roadmap: sign-off convergence mechanism (closure requires operator sign-off, not PR merge)

dsl/gunbc/roadmap_authority.dag

@@ -9,7 +9,7 @@ import gunbc.roadmap_model {
   NodeSizing, Unsized, Sized,
   SectionElement, section_prose, section_group,
 }
-import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, PlainLine }
+import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, PlainLine, Signoff, Unsigned, SignedOff }
 import ctrl.process_algebra { ProcessNodeId }
 import std.markdown { MarkdownBlock, HeadingBlock, ParagraphBlock, TextInline, H1 }
 import extdeps.languages.markdown { serialize_markdown_source }
@@ -19,30 +19,36 @@ fn nid(s: String) -> ProcessNodeId { s }
 fn ptr(label: String, path: String) -> Pointer { Pointer { label: label, path: path } }
 fn plan_ptr(path: String) -> List<Pointer> { [Pointer { label: "plan", path: path }] }
 
+fn unsigned() -> Signoff { Unsigned }
+
+fn signed(by: String, works: Bool, scope_equivalent: Bool, as_expected: Bool) -> Signoff {
+  SignedOff { by: by, works: works, scope_equivalent: scope_equivalent, as_expected: as_expected }
+}
+
 fn authored(id: String, done: Bool, content: String) -> RoadmapNode {
-  RoadmapNode { node: nid(s: id), line: AuthoredLine { done: done, content: content }, carriers: [], sizing: Unsized }
+  RoadmapNode { node: nid(s: id), line: AuthoredLine { done: done, content: content }, carriers: [], sizing: Unsized, owner: "", signoff: Unsigned }
 }
 
 fn authored_doc(id: String, done: Bool, content: String, path: String) -> RoadmapNode {
-  RoadmapNode { node: nid(s: id), line: AuthoredLine { done: done, content: content }, carriers: plan_ptr(path: path), sizing: Unsized }
+  RoadmapNode { node: nid(s: id), line: AuthoredLine { done: done, content: content }, carriers: plan_ptr(path: path), sizing: Unsized, owner: "", signoff: Unsigned }
 }
 
 fn authored_pp(id: String, done: Bool, content: String, carriers: List<Pointer>) -> RoadmapNode {
-  RoadmapNode { node: nid(s: id), line: AuthoredLine { done: done, content: content }, carriers: carriers, sizing: Unsized }
+  RoadmapNode { node: nid(s: id), line: AuthoredLine { done: done, content: content }, carriers: carriers, sizing: Unsized, owner: "", signoff: Unsigned }
 }
 
 fn plain(id: String, content: String) -> RoadmapNode {
-  RoadmapNode { node: nid(s: id), line: PlainLine { content: content }, carriers: [], sizing: Unsized }
+  RoadmapNode { node: nid(s: id), line: PlainLine { content: content }, carriers: [], sizing: Unsized, owner: "", signoff: Unsigned }
 }
 
 fn derivable(id: String, prs: List<Int>, title: String, description: String) -> RoadmapNode {
-  RoadmapNode { node: nid(s: id), line: DerivableLine { prs: prs, title: title, description: description }, carriers: [], sizing: Unsized }
+  RoadmapNode { node: nid(s: id), line: DerivableLine { prs: prs, title: title, description: description }, carriers: [], sizing: Unsized, owner: "", signoff: Unsigned }
 }
 fn derivable_doc(id: String, prs: List<Int>, title: String, description: String, path: String) -> RoadmapNode {
-  RoadmapNode { node: nid(s: id), line: DerivableLine { prs: prs, title: title, description: description }, carriers: plan_ptr(path: path), sizing: Unsized }
+  RoadmapNode { node: nid(s: id), line: DerivableLine { prs: prs, title: title, description: description }, carriers: plan_ptr(path: path), sizing: Unsized, owner: "", signoff: Unsigned }
 }
 fn derivable_pp(id: String, prs: List<Int>, title: String, description: String, carriers: List<Pointer>) -> RoadmapNode {
-  RoadmapNode { node: nid(s: id), line: DerivableLine { prs: prs, title: title, description: description }, carriers: carriers, sizing: Unsized }
+  RoadmapNode { node: nid(s: id), line: DerivableLine { prs: prs, title: title, description: description }, carriers: carriers, sizing: Unsized, owner: "", signoff: Unsigned }
 }
 
