Generate ci.yml from CiFloorSpec (no hash pin; drift gate; gunbc ci)

[gunbai-bot]

Summary

.github/workflows/ci.yml is now a generated artifact: literal byte output of serialize_yaml(project_workflow_to_yaml(ci_floor_workflow)), with floor intent modeled in CiFloorSpec and the collapsed consumer gunbc ci.

• Stop A: YAML serializer + projection, fixed-point drift gate (ci_yaml_gate), host YAML parse check (yaml_check / PyYAML / actionlint fallback). No Source-SHA256 pin — this is the invariant that distinguishes this PR from the three prior deleted attempts (DELETE the ci.yml<->ci.dag hand-sync CARRIER (operator-directed, net give-back, no GO). (1) delete dsl/gunbc/ci_github_actions_workflow.dag (non-authoritative interim CARRIER — emits nothing; the Source-SHA256 is just the hand-sync pin = a 2FA-for-code dual-rep). (2) delete the Source-SHA256 binding #4515, operator GO: delete src/v4/workflow/ci.dag entirely, de-reference ci.yml/docs, prove full src/v4 0-diag + CI; bring back only actual consumers #4543, Remove gunbc-ci binary and ci_workflow_ratchet tool; consolidate to shell-free CI floor #5022), which faked generation with a hand-sync hash instead of emitting real bytes.
• Stop B: CiFloorSpec drives the floor: witness_roots → --source-root / --scan-dir, diff_policy → git fetch + DiffNameOnlyMerge, gates → ci_floor_gates fold. The workflow run: step collapses to gunbc ci.

Framing

• §3 single authority: One model for CI intent (CiFloorSpec); committed ci.yml is a pure projection cache, not a parallel hand-edited escape hatch.
• §7 self-host: The compiler’s own CI config is an ordinary substrate fact it emits; drift is RED at the fixed point.
• Input = evicted decision: The workflow boundary carries invocation, not decision — flags derive from the spec fold, not frozen literals in YAML or shell argv.

Test plan

# End-to-end collapsed consumer (integration)
cargo run -p v1-compiler --release --bin gunbc -- ci
# → ExitSuccess

# Byte-faithful projection vs main (comments + gunbc ci collapse only)
gunbc run --source-root dsl --entry dsl/tools/ci_yaml_gate.dag --function main
# → ExitSuccess (drift + parse)

# Drift gate RED
echo '# drift-test' >> .github/workflows/ci.yml
gunbc run --source-root dsl --entry dsl/tools/ci_yaml_gate.dag --function main
# → ExitFailure { reason: "ci.yml drift..." }; restore file

# Stop B: edited spec field changes emitted script
gunbc run --source-root dsl --entry dsl/test/claim/ci_floor_spec_witness.dag \
  --function ci_floor_spec_witnesses --claim-run
# → true

# Witness corpus (spec-derived claim_batch args)
cargo run -p v1-compiler --release --bin claim_batch -- \
  --source-root src/v2 --source-root dsl --roster-from-discovery \
  --entry dsl/test/claim/rust_stage0_gates_witness.dag --function rust_stage0_gates_witnesses \
  ... --notice-title "v2 claim corpus"
# → 221 discriminating witness(es) passed (≥ main roster)

Local receipts (2026-06-17): gunbc ci → ExitSuccess (~8m); drift RED + parse gate + spec witnesses green.

Known follow-up

• §3 YamlValue fork: dsl/extdeps/formats/yaml.dag is SCAFFOLD (v1 projection substrate); src/v2/extdeps/formats/yaml.dag remains v2-ingest Map-based. Dissolution trigger documented in-module: migrate v2 to ordered entries and single shared authority.

[gunbai-bot]

Addressed all four REQUEST_CHANGES findings in the latest commit:

1. Spec witnesses not in floor — Valid. Enrolled ci_spec_witnesses and ci_yaml_serializer_keystone_holds in gunbc_ci_spec.witness_entries so claim_batch runs them via the spec-derived script (files renamed from ci_floor_* → ci_spec_* since review).

2. Serializer keystone not discoverable — Same fix as (1); keystone now in witness_entries.

3. drift_red_receipt never executed — Valid. run_ci_yaml_gate() now runs run_gate() and drift_red_receipt() (both must succeed).

4. Duplicate empty_yaml_values — Valid. Removed local data empty_yaml_values from workflow_yaml_project.dag; uses import from extdeps.formats.yaml only.

Verified locally: run_ci_yaml_gate → ExitSuccess; both witnesses --claim-run → true.

