Repository navigation
Relocate hub: ComputeHost/ComputeOffer to fleet_intent/ci_fleet; ToolchainCapability, IsolationBoundary families to extdeps authority homes; repoint all consumers - #5904
Conversation
These data rows were moved from gunbc.fleet_intent to gunbc.ci_fleet (the offer authority) as part of the compute_fabric relocation sequence. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…n' into session/vivid-wren-440-relocation
ci_spec.dag importing extdeps.github.actions { RunnerSpec } poisoned the
transitive import closure of orchestration_retry_emit_test.dag (which imports
ci_spec for ci_cargo_eagain_retry_core), causing a Step type collision between
v2.std.orchestration.Step (Retry/Do/If variants) and extdeps.github.actions.Step
(RunStep/UsesStep only). Fix: keep gunbc_ci_runner_spec in ci_fleet.dag (where
it lived on main); ci_spec has no path to extdeps.github.actions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…c to runner_spec_from_offer ci_fleet importing runner_spec_from_offer created a 2-cycle. On main this was unreachable from ci_floor_plan, but the hub branch added ci_budget_tree→ci_fleet, making the longer cycle ci_floor_plan→ci_budget_tree→ci_fleet→runner_spec_from_offer→ci_fleet detectable. Fix: move gunbc_ci_runner_spec() to runner_spec_from_offer.dag (which already imports ci_fleet), remove the reverse import from ci_fleet. The dependency becomes one-way again. Update consumers (ci_workflow, bmc_token_federation, ci_runner_seam_witness_test) to import gunbc_ci_runner_spec from gunbc.runner_spec_from_offer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ope from compute_fabric fleet_container.dag re-declared IsolationBoundary, ContainerRuntime, and the ResourceEnvelope family byte-for-byte from compute_fabric. These are now imported directly from compute_fabric (single authority), making fleet_container a consumer not a re-declarer. Cascade: fleet_intent and ci_fleet previously imported IsolationBoundary from fleet_container; now import from compute_fabric directly (explicit rather than transitive). Remaining §3 forks (ComputeHost, ExecutionSurface, WorkUnitId, ComputeOffer in fleet_intent/ ci_fleet) require compute_fabric.dag to first import StorageDevice from extdeps.storage.types (child PR B established the authority but compute_fabric was not updated). That is a focused follow-on PR. Explained in PR review reply. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Thanks for the thorough review. Addressing both findings: Finding 1 — Parallel representation / §3 forkPartially fixed (fleet_container) in 877700a. Remaining forks acknowledged below with resolution path. The review is correct that types were re-declared. Here is the accurate current state: Already resolved
Remaining genuine forks
These cannot be closed by simple import redirection because The fix is a focused follow-on PR that:
This is the right structural resolution — compute_fabric as the single authority for the connector types, fleet_intent/ci_fleet as consumers. Finding 2 — Semantic narrowingBoth narrowings are intentional, not silent:
The follow-on PR that completes finding 1 should also clean these from compute_fabric.CostModel and compute_fabric.ComputeOffer so the narrowing becomes the single-authority shape rather than a fork. — sent from vivid-wren-440 |
…o fleet_intent, delete obsolete tests - fleet_intent.dag declares IsolationBoundary + ContainerRuntime as single authority (compute_fabric thin connector no longer does) - compute_fabric_resource_witness_test.dag: tests thin connector witnesses + demand envelope witnesses from fleet_container (replaces old offer-feasibility tests that referenced deleted types) - Delete execution_receipt_digest_test.dag: tested WorkDemand/ExecutionReceipt types deleted from compute_fabric with no production consumer - Delete probe_selector_compute_fabric_import_repro_test.dag: tested example_shared_host_offer deleted from compute_fabric Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Addressing both reviews (claude-opus-4-7 and cursor/composer-2.5): Root finding (confirmed by both): Resolution: Replaced
Consumer updates: What compute_fabric now exports: Only — sent from vivid-wren-440 |
…tor resolves the std.* collision The compute_fabric namespace collision that blocked probe_selector cross-tree import (Option<T> vs Optional<T> + std.* dual-root collision) is dissolved by the thin connector in #5904: compute_fabric now imports only std.types + std.measure. Repro test deleted. Mark step-4 row DONE in .dag + hand-sync .md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…_fabric parallel-copy debt Dissolution triggers fired: compute_fabric connector PR (#5904) removed GpuRuntime/GpuFacts/ AcceleratorFacts and MemoryKind/MemoryFacts from compute_fabric. Delete the two SCAFFOLD data decls in extdeps/gpu/types.dag and extdeps/memory/types.dag (DESIGN §6: scaffold lives until its named trigger fires, then is deleted, not left lying). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Both scaffold dissolutions done in commit 6cd9c90:
No remaining — sent from vivid-wren-440 |
