base64/base64url in std.encoding (pure .dag, RFC 4648) + Bytes≅List<UInt8> host seam — parent-greenlit shape; done = iso round-trip + base64 round-trip + RFC §10 golden vectors all green by execution in a *_test.dag

[gunbai-bot]

Summary

base64 / base64url in std.encoding (RFC 4648 §4/§5), pure .dag over std.integer.UInt8, plus the Bytes ≅ List<UInt8> host seam.

• Host seam (dsl/std/bytes.dag): bytes_octets / octets_bytes / utf8_encode_bytes — declared as std stubs, realized as interpreter builtins in eval_builtin mirroring utf8_decode_bytes. Reuses existing UInt8 (no Octet nickname).
• base64 (dsl/std/encoding.dag): Base64Variant = Standard | UrlSafe, fold-with-state encode/decode (decode is a partial function List<UInt8>? — fail-closed Absent on any non-alphabet char, §5), 6-bit regroup by Int arithmetic only (*256 /64 %64, no shift/mask primitive — deferred to a 2nd consumer per §6). Distinct from the existing Encoding charset-fidelity lattice.

Test plan

All witnesses green by execution (gunbc run --source-root dsl --entry <F> --function <fn> --claim-run) in dsl/test/claim/base64_rfc4648_witness_test.dag (floor auto-enrolled test fns):

• bytes_octets_iso_holds — octets_bytes(bytes_octets(b)) == b (total)
• utf8_total_direction_holds — utf8_decode_bytes(utf8_encode_bytes('naïve')) == 'naïve' (total direction only; non-ASCII proves octets ≠ codepoints)
• base64_octet_roundtrip_holds — total over octets
• base64_decode_rejects_invalid_char_holds — 'Zm9*' → Absent (fail-closed)
• base64_decode_rejects_cross_variant_char_holds — 'Zm9-' under Standard → Absent (fail-closed)
• base64_decode_rejects_interior_pad_holds — 'Zg==Zg==' → Absent (interior = rejected, RFC §3.5)
• base64_decode_rejects_lone_sextet_holds — 'Zm9vY' (5 sextets) → Absent (lone sextet rejected)
• base64_decode_accepts_unpadded_holds — 'Zm9vYg' → 'foob' (control: unpadded-valid still decodes, not over-rejecting)
• base64_rfc4648_golden_vectors_holds — RFC 4648 §10: '' f fo foo foob fooba foobar → Zg== Zm8= Zm9v Zm9vYg== Zm9vYmE= Zm9vYmFy
• base64url_alphabet_golden_holds — [251,255,191] → Standard +/+/ vs UrlSafe -_-_
• base64url_roundtrip_holds — UrlSafe round-trip

Also: dsl whole-tree compile = 437 files / 0 diagnostics; cargo fmt --all --check clean; cargo clippy --all-targets -- -D warnings clean; teeth-checked (corrupting a golden expectation → false).

Deferred: emit-handler parity (intentional, parent-ratified)

DEFERRED: std.bytes/std.encoding seam fns (bytes_octets/octets_bytes/utf8_encode_bytes, base64_*) have no emit handler; emitted Rust is panic!("unsupported cast") — fail-closed but RUNTIME-only (compiles clean, only panics if executed), a weaker guarantee than an emit-TIME typed refusal. These modules are not in the v1 seed emit pipeline, and the scoped consumer (GCP cred-rotate) runs through the interpreter (gunbc run), so interpreter-side realization is correct and sufficient today.

TRIGGER (must fire BEFORE the fact): adding any std.encoding/std.bytes consumer to an EMIT path requires authoring emit handlers in 05_emit_rust.dag (load-bearing, needs greenlight) FIRST — not discovering it after one emits panicking code. The general fix (unhandled cast → located emit-TIME refusal) is a separate emitter concern, not base64's. Approved by neat-boar-71.

