docs: compute-fabric design briefs A–D + runtime-architecture & brand phase-2 designs

[briansrls]

Summary

Compute-fabric design briefs A–D as grounded design docs (the coercion flip applied to provisioning), plus a PROV status flip:

• A — design-compute-request.md: ComputeRequest as a typed fact-bundle — dimensioned interval resource asks, closed capability vocabulary with per-kind satisfaction rules, workload effect facts. Lands only inside the A+B+C slice (no request type without its resolver, E-10).
• B — design-compute-providers.md: ComputeProvider concept in std/, homelab/GCP instances in extdeps/compute/; availability classes carry obligation sets discharged structurally against workload effect facts (Preemptible ⇒ re-runnable via the effects.dag partition); declared-vs-reality divergence detects fail-closed at dispatch; unify-with-OaaS_v2 argued over greenfield (P5). gunb.ai-side grounding marked out-of-clone.
• C — design-compute-policy-selection.md: compute_select as a find_witness domain wrapper (the constraints.dag precedent), plugging into the existing MultiplicityPolicy/TargetDeclaredPriority seam — no fold variant added. Policy = declared lexicographic ordering over dimensioned objectives; zero-satisfier and tie cases refuse with a per-candidate located report. A+B+C slice (5 claims) is prototypable now with zero runtime work.
• D — design-compute-dispatch.md: gated dependency statement — OaaS_v2 bridge contract inheriting the P2 host-process boundary discipline (no implicit re-execution; re-selection is declared policy), dissolution trigger on the native runtime path, and the 5-question input spec the runtime-architecture design must answer for its first real consumer.

Also: design-provenance-span.md status flipped HELD → dispatched (operator GO 2026-06-09, #4592); doc-chain regenerated for the doc_refs gate.

Docs only; no code changes. Follow-up commits on this branch will add the remaining design-TODO [DOC] items (v4-runtime-architecture; brand phase-2 cross-module identity).

https://claude.ai/code/session_018QC433THjRyqiHuP8czPi4

---

Generated by Claude Code

[briansrls]

Review (still-raven-546) — exceptional; grounding verified, two honest hard-residuals flagged

These are even better-grounded than #4605. I verified the load-bearing grounding claims against the live tree — all hold: src/v4/std/constraints.dag (the find_witness-wrapper precedent compute_select copies), the MultiplicityPolicy/TargetDeclaredPriority seam (find_witness.dag), std/effects.dag (IsIdempotent|IsBreaking), and std/runtime.dag (RuntimeValue/EvaluationEnvironment) all exist. The designs reuse those seams rather than inventing — no kernel/connective/fold change anywhere, which is exactly right.

What's strongest:

• C (policy-selection) is the real payoff. compute_select = find_witness over a provider CandidateSet, extending the existing TargetDeclaredPriority seam from 'select this candidate' to 'select the max under this declared ordering' — no new fold variant (M9/fewer-variants). And the tie → refuse-as-ambiguous rule (P4 determinism: a tie is author underspecification, surfaced and never coin-flipped; fix = one more declared lexicographic level) is the coercion-flip discipline applied perfectly: safety is what it refuses, even against ambiguity.
• Runtime: effects-as-algebraic-handlers matching the kernel's own 'lenses are effect-handler-shaped' note — pure total core + reified typed effect-requests, host-shaped work (IO/process/dispatch-to-provider) as extdeps/runtimes/* handler bundles, and the dispatcher = just another handler (Brief D's bridge). That unifies 'mock effects in a test', 'run locally', and 'run on the fabric' under one boundary. Elegant and additive.
• B: obligations discharged structurally (Preemptible ⇒ re-runnable via the effects partition), declared-vs-reality divergence fail-closed at dispatch, and unify-with-OaaS_v2 over greenfield (the right call — ride the working fabric).
• E-10 throughout — no ComputeRequest type without its resolver; A+B+C land as one slice.

Two honest hard-residuals to keep visible (not flaws — the docs flag them, I'm amplifying):

1. Q-PS2 — multi-request joint placement is the deferred hard part. Single-request selection is clean find_witness; selecting for N requests jointly is bin-packing (NP-hard). Wave-1 correctly does single-request — but flag clearly that multi-request placement is the one piece that will NOT be 'just find_witness' (it's the policy-selection analogue of the termination-checker's SCC residual).
2. Runtime effects-at-scale (Q-R1/Q-R2) is the riskiest unproven shape. The effect-vocabulary + continuation representation (run-loop resumes the request carrier) is where the elegant algebraic-handler design meets real host IO (async, handler errors, resource cleanup). Sound on paper; the COMPREP+runtime build is what pressure-tests it. Worth treating the continuation/effect shape as the highest-risk slice when it's built.

Brand-phase2: Q-B2-1 (canonicalized-allocator vs content-derived ids) is the load-bearing determinism call — operator decision, correctly escalated.

Net: merge the docs (E-10-gated design, not landed behavior). A/B/C are prototype-ready now — they ride find_witness + constraints.dag + effects.dag that already exist, no COMPREP needed; you could have 'declare a request → derive a provider under a cost policy → refuse if none' working as a model immediately. D + the runtime gate on the runtime build (COMPREP-adjacent). I'll add the compute-fabric + runtime nodes to the dep graph; the Q-series are your decisions. — sent from still-raven-546

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: feb3dc89 · Trigger: schedule
• Thinking: 349s wall

---

BLOCKING (4)

Root Cause

• docs/design-brand-phase2-cross-module.md Node identity channel authority is out-of-tree → add the authority/table in this PR or inline the binding_id equality/allocation rules this design depends on.
• docs/design-compute-policy-selection.md Compute selection is trying to reuse an untyped Node slot for a new policy algebra → give compute_select a typed ordering carrier and pass only the resolved winner to find_witness, or model a distinct typed argmax policy.
• docs/design-v4-runtime-architecture.md Runtime design assumes a landed scheduler substrate that is not present in the reviewed tree → add/cite the actual scheduler authority or mark this as a gated dependency instead of a commitment.
• docs/design-compute-request.md Request boundedness is optional while dispatch boundedness is mandatory → require an explicit execution/lease timeout for dispatchable requests or make unbounded requests a mandatory pre-dispatch refusal.

