§5 CI-tooling gap: runner-context env scope — discriminating witnesses on generator output

[gunbai-bot]

Summary

• yaml_check.rs is a YAML-syntax-only fallback (parse only, no semantic checks — this is correct per §5/§3)
• The §5 gap was real: ${{ env.RUNNER_TEMP }} passes YAML parse but is semantically wrong in GitHub Actions (RUNNER_TEMP is not declared in any env: block; ${{ runner.temp }} is the correct runner-context path)
• yaml_check.rs hardening is superseded: the generated ci.yml is correct-by-construction (ci_workflow.dag uses runner.temp throughout); a hand-edited bad ci.yml fails the drift gate first (ci_yml_drifted)
• Adds two discriminating witnesses + two red controls in dsl/test/claim/ci_yaml_serializer_witness_test.dag, operating on expected_ci_yml() (the live generator output), auto-enrolled by the CI floor discovery scan

Changes

dsl/test/claim/ci_yaml_serializer_witness_test.dag — four additions:

• runner_env_scope_ok(yaml) / no_runner_env_context_vars(yaml) — extracted predicate helpers
• witness_cache_uses_runner_temp_not_env_cargo_home() — asserts generator emits runner.temp path, not env.CARGO_HOME
• witness_cache_runner_env_scope_red_control() — feeds a bad yaml string (env.CARGO_HOME), asserts guard fires → proves witness 1 is non-vacuous
• witness_no_runner_env_vars_accessed_via_env_context() — asserts generator never emits env.RUNNER_TEMP/OS/ARCH
• witness_no_runner_env_context_red_control() — appends ${{ env.RUNNER_TEMP }} to good yaml, asserts guard fires → proves witness 2 is non-vacuous
• All four wired into ci_yaml_serializer_keystone_holds

yaml_check.rs is unchanged (pure YAML syntax, §3 single authority, SCAFFOLD marker intact).

Test plan

• All new witnesses are fn (not test fn) — enrolled via keystone aggregator, not standalone
• Red controls exercise each predicate helper on bad input — non-vacuous by construction
• ci_yaml_serializer_keystone_holds (the single test fn) enumerates all witnesses including the new four
• Branch synced with main (includes Project: invert hand-maintained artifacts (emit ROADMAP/docs from .dag, drift-gate) #5480 roadmap DAG + ROADMAP: inline ◆ milestone spines (verifiable, dependency-ordered) + reconcile checkboxes #5488 milestone changes)

🤖 Generated with Claude Code

[gunbai-bot]

Addressed the REQUEST_CHANGES by reversing the approach entirely — the reviewer was right on all three counts.

What changed:

1. yaml_check reverted to pure YAML syntax — the 150-LOC Rust env-scope checker is gone. yaml_check is the fallback parser; adding a second representation of the env-scope constraint in Rust (when the generator/model already owns that knowledge) was a §3/§5 parallel-representation violation, not a §5 fix.

2. Constraint moved to the .dag world — two discriminating witnesses added to ci_yaml_serializer_witness_test.dag, operating on expected_ci_yml() (the generator's output):

   • witness_cache_uses_runner_temp_not_env_cargo_home — asserts the cache path uses ${{ runner.temp }} (runner context), not ${{ env.CARGO_HOME }} (env context). Goes RED if the generator emits the wrong form.
   • witness_no_runner_env_vars_accessed_via_env_context — asserts ${{ env.RUNNER_TEMP/OS/ARCH }} never appear. Goes RED on the exact false-green class the original task targeted.

Both are enrolled automatically by *_test.dag / test fn discovery (no hand-registration). The heuristic-shell-parsing problem (find #2) disappears because the witnesses operate on the modeled output, not a Rust scan of bash scripts.

— sent from warm-crab-895