§7 receipt: 3 new stage0 host builtins

bytes_octets / octets_bytes / utf8_encode_bytes (src/v1/stage0/src/v1_interpreter.rs) are the host realization of the Bytes ≅ List<UInt8> seam, mirroring the existing utf8_decode_bytes builtin (no net-new pattern). They are not cemented authority — the .dag side is the spec; these are §2 realization handlers. Dissolution trigger: the standing DESIGN.md open thread "ground each primitive into its realization" — and specifically, bytes_octets/octets_bytes collapse to pure-.dag identity if Bytes is ever made a transparent List<UInt8> alias (a kernel-type change, out of this PR's scope; flagged to parent). No census-shrink/ROADMAP deferral is claimed — this is additive host surface for a new std primitive, consistent with utf8_decode_bytes.

Closes #adhoc-5ebf246b-c8a (dashboard work item).

[gunbai-bot]

Note for reviewers: the modeling-coherence "unavailable" red is the known C7 host/ctrl pin-skew (host gunbc tree at 0ae47bfdc8 #5036 is behind the ctrl checkout's third_party/gunbc pin 983a45d8d2 #5226, so the ctrl-plan resolve can't satisfy std.reducible/#5208) — it fires head-independently across the lane and is not this diff. This branch resolves clean (gunbc compile --source-root dsl = 437 files, 0 diagnostics). The real gating bar is CI green (ci + rust_tests) + approval + mergeable CLEAN. — sent from keen-wren-182

[gunbai-bot]

Thanks — addressed all three.

Finding 2 (fail-open decoder) — FIXED by construction in e347afb. You're right, this was a §5 violation. base64_decode is now a partial function (List<UInt8>?), mirroring the utf8_decode partiality: base64_char_value -> Int? returns Present only for the exact RFC 4648 alphabet (incl. the per-variant +/ vs -_ specials — note /=47 and _=95 are now explicit, not a fall-through to 63), none otherwise; base64_collect_values short-circuits to Absent on the first invalid char, so any garbage/whitespace/cross-variant char yields typed absence, never fabricated octets. Two new fail-closed witnesses green by execution: base64_decode_rejects_invalid_char_holds ('Zm9*' → Absent), base64_decode_rejects_cross_variant_char_holds ('Zm9-' under Standard → Absent). The = skip stays (it's the only RFC pad char); everything else now fails closed.

Finding 1 (host-seam .dag bodies) — working as designed (precedented), not silent debt. This is the sanctioned host-seam pattern: utf8_decode_bytes in the same file has body "" and is realized identically by a host arm. Bytes is an opaque kernel type (type Bytes, in kernel_type_set) with no .dag constructor — a pure-.dag body is structurally impossible, as for String/Int/Json. So this isn't parallel-representation debt a pure-.dag rewrite could dissolve; Bytes is a host primitive. The iso witness passing by execution is the proof the host intercepts (a [] return would red it) — that's the §5 green-by-execution bar, not spec-without-execution. On the 🟡 marker: in-file .dag comments were stripped + walled tree-wide by #5567 (parser-wall flush), so a comment marker isn't available; the deferral is tracked in the PR description and the standing DESIGN.md open thread 'ground each primitive into its realization' (the systemic Value::Null/primitive-grounding work — where this actually dissolves, not in base64). Parent (neat-boar-71) ratified this disposition.

Finding 3 (UInt8 ≈ Int, +0 as cast verb) — language-level, not base64-fixable. b + 0 / bare n are forced: b as Int / n as UInt8 fail at runtime (eval_cast has no Int→Int or →UInt8 arm — verified by execution; the typechecker allows the cast so it only blows up by running). The typechecker coerces UInt8↔Int freely because UInt8 = Compose<UInt, MachineWidth<8>> carries no runtime construction wall in the current std.integer realization — that absence is a std.integer/language property (same model↔realization fork open thread), not something base64 introduced or can wall locally. base64 reuses the single UInt8 authority with no Octet nickname, exactly as §3 asks; the construction wall on UInt8 is downstream language work.

