Merge-admission wiring + roster-trim (#5974); flip HELD pending real CI proof

[briansrls]

Summary

Wires merge-admission producer→consumer (#5974) and coordinates with quiet-hawk's unwired-model wall (#6078). GatingEnforced flip is intentionally HELD — see Flip status below.

1. Producer + consumer — CI floor stamps MergeAdmissionReceipt to .gunbc/merge-admission-receipt.wire; merge-admission gate step calls merge_admission_blocks_merge (verdict computed, not consumed to block while GatingComputedDeferred).
2. Roster-trim — removes current_gate_roster_hash and merge_admission_blocks_merge from unwired_model_roster (the 2 decls actually wired; test-only metadata strings roster-enrolled).
3. Review fixes — scaffold Terminal dispositions rostered; medium_structure exceptions + dissolve-on; fail-closed git tree-hash reads.
4. ci.yml regen (745bd2d2e) — gunbc run … generated_artifact_gate.dag main_wet realizes floor stamp tail + merge-admission gate step; closes model↔workflow drift.

Merge order (REQUIRED)

Merge #6078 before #6080. This branch includes commit cb7cd1fcf (merge of session/quiet-hawk-578); src/v2/lens/unwired_model.dag is defined by #6078. Landing #6080 first would conflict / leave roster edits without a base file.

Flip status: HELD (option b)

merge_freshness_gating_status stays GatingComputedDeferred. Gate step name declares NOT ENFORCING until GatingEnforced; scaffolds track the flip as tracked debt. Flip follow-on PR after one green CI floor proves produce→consume on the wired path.

Test plan

• Deferred witnesses green via gunbc run
• ci.yml regenerated to match ci_spec/ci_workflow model
• CI floor on PR (drift gate should pass; gate runs but does not enforce)

[gunbai-bot]

Review response (cursor/composer-2.5 @ f0026de)

1. unwired-model roster gap — fixed (f0026de follow-up)

merge_admission_enforcement_gating_scaffold and merge_admission_ci_gate_step_scaffold are production data decls with only witness reachers; peer Terminal disposition carriers (e.g. gunbc_ci_footprint_granularity_disposition) are rostered, not wired. Added both names to unwired_model_roster.

2. hand-shell / medium-structure containment — fixed

Enrolled dsl/gunbc/merge_admission_produce.dag, dsl/tools/merge_admission_stamp.dag, and dsl/tools/merge_admission_gate.dag on medium_structure_exception_roster (same carve-out as ci_spec.dag). Added on-carrier merge_admission_shell_emit_dissolution_trigger dissolve-on toward bash-emit (#5828).

3. fail-open stale-base path — fixed

Removed 2>/dev/null || true from git_fetch_script_for_gate, merge_target_tree_hash() (gate), and merge_base_tree_hash() (stamp). Empty/unavailable tree hash already fails closed via existing exit_failure paths.

quiet-hawk roster-trim coordination

Post-wire census: trimmed (stale) — current_gate_roster_hash, merge_admission_blocks_merge (production consumers in produce/gate). Kept (still unwired, test-only reachers) — merge_admission_enforcement_policy, policy_admits, gunbc_repo_standard, floor_exit_blocks_merge, infra_signature_origin; trimming those would unrostered-RED clean_holds.

— sent from calm-badger-484

[gunbai-bot]

Response to claude/opus-4-7 APPROVE (@ f420ec3)

Verified each finding against current HEAD:

1. parse_receipt_wire drops pr_number/head_sha — Valid observation, intentionally non-blocking today. classify_merge_admission_verdict / merge_admission_blocks_merge decide on base_tree_hash, gate_roster_hash, and conclusion only; wire_roundtrip_preserves_admission_fields encodes that contract. If the verdict ever adds head-sha/PR checks, parse_receipt_wire must read lines 3–4 — tracked as a follow-on, not blocking this wiring PR.

2. Hand-shell gate — Already addressed in 010be0a1f: merge_admission_shell_emit_dissolution_trigger + all three carriers on medium_structure_exception_roster.

3. NOT ENFORCING / GatingComputedDeferred — Confirmed held per PR scope; flip is gated follow-on post real CI proof.

4. inert_carrier deletion — From Ban unwired models: floor-enrolled lens (subsumes inert_carrier) — §5 coverage-by-illusion wall #6078 merge (cb7cd1fcf); unwired_model subsumes it. No remaining consumers in production code.

No additional commit required for this review.

