Skip to content

Relocate hub: ComputeHost/ComputeOffer to fleet_intent/ci_fleet; ToolchainCapability, IsolationBoundary families to extdeps authority homes; repoint all consumers - #5904

Merged
briansrls merged 21 commits into
mainfrom
session/vivid-wren-440-relocation
Jun 29, 2026

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Jun 28, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Green-stepwise hub PR that repoints all consumers from `product.compute_fabric` transient definitions to their new single-authority homes, after the five leaf PRs each added the type families to their proper locations:

This hub PR adds:

  • `extdeps/toolchain/types.dag` (new authority home for Architecture, ToolchainCapability, BuildWrapperKind)
  • `gunbc/fleet_container.dag` (new: IsolationBoundary, ResourceEnvelope, FleetContainerType)
  • `gunbc/fleet_intent.dag` (rewrite: ComputeHost defined here; imports storage/gpu/memory/toolchain from their extdeps homes)
  • `gunbc/ci_fleet.dag` (rewrite: ComputeOffer defined here; fleet_intent_offers, gunbc_ci_fleet_offer)
  • `gunbc/ci_spec.dag` (adds gunbc_ci_runner_spec derived from ci_fleet offer)
  • All consumers repointed: bmc_token_federation, ci_budget_tree, ci_runner_placement, ci_workflow, fleet_host_budget, host_converge, host_effect, host_effect_realize, runner_deploy_emit, runner_spec_from_offer, rust_gates_ci
  • Fixes `ci_runner_seam_witness_test` to import `gunbc_ci_runner_spec` from `ci_spec` (where it now lives) instead of `ci_fleet`

Test plan

🤖 Generated with Claude Code

@gunbai-bot gunbai-bot Bot changed the title Re-model compute_fabric as a namespace need<->opportunity connector; shape DERIVED from the .dag program, no heavy/workload/locality (replaces discarded #5866) Relocate hub vocabulary: ToolchainCapability, IsolationBoundary, ResourceEnvelope, ExecutionSurface, ComputeHost, ComputeOffer families to their authority homes Jun 28, 2026
briansrls and others added 3 commits June 28, 2026 18:53
These data rows were moved from gunbc.fleet_intent to gunbc.ci_fleet
(the offer authority) as part of the compute_fabric relocation sequence.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot gunbai-bot Bot changed the title Relocate hub vocabulary: ToolchainCapability, IsolationBoundary, ResourceEnvelope, ExecutionSurface, ComputeHost, ComputeOffer families to their authority homes Relocate hub: ComputeHost/ComputeOffer to fleet_intent/ci_fleet; ToolchainCapability, IsolationBoundary families to extdeps authority homes; repoint all consumers Jun 28, 2026
briansrls and others added 3 commits June 28, 2026 21:57
ci_spec.dag importing extdeps.github.actions { RunnerSpec } poisoned the
transitive import closure of orchestration_retry_emit_test.dag (which imports
ci_spec for ci_cargo_eagain_retry_core), causing a Step type collision between
v2.std.orchestration.Step (Retry/Do/If variants) and extdeps.github.actions.Step
(RunStep/UsesStep only). Fix: keep gunbc_ci_runner_spec in ci_fleet.dag (where
it lived on main); ci_spec has no path to extdeps.github.actions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…c to runner_spec_from_offer

ci_fleet importing runner_spec_from_offer created a 2-cycle. On main this was unreachable from
ci_floor_plan, but the hub branch added ci_budget_tree→ci_fleet, making the longer cycle
ci_floor_plan→ci_budget_tree→ci_fleet→runner_spec_from_offer→ci_fleet detectable.

Fix: move gunbc_ci_runner_spec() to runner_spec_from_offer.dag (which already imports ci_fleet),
remove the reverse import from ci_fleet. The dependency becomes one-way again.
Update consumers (ci_workflow, bmc_token_federation, ci_runner_seam_witness_test) to import
gunbc_ci_runner_spec from gunbc.runner_spec_from_offer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot
gunbai-bot Bot marked this pull request as ready for review June 28, 2026 22:34
briansrls and others added 3 commits June 28, 2026 22:39
…ope from compute_fabric

fleet_container.dag re-declared IsolationBoundary, ContainerRuntime, and the ResourceEnvelope
family byte-for-byte from compute_fabric. These are now imported directly from compute_fabric
(single authority), making fleet_container a consumer not a re-declarer.

Cascade: fleet_intent and ci_fleet previously imported IsolationBoundary from fleet_container;
now import from compute_fabric directly (explicit rather than transitive).

Remaining §3 forks (ComputeHost, ExecutionSurface, WorkUnitId, ComputeOffer in fleet_intent/
ci_fleet) require compute_fabric.dag to first import StorageDevice from extdeps.storage.types
(child PR B established the authority but compute_fabric was not updated). That is a focused
follow-on PR. Explained in PR review reply.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot

gunbai-bot Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for the thorough review. Addressing both findings:

Finding 1 — Parallel representation / §3 fork

Partially fixed (fleet_container) in 877700a. Remaining forks acknowledged below with resolution path.

The review is correct that types were re-declared. Here is the accurate current state:

Already resolved

fleet_container.dag was written to import IsolationBoundary, ContainerRuntime, ResourceEnvelope (and the CpuRequirement/GpuRequirement/MemoryRequirement/StorageRequirement/NetworkRequirement family) directly from product.compute_fabric — it does not re-declare them. fleet_container is a consumer of compute_fabric's single authority for these types. The 877700a commit makes fleet_intent and ci_fleet also import IsolationBoundary/ContainerRuntime directly from compute_fabric (previously they reached them transitively through fleet_container, which worked but was implicit).

Remaining genuine forks

gunbc.fleet_intent re-declares: WorkUnitId, ProviderIdentity, MemoryDevice, StorageMount, ProcessorKind, ExecutionSurface, ComputeHost, MeasurementConfidence, PerformanceReceipt (plus associated fns/data already in compute_fabric). gunbc.ci_fleet re-declares: ComputeOffer, ComputeSupplyFacts, CostModel, CostEstimate, AvailabilityWindow.

