warm==cold cache purity detective (§2 P1)

[gunbai-bot]

warm==cold cache purity detective (ROADMAP §2 P1)

Makes the DESIGN §5 caching-via-realization principle executable: a cache that
changes a verdict is not a cache bug, it is a purity bug the cache exposed. A
content-keyed realization promises output = f(declared key inputs). If an input is
read at realize time but absent from the content-key, a WARM hit (addressed by the
now-stale key) serves a result a fresh COLD recompute would no longer produce:
warm != cold. So the cache IS the purity falsifier — this oracle makes that falsifier run.

What lands

• dsl/extdeps/realization/cache_purity.dag — CachePurityVerdict = Pure | Impure { violation }
  carrier; the violation LOCATES the read-but-unkeyed axis. The durable artifact v2 inherits
  (the Rust below is the §7 proving handler). It is the run-side twin of
  extdeps.cache.key_completeness (the declare-side lens): both ends of one authority, the content-key.
• src/v1/stage0/src/cache_purity_oracle.rs — the oracle. audit_warm_equals_cold holds
  the content-key fixed, perturbs candidate hidden inputs, and raises a located, typed, LOUD
  CachePurityViolation on divergence (fail-closed, never a warning). A probe that moves the
  key is a declared axis (a miss, not a stale hit) and is skipped — no false positive on keyed inputs.

Discriminating witnesses (DESIGN §5 spec-without-execution — green by execution + a RED)

• Real consumer green: the REAL resolved_graph_cache::{lookup,write} path — a cold compute
  then a warm hit are byte-identical after canonicalization; and the real resolve realization is
  PURE under probes the key legitimately ignores (unrelated env var / non-imported sibling file).
• RED falsifier: an injected hidden non-keyed input (read at realize time, absent from the
  key) → the oracle raises the loud located error naming the axis. Without it, the green cases pass
  vacuously. Also proven RED-on-revert for the .dag carrier (inverting the verdict flips the witness).

Coordination

Consumes the public subject_digest_for_closure (the from-inputs key); does not re-fork #5425's
key derivation. Purely additive (1 new .dag carrier, 1 new .dag witness, 1 new Rust module, 1 new
Rust test) — no edits to the lines #5425 touches, so no conflict.

P3 (wire it so every cached realization is checked at the kernel/CI seam) follows in a separate PR.

🤖 Generated with Claude Code

[gunbai-bot]

Thanks for the review — both soft concerns addressed in d3bde56:

1. predicate-dissolution (cache_purity_is_pure): valid, deleted. It was a Bool restating the CachePurityVerdict coproduct; consumers (and the .dag witness) now match the verdict directly, so the located violation stays in hand on the Impure arm instead of being flattened to a bare Bool. Left a comment in the carrier marking why no is_pure projection exists.

2. §7 hand-Rust receipt: added an explicit SCAFFOLD — dissolve-on trigger to the cache_purity_oracle.rs header. The honest receipt here is named dissolution, not a deletion: this is net-new capability (no prior oracle existed, so there is no scaffold path to delete in this diff), bound to a concrete fixed point — when the v2 fold_node evaluator self-hosts the realize fold and content(T) = content_hash(subgraph) lands (ROADMAP §2 P5), the axis set and the audit become one derived .dag fact and the Rust handler is deleted. Until then the .dag carrier is the authority and the Rust is one handler of it, matching the v1_handler.dag convention.

— sent from stern-otter-43

[gunbai-bot]

Addressed in af3500a:

• Hermeticity finding (test 2 not isolating the cache dir): valid, fixed. Replaced the bare CACHE_ENV_MUTEX lock with CacheEnvGuard::set(temp) so the test both isolates GUNBC_RESOLVED_GRAPH_CACHE_DIR to a temp path and serializes the env-var probe — now hermetic like tests 1 and 3. All 4 tests still green, clippy clean.
• Bool-from-handler flag (verdict fn takes a Bool bridge): agreed it's not a finding — the doc comment names it honestly. It rides the existing DESIGN open thread (the Value::Bool straddle, the remaining-(a) item after the numeric tower); when that grounds, this Bool-from-handler grounds with it. No separate action.
• §7 hand-Rust receipt and the predicate-dissolution refusal: thanks for confirming both land right.

— sent from stern-otter-43

[gunbai-bot]

Verified — this review is APPROVE with Findings: none; the cited lines (cache_purity.dag:50-53, cache_purity_oracle.rs:19-23, the test refs) all match the current head af3500a, so it is reviewing the latest code. The dashboard registers it as an approval (request_changes: 0, has_request_changes: false, mergeable: MERGEABLE) — the 'BLOCKING REVIEW' relay header is a misclassification, not a request-changes. Nothing to fix; no commit needed.

— sent from stern-otter-43