— sent from keen-wren-182

[gunbai-bot]

Thanks for the APPROVE. Completed the §5 wall on the one remaining residual you flagged (the host-seam stub is the parent-greenlit precedented pattern, as you noted — left as-is).

Decoder structural strictness — fixed in 7244ea1 (RFC 4648 §3.5 SHOULD-reject):

• Interior/misplaced =: base64_collect_values now carries seen_pad; once a = is seen, any later non-= char → Absent. ('Zg==Zg==' → Absent.)
• Lone trailing sextet: base64_decode_flush → List<Int>?; count==1 (structurally impossible in valid base64) → Absent instead of silent drop. ('Zm9vY' → Absent.)
• Control against over-rejection: 'Zm9vYg' → 'foob' still decodes — unpadded-but-valid is accepted (base64url legitimately omits padding, so I deliberately did not require length % 4 == 0; that would wrongly reject valid unpadded input).

3 new witnesses green by execution; decoder is now fully fail-closed (4 rejection witnesses + 1 unpadded-accept control). All 11 witnesses green, dsl compile 437/0.

— sent from keen-wren-182

[gunbai-bot]

Addressing the three findings; the §3 one is a modeling-shape decision the parent (neat-boar-71) owns, so I've routed it to them rather than thrash the head.

Finding 1 (seam .dag bodies / §3 fork) — under parent modeling review. This is the parent-greenlit ROW-0 shape, and it's strictly consistent with the precedent the parent named: utf8_decode_bytes (encoding.dag:113) is itself a decoy-body .dag fn ({ "" }), not in builtin_function_registry and not a PrimitiveContract — exactly the pattern these 3 follow. Bytes is an opaque kernel type with no .dag constructor, so there is no honest pure-.dag body; the only way to remove the decoy is to convert all of these (and, for consistency, utf8_decode_bytes) to the char_at-style PrimitiveContract + registry pattern you cite — which touches load-bearing inference (v1_compiler_infer_method.rs). That's a real improvement and may be the right call, but it contradicts the parent's explicit ROW-0 instruction, so I've asked the parent for the A/B ruling. Note this same review flipped RC→APPROVE→RC on this exact unchanged code — the shape is stable; the disposition is the open question. Tracking it on the standing DESIGN.md open thread "ground each primitive into its realization."

Finding 2 (no §7 receipt for the 3 stage0 builtins) — receipt added to PR description. They are the host realization of the Bytes↔octets seam, mirroring utf8_decode_bytes; dissolution trigger is the same primitive-grounding open thread (and, as you note, bytes_octets/octets_bytes collapse to pure .dag if Bytes is ever made a transparent List<UInt8> alias — a kernel-type change above this PR's scope, flagged to parent).

Finding 3 (UInt8↔Int +0 punning, of_int no range guard) — no guard, by design. The octets fed to base64_octet_of_int are produced by (n % 256) / (n / k) % 256, so the 0..255 range is already carried by construction. Adding a range check would be precisely the "check that re-states a constraint the model already carries… a second representation of it" (§5) that your own review quotes — validation standing where construction already holds. The +0 / bare-n projectors are forced by the language: as Int / as UInt8 fail at runtime (eval_cast has no Int→Int / →UInt8 arm — verified by execution), and UInt8 = Compose<UInt, MachineWidth<8>> carries no construction wall in the current std.integer realization — a language-level model↔realization gap (same open thread), not base64-local.

— sent from keen-wren-182

[gunbai-bot]

§3 seam shape — RULED (A)-defer, with the §5 no-fail-open hardening applied (8f0ad79). Parent (neat-boar-71), grandparent-signed (bright-stag-194): keep the host-seam shape — no PrimitiveContract/registry conversion, no inference touch — but a decoy body is only acceptable if provably unreachable, and a body returning a plausible value ([] / "") on an executable path is a fail-open fabrication (worse than the §3 fork). So all four seam bodies are now fail-closed:

• bytes_octets: [] → [pure_dag_seam_unreachable()] (1/0 → loud DivisionByZero).
• utf8_decode_bytes: "" → from_code_point(pure_dag_seam_unreachable()).
• octets_bytes / utf8_encode_bytes: already fail-closed — _ as Bytes raises an unsupported-cast at runtime (eval_cast has no Bytes arm).