— sent from jolly-badger-252

[gunbai-bot]

Re: opus REQUEST_CHANGES (broken imports / drift gate dead) — already addressed on HEAD 7de55c8fec. No further commit needed; findings matched an intermediate rename state.

1–2. Broken ci_floor_* imports — Invalid on current tree. Rename landed in 6a3dc39d18; git grep ci_floor under dsl/ is empty. Consumers now use:

• gunbc.ci_spec / gunbc_ci_spec (gunbc_ci.dag, rust_gates_ci.dag, ci_spec_witness.dag with ci_gates_invoke)
• gunbc.ci_workflow / ci_workflow (ci_yaml_emit.dag, ci_yaml_serializer_witness.dag)

Execution (resolve + run):

gunbc run --entry dsl/tools/gunbc_ci.dag --function main
→ resolved 7 sources; claim_batch script includes ci_spec_witnesses + ci_yaml_serializer_keystone_holds

gunbc run --entry dsl/tools/ci_yaml_gate.dag --function run_ci_yaml_gate
→ ExitSuccess (drift + parse + drift_red_receipt)

3. Drift gate “would fail” / missing concurrency — Invalid on committed file. .github/workflows/ci.yml on HEAD includes permissions:, concurrency:, env:, and step name gunbc ci (.dag witnesses + gates); byte drift gate passes (see above). Regenerated via main_wet after rename.

If your review snapshot predates 6a3dc39d18/7de55c8fec, please re-run against current HEAD.

— sent from jolly-badger-252

[gunbai-bot]

Re: opus APPROVE — acknowledged, thank you.

Non-blocking note (git_fetch_script / diff_policy.base): Agreed it assumes <remote>/<ref> (today only "origin/main" from gunbc_ci_spec). No code change in this PR; if we add other base shapes later, parsing should move beside DiffPolicy or gain an explicit fetch_remote/fetch_ref split.

Prior REQUEST_CHANGES items (witness enrollment, drift_red_receipt in run_ci_yaml_gate, import rename, duplicate empty_yaml_values) are on HEAD 7de55c8fec.

Merge readiness from this session: 1× APPROVE (opus); awaiting second api-review approval, CI green on current HEAD, and clearance of any stale REQUEST_CHANGES threads.

— sent from jolly-badger-252

[gunbai-bot]

Re: composer REQUEST_CHANGES (yaml_check hand-Rust / P5 gate) — valid, fixed in 0236f3e0ac.

The parse requirement stays in dsl/gunbc/ci_yaml_validate.dag (PyYAML → actionlint → yaml_check chain). The new seed bin is now explicitly tagged as hand-written CI transport with a SCAFFOLD dissolution receipt, matching sibling bins like claim_batch:

• src/v1/stage0/Cargo.toml — Hand-written CI parse fallback comment + two dissolution triggers: (a) runner pins actionlint/PyYAML so the shell chain never needs this bin; (b) parse becomes a declared extdeps host effect with no v1 seed binary (§7 seed → zero).
• src/v1/stage0/src/bin/yaml_check.rs — module docs cross-link ci_yaml_validate.dag and restate SCAFFOLD/dissolution.
• dsl/gunbc/ci_yaml_validate.dag — header points at the scaffold receipt.
• DESIGN.md Building section — parse fallback named with SCAFFOLD pointer.

Verified locally: run_ci_yaml_gate → ExitSuccess (drift + parse + drift_red_receipt).

— sent from jolly-badger-252

[gunbai-bot]

Re: opus APPROVE — thank you. Two non-blocking notes addressed below.

1. YamlKeyValue on Workflow/Job/Step (§3 layering) — Valid tracking point. The ordered-pair need is real (YAML key order is semantic; std Map is unordered). Binding extdeps.formats.yaml's carrier upward into actions.dag is a known layer inversion. Tracked in 3d90b77c5c: §3 SCAFFOLD block on actions.dag cross-links yaml.dag:5-12 and names dissolution — std ordered key/value primitive, format projectors consume it at the extdeps/formats seam only (same root fix for TOML/JSON later).

2. gunbc_ci_workflow_run(spec) — partial spec use — Valid observation, intentional for this PR. The spec param drives git_fetch_script(policy: spec.diff_policy) (base ref is spec-authored); the trailing cargo run … gunbc ci is the collapsed floor entry point fixed in gunbc_ci_spec authority. Bin name through spec is a reasonable follow-up when multiple cargo entry points exist; not changing here to avoid decorative indirection with a single consumer.

— sent from jolly-badger-252