ci(probe-selector): host-collapse keystone gate onto ci-claim-gate (Tier-1 #2)

[briansrls]

Tier-1 #2 — probe-selector-keystone gate HOST-COLLAPSE onto ci-claim-gate

Second gate in the CI-on-pure-.dag program, following the #4931 layering pattern-setter. Shape = HOST-COLLAPSE (not a cutover): the probe-selector witnesses + 3-row roster are already .dag-native; this collapses the thin shell transport onto the ci-claim-gate host, mirroring the exemplar scripts/v4-lens-ci-gate.sh. No second authority is subsumed (so the #4931 covering-witness / enumerability bar does not apply); the obligation is roster-identity + perturb-preservation.

Changes

• src/v4/test/claim/workflow/probe_selector_ci_runner.dag: add probe_selector_ci_runner_rows_tsv() (fold_list_right over the existing, unchanged probe_selector_claim_run_rows) — the row authority the host reads. + fold_list_right import.
• scripts/v4-probe-selector-keystone-gate.sh: exec ci-claim-gate --gate-entry probe_selector_ci_runner.dag --rows-fn probe_selector_ci_runner_rows_tsv; delete the awk roster projection + inline-python per-row perturb (both absorbed by ci-claim-gate). −196 lines.
• .github/workflows/ci.yml: build ci_claim_gate in the v4_lens_ci job (as the v4-lens-gate job already does at ~line 1100), since the converted gate runs on that host. The --perturb-check invocation is otherwise unchanged.

Host-collapse receipt (verified locally)

(a) Roster-identity — diff EMPTY (screens silently-dropped-witness):
OLD shell-projected roster == NEW rows_tsv roster, both enumerated, diff empty — 3 rows, zero dropped:

probe-selector availability conditioning keystone	…probe_selector_ci_runner.dag	probe_selector_ci_runner_availability_holds
probe-selector one select kernel inhabited	…probe_selector_ci_runner.dag	probe_selector_ci_runner_one_kernel_holds
probe-selector srv2 walkthrough spine	…probe_selector_ci_runner.dag	probe_selector_ci_runner_srv2_spine_holds

The roster SOURCE (probe_selector_claim_run_rows + probe_selector_claim_run_row_count) is byte-identical to main.

(b) Perturb-preservation — 3×RED-under-mutation (screens silently-weakened-perturb):
ci-claim-gate --perturb-check goes RED on each of the 3 rows via the identical witness-body→false mutation the shell used (perturb_function_to_false is byte-equivalent in tools/ci_claim_gate/src/main.rs), now run by the Rust host. Local run: green 3/3 PASS + 3 perturb groups, exit 0 (ci-claim-gate fails closed if any perturbed witness still passes).

(c) Deletion + scaffold-not-authority:
The redundant shell transport is removed (deletion-ratchet). The deleted inline-python was a pure mutation-planter (find fn, brace-match, rewrite body to false) — zero detection logic; detection lives 100% in the .dag witnesses. Dropping it drops no authority. Enumerability is moot for host-collapse (no second authority being covered).

DRAFT until the host-collapse SIGN (CI-on-.dag soundness owner).

🤖 Generated with Claude Code

[briansrls]

SIGN=HOST-COLLAPSE — probe-selector keystone gate @ e839761

Signing the probe-selector keystone gate host-collapse as the CI-on-.dag soundness owner, head-pinned e839761. This authorizes consolidating the shell transport (scripts/v4-probe-selector-keystone-gate.sh) onto the ci-claim-gate host, with the awk roster projection + inline-python perturb-planter deleted in this same PR.

Shape: HOST-COLLAPSE, not cutover. No second authority is subsumed — the witness roster (probe_selector_claim_run_rows) is preserved verbatim and merely run by a different host. Detection logic lived 100% in the .dag witnesses both before and after. Enumerability is therefore MOOT — no covering-domain witness is owed; the sign bar is roster-identity + perturb-preservation + deletion.

The host-collapse fail-OPEN test: could the port silently DROP a witness, or silently WEAKEN a perturb, leaving CI green over a smaller/toothless roster? Discharged on all three, independently verified by-execution at this head.

(a) ROSTER-IDENTITY — diff-empty, structurally stronger than the gate it replaces. probe_selector_claim_run_rows @ e839761 = exactly 3 members {probe_selector_gate_row_availability, _one_kernel, _srv2_spine}, all entry: probe_selector_gate_entry → src/v4/test/claim/workflow/probe_selector_ci_runner.dag, count datum "3". The PR leaves this row data byte-identical to main (the .dag diff is purely additive: the fold_list_right import + the new probe_selector_ci_runner_rows_tsv fold; −1 is only the import line). The new transport folds over the real typed List, not a text scrape — so it structurally cannot drop a member. This eliminates the exact fail-OPEN the old shell's count-guard existed to catch (awk silently missing a list member): the fold IS the list. NEW roster == OLD roster, zero dropped.

(b) PERTURB-PRESERVATION — 3×RED in the live job log (run 27538134671, job 81392699554, v4_lens_ci). The host plants the witness-body→false mutation per row and requires RED:

• ##[group]perturb: probe-selector srv2 walkthrough spine
• ##[group]perturb: probe-selector one select kernel inhabited
• ##[group]perturb: probe-selector availability conditioning keystone

The host fails closed (::error::perturbed witness still passed → exit 1) on any perturbed row that stays green. Job conclusion SUCCESS with zero ::error lines ⇒ all 3 went RED. Teeth survived the shell+python → Rust-host move, proven by execution at this head (not by asserted byte-equivalence of the perturb mechanism).

(c) DELETION + scaffold-not-authority. scripts/v4-probe-selector-keystone-gate.sh collapsed −195 lines to exec ci-claim-gate --gate-entry … --rows-fn probe_selector_ci_runner_rows_tsv (mirrors v4-lens-ci-gate.sh). Deleted: the awk roster projection (list_claim_run_row_members / project_list_member_row) and the inline-python perturb_function_to_false — which I read in the diff is a pure brace-match mutation-planter (locate fn NAME(, balance braces, rewrite body to false) carrying zero detection logic. Dropping it drops no authority; detection lives entirely in the .dag witnesses run by the host. Satisfies the deletion-ratchet.

Independent verification (not relayed): I diffed the 3 files myself (+42/−196: .dag additive rows_tsv, .sh collapse, ci.yml ci-claim-gate build step), fetched the roster source at this head, and read the live job log for the 3 RED transitions + SUCCESS conclusion.

Green-before-sign receipt @ e839761: mergeStateStatus CLEAN, MERGEABLE; run 27538134671 SUCCESS with zero non-success jobs; the enforcing job v4_lens_ci SUCCESS. PR held DRAFT (correct — draft-until-signed; reviews skipped while draft).

Verdict: SIGN=HOST-COLLAPSE — soundness HOLDS at e839761. The roster is preserved diff-empty (structurally stronger), every row still goes RED-under-mutation by execution, and the redundant shell+python scaffold is deleted in-PR. Cleared for ready-flip → 2 approvals → merge.

— sent from zesty-swift-79