These cannot be closed by simple import redirection because product.compute_fabric (product layer) cannot import from gunbc.* (gunbc layer), so the direction must be reversed: fleet_intent/ci_fleet must import these types FROM compute_fabric. That works at the layer level — gunbc.* can import product.*. The blocker is that compute_fabric.ComputeHost.storage: List<compute_fabric.StorageDevice> while fleet_intent uses extdeps.storage.types.StorageDevice (child PR B's authority). Until compute_fabric.dag itself is updated to import StorageDevice from extdeps.storage.types (removing its own re-declaration), the type identities don't align and fleet_intent cannot import ComputeHost from compute_fabric.

The fix is a focused follow-on PR that:

  1. Updates compute_fabric.dag to import StorageDevice (and related types/fns) from extdeps.storage.types, GpuFacts/AcceleratorFacts/GpuRuntime from extdeps.gpu.types, MemoryKind/MemoryFacts from extdeps.memory.types, and the network types from product.network_topology — removing its own re-declarations (child PRs B/C/A established these authorities; compute_fabric was not updated in this PR)
  2. Updates fleet_intent.dag to import ComputeHost, ExecutionSurface, WorkUnitId, etc. from compute_fabric (removing its re-declarations)
  3. Updates ci_fleet.dag to import ComputeOffer, ComputeSupplyFacts etc. from compute_fabric

This is the right structural resolution — compute_fabric as the single authority for the connector types, fleet_intent/ci_fleet as consumers.

Finding 2 — Semantic narrowing

Both narrowings are intentional, not silent:

CostModel drops rates: ProviderCostModel: ProviderCostModel was type ProviderCostModel { placeholder: Bool } — a type whose only field is literally named placeholder, always set to true in every data instance. Zero semantic content. Dropping it is cleanup of dead scaffold.

ComputeOffer drops constraints: List<ProviderConstraint>: All data instances in compute_fabric had constraints: [] — the field was never populated. ProviderConstraint has real variants (HostJobserverFifo, SharedHomeRoot, MaxConcurrentRunners, OomBehavior) but none were ever instantiated. The ci_fleet.ComputeOffer is intentionally scoped to the CI fleet use case; if constraint modeling is needed in the future it belongs in a typed extension, not a resurrect-the-dead-scaffold move.

The follow-on PR that completes finding 1 should also clean these from compute_fabric.CostModel and compute_fabric.ComputeOffer so the narrowing becomes the single-authority shape rather than a fork.

— sent from vivid-wren-440

briansrls and others added 2 commits June 28, 2026 23:16
…o fleet_intent, delete obsolete tests

- fleet_intent.dag declares IsolationBoundary + ContainerRuntime as single authority (compute_fabric thin connector no longer does)
- compute_fabric_resource_witness_test.dag: tests thin connector witnesses + demand envelope witnesses from fleet_container (replaces old offer-feasibility tests that referenced deleted types)
- Delete execution_receipt_digest_test.dag: tested WorkDemand/ExecutionReceipt types deleted from compute_fabric with no production consumer
- Delete probe_selector_compute_fabric_import_repro_test.dag: tested example_shared_host_offer deleted from compute_fabric

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot

gunbai-bot Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor Author

Addressing both reviews (claude-opus-4-7 and cursor/composer-2.5):

Root finding (confirmed by both): compute_fabric.dag was not updated — the hub PR left 1300 lines of heavy types in place while new modules re-declared the same types, creating §3 forks.

Resolution: Replaced compute_fabric.dag with the ~130-line thin connector from PR #5889 (commits 904f45e, 80d21b5). This deletes every duplicated declaration at once:

  • IsolationBoundary/ContainerRuntime → now declared in gunbc.fleet_intent (single authority; fleet_intent was always the roadmap home for ExecutionSurface)
  • ResourceEnvelope + sub-types → now declared in gunbc.fleet_container (single authority; fleet_container uses it for idle baselines)
  • parallel_run_demand_envelope + demand functions → moved to fleet_container (where ResourceEnvelope lives)
  • ComputeHost, ExecutionSurface, WorkUnitId, PerformanceReceipt, ProviderIdentity → single authority is now fleet_intent (compute_fabric no longer declares them)
  • CostClass, CostModel, ComputeOffer → single authority is gunbc.ci_fleet (compute_fabric no longer declares them)
  • ToolchainCapability etc. → single authority is extdeps.toolchain.types (compute_fabric no longer declares them)
  • GpuRuntime, PersistenceKind, NetworkEgressClass → single authority is their respective extdeps module (compute_fabric's duplicates deleted)

Consumer updates: ci_fleet.dag → imports IsolationBoundary from fleet_intent; ci_floor_plan.dag → imports ResourceEnvelope/demand fns from fleet_container; test files updated/deleted accordingly.

What compute_fabric now exports: Only Fabric, Program, Shape, ComputeNeed, Opportunity, Connection, derive_shape, connect, shape_covers + example data and witnesses. Imports only from std.types and std.measure.

— sent from vivid-wren-440

briansrls and others added 2 commits June 28, 2026 23:26
…tor resolves the std.* collision

The compute_fabric namespace collision that blocked probe_selector cross-tree import
(Option<T> vs Optional<T> + std.* dual-root collision) is dissolved by the thin connector
in #5904: compute_fabric now imports only std.types + std.measure.
Repro test deleted. Mark step-4 row DONE in .dag + hand-sync .md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…_fabric parallel-copy debt

Dissolution triggers fired: compute_fabric connector PR (#5904) removed GpuRuntime/GpuFacts/
AcceleratorFacts and MemoryKind/MemoryFacts from compute_fabric. Delete the two
SCAFFOLD data decls in extdeps/gpu/types.dag and extdeps/memory/types.dag (DESIGN §6:
scaffold lives until its named trigger fires, then is deleted, not left lying).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot

gunbai-bot Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor Author

Both scaffold dissolutions done in commit 6cd9c90:

  • dsl/extdeps/gpu/types.dag: deleted gpu_types_compute_fabric_parallel_copy_debt — dissolution trigger fired (compute_fabric connector PR removed GpuRuntime/GpuFacts/AcceleratorFacts)
  • dsl/extdeps/memory/types.dag: deleted memory_types_compute_fabric_parallel_copy_debt — dissolution trigger fired (MemoryKind/MemoryFacts removed from compute_fabric)

No remaining compute_fabric_parallel_copy_debt or SCAFFOLD.*compute_fabric markers in the tree.