 fn derivable_wi(id: String, prs: List<Int>, title: String, description: String, intricacy: Intricacy, volume: Volume, repo: String) -> RoadmapNode {
@@ -51,6 +57,8 @@ fn derivable_wi(id: String, prs: List<Int>, title: String, description: String,
     line: DerivableLine { prs: prs, title: title, description: description },
     carriers: [],
     sizing: Sized { intricacy: intricacy, volume: volume, repo: repo, acceptance: PrsMerged },
+    owner: "",
+    signoff: Unsigned,
   }
 }
 
@@ -60,9 +68,19 @@ fn authored_wi(id: String, done: Bool, content: String, intricacy: Intricacy, vo
     line: AuthoredLine { done: done, content: content },
     carriers: [],
     sizing: Sized { intricacy: intricacy, volume: volume, repo: repo, acceptance: ManualAcceptance },
+    owner: "",
+    signoff: Unsigned,
   }
 }
 
+fn owned(rn: RoadmapNode, owner: String) -> RoadmapNode {
+  RoadmapNode { node: rn.node, line: rn.line, carriers: rn.carriers, sizing: rn.sizing, owner: owner, signoff: rn.signoff }
+}
+
+fn sign(rn: RoadmapNode, s: Signoff) -> RoadmapNode {
+  RoadmapNode { node: rn.node, line: rn.line, carriers: rn.carriers, sizing: rn.sizing, owner: rn.owner, signoff: s }
+}
+
 fn preamble() -> List<MarkdownBlock> {
   [
     HeadingBlock { level: H1, inlines: [TextInline { text: "gunbc — Roadmap" }] },

dsl/gunbc/roadmap_emit.dag

@@ -11,15 +11,31 @@ import gunbc.roadmap_model {
   SectionElement, Prose, Group, SectionProse, SectionGroup,
 }
 
-import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, PlainLine, item_is_done }
+import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, PlainLine, item_is_done, signoff_accepts, signoff_by }
 import ctrl.process_algebra { ProcessNodeId }
 
 fn roadmap_max_depth() -> Int { 8 }
 
 fn node_is_done(rn: RoadmapNode, merged: List<Int>) -> Bool {
+  signoff_accepts(s: rn.signoff)
+}
+
+fn node_evidence_present(rn: RoadmapNode, merged: List<Int>) -> Bool {
   item_is_done(item: rn.line, merged: merged)
 }
 
+fn signoff_suffix_inlines(rn: RoadmapNode, merged: List<Int>) -> List<MarkdownInline> {
+  if signoff_accepts(s: rn.signoff) {
+    [TextInline { text: concat(" — ✓ signed off: ", signoff_by(s: rn.signoff)) }]
+  } else {
+    if node_evidence_present(rn: rn, merged: merged) {
+      [TextInline { text: " — ⏳ awaiting sign-off" }]
+    } else {
+      []
+    }
+  }
+}
+
 fn pointer_inlines(p: Pointer) -> List<MarkdownInline> {
   [
     TextInline { text: " " },
@@ -90,7 +106,7 @@ fn plain_item_for(rn: RoadmapNode) -> MarkdownListItem {
 }
 
