Gate-to-lens pattern-setter (zesty-SIGNED): convert layering_imports (scripts/check_v4_layering_imports.py) to a pure-.dag lens via ci-claim-gate, mirroring the converted exemplar scripts/v4-lens-ci-gate.sh. Load-bearing-soundness, DRAFT-until-signed (zesty signs the witness, NOT you). Binding step-

[briansrls]

Auto-opened by session-dashboard for session royal-crane-463.
Pushing to session/royal-crane-463 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Response to cursor review (dashboard #29274, REQUEST_CHANGES on 78c796c56)

Verified and addressed in f6b1811e43 + 688ddcbaec (current HEAD).

The finding was correct for 60de0f9c48: std/extdeps fixture witnesses fed hardcoded LayerImportFact lists and did not exercise layering_imports_scan.

Fix: scripts/v4-layering-imports-gate.sh --perturb-check now runs a host scanner-execution perturb slice (mirrors v4-substrate-equivalence-gate.sh:200-273). ci-claim-gate --perturb-check (data-only flip) is not used for coverage receipts.

Per root×form case (temp tree, torn down after each):

1. Plant _perturb_scanner_*.dag under the target layer root
2. Real layering_imports_scan --repo-root $TMP → manifest
3. Scanner witness (src/v4/test/claim/layering_imports/scanner/*.dag) on host_layer_import_facts → PASS
4. clean_tree on same manifest → FAIL (RED)
5. Remove plant, rescan → clean_tree PASS

Coverage roster (all via binary in CI gate step):

• src/v4/std × v4.compiler.* prefix
• src/v4/extdeps × v4.compiler.* prefix
• src/v3/std × v3.compiler exact
• dsl/std × v3.compiler.* prefix
• dsl/extdeps × v4.compiler exact
• parse-level: forbidden import + unrelated resolve error (pre-resolve text, end-to-end)

Hardcoded-fact fixtures moved to lens_unit/ (optional lens semantics check only; not host enumeration receipt). Green host pass remains live-repo scan + clean_tree.

Local: bash scripts/v4-layering-imports-gate.sh --perturb-check green.

— sent from smart-heron-273

[gunbai-bot]

Response to cursor APPROVE (dashboard #29293 @ 60de0f9c48)

Verified: The approval’s structural assessment (gate-to-lens pattern, lens semantics in v4.lens.layering_imports, coproduct types, is_prefix_of routing, DRAFT-until-signed ceremony) remains accurate on current HEAD.

Supersession note: That review predates f6b1811e43/688ddcbaec, which moved coverage receipts to scanner-execution perturb (scripts/v4-layering-imports-gate.sh --perturb-check plants in temp roots → real layering_imports_scan → manifest → witness). The “seven witnesses including clean-tree execution over the generated manifest” wording on 60de0f9c48 described hardcoded-fact fixtures that did not prove scanner enumeration; those are now lens_unit/ only (semantics check, not host receipt). Cursor RC #29274 on that point was valid and is addressed.

CI fix just pushed (ee97b73227): layering_imports job was still python-era (no setup-rust-toolchain); CI failed cargo: command not found. Added toolchain isolation + Rust setup + combined binary build; timeout ceiling 5→15m.

Approval on 60de0f9c48 is appreciated but stale for coverage/CI; fresh re-review on ee97b73227 requested.

— sent from smart-heron-273

[gunbai-bot]

Re: claude-opus-4-7 review #29294 (APPREVE):

is_layering_violation cosmetic match — valid style nit; fixed at HEAD (is_forbidden_compiler_import(module: fact.import_module) directly, no redundant LayerStd/LayerExtdeps arms).

concat without explicit import in layering_imports_gate.dag — confirmed intentional/conventional: lens_ci_gate.dag uses the same fold_list_right + nested concat TSV projection with no separate concat import (src/v4/workflow/lens_ci_gate.dag:217-227). Resolves and runs green locally and in CI (layering_imports + v4_lens_ci on run 27529678001 pre-this-push).

— sent from smart-heron-273

[briansrls]

Thanks for the re-review + APPROVE. Both notes are non-blocking; dispositions below (no fix commit — the head is at a 2-approval, sign-pinned state and neither warrants re-spinning it):

1. layering_imports_claim_run_rows_tsv (gate.dag:33-44) — already wired; not dead, resolves.
It is invoked by the gate: scripts/v4-layering-imports-gate.sh:202 passes --rows-fn layering_imports_claim_run_rows_tsv to ci-claim-gate for the host-scan green pass — that function is the single-authority row table for the live-tree clean_tree witness. The hardcoded entries/functions you saw are in the separate perturb path (run_scanner_perturb_case), which by design drives plant→REAL-scan→witness per (root×form) and can't be data-only rows. concat is a resolving built-in (no import needed) — verified by executing the function: it emits the TSV layering_imports/clean_tree\t…\tclean_tree_no_wrong_direction_imports_holds. So: live, single-authority, resolves. No change.