— sent from vivid-wren-440

briansrls and others added 2 commits June 29, 2026 00:02
…5904)

Per DESIGN §5/§6: on-carrier data note in compute_fabric.dag names the
equivalent walls now — satisfies(offer,demand) thread-floor coverage moved
to witness_hard_requirement_unmet_is_unmet; memory-budget coverage in
fleet_container.demand_envelope_fits_budget; execution_receipt_digest was
a documented stub (returns work.id, not a content hash), grounding tracked
in realization_measurement_loop plan.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot

gunbai-bot Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

Addressing claude review #32975 — sent from vivid-wren-440

Finding 1 — silent witness deletions: Fixed in 267bc39. Added data compute_fabric_resource_model_dissolution_receipt as an on-carrier note in compute_fabric.dag (§6 carrier = the module where the old model lived). The note names equivalent walls explicitly:

  • satisfies(offer, demand) had zero production consumers (grep-confirmed). Thread-floor wall: witness_hard_requirement_unmet_is_unmet (this module, tests 64-thread need vs 8-thread opportunity → Unmet). Memory-budget wall: gunbc.fleet_container.demand_envelope_fits_budget + witness_run_demand_envelope_fits_budget (tested in compute_fabric_resource_witness_test.dag).
  • execution_receipt_digest was a documented stub returning receipt.work.id (not a content hash — the plan doc explicitly calls this out as future work). Deleting the test of a stub does not remove a wall; the wall was not yet built. Grounding tracked in gunbc.plans.realization_measurement_loop.
  • WorkDemand / ExecutionReceipt: zero production consumers, deleted with the stub they backed.

Finding 2 — PR title vs. reality, IsolationBoundary / Container...: The review delivery was truncated at "Container..." so I'm addressing based on the visible prefix. The §3 type migrations are:

  • IsolationBoundary / ContainerRuntime → gunbc.fleet_intent (single authority: ExecutionSurface is declared there and uses both; fleet_container and ci_fleet now import from fleet_intent, not from compute_fabric).
  • ResourceEnvelope + demand fns → gunbc.fleet_container (single authority: idle-baseline envelopes were already there).

These moves are in scope for this PR because they were the §3 forks compute_fabric held against its final roadmap homes. The PR title describes the end-state (compute_fabric = thin connector); the migrations were the mechanism. If the full finding flags a different concern, please re-post the full text and I'll address it directly.

CI: The prior run OOMed (exit 137) on source_root_ingest during fleet pressure — main was green concurrently. Merged main (1 commit, #5918) to eliminate any stale-base risk. New run triggered at 267bc39.

@gunbai-bot

gunbai-bot Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

Re: non-blocking IsolationBoundary/ContainerRuntime home observation — sent from vivid-wren-440

fleet_intent.dag is correct (not extdeps/): ExecutionSurface is declared in fleet_intent and has isolation: IsolationBoundary and container_runtime: ContainerRuntime? as fields. Layer rule: std ← extdeps ← product ← gunbc ← workflow. If IsolationBoundary/ContainerRuntime lived in extdeps/, fleet_intent (which is in gunbc) would import them from extdeps, but ExecutionSurface itself is a gunbc-layer type — so the field types must be at extdeps or gunbc. They're not universal standards (not std) and not cited external-authority facts (not extdeps) — they're gunbc fleet-operation concepts, so gunbc.fleet_intent is the single authority that holds them co-located with their first consumer. fleet_container and ci_fleet import from fleet_intent (sibling gunbc modules) which is correct.

@briansrls
briansrls merged commit 60b137c into main Jun 29, 2026
2 checks passed
@briansrls
briansrls deleted the session/vivid-wren-440-relocation branch June 29, 2026 00:44
gunbai-bot Bot pushed a commit that referenced this pull request Jul 3, 2026
Qualify P0–P5 as this design's namespace (input-envelope-roadmap P2 = P5); repoint ResourceEnvelope and PerformanceReceipt to gunbc.fleet_container / gunbc.fleet_intent (#5904); replace dissolved WorkDemand with live floor admission carriers.

Co-authored-by: Cursor <cursoragent@cursor.com>
briansrls added a commit that referenced this pull request Jul 3, 2026
…e scheduler types; this is the design record): author the operator-signed 'bounded-input / cost-envelope scheduling' design. WORK OFF FRESH origin/main (post dsl->dag rename: the roadmap authority is dag/gunbc/roadmap_authority.dag (#6198)

* WIP: CAPTURE (docs + roadmap, model-before-implement — do NOT implement the s

* Author operator-signed bounded-input / cost-envelope scheduling design.

Unifies InputEnvelope → CostEnvelope → scheduling into one plan authority, enrolls it in the plan registry, and updates the roadmap with operator sign-off — design record only, no scheduler implementation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix design doc carrier refs and phase namespace per review.