 fn task_item_for(rn: RoadmapNode, nodes: List<RoadmapNode>, edges: List<RoadmapEdge>, merged: List<Int>, fuel: Int) -> MarkdownTaskItem {
-  let para = ParagraphBlock { inlines: node_inlines(rn: rn) }
+  let para = ParagraphBlock { inlines: concat(node_inlines(rn: rn), signoff_suffix_inlines(rn: rn, merged: merged)) }
   let kids = if fuel > 0 { children_of(nodes: nodes, edges: edges, parent: rn.node) } else { [] }
   let blocks = if count(kids) > 0 {
     concat([para], nodes_to_blocks(items: kids, nodes: nodes, edges: edges, merged: merged, fuel: fuel - 1))

dsl/gunbc/roadmap_model.dag

@@ -1,7 +1,7 @@
 module gunbc.roadmap_model
 
 import ctrl.process_algebra { ProcessNodeId }
-import gunbc.roadmap_status { RoadmapItem, DriftVerdict, status_drift }
+import gunbc.roadmap_status { RoadmapItem, DriftVerdict, Signoff, signoff_accepts, signoff_drift }
 
 type Pointer { label: String, path: String }
 
@@ -28,6 +28,8 @@ type RoadmapNode {
   line: RoadmapItem
   carriers: List<Pointer>
   sizing: NodeSizing
+  owner: String
+  signoff: Signoff
 }
 
 type RoadmapEdge {
@@ -81,5 +83,9 @@ fn node_carrier_clean(rn: RoadmapNode, existing_docs: List<String>) -> Bool {
 }
 
 fn node_status_drift(rn: RoadmapNode, committed_box: Bool, merged: List<Int>) -> DriftVerdict {
-  status_drift(item: rn.line, committed_box: committed_box, merged: merged)
+  signoff_drift(s: rn.signoff, committed_box: committed_box)
+}
+
+fn node_closed(rn: RoadmapNode) -> Bool {
+  signoff_accepts(s: rn.signoff)
 }

dsl/gunbc/roadmap_status.dag

@@ -10,6 +10,31 @@ type RoadmapItem
 
   | PlainLine { content: String }
 
+type Signoff
+  = Unsigned
+  | SignedOff { by: String, works: Bool, scope_equivalent: Bool, as_expected: Bool }
+
+fn signoff_accepts(s: Signoff) -> Bool {
+  match s {
+    Unsigned => false
+    SignedOff { by: _, works, scope_equivalent, as_expected } => works && scope_equivalent && as_expected
+  }
+}
+
+fn signoff_is_present(s: Signoff) -> Bool {
+  match s {
+    Unsigned => false
+    SignedOff { by: _, works: _, scope_equivalent: _, as_expected: _ } => true
+  }
+}
+
+fn signoff_by(s: Signoff) -> String {
+  match s {
+    Unsigned => ""
+    SignedOff { by, works: _, scope_equivalent: _, as_expected: _ } => by
+  }
+}
+
 fn pr_merged(pr: PullRequest) -> Bool {
   match pr.merged_at {
     Present { value: _ } => true
@@ -35,6 +60,10 @@ fn item_is_done(item: RoadmapItem, merged: List<Int>) -> Bool {
 
 type DriftVerdict = Drifted | Clean | Underivable
 
+fn signoff_drift(s: Signoff, committed_box: Bool) -> DriftVerdict {
+  if committed_box == signoff_accepts(s: s) { Clean } else { Drifted }
+}
+
 fn status_drift(item: RoadmapItem, committed_box: Bool, merged: List<Int>) -> DriftVerdict {
   match item {
     AuthoredLine { done: _, content: _ } => Underivable

dsl/test/claim/roadmap_authority_test.dag

@@ -41,19 +41,22 @@ fn witness_emit_refs_from_binding() -> Bool {
 
 fn witness_c1_measure_rows() -> Bool {
   string_contains(s: out(),
-    pattern: "- [x] **Section 1 spawn-width foundation — std.measure expressibility** (#5470/#5478)")
+    pattern: "- [ ] **Section 1 spawn-width foundation — std.measure expressibility** (#5470/#5478)")
+    && string_contains(s: out(), pattern: "⏳ awaiting sign-off")
 }
 
