Flip intent-linearity to live enforcement via the import-graph representation (consumed-input-closure drift wall + ImportGraph LinearityRule)

[briansrls]

Flip intent-linearity to live enforcement via the import-graph representation

Makes v2.lens.intent_linearity enforce a real wall over the live corpus for the first time (it was previously only unit-tested over synthetic Node chains), via the import-graph representation: a module's declared inputs should be 1:1 with the inputs it actually consumes — redundancy = declared − minimal, and the wall is declared == derived.

D1 — the wall, NOW (src/v1/tests/src/consumed_input_closure_drift_test.rs)

dsl/tools/rust_stage0_gates.dag hand-declares declared_consumed_input_closures and admits the fail-open itself (slice1_status: "HAND-LISTED ... declaration drift silently re-opens the .dag→rust fail-open"). That declared list is pure parallel representation of a value the compiler already derives — the transitive import-graph closure.

The drift oracle reads the declared closure straight from the .dag (eval_data_item_value), derives each unit's closure with the existing resolve_imports_transitively_with_source_roots, and asserts the two path sets are equal over the live corpus. This closes the admitted fail-open today.

• Discriminating in both directions (proven by execution, not just green-when-clean): dropping a declared path (under-declared / §5 fail-open) and adding a bogus path (over-declared / §2 redundancy) each go red.
• Entry convention is fail-closed (the declared path whose file-stem == unit; no match panics).
• Self-protecting: the entry is in its own declared closure, so a future PR that adds a .dag import trips should_run_gates edge-(b) closure-hit → fires the rust gate → the new import surfaces as under-declared drift. The same Edge-(b) coverage keystone — slice 1: declare coproduct_reflection_conformance_test's consumed-.dag closure on the existing NodeArtifactProvenance carrier + fire should_run_gates on a closure-path change (fail-closed: undeclared test = must-run), proven green-by-execution with a discriminating contr #5605 mechanism the declaration feeds guarantees the wall fires when the closure's inputs move.
• Runs in CI: it's in v1-compiler-tests (run-all, Widen the rust gate by construction (§1): invert the hand-picked 3-filter allowlist (29 of 792 green tests) → run-all-unless-#[ignore]d-with-written-reason; add CI-coverage-completeness so a new test is covered by default (fail-closed); measure CI-time impact before committing the full set #5427), and .rs/closure-hit both fire the rust gate.

D2 — the lens goes live (modeled) (src/v2/lens/intent_linearity.dag)

• Representation gains a 3rd variant ImportGraph beside TermChain/TypeForest.
• New ParallelRepresentationRule family whose verdict is a populated ConstructionClass (reused from construction_justification.dag, not minted — a parallel-representation lens that minted its own copy of the §5 trichotomy would be the bug it detects). import_graph_rule = WallNow naming resolve_imports_transitively.
• closure_is_clean dispatches on the class: WallNow drift = hard violation; WallAfterGrounding / RatchetForever drift = tracked, not failed — so an honestly-marked shrinking scaffold (e.g. an exception roster) is never falsely flagged. This is the §5-bound demonstrated on real corpus rows.
• Registry-wired (closure_is_clean_for_representation folds the registry — not an inert one-row table). lens_unit witnesses (import_graph_test.dag, 9 test fn, all green by execution) cover both drift directions, set-not-list-order, and the trichotomy dispatch.

Scope fence (honored)

The ConsumedInputClosure type and its values are untouched; migrating should_run_gates() to derive from the import graph is separate work blocked on the same seam.

Tier-2 (named dissolution trigger, escalated separately)

Making the .dag row itself live (so import_closure_is_clean reads derived from a real .dag walk instead of a host-projected ClosureFact) needs the import-graph walk grounded .dag-callable through the host-read seam — load-bearing operator-seeded plumbing (#5241/#5603). Per the model-first checkpoint discipline this is routed to the operator (via witty-crane-380); the WallNow.construction String names the walk and promotes to a live fn field when the seam grounds. The Rust drift oracle (D1) is the live-corpus discriminating witness in the meantime.

🤖 Generated with Claude Code