…5904) Per DESIGN §5/§6: on-carrier data note in compute_fabric.dag names the equivalent walls now — satisfies(offer,demand) thread-floor coverage moved to witness_hard_requirement_unmet_is_unmet; memory-budget coverage in fleet_container.demand_envelope_fits_budget; execution_receipt_digest was a documented stub (returns work.id, not a content hash), grounding tracked in realization_measurement_loop plan. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Addressing claude review #32975 — sent from vivid-wren-440 Finding 1 — silent witness deletions: Fixed in 267bc39. Added
Finding 2 — PR title vs. reality, IsolationBoundary / Container...: The review delivery was truncated at "Container..." so I'm addressing based on the visible prefix. The §3 type migrations are:
These moves are in scope for this PR because they were the §3 forks compute_fabric held against its final roadmap homes. The PR title describes the end-state ( CI: The prior run OOMed (exit 137) on |
|
Re: non-blocking IsolationBoundary/ContainerRuntime home observation — sent from vivid-wren-440
|
Qualify P0–P5 as this design's namespace (input-envelope-roadmap P2 = P5); repoint ResourceEnvelope and PerformanceReceipt to gunbc.fleet_container / gunbc.fleet_intent (#5904); replace dissolved WorkDemand with live floor admission carriers. Co-authored-by: Cursor <cursoragent@cursor.com>
…e scheduler types; this is the design record): author the operator-signed 'bounded-input / cost-envelope scheduling' design. WORK OFF FRESH origin/main (post dsl->dag rename: the roadmap authority is dag/gunbc/roadmap_authority.dag (#6198) * WIP: CAPTURE (docs + roadmap, model-before-implement — do NOT implement the s * Author operator-signed bounded-input / cost-envelope scheduling design. Unifies InputEnvelope → CostEnvelope → scheduling into one plan authority, enrolls it in the plan registry, and updates the roadmap with operator sign-off — design record only, no scheduler implementation. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix design doc carrier refs and phase namespace per review. Qualify P0–P5 as this design's namespace (input-envelope-roadmap P2 = P5); repoint ResourceEnvelope and PerformanceReceipt to gunbc.fleet_container / gunbc.fleet_intent (#5904); replace dissolved WorkDemand with live floor admission carriers. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
- R5 compute_fabric relationship: Shape IS the degenerate one-axis MachineShape; market stays thin (no #5904 rebuild); Fabric = outermost rung of the recursive supply tower. Convergence-map row added. - R6 evidence carriers: staged convergence (Quantified for greenfield, P1 receipts reuse Evidence.MeasuredBy, CostBasis migrates on forced join); owner = #6663 lane. - R7 Energy: derived quantity (Power x Time), lands Phase 1, is the F3 dedupe. - R8 scheduling invariant REFINED not superseded (operator: determinism was being conflated with input-invariance — different machines are different inputs). Surviving wall: no UNSTABLE (MeasuredBy) inputs to topology; declared shape is a stable input; cross-host schedule_eq demoted to corollary under equal declared shapes. Phase 3 UNBLOCKED. Open list rewritten: law-carrier home, SymbolIndex sequencing, hash convergence (dispatched), P0 field wall (#6663) remain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… evidence carriers, Energy, scheduling-invariant refinement) (#6685) * WIP: map reduce * WIP: map reduce * WIP: map reduce * WIP: map reduce * machine-shape plan: end shape agreed, no-kind rule, convergence map to existing carriers - §2 terminal model pinned (operator rulings 2026-07-15): one locality lattice (lifted to std, converging BOTH existing latency enums), divergence/idle-lane/ crossing laws, Placement dissolution trigger, kind-erasure at the ComputeHost→MachineShape derivation boundary - convergence map: every end-shape element bound to its existing carrier (HardwareThreadCount reused for lane_count; PlacementSupplyRow identified as the degenerate single-domain MachineShape; PTX ThreadHierarchyShape/PtxCost gain their consumer; MemoryKind.UnifiedShared flagged as topology-in-technology) - MemoryLevel.sharing dropped: sharing derives from SharedLevelEdge graph structure (single authority) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: address operator request-changes (7 blocking findings) - MachineShape is now a representable graph: DomainId/LevelId identities, explicit edge endpoints, SharedLevelEdge references the owner's level by id (embedding duplicated it), InterconnectLink coproduct holds NetworkAttach (LinkEdge was PcieLink-only while the map claimed NetworkInterface as a fill), terminal Placement = DomainId reference; dangling refs refuse - Phase 3 batching vs signed scheduling authority: conflict acknowledged, now an EXPLICIT supersession proposal (topology = pure fn of declared shape; MeasuredBy banned from topology; schedule_eq generalized to equal-given-equal- declared-inputs) gated on operator sign-off, with a confined fallback - both §5 fallback arms converted to refusals: Priced|PricingRefused{missing} (no term-incomplete Predicted accounts), Placed|PlacementRefused{missing} (no stay-at-current-domain answer) - Quantified<T> restructured: Precision (Exact|Interval) x Evidence (Cited|MeasuredBy{ExecutionReceiptDigest}|DerivedFrom) — evidence-bearing constructors make the authored-literal RED enforceable - locality/latency split into two axes: latency = per-level magnitude with one std class projection (converging ReadLatencyClass + network LatencyClass); locality = graph-derived, domain-relative (no universal total order) - OperandFlow total derivation spelled out: operand_root (fail-closed), hash- authority convergence precondition (v2.std.node.Hash vs ContentHash — the fnv1a64 thread), edge->root mapping for node_keyed_graph_transitive_bytes, OperandFlowRefused rows - AssociativityEvidence subject-bound: {combine, inhabitant, law, receipt}, license requires structural identity with the scheduled combine; keyed-patch witness scoped to mechanism-precedent-only; within-fold expansion scoped kernel-internal (never central Schedule topology) - corrections: PlacementSupplyRow has zero production callers (grep -l overcount); document-level dissolution trigger added (Plan-row registration = part of Phase 1 definition of done) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * de-orphan machine-shape plan doc + correct doc_reachability lying live-tree stamp Two fixes from the docs-enforcement audit (operator-directed): 1. bind: provenance row in accelerator_demo_plan.dag makes docs/plans/machine-shape-orthogonal-scheduling.md doc-graph-reachable (the established hand-authored-design-md convention: accelerator_demo_plan :51, live_read_classification.dag:66). Registration as a gunbc.plan.Plan row stays the md's declared Phase-1 dissolution — registering now would flip the actively-evolving doc into a generated artifact prematurely. Verified by build_doc_graph_report replication: doc_count=107, orphan_count 1->0, dangling 0. 2. doc_reachability_witness_test live_tree_disposition: SubstrateInputsOnly -> ReadsLiveTree. The 2026-07-12 machine stamp (#6479 entry-text batch) was false: every test fn reads the live docs/ tree via doc_graph_* host builtins — the exact classifier blind spot live_tree.dag:5 declares. The false stamp made the orphan wall predict-skippable, which composed with the docs-only floor shortcut into a pre-merge false-green (this PR minted an orphan with green CI). ReadsLiveTree restores the never-skip tooth: the wall now runs on every full floor, including this PR's. This diff leaves the docs-only shortcut class, so this PR runs the full floor with the corrected stamp — the wall itself verifies the de-orphan by execution, pre-merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * bind main's orphaned no-smuggled-programs-wall.md from its lens carrier The doc merged to main orphaned (docs-only shortcut + then-lying doc_reachability stamp — the same false-green class this PR fixes). With the stamp corrected, the orphan wall's first live pre-merge run (this PR's floor) caught it: 1 of 1880 witnesses red. Bound from medium_structure_containment.dag, the wall the design doc signs — same bind-from-carrier convention as accelerator_demo_plan.dag:51. Verified by build_doc_graph_report replication on the merged tree: doc_count=108, orphan_count 1->0, dangling 0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: apply #6663 review amendments 1+2 - Amendment 1: the 'evidence carried by construction' claim is gated on the record-field wall (witness-realization P0 / #6663 audit F1) — the typechecker checks field NAMES only (refuted-by-execution: Known omitting evidence compiles at 0 diagnostics); P0 named a Phase-1 acceptance precondition. Asymmetry recorded: the no-kind wall rests on field-name checking, which DOES hard-error — it holds today; evidence-required does not. - Amendment 2: Phase 2 claims the DerivedFrom fill of CostAccount.space only; the AIMD governor's dissolve-on additionally requires MeasuredBy per-runnable peaks (witness-realization P1) — derived operand footprint and measured peak are different space facts (receipt: 6.25GB VmSize vs KB operands — retention, not operands; the v1 run-stability axis). - Cross-refs: P4 composition note in the supersession paragraph; P1 named third party to the Quantified/CostBasis convergence (one carrier, not three; realization_measurement.dag merge-order flagged); Energy/Watt divergence deduped with audit F3 (owner TBD). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * heal main's composed drift + re-anchor vacuity design docs (unblocks all full-floor PRs) Main's tree (post #6638/#6664) fails generated_artifact_drift_gate_passes on every full floor: the vacuity lane hand-added a 'Sibling family' paragraph to the GENERATED docs/plans/inert-layer-lens.md without updating its generating Plan row (dag/gunbc/plans/inert_layer_lens.dag) — committed != regenerated. Their docs-only PRs merged through the docs-only shortcut, which skipped both the drift gate and the doc-graph wall. 1. Regenerate inert-layer-lens.md (paragraph removed; byte-identical to warm-crab-65's independent main_wet regen on #6658 — same blob 2b36cf2). 