 fn witness_c2_roundtrip_law() -> Bool {
   let o = out()
-  string_contains(s: o, pattern: "- [x] **round-trip law (ingest∘emit = id, DecodeFidelity-bounded)** (#5525/#5527)")
-    && string_contains(s: o, pattern: "- [x] **medium axis** —")
+  string_contains(s: o, pattern: "- [ ] **round-trip law (ingest∘emit = id, DecodeFidelity-bounded)** (#5525/#5527)")
+    && string_contains(s: o, pattern: "- [ ] **medium axis** —")
     && string_contains(s: o, pattern: "per-medium round-trips are v1-seed interim")
+    && string_contains(s: o, pattern: "⏳ awaiting sign-off")
 }
 
 fn witness_c3_inversion_subrows() -> Bool {
   string_contains(s: out(),
-    pattern: "- [x] **PR→checkbox status + section-emit + projection layer** (#5491/#5508/#5520)")
+    pattern: "- [ ] **PR→checkbox status + section-emit + projection layer** (#5491/#5508/#5520)")
+    && string_contains(s: out(), pattern: "⏳ awaiting sign-off")
 }
 
 fn witness_c4_selfhost_no_overclaim() -> Bool {
@@ -65,7 +68,8 @@ fn witness_c4_selfhost_no_overclaim() -> Bool {
 
 fn witness_c4_cargo_green_landed() -> Bool {
   string_contains(s: out(),
-    pattern: "- [x] **emitted crate `cargo build`s green (Route-A last mile) ✓ LANDED (#5777/#5873)**")
+    pattern: "- [ ] **emitted crate `cargo build`s green (Route-A last mile) ✓ LANDED (#5777/#5873)**")
+    && string_contains(s: out(), pattern: "⏳ awaiting sign-off")
 }
 
 fn witness_c5_rust_gate_not_greenlit() -> Bool {
@@ -89,10 +93,13 @@ fn witness_b_order_discriminator() -> Bool {
   !string_contains(s: out(), pattern: "**Audits (done):**\n\nThis window = a few days of STABILITY")
 }
 
-fn witness_derivation_has_teeth() -> Bool {
+fn witness_merge_perturb_does_not_flip_boxes() -> Bool {
+  let full = out()
   let dropped = emit_with(m: [5445, 5453, 5433, 5476, 5473, 5456, 5421, 5425])
-  string_contains(s: dropped, pattern: "- [ ] **numeric-tower grounding** (#5428)")
-    && string_contains(s: dropped, pattern: "- [ ] **Section 1 spawn-width foundation — std.measure expressibility** (#5470/#5478)")
+  let pat = "- [ ] **numeric-tower grounding** (#5428)"
+  string_contains(s: full, pattern: pat)
+    && string_contains(s: dropped, pattern: pat)
+    && !string_contains(s: full, pattern: "- [x] **numeric-tower grounding** (#5428)")
     && !string_contains(s: dropped, pattern: "- [x] **numeric-tower grounding** (#5428)")
 }
 
@@ -109,5 +116,5 @@ test fn roadmap_authority_witnesses() -> Bool {
     && witness_a_prose_verbatim()
     && witness_b_ordered_interleaving()
     && witness_b_order_discriminator()
-    && witness_derivation_has_teeth()
+    && witness_merge_perturb_does_not_flip_boxes()
 }

dsl/test/claim/roadmap_document_test.dag

@@ -2,8 +2,8 @@ module test.claim.roadmap_document
 
 import extdeps.languages.markdown { serialize_markdown_source }
 import gunbc.roadmap_document { RoadmapDocument, RoadmapSection, project_roadmap_to_markdown }
-import gunbc.roadmap_model { RoadmapNode, RoadmapEdge, Pointer, SectionElement, section_group }
-import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine }
+import gunbc.roadmap_model { RoadmapNode, RoadmapEdge, Pointer, NodeSizing, Unsized, SectionElement, section_group }
+import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, Signoff, Unsigned, SignedOff }
 import std.markdown { MarkdownBlock, HeadingBlock, ParagraphBlock, TextInline, H1 }
 import ctrl.process_algebra { ProcessNodeId }
 