Proven by execution (the probe): with the bodies fail-closed, the full 11-witness suite stays green → the v1 host builtins shadow the bodies → they are dead. And when reached on a non-shadowed fn, they raise 'division by zero' instead of fabricating — so reaching the .dag body is now a loud error, not silent garbage. This addresses your finding precisely: the .dag body can no longer be mistaken for the spec, because obeying it fails loudly.

Marker: comments are walled tree-wide (#5567), so the open-thread markers are in-code data rows (bytes_seam_host_realization_marker, utf8_decode_bytes_host_realization_marker) tying all four bodies to the DESIGN.md open thread 'ground each primitive into its realization' (operator-owned); dissolve-on = that systemic grounding lands, converting all to PrimitiveContract + registry together. This makes (A)'s 'no new debt' explicit, not asserted.

Findings 2 (§7 receipt) and 3 (no range guard — the % 256 modulo is the construction wall) stand as previously dispositioned. dsl compile 437/0; 11 witnesses green.

— sent from keen-wren-182

[gunbai-bot]

Pushed two things (HEAD now 12dc31ab):

CI fix — orphan-doc gate (was NOT this diff). The ci floor failed on doc_graph_has_no_orphan_docs because the PR's merge-with-main tree contained docs/plans/intent-linearity-design-draft.md — a DRAFT added on main by #5584 and linked from nowhere (genuine orphan; my branch alone passed the gate). Integrated main (clean auto-merge, no conflicts) and added the documented one-line fix: a terse ROADMAP pointer to the orphan under the axiom + syllogism lens (DESIGN open thread #1) line — which is exactly the thread the draft self-describes as belonging to. All three doc witnesses (orphan / dangling-link / nonempty) now green; rebuilt on the merged tree, compile 446/0, all 11 base64 witnesses green.

Review 🟡 (count: Int carrier debt) — tracked, non-blocking as you noted. Added base64_group_fill_carrier_debt_marker (in-code data row; comments are walled tree-wide #5567) recording that Base64EncodeState.count / Base64DecodeState.count are hand-rolled closed sums ({0,1,2} / {0,1,2,3}) with representable illegal states, every arm witnessed by execution, dissolve-on = carrier swap to declared closed sums (Empty|One|Two / +Three) the next time the state machine is touched. Kept it a tracked marker rather than a refactor on a signed PR (your call + §6).

— sent from keen-wren-182

[gunbai-bot]

Disposition for review 31932 (APPROVE, both findings non-blocking):

Finding 2 (seam-body loudness symmetry) — verified fail-closed by execution, premise corrected. All three seam bodies are loud; the asymmetry is forced by the return type, not a fail-open. Bytes is an opaque kernel with no value constructor, so the only way a -> Bytes body can typecheck is _ as Bytes, and eval_cast has no Bytes arm → it raises. Receipt (non-shadowed probe fns, host arm bypassed):

fn list_as_bytes(o: List<UInt8>) -> Bytes { o as Bytes }   // runtime error: type error: cannot cast List to Bytes
fn str_as_bytes(s: String) -> Bytes { s as Bytes }         // runtime error: type error: cannot cast String to Bytes

bytes_octets returns List<UInt8> (value-constructable), so it uses the [1/0] idiom; the two -> Bytes bodies use _ as Bytes. Both are division-by-zero/unsupported-cast hard raises — same fail-closed guarantee, different idiom because one return type is constructable and the other is opaque. pure_dag_seam_unreachable() returns Int and could only reach Bytes via the same cast, so substituting it would not add loudness.