2. That hand-edit was ALSO the only doc-graph anchor for the vacuity lane's two design docs; regen alone orphans vacuity-lens-design.md and (via its link chain) lens-consolidation-design.md. Re-anchored with a bind: provenance row in dag/std/materialization_ladder.dag — the file whose AuthoredDuplication verdict the vacuity doc's load-bearing correction is about — migrating to the vacuity lens .dag carrier when it lands. Verified by build_doc_graph_report replication: doc_count=110, orphan_count=0, dangling=0. Follow-up for the vacuity lane: re-add the sibling-family paragraph via the inert_layer_lens Plan row (the authority), not the generated md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: record operator rulings 5-8 (2026-07-15) - R5 compute_fabric relationship: Shape IS the degenerate one-axis MachineShape; market stays thin (no #5904 rebuild); Fabric = outermost rung of the recursive supply tower. Convergence-map row added. - R6 evidence carriers: staged convergence (Quantified for greenfield, P1 receipts reuse Evidence.MeasuredBy, CostBasis migrates on forced join); owner = #6663 lane. - R7 Energy: derived quantity (Power x Time), lands Phase 1, is the F3 dedupe. - R8 scheduling invariant REFINED not superseded (operator: determinism was being conflated with input-invariance — different machines are different inputs). Surviving wall: no UNSTABLE (MeasuredBy) inputs to topology; declared shape is a stable input; cross-host schedule_eq demoted to corollary under equal declared shapes. Phase 3 UNBLOCKED. Open list rewritten: law-carrier home, SymbolIndex sequencing, hash convergence (dispatched), P0 field wall (#6663) remain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: reconcile §2/§3/§5/§8 with rulings 6-8 (cursor review on #6685) Five stale spots aligned: Energy divergence now records ruling 7 (was 'flagging for operator'); the Quantified/CostBasis rows in §2 and the convergence map record ruling 6's staged convergence (was 'open Q1'); §5's batching rule reads 'under the refinement' (was 'supersession'); §8's schedule_eq wall restated per ruling 8 (corollary under equal declared shapes, not unconditional). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…nt finding was wrong Two corrections, one of which changes how Cut B has to be executed. THE DELETION IS NOT THE CENSUS HERE. Every reference to product.compute_fabric in the corpus is a string literal; there is no import of it anywhere. So deleting the module refuses nothing, and the doctrine's "the deletion is the census" does not apply. The census has to be read before the cut rather than discovered by it, or a cut relying on compile refusals will find none and conclude it is done. The census is also larger than the first version said: five witnesses inside the production module, a separate witness file, two host_standup prose strings, five plan documents, and DESIGN section 2 (fixed separately in #8559). Several plan docs cite types the module no longer has, which its own dissolution receipt records as removed in #5904 -- the prose was stale before this cut. AND MY ENDPOINT FINDING WAS WRONG. I recorded that grounding_lens_test cites product.compute_fabric.Endpoint as a fabricated citation of the section 3 class. It is a controlled fixture: two hand-built concept_decl rows testing that a product.* namespace is not layer-excluded, and the sibling row names product.network_topology.Url, which also does not exist. The test needs a string shaped like a product qualified name, not one that resolves, and an independently authored fixture is exactly what DESIGN section 5 endorses. I read a fixture as a citation because the string looked like one. Recorded rather than quietly removed. A plan that silently drops its own false claims teaches nothing, and this is the same adjacent-question error the document charges elsewhere. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf
…rements move to product.fabric.work (#8560) * Cut B (HELD): delete product.compute_fabric at the root; census, witnesses, and prose fixed forward Held, not pushed: #8413 merged to main after this was authored and product.fabric supply/work now import product.compute_fabric Shape, so the deletion refuses inside a tree this session was told not to edit. Awaiting the carrier decision before completing. * Cut B: delete product.compute_fabric at the root; Shape and HardRequirements move to their owner The dead root goes: Fabric, Program, ComputeNeed, Opportunity, Connection, connect, shape_covers, derive_shape, the five example rows and the five in-module witnesses. None of it had a decision consumer. Shape and HardRequirements are NOT replaced — they MOVE, to product.fabric.work. They are the module's only load-bearing content, and they are work-side facts: Shape is what a WorkSpec requires and what an Offer offers, and work.dag's shape_material already destructures the axis deliberately, so the axis wall now sits beside the carrier instead of one module away. supply.dag already imported work, so the edge exists and no cycle is introduced. (Operator ruling: move the surviving authority to its owner rather than hunt a substitute so the old file can die with its contents intact. ExecutionClassRef / ResourceSupplyRef were considered and do not exist on main.) THE DELETION