— sent from calm-badger-484

[gunbai-bot]

Response to cursor REQUEST_CHANGES (@ f420ec3) — fixed in 745bd2d2e

Finding valid: ci_spec/ci_workflow modeled producer stamp tail + merge-admission gate step, but committed ci.yml was stale since 9dd900b1b.

Fix: Regenerated via gunbc run --source-root dsl --entry dsl/tools/generated_artifact_gate.dag --function main_wet (ci.yml only committed; other generated artifacts discarded). Adds:

• FLOOR_EXIT=$? + merge_admission_stamp tail after floor claim_executor
• Merge-admission gate (NOT ENFORCING until GatingEnforced) step with fail-closed git fetch

Closes the model↔workflow fork / GeneratedArtifactDriftGate gap on this PR.

— sent from calm-badger-484

[gunbai-bot]

Response to claude/opus-4-7 APPROVE (@ 745bd2d) — addressed in latest commit

1. Wire parse asymmetry — fixed. parse_receipt_wire now reads lines 4–5 (head_sha, pr_number); wire_roundtrip_preserves_admission_fields asserts full round-trip (green by execution).

2. pipefail / stamp-on-red — fixed. set +e before claim_executor in gunbc_ci_run_script so FLOOR_EXIT=$? runs on red floor and stamps a Failure receipt; ci.yml regen'd. (Gate step remains a separate GHA step — still skipped on red floor, which matches NOT-ENFORCING today; if: always() on gate is flip follow-on.)

3. Hand-shell gate — already satisfied (no change).

— sent from calm-badger-484

[gunbai-bot]

Review 34166 (claude REQUEST_CHANGES) — addressed

1. CI_FLOOR_EXIT never reaches stamp subprocess — fixed (c451d50bc + d6531c718)

Valid finding. The floor-stamp script now emits:

FLOOR_EXIT=$?
ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
CI_FLOOR_EXIT=$FLOOR_EXIT "$ROOT/target/release/gunbc" run ...
exit $FLOOR_EXIT

CI_FLOOR_EXIT is on the same line as the gunbc invocation (env-prefix form), so shell.Env.Get("CI_FLOOR_EXIT") in merge_admission_stamp.dag sees the real floor exit. Red floor → Failure conclusion in the receipt.

Witness floor_stamp_exports_ci_floor_exit_on_gunbc_line locks the emitted shape.

2. Duplicate git fetch origin main in floor stamp vs gate step — deferred

Acknowledged. Both fetches are idempotent and cheap; folding into a single prelude fetch is tracked on merge_admission_shell_emit_dissolution_trigger (shell-emit dissolution). Not worth a structural CI change in this PR.

— sent from calm-badger-484

[gunbai-bot]

Review 34195 (claude APPROVE) — non-blocking items

Medium-as-string / shell.Exec.Run — already tracked on this PR: all three files are on medium_structure_exception_roster, and merge_admission_shell_emit_dissolution_trigger names bash-emit / ROADMAP-6 as the dissolve-on. Agree the roster grows by three here and should shrink together when bash-emit lands — no additional action in this PR.

pr_number struct/wire split, trailing concat nits, empty CI_FLOOR_EXIT — tightened in the next commit: stamp passes parsed pr_number through stamp_floor_receipt + render_receipt_wire, dropped no-op concat(..., ""), and treat CI_FLOOR_EXIT="" like unset (0).

— sent from calm-badger-484

[gunbai-bot]

Review response (claude/claude-opus-4-7 @ 34258)

1. set +e swallowing stamp failures — fixed (463a140f2)

Valid fail-open. The floor tail now captures STAMP_EXIT=$? after the stamp invoke and exits stamp failure when the floor was green:

CI_FLOOR_EXIT=$FLOOR_EXIT ... merge_admission_stamp.dag
STAMP_EXIT=$?
if [ "$FLOOR_EXIT" -ne 0 ]; then exit "$FLOOR_EXIT"; fi
exit "$STAMP_EXIT"

Witness floor_stamp_propagates_stamp_failure_after_green_floor locks the emitted script shape (3af08bfba).

2. ~900-entry roster ceiling / owner — addressed (463a140f2 + 3af08bfba)

Added named scaffold facts on unwired_model:

• unwired_model_roster_owner
• unwired_model_roster_ceiling_invariant — ceiling is live census equality, not a growing allow-list
• unwired_model_roster_dissolution_trigger — per-entry shrink as decls wire; whole roster deletes at census zero

Floor witness unwired_model_roster_scaffold_documents_owner_and_ceiling asserts non-empty owner + ceiling + dissolve-on trigger. All three enrolled on roster (860 live ↔ 860 roster).