Finding 1 (declare count:Int as closed sums now) — parent-ruled marker-not-refactor. On a signed PR a tracked dissolve-on marker is the §6 call, not a mid-PR carrier swap. base64_group_fill_carrier_debt_marker names the inhabitants ({0,1,2} / {0,1,2,3}), the §5 rationale, and the dissolve trigger (carrier swap to declared sums the next time the state machine is touched); every arm is covered by execution in base64_rfc4648_witness_test.dag.

— sent from keen-wren-182

[gunbai-bot]

Disposition for review 31952 (APPROVE; both findings non-blocking, both already dispositioned):

count: Int hand-rolled sums + "trigger has no named owner/lane." Parent-ruled marker-not-refactor on a signed PR: grounding {0,1,2}/{0,1,2,3} into declared closed sums is a real but separate carrier swap, not a mid-PR widen. On the owner/lane point — the dissolve-on is deliberately event-based ("the next time the encode/decode state machine is touched"), which is the project's standard scaffold-marker form (a structural condition on the carrier, per DESIGN §6 "every scaffold lands with a named dissolution trigger"). Naming a speculative owner/lane on a §6 debt marker would be a parallel ledger — the mark on the carrier is the authority (DESIGN §6 "let the mark on the carrier be the authority; no parallel-ledger docs"). The trigger is concrete (carrier swap to Empty|One|Two / +Three); whoever next touches the state machine owns it, by construction.

base64_octet_int { b + 0 } and o as Bytes / s as Bytes — dead-under-host-shadow seam. Confirmed fail-closed by execution: _ as Bytes raises (eval_cast has no Bytes arm → cannot cast List/String to Bytes); since Bytes is opaque with no value constructor, _ as Bytes is the only loud idiom for a -> Bytes body. b + 0 is the verified UInt8→Int projector (UInt8 coerces to Int freely; b as Int would itself raise). All carry the dissolve-on tied to the DESIGN open thread "ground each primitive into its realization." No model change here per parent ruling (A): wait for the central #5604 main-side orphan fix; do not churn the model.

— sent from keen-wren-182

[gunbai-bot]

Addressed review 31963 (REQUEST_CHANGES) in commit 7a1bf768b2:

Finding 1 — count: Int hand-rolled sum → grounded as a closed coproduct (the requested 🔴 fix). The counter is now fused with the octets it counts into one sound carrier, so the illegal states (count says 2, wrong/missing octets buffered) cease to be representable:

type Base64EncodeBuf = EncEmpty | EncOne { b0: Int } | EncTwo { b0: Int, b1: Int }
type Base64DecodeBuf = DecEmpty | DecOne { v0: Int } | DecTwo { v0: Int, v1: Int } | DecThree { v0: Int, v1: Int, v2: Int }

The four base64_encode_step / _flush / base64_decode_step / _flush fns now match exhaustively over the coproduct — there is no else/catch-all arm left to write (construction, not validation; §4 operations-from-inhabitance). This is state-space de-conflation, not the widening trap: the variants carry the octet payload, and you cannot construct an EncOne without its Int. Verified by execution on the post-#5579 binary: compile 450/0, 11/11 base64 witnesses green; a discriminating perturbation (swap the octets in the EncOne → EncTwo arm) reds golden-vectors + roundtrip, and restoring goes green again.

Finding 3 — *_host_realization_marker: String rows in std/ → deleted (operator-directed, commit 49df419dcd). All three marker data rows are gone; the seam is pure base64 with no comment/marker residue.

Finding 2 — base64_octet_int { b + 0 } / base64_octet_of_int { n } UInt8↔Int coercion — named, not grounded here (by design). std.integer exposes no widen/narrow surface (UInt8 = Compose<UInt, MachineWidth<8>> with no typed Bounded<Int> conversion), so a width-witnessed coercion is the operator-owned DESIGN open thread "ground each primitive into its realization", not in scope for this base64 PR. The conversions are sound by construction (widen is total; the narrow consumes only % 256-bounded values), just expressed as the idiomatic free coercion until that surface exists.

— sent from keen-wren-182