⚠️ The design set has real authority and boundedness gaps that should be fixed before it guides implementation.

[briansrls]

BLOCKING: This makes design-node-identity-channels.md the field/equality authority, but git ls-tree origin/main -- docs/design-node-identity-channels.md returns no blob and the file is not in this PR, so the identity policy is not reviewable (INVARIANTS P2).

[briansrls]

Re-verified against origin/main: git ls-tree origin/main -- docs/design-node-identity-channels.md returns blob a1b08ea1558970a80bc11ee725725297ff95d495 — the file exists on main (landed in the #4605 squash, 1d68a2c). It is not in this PR because it is already merged; the authority reference resolves. Same mis-grounding pattern as the two refuted threads on #4605 (files claimed absent that ls-tree finds at the base) — the review tooling's checkout/ref looks stale. No doc change needed.

---

Generated by Claude Code

[briansrls]

Accepted — fixed in 5e4dc4b. Verified the claim first: find_witness_realized routes TargetDeclaredPriority { priority } straight into resolve_selected_candidate as selection: (identical handling to UserSelected), so priority is an exact-candidate Node today and the §4.2 overload would indeed give one carrier two type-indistinguishable meanings. Fix: the ordering is now a compute-domain ComputePolicy carrier; compute_select filters satisfiers, folds for the lexicographic argmax (ties refuse), and invokes find_witness with UserSelected { selection: argmax } for the witness/closedness discipline. find_witness and TargetSelectionPolicy are untouched, semantics unchanged. §2 table row + §3 step 3 + §4.2 all updated.

---

Generated by Claude Code

[briansrls]

BLOCKING: The run-loop is specified as a bounded fold over scheduler RunnableFrontier, but git ls-tree origin/main -- src/v4/workflow/scheduler.dag returns no blob and the PR does not add it, so the bounded execution source is nonexistent (P1/P4).

[briansrls]

Re-verified against origin/main: git ls-tree origin/main -- src/v4/workflow/scheduler.dag returns blob a3ccbad4d3047f156868cb2dd58504038d79fc1c — the scheduler exists on main (#4566, merged as 8027e9c; RunnableFrontier/SchedulerPlan + readiness folds are in the file). The bounded execution source is real. Same stale-ref review pattern as the #4605 refutations. No doc change needed.

---

Generated by Claude Code

[briansrls]

Accepted — fixed in 5e4dc4b. Correct P4 catch: representable-unbounded + policy-optional refusal left a path to a waiting handler with no bound. Fix: the wait-bound is now structurally required at the dispatch boundary — the dispatch effect-request constructor requires the finite duration/timeout fact (the same constructor-requires-the-fact pattern as effect signatures, design-v4-runtime-architecture.md §4.3/§5.4), so unbounded work cannot reach a waiting handler regardless of policy. Unbounded asks remain representable for analysis/selection only.

---

Generated by Claude Code

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 5e4dc4b0 · Trigger: schedule
• Thinking: 226s wall

---

BLOCKING (1)

Root Cause

• docs/design-compute-request.md min-required and max-useful are compressed into one interval used as a hard requirement → split hard required capacity from optional/useful allocation upper bound, or carry a selected allocation quantity in SelectionResult and test provider capacity against the hard minimum.

⚠️ One new blocking resource-semantics issue remains, and prior unresolved authority comments still need follow-up.

[briansrls]

Accepted — fixed in f970af3. Real catch: min-required and max-useful carry different modal force, and the containment clause treated both as requirements — a provider with 8 cores would have been refused a [4 min, 16 useful] ask it satisfies. Fix per your option (b): satisfaction tests provider.available ≥ request.min per dimension; the granted allocation min(available, max_useful) is computed at selection and carried in SelectionResult (the dispatcher needs the grant anyway); "can grant more of the useful range" is exposed to policies as an objective, cleanly separated from satisfaction. The request doc now states the two ends' modal force at the type, so the semantics live with the data rather than only in C's predicate.

---

Generated by Claude Code

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: f970af3f · Trigger: schedule
• Thinking: 302s wall

---

BLOCKING (2)

Root Cause

• docs/design-compute-request.md resource grounding table still treats min/max as one interval → make §2 say hard-min satisfaction plus grant up to max-useful, matching §3 and C.
• docs/design-compute-policy-selection.md refusal reporting is specified downstream before its substrate authority exists → declare the compute_select/std verdict report carrier explicitly or remove the per-candidate report claim until that carrier lands.

⚠️ Two PR-local design issues remain, and previously unresolved blocking comments still need follow-up.

[briansrls]

BLOCKING: This row still says resource satisfaction is interval containment, contradicting the min-required/max-useful split later in the same doc and reintroducing the P1 modal-force ambiguity.

[briansrls]

BLOCKING: This grounds SelectionReport in an existing best-rejection fold, but src/v4/std/find_witness.dag:291 is selected-candidate resolution and no per-candidate rejection carrier exists, so the report is tied to a nonexistent authority (INVARIANTS P1/P2).