IS PARTLY A CENSUS, contrary to the plan it was briefed from: the "every reference is a string literal, nothing refuses" measurement grepped the qualified module name only, and a .dag reference can be a bare name. Two real structural dependents were invisible to it -- host_standup_spine_witness_test called witness_fabric_binds_need_to_opportunity() bare, and #8413 landed three imports of Shape while the cut was being authored. Both refuse loudly and both are handled here. Dispositions, each decided rather than swept: - The five in-module witnesses die with their subject; they assert properties of the deleted types. One consequence is recorded rather than dropped: the module's own #5904 dissolution receipt named witness_hard_requirement_unmet_is_unmet as the THREAD-FLOOR COVERAGE for that earlier dissolution, and deleting the receipt alongside the coverage is how a guarantee disappears with nobody deciding to drop it. The successor obligation is now stated in the plan prose as unhomed. - compute_fabric_resource_witness_test split: its connector test dies, its four fleet_container demand-envelope witnesses survive and move to test.claim.fleet_container_demand_envelope_witness, because a file named for compute_fabric holding only fleet_container claims is a stale name. - host_standup_spine_witness_test's claim SURVIVES with a retarget: the shape authority is still referenced rather than redeclared, and now points at product.fabric.work. The witness checks the refusal string names it. - host_standup's two prose strings become true again: the shape carrier is referenced; what the deletion removed and nothing replaced is the need/opportunity MATCH, so the enroll decision has no authority. Its gap-ledger row moves gap-shape-only -> gap, which made a third string false (it enumerated five modeling values, and only four now occur) -- corrected too. Prose: five plan modules and four hand-authored docs carried claims that a deleted thing is live; corrected. Several were ALREADY false before this cut (#5904 had moved ResourceEnvelope and PerformanceReceipt out years of commits ago) and now name their live homes. The dated 2026-06-21 inert-layer measurement is left AS MEASURED with a note, not rewritten -- a measurement is a fact about a moment. phase_profile.rs's dissolution trigger stops naming a path that never existed in this repo. The three generated plan .md are regenerated through dag/tools/generated_artifact_gate.dag main_wet with a tree-built binary, not hand-edited. DESIGN.md and src/v2/test/claim/grounding_lens_test.dag are deliberately untouched: the first is #8559's, and the second needs a string SHAPED like a product qualified name, not one that resolves. --------- Co-authored-by: gunbc-ci-auto-heal <searlsbrian@gmail.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
…is replaced (#8550) * Fabric recut program: the carriers survive, the layer underneath is replaced Signed off by external review with candidate (b) for the lease decomposition. Records the program, the verified fork census, the measured blast radii, and the fourteen controls that gate merge. The verdict: #8413 does not land in its current carrier shape. The six product concepts (Demand, Work, Attempt, Offer, ExecutionGrant, Receipt) survive; the layer beneath them forks nine existing authorities. Each fork verified by execution against branch 66dc3aa and main a2b33f5 rather than accepted from the review. Two corrections are recorded rather than quietly absorbed: The review's stated support for recutting -- that the PR is stale at ed2d375 and non-mergeable -- is FALSE. The branch is at 66dc3aa, MERGEABLE/CLEAN and CI-green; its earlier 44 failures were entirely main's. The recut stands on the fork census alone, and a conclusion carried by a false premise decays the moment someone checks it. And my own claim that owner_fingerprint's absence CAUSED the unchecked attester is refuted. Lease owner and receipt attester are independent identities that coincide only in the first vertical -- a worker attests execution, a meter attests usage, a billing observer attests spend. So the lease decomposition and attester authorization are parallel repairs, not a chain, and the attester goes through std.access rather than a branch in the epoch comparator. Controls 7 and 8 exist precisely to stop the conflation returning: testing only "foreign attester refuses" passes under it. Verified while writing: std.effect_grant Envelope and envelope_bounded_by are present on main and are the authority envelope, so product.fabric duplicates no Verb or child-boundedness. And extdeps/accounting/encumbrance is NEW on the branch and absent from main -- a generic cited kernel that is endorsed unchanged, not part of the layer being replaced. Doc registered as a HandAuthoredDocBind on std.temporal_effect HeldLease with ComputationIdentity and ComputeOffer as additional works; all three symbols verified to resolve, and the three doc_graph bind witnesses return true. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Cut order: two roots, not one — and two defects found while verifying it Sequencing signed off. My framing of 'the old market vocabulary' as one root was wrong: it bundles a dead root, a live supply authority, and a wrong product-interface dependency into one migration. X1 product.compute_fabric is dead — verified, its only non-plan mentions on main are inside string literals in gunbc.host_standup (a refusal: message and an authority_or_interim: field), so there is no production decision consumer and it deletes outright. X2 gunbc.ci_fleet.ComputeOffer is live and is the real migration. The finding that reorders everything: the workflow edge ComputeOffer -> runner_spec_from_offer -> RunnerSpec -> witnesses.yml is itself wrong, because it derives GitHub labels from the physical host, so the customer-facing execution class depends on physical supply and every supply migration is a workflow migration. gunbc.ci_runner_target is a smaller interception point (verified present with consumers). Order: A canonical LeaseEpoch, B delete the dead root, C sever physical supply from the public CI interface, D replace live ComputeOffer. C is what makes D safe. Two defects found while verifying rather than assumed, both recorded so the deletion does not silently leave them: src/v2/test/claim/grounding_lens_test cites product.compute_fabric.Endpoint, which has ZERO occurrences in that module — a fabricated citation in a lens test that will not surface as a compile refusal on deletion because it is a qualified-name string. And five witnesses live inside the production module, so the deletion is not a single file removal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Resolve the last two open questions: WorkContentKey survives, and six modules are not the present six The two items §5 left undecided came back with answers that both refuse the author's proposal, in opposite directions. I proposed deleting the Work key as a rename of ComputationIdentity's structural member. Refused: a qualification result is a verdict about two things, a content address answers for one. Collapsing them erases addressing rather than deduplicating it. The carrier survives as WorkContentKey wrapping ContentHash — not a branded string, because brands are unenforced here, so a brand would be a name standing where a distinct carrier was available. Derived canonical-contract → hash → key, never caller-supplied. On module boundaries, both extremes were refused. One module fuses eight concerns into one file; the present six have backward imports (supply borrows a receipt ref from demand, budget borrows an account id from demand and a reservation ref from execution) and a central freely-constructible identity record. The answer is an acyclic authority graph — the count is incidental. The identity module is deleted and each owner defines its own key, projected through std.key_relation.ScopedKey. Also records Cut E (module recut) and the market allocation fold that follows it, and the merge constraint on #8413: it may not merge while ComputeOffer and Offer are both authoritative. #8413 is preserved, not closed — A–D merge into its branch so its final diff is the product protocol. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Correct two things Cut A found wrong by touching them: LeaseKey does not exist, and the census was stale Cut A landed on #8553 and returned two corrections against this doc, both of which are the doc's fault rather than the implementation's. Section 7 spelled lease_key: LeaseKey. There is no such type on main and I had not checked. Cut A refused to mint it, and the refusal is right: an unenforced alias is the hollow-alias mode, and minting one inside the authority a consolidation cut exists to establish is where it does the most damage. The field is NonEmptyStr; a branded key lands with its validating mint or not at all. The HeldLease census read 8 against an older base and is 10 at 8687f2a -- two witness consumers landed between. Corrected with the base named, because a census with no base is not a measurement. Also records that the per-witness gunbc run route is narrower than the brief claimed. I verified it does work on a zero-import claim file, so the flat "it does not work" is wrong too; what is established is that cross-module type reach fails through it and the boundary is not yet known. Until it is, the required-floor run is the only receipt covering every witness. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * The run-recipe boundary is the binary: bare gunbc in a gunbc checkout reaches the baked pin Two explanations were proposed for why the per-witness route failed and both are now refuted by execution. Cut A's discriminating pair killed the closure candidate (three --function selections from one file yield identical file-wide diagnostics naming unselected functions, so --function selects nothing about resolution) and the base candidate (identical across five main commits spanning 129). The variable is which binary the invocation reaches. The ctrl-build shim has an explicit gunbc-checkout guard that execs the baked /usr/local/bin/gunbc when cwd's origin is this repo. Confirmed on one specimen: the baked binary reports "resolved 1 sources" and then unresolved NonEmptyStr/ContentHash/Timestamp, while the tree-built binary evaluates and returns the value. It never walks the source roots, so the corpus is invisible and the diagnostics land on whatever line first mentions a type. That failure mode matters more than the inconvenience: a stale binary produces a plausible located diagnostic in the file under test, which is the fabricated plausible output shape pointed at the author's own instrument. The doc now requires an explicit ./target/release/gunbc path for every cut. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Re-measure the Cut B census: zero structural consumers, and my Endpoint finding was wrong Two corrections, one of which changes how Cut B has to be executed. THE DELETION IS NOT THE CENSUS HERE. Every reference to product.compute_fabric in the corpus is a string literal; there is no import of it anywhere. So deleting the module refuses nothing, and the doctrine's "the deletion is the census" does not apply. The census has to be read before the cut rather than discovered by it, or a cut relying on compile refusals will find none and conclude it is done. The census is also larger than the first version said: five witnesses inside the production module, a separate witness file, two host_standup prose strings, five plan documents, and DESIGN section 2 (fixed separately in #8559). Several plan docs cite types the module no longer has, which its own dissolution receipt records as removed in #5904 -- the prose was stale before this cut. AND MY ENDPOINT FINDING WAS WRONG. I recorded that grounding_lens_test cites product.compute_fabric.Endpoint as a fabricated citation of the section 3 class. It is a controlled fixture: two hand-built concept_decl rows testing that a product.* namespace is not layer-excluded, and the sibling row names product.network_topology.Url, which also does not exist. The test needs a string shaped like a product qualified name, not one that resolves, and an independently authored fixture is exactly what DESIGN section 5 endorses. I read a fixture as a citation because the string looked like one. Recorded rather than quietly removed. A plan that silently drops its own false claims teaches nothing, and this is the same adjacent-question error the document charges elsewhere. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Cut B: the census claim was false, the method is the finding, and Shape moves to product.fabric.work I asserted that every reference to product.compute_fabric is a string literal, so the deletion refuses nothing. False. host_standup_spine_witness_test calls the module's own witness_fabric_binds_need_to_opportunity by bare name, and so does compute_fabric_resource_witness_test; both predate the base I measured. The method is the real finding. I grepped the module name, and a bare call carries no module name, so that grep could never have found it. A .dag reference takes at least three forms and I checked one, then reported the output as a structural fact. Caught by the implementer, not by me. #8413 also merged mid-cut, adding three real imports of Shape from product.fabric. Ruling: Shape and HardRequirements move into product.fabric.work and the rest of compute_fabric is deleted. The dead module's only load-bearing content is Shape, and a replacement migration moves the surviving authority to its owner rather than finding a substitute so the old file can die intact. supply.dag already imports work, so the edge exists and nothing is minted -- which matters because my earlier brief named ExecutionClassRef and ResourceSupplyRef as the alternatives and neither exists on main. Naming unavailable carriers is how a brief pushes someone into minting one inside a deletion. Also records the thread-floor coverage obligation that must outlive the cut, and keeps the earlier Endpoint correction. Two false findings in one section, both about whether a string was a reference. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Cut C rewritten after measurement: the seam exists, and the live workflow emitter bypasses it I specified Cut C as severing a wrong edge -- the customer-facing execution class depending on physical supply -- and said the seam needed building. Both halves were wrong. gunbc.ci_runner_target already exists, already is the authority, and already projects the runs-on spec and the memory regime from one selection. Its FleetSelfHosted arm delegating to runner_spec_from_offer is correct and deliberate: a self-hosted fleet runner's labels genuinely are facts about the physical fleet. The real defect is narrower. witness_floor_workflow reads gunbc_ci_runner_spec() -- the un-seamed function -- while the seam's own projection gunbc_ci_selected_runner_spec() has no workflow consumer at all. The module's note says "ci_workflow reads the spec projection now", but ci_workflow was deleted in the floor cut, so the bypass is most likely collateral of that cut rather than an original decision. It is a provably safe change: ci_runner_target_witness_test already asserts the two specs are equal, so the emission is byte-identical and that witness is the control. What it buys is that runner selection becomes a one-row edit again -- the whole reason the seam was built -- and one of three direct runner_spec_from_offer call sites disappears ahead of Cut D. The other two are legitimately about physical placement and stay. Also records the stale present-tense note inside ci_runner_target itself, and the Cut D census measured by declaration name rather than module name. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Cut D is not a type swap: Offer deliberately carries no physical facts, and the label derivation reads them Measured the two carriers rather than assuming they were the same shape, since the last three specifications here were wrong from under-measuring. ComputeOffer carries ComputeSupplyFacts -- a ComputeHost, an ExecutionSurface, observed performance. Offer<P> carries none of that: id, executor, a one-axis Shape, capabilities, trust domain, quantity bound, quote, evidence. The absence is deliberate and consistent with the module's own reasoning about remaining_capacity: an offer states what is offered and on what terms, and the physical realization behind it belongs to another layer. So runner_spec_from_offer's reads of offer.supply.physical and offer.supply.execution.os have no counterpart in the replacement, and "migrate the consumers to Offer" is under-specified in the way that pushes an implementer into either widening Offer with physical fields -- fusing realization into the offer, exactly what its shape avoids -- or quietly dropping the derivation. Records the three honest options and picks none unilaterally. Also strengthens the ordering argument: Cut C removes the CI interface from Cut D's population, so the physical-facts question gets answered once at the runner-target seam rather than once per consumer mid-migration. Cut D is not dispatchable until one option is signed off. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Cut D signed off: decompose the fused carrier rather than replace it, and all three of my options were wrong as stated The fork came back refusing every option in the form I put it. The construction is a combination: option 1's severance but with ExecutionClass rather than ComputeHost as the destination, option 3's relation as a provider-owned OfferBacking rather than a field on Offer, and option 2 rejected outright. Option 1 was right that runner_spec_from_offer reads no market fact, and wrong about where the labels come from: runner labels describe the environment presented to the job, not the bare-metal host, so ComputeHost -> RunnerSpec still points the wrong way. Option 2 would collapse selected execution class into selected physical backing, making the customer-facing target change whenever placement changes. Option 3's relation is necessary but is not one-to-one, so a single field would make quoted supply unrepresentable. Severing does not lose the offered-versus-ran link: it is proven at offer publication, grant issuance and realization readback, and the severance removes the relation from the wrong consumer rather than removing the relation. Verified the observed_performance ruling rather than taking it, and it is stronger than stated: one declaration, five row initializers all empty, one plan mention. No consumer and no data. Records Cut D as a five-way consumer classification in four steps, and adds a fourth acceptance condition to Cut C -- the old direct projection is marked for deletion with D rather than surviving as a permanent equal path, which is what keeps C from creating the interval it exists to close. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf * Cut C's carve-out gives Cut D a precondition: D4 cannot delete runner_spec_from_offer yet Condition 2 is ruled to read "no CI workflow emitter", not "no production emitter". fleet_converge_workflow calls gunbc_ci_runner_spec directly and must not be routed through the CI seam: selected_ci_runner_target is a one-row function built to be flipped to a cloud runner, and fleet convergence must run on the fleet, so a flip would send the converger to a machine that cannot reach the hosts it converges. Which machine runs CI and which machine converges the fleet are two questions with the same answer today and not the same question -- FleetSelfHosted there is a coincidence of value, and merging the authorities would be nicknaming in reverse. That carve-out has a consequence neither the sign-off nor I had seen: D4's deletion list includes runner_spec_from_offer, gunbc_ci_runner_spec lives in it, and fleet_converge_workflow still consumes it. So D4 cannot execute as written. Fleet convergence needs its own fleet-derived runner authority first, and the deletion is conditional on it. Recorded now rather than at D4, because a deletion list that cannot execute surfaces as an implementer improvising a merge of two authorities to make the cut compile -- the arm this program has already had to stop twice. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Summary
Green-stepwise hub PR that repoints all consumers from `product.compute_fabric` transient definitions to their new single-authority homes, after the five leaf PRs each added the type families to their proper locations:
This hub PR adds:
Test plan
🤖 Generated with Claude Code