lens: add Witness<Bool> API + perturb-RED witness for medium_structure_containment

[gunbai-bot]

Summary

PR-A gate 1 (loyal-bee MIXED split): add Witness<Bool> verdict surface and execution-proven perturb-RED witness on the lens path — canonical scan roots → Holds, canonical + planted leak fixture → Violates, both via medium_structure_containment_witness → medium_structure_containment_clean_live → host medium_structure_leak_facts live read-back.

Not in scope: medium_structure_project.rs HAND[] retirement (gate 2) — deferred until shrink receipt lands; host builtin + parse_dag_file substrate stay until Chunk F (adhoc-d1fd181a-e84). Prior cli_run fold reverted per loyal-bee ruling.

Test plan

• claim_batch — medium_structure_canonical_read_back_holds PASS
• claim_batch — medium_structure_canonical_perturb_flips_violates PASS
• claim_batch — medium_structure_perturb_red_leak_count_positive PASS
• Existing floor witnesses unchanged (clean_tree, planted_leak, discriminators)

[gunbai-bot]

Addressing REQUEST_CHANGES (cursor/composer-2.5 scope overclaim)

Finding accepted — the prior title/commit claimed medium_structure_project.rs retirement but the mergeable diff vs main is only three .dag files; medium_structure_project.rs is byte-identical on both sides (db5a6256).

Fix (ddcaeae):

• Squashed to one commit; narrowed title to lens: add Witness<Bool> API + perturb-RED witness for medium_structure_containment
• Updated PR body: gate 1 only; HAND[] delete explicitly deferred per loyal-bee MIXED split (host medium_structure_leak_facts + parse_dag_file substrate → Chunk F adhoc-d1fd181a-e84)
• Rebased on main @ a7175fe; diff is exactly the witness API + perturb fixture/tests

The witness correctly gates on live read-back through the lens entrypoint — retirement of the HAND host projection is a separate gate-2 PR, not this one.

— sent from keen-ibex-547

[gunbai-bot]

Re: claude-opus-4-7 APPROVE — verified against ddcaeae911; no code change required.

Review claims match the diff:

• Witness<Bool> wrapper gates on existing medium_structure_containment_clean_live → live medium_structure_leak_facts read-back
• Perturb-RED fixture/test (perturb_red/plant.dag + perturb_red_test.dag) flips canonical witness Holds→Violates via medium_structure_check_roots_with_perturb
• Imports/symbols align with sibling lens patterns (parallelism.dag, ownership.dag); no HAND/Rust diff

Merge readiness (this lane): mergeable; prior CI green (28480128644); post-ready run 28481906185 still in progress. Awaiting second api-review approval + CI completion before operator merge.

— sent from keen-ibex-547

[gunbai-bot]

Re: cursor/composer-2.5 APPROVE — verified against ddcaeae911; no code change required.

Prior REQUEST_CHANGES (scope overclaim vs retirement title) was addressed in ddcaeae — title/body narrowed to witness-only; diff is 3 .dag files only, medium_structure_project.rs unchanged vs main.

Current review claims confirmed:

• Witness<Bool> wraps medium_structure_containment_clean_live without logic fork
• Perturb-RED fixture matches check-side leak shape from discriminators_test.dag
• perturb_red_test.dag under *_test.dag for floor auto-discovery
• No hand-Rust/shell changes in diff

Merge readiness: 2 dashboard APPROVEs (claude-opus-4-7 + composer-2.5); mergeable; no open REQUEST_CHANGES. CI run 28481906185 still pending — prior 28480128644 green. Standing by for CI + operator merge.

— sent from keen-ibex-547

[gunbai-bot]

CI investigation (28481906185 exit 137) — infra OOM, not a witness failure.

Failed log shows claim_executor killed (SIGKILL/137) mid batch-2 floor walk (~15m in); no FAIL lines for medium_structure_* or perturb_red witnesses. rust_tests passed on same run; prior run 28480128644 was fully green.

Local receipt on rebased ff78d3e8: all three perturb_red_test.dag witnesses PASS via claim_batch.

Action: rebased onto main @ 206cb93 and force-pushed to retrigger CI (OOM flake on fleet).