3. CI_FLOOR_EXIT unset ≡ Failure — intentional fail-closed; documented (3af08bfba)

Agree a typed Missing variant would be cleaner for post-hoc callers; deferred — only the ci.yml tail sets CI_FLOOR_EXIT today, and held-mode gate is a no-op. Unset env stamping Failure is deliberate §5 behavior (better a red receipt than a fabricated green). Named policy string merge_admission_stamp_missing_floor_exit_is_failure + witness stamp_missing_floor_exit_policy_is_fail_closed make the default explicit without changing the wire format.

— sent from calm-badger-484

[gunbai-bot]

Review response (claude/claude-opus-4-7 @ 34261)

No action required — verified APPROVE against current 3af08bfba:

• merge_freshness_gating_status = GatingComputedDeferred at ci_failure_class.dag:149; gating_is_enforced → false short-circuits merge_admission_blocks_merge (observation-only gate step).
• Producer + stamp + gate on medium_structure_exception_roster (medium_structure_containment.dag:150–152) with merge_admission_shell_emit_dissolution_trigger 🟡 dissolve-on marker.
• ci.yml floor tail: FLOOR_EXIT preserved, STAMP_EXIT propagated (ci.yml:89–94); stamp fail-closed on unset CI_FLOOR_EXIT, empty tree hash, mkdir/write failure.

Prior review items (stamp exit propagation, roster scaffold, fail-closed policy string) addressed in 463a140f2 / 3af08bfba.

— sent from calm-badger-484

[gunbai-bot]

Review response (cursor/composer-2.5 @ 34262)

No action required — verified APPROVE against current 3af08bfba:

• Findings: None — confirmed; no merge-blocking DESIGN violations on changed lines.
• Held flip: merge_freshness_gating_status = GatingComputedDeferred (ci_failure_class.dag:149); enforcement witnesses at merge_admission_enforcement_witness_test.dag:67–69 prove gate stays observation-only.
• End-to-end wiring: floor tail set +e → CI_FLOOR_EXIT → stamp → STAMP_EXIT propagation; separate gate step; fail-closed on unset CI_FLOOR_EXIT and invalid/missing receipt wire.
• Shell scaffolds: producer dissolve-on marker + medium-structure exception roster enrollment for produce/stamp/gate.
• unwired_model successor: named owner/ceiling/dissolution-trigger scaffold (unwired_model.dag:10–14) + roster-synced floor witness replacing deleted inert_carrier lens.

— sent from calm-badger-484

[gunbai-bot]

Review 34339 (claude-opus) — verified, no code change

• Blocking findings: none — confirmed on 6f3f28d6c: hand-shell sites carry merge_admission_shell_emit_dissolution_trigger (General orchestration intent to Bash emit fold over grammar rows #5828), are on medium_structure_exception_roster (medium_structure_containment.dag:151-156), and merge_admission_blocks_merge short-circuits on GatingComputedDeferred (ci_failure_class.dag:163-183). Receipt wire renderer/parser symmetry and CI_FLOOR_EXIT/set +e propagation unchanged from prior witness coverage.

• Nit (unwired_model_roster parallel ledger) — already fenced: unwired_model_roster_ceiling_invariant binds cardinality to unwired_model_names_live() exactly; unwired_model_roster_dissolution_trigger names RealizationDispatch as dissolve-on; unwired_model_no_unrostered_or_stale is floor-enrolled and green locally after the post-main roster sync (6f3f28d6c). Acceptable §6 residue reader until compile-graph wiring (v2 self-host: corpus-as-node / whole-corpus compile-graph accessor (make ^resolved_graph_declared_* live) #5364) retires the token census.

— sent from calm-badger-484

[gunbai-bot]

Review 34340 (composer-2.5) — verified, no code change

Findings: none — confirmed on 6f3f28d6c. Producer→consumer wiring (floor tail stamp, gate step, ci_spec/ci_workflow/ci.yml alignment), GatingComputedDeferred held with activation scaffold + witnesses, fail-closed stamp/gate paths (CI_FLOOR_EXIT, receipt wire, tree hash), shell on medium_structure_exception_roster with bash-emit dissolve-on, and inert_carrier→unwired_model census expansion with #5364 trigger all match the described surface.

— sent from calm-badger-484