Qualify P0–P5 as this design's namespace (input-envelope-roadmap P2 = P5); repoint ResourceEnvelope and PerformanceReceipt to gunbc.fleet_container / gunbc.fleet_intent (#5904); replace dissolved WorkDemand with live floor admission carriers.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot Bot pushed a commit that referenced this pull request Jul 15, 2026
- R5 compute_fabric relationship: Shape IS the degenerate one-axis
  MachineShape; market stays thin (no #5904 rebuild); Fabric = outermost
  rung of the recursive supply tower. Convergence-map row added.
- R6 evidence carriers: staged convergence (Quantified for greenfield,
  P1 receipts reuse Evidence.MeasuredBy, CostBasis migrates on forced
  join); owner = #6663 lane.
- R7 Energy: derived quantity (Power x Time), lands Phase 1, is the
  F3 dedupe.
- R8 scheduling invariant REFINED not superseded (operator: determinism
  was being conflated with input-invariance — different machines are
  different inputs). Surviving wall: no UNSTABLE (MeasuredBy) inputs to
  topology; declared shape is a stable input; cross-host schedule_eq
  demoted to corollary under equal declared shapes. Phase 3 UNBLOCKED.

Open list rewritten: law-carrier home, SymbolIndex sequencing, hash
convergence (dispatched), P0 field wall (#6663) remain.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
briansrls added a commit that referenced this pull request Jul 16, 2026
… evidence carriers, Energy, scheduling-invariant refinement) (#6685)

* WIP: map reduce

* WIP: map reduce

* WIP: map reduce

* WIP: map reduce

* machine-shape plan: end shape agreed, no-kind rule, convergence map to existing carriers

- §2 terminal model pinned (operator rulings 2026-07-15): one locality lattice
  (lifted to std, converging BOTH existing latency enums), divergence/idle-lane/
  crossing laws, Placement dissolution trigger, kind-erasure at the
  ComputeHost→MachineShape derivation boundary
- convergence map: every end-shape element bound to its existing carrier
  (HardwareThreadCount reused for lane_count; PlacementSupplyRow identified as
  the degenerate single-domain MachineShape; PTX ThreadHierarchyShape/PtxCost
  gain their consumer; MemoryKind.UnifiedShared flagged as topology-in-technology)
- MemoryLevel.sharing dropped: sharing derives from SharedLevelEdge graph
  structure (single authority)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: map reduce

* machine-shape plan: address operator request-changes (7 blocking findings)

- MachineShape is now a representable graph: DomainId/LevelId identities,
  explicit edge endpoints, SharedLevelEdge references the owner's level by id
  (embedding duplicated it), InterconnectLink coproduct holds NetworkAttach
  (LinkEdge was PcieLink-only while the map claimed NetworkInterface as a fill),
  terminal Placement = DomainId reference; dangling refs refuse
- Phase 3 batching vs signed scheduling authority: conflict acknowledged, now
  an EXPLICIT supersession proposal (topology = pure fn of declared shape;
  MeasuredBy banned from topology; schedule_eq generalized to equal-given-equal-
  declared-inputs) gated on operator sign-off, with a confined fallback
- both §5 fallback arms converted to refusals: Priced|PricingRefused{missing}
  (no term-incomplete Predicted accounts), Placed|PlacementRefused{missing}
  (no stay-at-current-domain answer)
- Quantified<T> restructured: Precision (Exact|Interval) x Evidence
  (Cited|MeasuredBy{ExecutionReceiptDigest}|DerivedFrom) — evidence-bearing
  constructors make the authored-literal RED enforceable
- locality/latency split into two axes: latency = per-level magnitude with one
  std class projection (converging ReadLatencyClass + network LatencyClass);
  locality = graph-derived, domain-relative (no universal total order)
- OperandFlow total derivation spelled out: operand_root (fail-closed), hash-
  authority convergence precondition (v2.std.node.Hash vs ContentHash — the
  fnv1a64 thread), edge->root mapping for node_keyed_graph_transitive_bytes,
  OperandFlowRefused rows
- AssociativityEvidence subject-bound: {combine, inhabitant, law, receipt},
  license requires structural identity with the scheduled combine; keyed-patch
  witness scoped to mechanism-precedent-only; within-fold expansion scoped
  kernel-internal (never central Schedule topology)
- corrections: PlacementSupplyRow has zero production callers (grep -l
  overcount); document-level dissolution trigger added (Plan-row registration
  = part of Phase 1 definition of done)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* de-orphan machine-shape plan doc + correct doc_reachability lying live-tree stamp

Two fixes from the docs-enforcement audit (operator-directed):

1. bind: provenance row in accelerator_demo_plan.dag makes
   docs/plans/machine-shape-orthogonal-scheduling.md doc-graph-reachable
   (the established hand-authored-design-md convention: accelerator_demo_plan
   :51, live_read_classification.dag:66). Registration as a gunbc.plan.Plan
   row stays the md's declared Phase-1 dissolution — registering now would
   flip the actively-evolving doc into a generated artifact prematurely.
   Verified by build_doc_graph_report replication: doc_count=107,
   orphan_count 1->0, dangling 0.

2. doc_reachability_witness_test live_tree_disposition: SubstrateInputsOnly
   -> ReadsLiveTree. The 2026-07-12 machine stamp (#6479 entry-text batch)
   was false: every test fn reads the live docs/ tree via doc_graph_* host
   builtins — the exact classifier blind spot live_tree.dag:5 declares.
   The false stamp made the orphan wall predict-skippable, which composed
   with the docs-only floor shortcut into a pre-merge false-green (this PR
   minted an orphan with green CI). ReadsLiveTree restores the never-skip
   tooth: the wall now runs on every full floor, including this PR's.

This diff leaves the docs-only shortcut class, so this PR runs the full
floor with the corrected stamp — the wall itself verifies the de-orphan
by execution, pre-merge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* bind main's orphaned no-smuggled-programs-wall.md from its lens carrier

The doc merged to main orphaned (docs-only shortcut + then-lying
doc_reachability stamp — the same false-green class this PR fixes).
With the stamp corrected, the orphan wall's first live pre-merge run
(this PR's floor) caught it: 1 of 1880 witnesses red. Bound from
medium_structure_containment.dag, the wall the design doc signs —
same bind-from-carrier convention as accelerator_demo_plan.dag:51.

