal/INVARIANTS_OPS.md row, EXPECTED_HAND_AUTHORED_TEST entry, and scripts/ci-merge/sg0-pr-body-append.3869.txt pairing; the dissolution trigger is “remove when OpenAPI operation wire-contract facts are exercised by .dag TestClaim rows or a generated harness.” chatgpt-review-a34265cf-e799-49…

2.5. Top-down PM intent review

Finding. The PR’s own receipt/brief line establishes the PM intent: OpenAPI WireContractFacts should be derived through openapi_http_wire_contract_facts_to_coordination / Outcome constructors sourcing coordination_effect_obligation(Http), with bounded guarantees failing closed. The implementation preserves that on the constructor path but dilutes it at the final projection by directly emitting ImmediateSettlement and NoReplicaConvergence in WireContractFacts instead of carrying or re-validating the accepted coordination values. A worker following this landed shape could treat the record carrier as sufficient evidence and bypass the fail-closed obligation check, which is the semantic error the lane exists to remove. chatgpt-review-a34265cf-e799-49…

3. Verdict

REQUEST_CHANGES. The PR is directionally correct and has the right SG-0 receipt shape, but the final OpenAPI→coordination projection still re-authors settlement and consistency facts instead of making coordination’s obligation row the single authority. Because this is substrate modeling and can admit valid-looking WireContractFacts after the bounded-obligation path should reject, it should be fixed before merge.