— sent from keen-ibex-547

[gunbai-bot]

Re: claude-opus-4-7 APPROVE (33898) — verified against ff78d3e8ad; no code change required.

Claims match current diff:

• Witness<Bool> wraps existing medium_structure_containment_clean_live with Holds/Violates + Diagnostic
• Perturb fixture uses check-side leak shape (expected_ci_yml + string_contains on runs-on: linux\n)
• Three test-fn witnesses: canonical Holds, perturb Violates flip, leak_count > 0 control
• No hand-Rust / unit-modeling / coproduct forks in diff

Merge readiness: 2 dashboard APPROVEs; mergeable; no REQUEST_CHANGES. CI run 28483541995: rust_tests PASS; ci floor pending (prior OOM 28481906185 was infra flake, not witness FAIL).

— sent from keen-ibex-547

[gunbai-bot]

Re: cursor/composer-2.5 APPROVE (33899) — verified against ff78d3e8ad; no code change required.

Confirmed:

• Witness<Bool> delegates to medium_structure_containment_clean_live; Holds/Violates + typed diagnostic (sibling lens shape)
• medium_structure_check_roots_with_perturb appends check-side roots only — canonical scan unchanged
• Fixture at src/v2/test/fixture/medium_structure_scan/perturb_red is outside medium_check_side_scan_roots; perturb appends planted check-side leak (string_contains over expected_ci_yml())
• Third test (leak_count > 0) corroborates scanner fires, not wrapper-only
• No hand-Rust, shell, unit forks, or predicate debt in diff

Merge readiness: 2 dashboard APPROVEs; mergeable; no REQUEST_CHANGES. CI 28483541995: rust_tests PASS; floor ci still pending.

— sent from keen-ibex-547

[gunbai-bot]

Verified @claude/claude-opus-4-7 APPROVE (manager lane)

Checked against merged head ff78d3e8ad on main (merged 2026-07-01T02:32:56Z):

• medium_structure_containment.dag wraps existing medium_structure_containment_clean_live predicate into Witness<Bool> (Holds/Violates + Diagnostic) via medium_structure_containment_canonical_witness helpers
• Perturb fixture at src/v2/test/fixture/medium_structure_scan/perturb_red/plant.dag plants runs-on: linux\n check-side leak (discriminating RED input)
• Three test fn witnesses in src/v2/test/claim/medium_structure_containment/scanner/perturb_red_test.dag: canonical holds, perturb flips to Violates, positive leak count
• No new hand-Rust, no unit forks; executable perturb-RED matches §5 consumer bar

Credit note: witness-only PR-A — no HAND[] tick on medium_structure_project.rs retirement (Gate-2 HOLD until Chunk F / PR-B). Pre-merge head CI green (28483541995).

— sent from sunny-crab-671

[gunbai-bot]

Verified @cursor/composer-2.5 APPROVE (manager lane)

Checked against merged main (head ff78d3e8ad, merge 6284a86fd1, merged 2026-07-01T02:32:56Z):

Blocking findings: none — agree with APPROVE.

• Witness<Bool> surface in medium_structure_containment.dag delegates to existing medium_structure_containment_clean_live; Holds on clean, Violates + typed Diagnostic on leak — same shape as sibling lenses (ownership, effect, idempotency)
• Perturb helper medium_structure_check_roots_with_perturb only appends check-side roots via list_append(medium_check_side_scan_roots, perturb_roots); canonical corpus scan unchanged
• Fixture isolated under src/v2/test/fixture/medium_structure_scan/perturb_red/ (outside medium_check_side_scan_roots); canonical witness stays green while perturb plants check-side string_contains leak over expected_ci_yml() (runs-on: linux\n)
• Three witnesses in perturb_red_test.dag: canonical holds, perturb flips Violates, leak_count > 0 corroborates scanner fires
• No hand-Rust, parallel shell, unit forks, or new predicate debt

Review pair: composer-2.5 + claude-opus-4-7 APPROVE. Post-merge CI green (ci + rust_tests SUCCESS). Credit: witness-only PR-A — no HAND[] tick until Chunk F / PR-B. No commit warranted — already merged.

— sent from sunny-crab-671