Verified by build_doc_graph_report replication on the merged tree:
doc_count=108, orphan_count 1->0, dangling 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: map reduce

* machine-shape plan: apply #6663 review amendments 1+2

- Amendment 1: the 'evidence carried by construction' claim is gated on the
  record-field wall (witness-realization P0 / #6663 audit F1) — the
  typechecker checks field NAMES only (refuted-by-execution: Known omitting
  evidence compiles at 0 diagnostics); P0 named a Phase-1 acceptance
  precondition. Asymmetry recorded: the no-kind wall rests on field-name
  checking, which DOES hard-error — it holds today; evidence-required does not.
- Amendment 2: Phase 2 claims the DerivedFrom fill of CostAccount.space only;
  the AIMD governor's dissolve-on additionally requires MeasuredBy per-runnable
  peaks (witness-realization P1) — derived operand footprint and measured peak
  are different space facts (receipt: 6.25GB VmSize vs KB operands — retention,
  not operands; the v1 run-stability axis).
- Cross-refs: P4 composition note in the supersession paragraph; P1 named
  third party to the Quantified/CostBasis convergence (one carrier, not three;
  realization_measurement.dag merge-order flagged); Energy/Watt divergence
  deduped with audit F3 (owner TBD).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: map reduce

* heal main's composed drift + re-anchor vacuity design docs (unblocks all full-floor PRs)

Main's tree (post #6638/#6664) fails generated_artifact_drift_gate_passes on
every full floor: the vacuity lane hand-added a 'Sibling family' paragraph to
the GENERATED docs/plans/inert-layer-lens.md without updating its generating
Plan row (dag/gunbc/plans/inert_layer_lens.dag) — committed != regenerated.
Their docs-only PRs merged through the docs-only shortcut, which skipped both
the drift gate and the doc-graph wall.

1. Regenerate inert-layer-lens.md (paragraph removed; byte-identical to
   warm-crab-65's independent main_wet regen on #6658 — same blob 2b36cf2).
2. That hand-edit was ALSO the only doc-graph anchor for the vacuity lane's
   two design docs; regen alone orphans vacuity-lens-design.md and (via its
   link chain) lens-consolidation-design.md. Re-anchored with a bind:
   provenance row in dag/std/materialization_ladder.dag — the file whose
   AuthoredDuplication verdict the vacuity doc's load-bearing correction is
   about — migrating to the vacuity lens .dag carrier when it lands.

Verified by build_doc_graph_report replication: doc_count=110,
orphan_count=0, dangling=0.

Follow-up for the vacuity lane: re-add the sibling-family paragraph via the
inert_layer_lens Plan row (the authority), not the generated md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: map reduce

* machine-shape plan: record operator rulings 5-8 (2026-07-15)

- R5 compute_fabric relationship: Shape IS the degenerate one-axis
  MachineShape; market stays thin (no #5904 rebuild); Fabric = outermost
  rung of the recursive supply tower. Convergence-map row added.
- R6 evidence carriers: staged convergence (Quantified for greenfield,
  P1 receipts reuse Evidence.MeasuredBy, CostBasis migrates on forced
  join); owner = #6663 lane.
- R7 Energy: derived quantity (Power x Time), lands Phase 1, is the
  F3 dedupe.
- R8 scheduling invariant REFINED not superseded (operator: determinism
  was being conflated with input-invariance — different machines are
  different inputs). Surviving wall: no UNSTABLE (MeasuredBy) inputs to
  topology; declared shape is a stable input; cross-host schedule_eq
  demoted to corollary under equal declared shapes. Phase 3 UNBLOCKED.

Open list rewritten: law-carrier home, SymbolIndex sequencing, hash
convergence (dispatched), P0 field wall (#6663) remain.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: map reduce

* machine-shape plan: reconcile §2/§3/§5/§8 with rulings 6-8 (cursor review on #6685)

Five stale spots aligned: Energy divergence now records ruling 7 (was
'flagging for operator'); the Quantified/CostBasis rows in §2 and the
convergence map record ruling 6's staged convergence (was 'open Q1');
§5's batching rule reads 'under the refinement' (was 'supersession');
§8's schedule_eq wall restated per ruling 8 (corollary under equal
declared shapes, not unconditional).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
gunbai-bot Bot pushed a commit that referenced this pull request Aug 19, 2026
…nt finding was wrong

Two corrections, one of which changes how Cut B has to be executed.

THE DELETION IS NOT THE CENSUS HERE. Every reference to product.compute_fabric
in the corpus is a string literal; there is no import of it anywhere. So
deleting the module refuses nothing, and the doctrine's "the deletion is the
census" does not apply. The census has to be read before the cut rather than
discovered by it, or a cut relying on compile refusals will find none and
conclude it is done.

The census is also larger than the first version said: five witnesses inside the
production module, a separate witness file, two host_standup prose strings, five
plan documents, and DESIGN section 2 (fixed separately in #8559). Several plan
docs cite types the module no longer has, which its own dissolution receipt
records as removed in #5904 -- the prose was stale before this cut.

AND MY ENDPOINT FINDING WAS WRONG. I recorded that grounding_lens_test cites
product.compute_fabric.Endpoint as a fabricated citation of the section 3 class.
It is a controlled fixture: two hand-built concept_decl rows testing that a
product.* namespace is not layer-excluded, and the sibling row names
product.network_topology.Url, which also does not exist. The test needs a string
shaped like a product qualified name, not one that resolves, and an
independently authored fixture is exactly what DESIGN section 5 endorses. I read
a fixture as a citation because the string looked like one.

Recorded rather than quietly removed. A plan that silently drops its own false
claims teaches nothing, and this is the same adjacent-question error the
document charges elsewhere.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf
briansrls pushed a commit that referenced this pull request Aug 19, 2026
…rements move to product.fabric.work (#8560)

* Cut B (HELD): delete product.compute_fabric at the root; census, witnesses, and prose fixed forward

Held, not pushed: #8413 merged to main after this was authored and
product.fabric supply/work now import product.compute_fabric Shape, so the
deletion refuses inside a tree this session was told not to edit. Awaiting the
carrier decision before completing.