@@ -16,6 +16,9 @@ fn audit_node() -> RoadmapNode {
     node: audit_id,
     line: AuthoredLine { done: true, content: "**fail-open audit**" },
     carriers: [Pointer { label: "plan", path: "docs/plans/fail-closed-lockdown.md" }],
+    sizing: Unsized,
+    owner: "",
+    signoff: Unsigned,
   }
 }
 
@@ -24,13 +27,19 @@ fn status_node() -> RoadmapNode {
     node: status_id,
     line: DerivableLine { prs: [5491], title: "**PR-checkbox status**", description: "" },
     carriers: [],
+    sizing: Unsized,
+    owner: "",
+    signoff: Unsigned,
   }
 }
 fn child_node() -> RoadmapNode {
   RoadmapNode {
     node: child_id,
     line: AuthoredLine { done: false, content: "**host-fed status bridge**" },
     carriers: [],
+    sizing: Unsized,
+    owner: "",
+    signoff: Unsigned,
   }
 }
 
@@ -78,14 +87,18 @@ fn witness_both_sections() -> Bool {
     && string_contains(s: out, pattern: "## 6. Expansion")
 }
 
-fn witness_authored_box_and_link() -> Bool {
+fn witness_authored_evidence_awaiting_signoff() -> Bool {
   let out = emit(merged: [5491])
-  string_contains(s: out, pattern: "[x] **fail-open audit**")
+  string_contains(s: out, pattern: "[ ] **fail-open audit**")
     && string_contains(s: out, pattern: "[plan](docs/plans/fail-closed-lockdown.md)")
+    && string_contains(s: out, pattern: "⏳ awaiting sign-off")
 }
 
-fn witness_derived_checked_when_merged() -> Bool {
-  string_contains(s: emit(merged: [5491]), pattern: "[x] **PR-checkbox status**")
+fn witness_derived_merged_awaiting_signoff() -> Bool {
+  let out = emit(merged: [5491])
+  string_contains(s: out, pattern: "[ ] **PR-checkbox status**")
+    && string_contains(s: out, pattern: "⏳ awaiting sign-off")
+    && !string_contains(s: out, pattern: "[x] **PR-checkbox status**")
 }
 
 fn witness_derived_unchecked_when_unmerged() -> Bool {
@@ -102,11 +115,11 @@ fn expected_roadmap() -> String {
     "\n",
     "## 0. Fail-closed lock-down\n",
     "\n",
-    "- [x] **fail-open audit** [plan](docs/plans/fail-closed-lockdown.md)\n",
+    "- [ ] **fail-open audit** [plan](docs/plans/fail-closed-lockdown.md) — ⏳ awaiting sign-off\n",
     "\n",
     "## 6. Expansion\n",
     "\n",
-    "- [x] **PR-checkbox status** (#5491)\n",
+    "- [ ] **PR-checkbox status** (#5491) — ⏳ awaiting sign-off\n",
     "  - [ ] **host-fed status bridge**\n"
   ], "")
 }
@@ -123,8 +136,8 @@ fn witness_drift_receipt() -> Bool {
 test fn roadmap_document_witnesses() -> Bool {
   witness_preamble_first()
     && witness_both_sections()
-    && witness_authored_box_and_link()
-    && witness_derived_checked_when_merged()
+    && witness_authored_evidence_awaiting_signoff()
+    && witness_derived_merged_awaiting_signoff()
     && witness_derived_unchecked_when_unmerged()
     && witness_exact_bytes()
     && witness_drift_receipt()