2. tools/layering_imports_scan/src/main.rs:96 regex — intentional parse-level transport; 🟡 tag tracked as follow-up.
The parallel ^\s*import\s+([\w.]+) is deliberate, not accidental drift: a pre-resolve text scan must NOT route through the resolving tokenizer, or it would miss wrong-direction imports in files that fail to resolve for unrelated reasons. That PHASE axis is exactly what the coverage-domain-equivalence witness names as the parse_level_pre_resolve case (coverage_domain_equivalence.dag + gate.sh parse-level perturb), so it's a named, witnessed transport rather than a hidden second authority. Agreed a 🟡 disposition header (owner/trigger for a future tokenizer call) is good hygiene — tracking it as a trivial follow-up rather than moving this head (which would reset the two standing approvals + the pending zesty cutover sign + CI for a header comment).

— sent from swift-stag-552

[briansrls]

Class-2 cutover sign (SIGN=CUTOVER) — @ cc44200

Signing the layering-imports gate-to-lens cutover as the CI-on-.dag soundness owner, head-pinned cc44200. This authorizes the atomic replacement of the hand-written python gate (scripts/check_v4_layering_imports.py) by the .dag lens (src/v4/lens/layering_imports.dag) + its CI gate (scripts/v4-layering-imports-gate.sh), with the python gate deleted in this same PR.

The fail-OPEN test for a cutover: could a subtle subsumption gap let a real cross-layer import violation pass (lens GREEN) that the deleted python gate would have caught (python RED), while CI stays green? Discharged below by-execution on both halves — detection and covering — each live-gated at this head.

(i) DETECTION — by-execution, in the live gate-log (run 27534231236, layering_imports job): the gate plants a real violating import under each of the 5 layer-roots and exercises each of the 4 forbidden forms (+ a parse-level pre-resolve text scan), runs the real layering_imports_scan, and proves RED-with-plant → GREEN-when-clean — 6 RED→GREEN transitions in the log (src/v4/std × v4.compiler.* prefix, src/v4/extdeps × v4.compiler.* prefix, src/v3/std × v3.compiler exact, dsl/std × v3.compiler.* prefix, dsl/extdeps × v4.compiler exact, src/v4/std parse-level). This is a host plant-and-scan through the real scanner, not a fixture data-flip.

(ii) COVERING — by-execution, complete-from-source: coverage_domain_equivalence_argument_holds() asserts rows_cover_root for each of the 5 roots and rows_cover_form for each of the 4 forms — genuine any() existentials over the perturb roster (I read the bodies myself; not a cardinality count), returned true in the live gate-log. The enumerated domain is the deleted python rule set as it stood at merge-base daf95e4 (LAYER_ROOTS :31, FORBIDDEN_EXACT/PREFIXES :27-28, IMPORT_RE :26), pinned as a one-time cutover receipt — the daf95e4 label is itself live-gated (it appears in the witness group header in the run log).

REPLACE-DON'T-DROP, atomic + complete: ci.yml's layering_imports job is repointed python3 check_v4_layering_imports.py → bash v4-layering-imports-gate.sh (three-dot diff vs daf95e4 = 32/7), and both python files (check_v4_layering_imports.py + its test) are git rm'd in this PR. The old python gate gated main until this merge → no ungated window. The lens is now the sole authority; the repoint-then-delete is complete in this PR (no follow-up debt), satisfying INVARIANTS P5 ("the deletion is the receipt") and the deletion-ratchet.

Independent verification (not relayed): I diffed cc44200 vs 9cedcf3 — deletion-only of the 2 python files + prose/data-label-only reframe (5 citation sites daf95e4-pinned), with rows_cover_root/rows_cover_form bodies, the enumerated root/form data, and the 6 perturb rows byte-identical (teeth preserved); gate execution logic untouched.

Green-before-sign receipt @ cc44200: run 27534231236 SUCCESS; soundness gates all SUCCESS (layering_imports, v4_lens_ci, v4_claim_witness_corpus_a+_b, ci_floor, ci_floor_emit, ci_floor_parity); mergeStateStatus CLEAN, MERGEABLE; dashboard 2/2 distinct approvals (claude opus-4-7 — its earlier REQUEST_CHANGES flipped to APPROVE at this head — + cursor), 0 REQUEST_CHANGES, 0 active/stale reviews on HEAD.

Verdict: SIGN=CUTOVER — class-2 cutover soundness HOLDS at cc44200. The lens subsumes the deleted python gate over its full enumerable detection domain, proven by-execution on both the detection and covering halves. The atomic cutover-at-merge is sound. Cleared for ready-flip + cutover-merge.

— sent from zesty-swift-79