* Cut B: delete product.compute_fabric at the root; Shape and HardRequirements move to their owner

The dead root goes: Fabric, Program, ComputeNeed, Opportunity, Connection,
connect, shape_covers, derive_shape, the five example rows and the five
in-module witnesses. None of it had a decision consumer.

Shape and HardRequirements are NOT replaced — they MOVE, to product.fabric.work.
They are the module's only load-bearing content, and they are work-side facts:
Shape is what a WorkSpec requires and what an Offer offers, and work.dag's
shape_material already destructures the axis deliberately, so the axis wall now
sits beside the carrier instead of one module away. supply.dag already imported
work, so the edge exists and no cycle is introduced. (Operator ruling: move the
surviving authority to its owner rather than hunt a substitute so the old file
can die with its contents intact. ExecutionClassRef / ResourceSupplyRef were
considered and do not exist on main.)

THE DELETION IS PARTLY A CENSUS, contrary to the plan it was briefed from: the
"every reference is a string literal, nothing refuses" measurement grepped the
qualified module name only, and a .dag reference can be a bare name. Two real
structural dependents were invisible to it -- host_standup_spine_witness_test
called witness_fabric_binds_need_to_opportunity() bare, and #8413 landed three
imports of Shape while the cut was being authored. Both refuse loudly and both
are handled here.

Dispositions, each decided rather than swept:
- The five in-module witnesses die with their subject; they assert properties of
  the deleted types. One consequence is recorded rather than dropped: the
  module's own #5904 dissolution receipt named witness_hard_requirement_unmet_is_unmet
  as the THREAD-FLOOR COVERAGE for that earlier dissolution, and deleting the
  receipt alongside the coverage is how a guarantee disappears with nobody
  deciding to drop it. The successor obligation is now stated in the plan prose
  as unhomed.
- compute_fabric_resource_witness_test split: its connector test dies, its four
  fleet_container demand-envelope witnesses survive and move to
  test.claim.fleet_container_demand_envelope_witness, because a file named for
  compute_fabric holding only fleet_container claims is a stale name.
- host_standup_spine_witness_test's claim SURVIVES with a retarget: the shape
  authority is still referenced rather than redeclared, and now points at
  product.fabric.work. The witness checks the refusal string names it.
- host_standup's two prose strings become true again: the shape carrier is
  referenced; what the deletion removed and nothing replaced is the
  need/opportunity MATCH, so the enroll decision has no authority. Its gap-ledger
  row moves gap-shape-only -> gap, which made a third string false (it enumerated
  five modeling values, and only four now occur) -- corrected too.

Prose: five plan modules and four hand-authored docs carried claims that a
deleted thing is live; corrected. Several were ALREADY false before this cut
(#5904 had moved ResourceEnvelope and PerformanceReceipt out years of commits
ago) and now name their live homes. The dated 2026-06-21 inert-layer measurement
is left AS MEASURED with a note, not rewritten -- a measurement is a fact about a
moment. phase_profile.rs's dissolution trigger stops naming a path that never
existed in this repo. The three generated plan .md are regenerated through
dag/tools/generated_artifact_gate.dag main_wet with a tree-built binary, not
hand-edited.

DESIGN.md and src/v2/test/claim/grounding_lens_test.dag are deliberately
untouched: the first is #8559's, and the second needs a string SHAPED like a
product qualified name, not one that resolves.

---------

Co-authored-by: gunbc-ci-auto-heal <searlsbrian@gmail.com>
Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
briansrls pushed a commit that referenced this pull request Aug 19, 2026
…is replaced (#8550)

* Fabric recut program: the carriers survive, the layer underneath is replaced

Signed off by external review with candidate (b) for the lease
decomposition. Records the program, the verified fork census, the measured
blast radii, and the fourteen controls that gate merge.

The verdict: #8413 does not land in its current carrier shape. The six
product concepts (Demand, Work, Attempt, Offer, ExecutionGrant, Receipt)
survive; the layer beneath them forks nine existing authorities. Each fork
verified by execution against branch 66dc3aa and main a2b33f5 rather
than accepted from the review.

Two corrections are recorded rather than quietly absorbed:

The review's stated support for recutting -- that the PR is stale at
ed2d375 and non-mergeable -- is FALSE. The branch is at 66dc3aa,
MERGEABLE/CLEAN and CI-green; its earlier 44 failures were entirely main's.
The recut stands on the fork census alone, and a conclusion carried by a
false premise decays the moment someone checks it.

And my own claim that owner_fingerprint's absence CAUSED the unchecked
attester is refuted. Lease owner and receipt attester are independent
identities that coincide only in the first vertical -- a worker attests
execution, a meter attests usage, a billing observer attests spend. So the
lease decomposition and attester authorization are parallel repairs, not a
chain, and the attester goes through std.access rather than a branch in the
epoch comparator. Controls 7 and 8 exist precisely to stop the conflation
returning: testing only "foreign attester refuses" passes under it.

Verified while writing: std.effect_grant Envelope and envelope_bounded_by
are present on main and are the authority envelope, so product.fabric
duplicates no Verb or child-boundedness. And extdeps/accounting/encumbrance
is NEW on the branch and absent from main -- a generic cited kernel that is
endorsed unchanged, not part of the layer being replaced.

Doc registered as a HandAuthoredDocBind on std.temporal_effect HeldLease
with ComputationIdentity and ComputeOffer as additional works; all three
symbols verified to resolve, and the three doc_graph bind witnesses return
true.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Cut order: two roots, not one — and two defects found while verifying it

Sequencing signed off. My framing of 'the old market vocabulary' as one
root was wrong: it bundles a dead root, a live supply authority, and a
wrong product-interface dependency into one migration.

X1 product.compute_fabric is dead — verified, its only non-plan mentions on
main are inside string literals in gunbc.host_standup (a refusal: message
and an authority_or_interim: field), so there is no production decision
consumer and it deletes outright.

X2 gunbc.ci_fleet.ComputeOffer is live and is the real migration. The
finding that reorders everything: the workflow edge ComputeOffer ->
runner_spec_from_offer -> RunnerSpec -> witnesses.yml is itself wrong,
because it derives GitHub labels from the physical host, so the
customer-facing execution class depends on physical supply and every supply
migration is a workflow migration. gunbc.ci_runner_target is a smaller
interception point (verified present with consumers).

Order: A canonical LeaseEpoch, B delete the dead root, C sever physical
supply from the public CI interface, D replace live ComputeOffer. C is what
makes D safe.

Two defects found while verifying rather than assumed, both recorded so the
deletion does not silently leave them: src/v2/test/claim/grounding_lens_test
cites product.compute_fabric.Endpoint, which has ZERO occurrences in that
module — a fabricated citation in a lens test that will not surface as a
compile refusal on deletion because it is a qualified-name string. And five
witnesses live inside the production module, so the deletion is not a single
file removal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Resolve the last two open questions: WorkContentKey survives, and six modules are not the present six

The two items §5 left undecided came back with answers that both refuse the
author's proposal, in opposite directions.

I proposed deleting the Work key as a rename of ComputationIdentity's
structural member. Refused: a qualification result is a verdict about two
things, a content address answers for one. Collapsing them erases addressing
rather than deduplicating it. The carrier survives as WorkContentKey wrapping
ContentHash — not a branded string, because brands are unenforced here, so a
brand would be a name standing where a distinct carrier was available. Derived
canonical-contract → hash → key, never caller-supplied.

On module boundaries, both extremes were refused. One module fuses eight
concerns into one file; the present six have backward imports (supply borrows a
receipt ref from demand, budget borrows an account id from demand and a
reservation ref from execution) and a central freely-constructible identity
record. The answer is an acyclic authority graph — the count is incidental. The
identity module is deleted and each owner defines its own key, projected through
std.key_relation.ScopedKey.

Also records Cut E (module recut) and the market allocation fold that follows
it, and the merge constraint on #8413: it may not merge while ComputeOffer and
Offer are both authoritative. #8413 is preserved, not closed — A–D merge into
its branch so its final diff is the product protocol.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Correct two things Cut A found wrong by touching them: LeaseKey does not exist, and the census was stale

Cut A landed on #8553 and returned two corrections against this doc, both of
which are the doc's fault rather than the implementation's.

Section 7 spelled lease_key: LeaseKey. There is no such type on main and I had
not checked. Cut A refused to mint it, and the refusal is right: an unenforced
alias is the hollow-alias mode, and minting one inside the authority a
consolidation cut exists to establish is where it does the most damage. The
field is NonEmptyStr; a branded key lands with its validating mint or not at
all.

The HeldLease census read 8 against an older base and is 10 at 8687f2a --
two witness consumers landed between. Corrected with the base named, because a
census with no base is not a measurement.

Also records that the per-witness gunbc run route is narrower than the brief
claimed. I verified it does work on a zero-import claim file, so the flat "it
does not work" is wrong too; what is established is that cross-module type
reach fails through it and the boundary is not yet known. Until it is, the
required-floor run is the only receipt covering every witness.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* The run-recipe boundary is the binary: bare gunbc in a gunbc checkout reaches the baked pin

Two explanations were proposed for why the per-witness route failed and both
are now refuted by execution. Cut A's discriminating pair killed the closure
candidate (three --function selections from one file yield identical file-wide
diagnostics naming unselected functions, so --function selects nothing about
resolution) and the base candidate (identical across five main commits spanning
129).

The variable is which binary the invocation reaches. The ctrl-build shim has an
explicit gunbc-checkout guard that execs the baked /usr/local/bin/gunbc when
cwd's origin is this repo. Confirmed on one specimen: the baked binary reports
"resolved 1 sources" and then unresolved NonEmptyStr/ContentHash/Timestamp,
while the tree-built binary evaluates and returns the value. It never walks the
source roots, so the corpus is invisible and the diagnostics land on whatever
line first mentions a type.

That failure mode matters more than the inconvenience: a stale binary produces
a plausible located diagnostic in the file under test, which is the fabricated
plausible output shape pointed at the author's own instrument. The doc now
requires an explicit ./target/release/gunbc path for every cut.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Re-measure the Cut B census: zero structural consumers, and my Endpoint finding was wrong

Two corrections, one of which changes how Cut B has to be executed.

THE DELETION IS NOT THE CENSUS HERE. Every reference to product.compute_fabric
in the corpus is a string literal; there is no import of it anywhere. So
deleting the module refuses nothing, and the doctrine's "the deletion is the
census" does not apply. The census has to be read before the cut rather than
discovered by it, or a cut relying on compile refusals will find none and
conclude it is done.

The census is also larger than the first version said: five witnesses inside the
production module, a separate witness file, two host_standup prose strings, five
plan documents, and DESIGN section 2 (fixed separately in #8559). Several plan
docs cite types the module no longer has, which its own dissolution receipt
records as removed in #5904 -- the prose was stale before this cut.

AND MY ENDPOINT FINDING WAS WRONG. I recorded that grounding_lens_test cites
product.compute_fabric.Endpoint as a fabricated citation of the section 3 class.
It is a controlled fixture: two hand-built concept_decl rows testing that a
product.* namespace is not layer-excluded, and the sibling row names
product.network_topology.Url, which also does not exist. The test needs a string
shaped like a product qualified name, not one that resolves, and an
independently authored fixture is exactly what DESIGN section 5 endorses. I read
a fixture as a citation because the string looked like one.

Recorded rather than quietly removed. A plan that silently drops its own false
claims teaches nothing, and this is the same adjacent-question error the
document charges elsewhere.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Cut B: the census claim was false, the method is the finding, and Shape moves to product.fabric.work

I asserted that every reference to product.compute_fabric is a string literal,
so the deletion refuses nothing. False. host_standup_spine_witness_test calls
the module's own witness_fabric_binds_need_to_opportunity by bare name, and so
does compute_fabric_resource_witness_test; both predate the base I measured.

The method is the real finding. I grepped the module name, and a bare call
carries no module name, so that grep could never have found it. A .dag
reference takes at least three forms and I checked one, then reported the
output as a structural fact. Caught by the implementer, not by me.

#8413 also merged mid-cut, adding three real imports of Shape from
product.fabric. Ruling: Shape and HardRequirements move into
product.fabric.work and the rest of compute_fabric is deleted. The dead
module's only load-bearing content is Shape, and a replacement migration moves
the surviving authority to its owner rather than finding a substitute so the
old file can die intact. supply.dag already imports work, so the edge exists
and nothing is minted -- which matters because my earlier brief named
ExecutionClassRef and ResourceSupplyRef as the alternatives and neither exists
on main. Naming unavailable carriers is how a brief pushes someone into minting
one inside a deletion.

Also records the thread-floor coverage obligation that must outlive the cut,
and keeps the earlier Endpoint correction. Two false findings in one section,
both about whether a string was a reference.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Cut C rewritten after measurement: the seam exists, and the live workflow emitter bypasses it

I specified Cut C as severing a wrong edge -- the customer-facing execution
class depending on physical supply -- and said the seam needed building. Both
halves were wrong.

gunbc.ci_runner_target already exists, already is the authority, and already
projects the runs-on spec and the memory regime from one selection. Its
FleetSelfHosted arm delegating to runner_spec_from_offer is correct and
deliberate: a self-hosted fleet runner's labels genuinely are facts about the
physical fleet.

The real defect is narrower. witness_floor_workflow reads gunbc_ci_runner_spec()
-- the un-seamed function -- while the seam's own projection
gunbc_ci_selected_runner_spec() has no workflow consumer at all. The module's
note says "ci_workflow reads the spec projection now", but ci_workflow was
deleted in the floor cut, so the bypass is most likely collateral of that cut
rather than an original decision.

It is a provably safe change: ci_runner_target_witness_test already asserts the
two specs are equal, so the emission is byte-identical and that witness is the
control. What it buys is that runner selection becomes a one-row edit again --
the whole reason the seam was built -- and one of three direct
runner_spec_from_offer call sites disappears ahead of Cut D. The other two are
legitimately about physical placement and stay.

Also records the stale present-tense note inside ci_runner_target itself, and
the Cut D census measured by declaration name rather than module name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Cut D is not a type swap: Offer deliberately carries no physical facts, and the label derivation reads them

Measured the two carriers rather than assuming they were the same shape, since
the last three specifications here were wrong from under-measuring.

ComputeOffer carries ComputeSupplyFacts -- a ComputeHost, an ExecutionSurface,
observed performance. Offer<P> carries none of that: id, executor, a one-axis
Shape, capabilities, trust domain, quantity bound, quote, evidence. The absence
is deliberate and consistent with the module's own reasoning about
remaining_capacity: an offer states what is offered and on what terms, and the
physical realization behind it belongs to another layer.

So runner_spec_from_offer's reads of offer.supply.physical and
offer.supply.execution.os have no counterpart in the replacement, and "migrate
the consumers to Offer" is under-specified in the way that pushes an
implementer into either widening Offer with physical fields -- fusing
realization into the offer, exactly what its shape avoids -- or quietly
dropping the derivation.

Records the three honest options and picks none unilaterally. Also strengthens
the ordering argument: Cut C removes the CI interface from Cut D's population,
so the physical-facts question gets answered once at the runner-target seam
rather than once per consumer mid-migration. Cut D is not dispatchable until
one option is signed off.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Cut D signed off: decompose the fused carrier rather than replace it, and all three of my options were wrong as stated

The fork came back refusing every option in the form I put it. The construction
is a combination: option 1's severance but with ExecutionClass rather than
ComputeHost as the destination, option 3's relation as a provider-owned
OfferBacking rather than a field on Offer, and option 2 rejected outright.

Option 1 was right that runner_spec_from_offer reads no market fact, and wrong
about where the labels come from: runner labels describe the environment
presented to the job, not the bare-metal host, so ComputeHost -> RunnerSpec
still points the wrong way. Option 2 would collapse selected execution class
into selected physical backing, making the customer-facing target change
whenever placement changes. Option 3's relation is necessary but is not
one-to-one, so a single field would make quoted supply unrepresentable.

Severing does not lose the offered-versus-ran link: it is proven at offer
publication, grant issuance and realization readback, and the severance removes
the relation from the wrong consumer rather than removing the relation.

Verified the observed_performance ruling rather than taking it, and it is
stronger than stated: one declaration, five row initializers all empty, one
plan mention. No consumer and no data.

Records Cut D as a five-way consumer classification in four steps, and adds a
fourth acceptance condition to Cut C -- the old direct projection is marked for
deletion with D rather than surviving as a permanent equal path, which is what
keeps C from creating the interval it exists to close.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

* Cut C's carve-out gives Cut D a precondition: D4 cannot delete runner_spec_from_offer yet

Condition 2 is ruled to read "no CI workflow emitter", not "no production
emitter". fleet_converge_workflow calls gunbc_ci_runner_spec directly and must
not be routed through the CI seam: selected_ci_runner_target is a one-row
function built to be flipped to a cloud runner, and fleet convergence must run
on the fleet, so a flip would send the converger to a machine that cannot reach
the hosts it converges. Which machine runs CI and which machine converges the
fleet are two questions with the same answer today and not the same question --
FleetSelfHosted there is a coincidence of value, and merging the authorities
would be nicknaming in reverse.

That carve-out has a consequence neither the sign-off nor I had seen: D4's
deletion list includes runner_spec_from_offer, gunbc_ci_runner_spec lives in it,
and fleet_converge_workflow still consumes it. So D4 cannot execute as written.
Fleet convergence needs its own fleet-derived runner authority first, and the
deletion is conditional on it.

Recorded now rather than at D4, because a deletion list that cannot execute
surfaces as an implementer improvising a merge of two authorities to make the
cut compile -- the arm this program has already had to stop twice.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant