Fix main-red: de-fork extdeps.shell + loud module-collision wall + nbd_proxy_serve anchor by gunbai-bot[bot] · Pull Request #6112 · gunb-ai/gunbc

gunbai-bot · 2026-07-01T21:39:47Z

What

Main is red on three fronts; this PR fixes all three at the root.

1. `extdeps.shell` was declared twice — and the index silently picked the wrong one

src/v2/extdeps/shell.dag was a subset fork of the dsl authority dsl/extdeps/shell/shell.dag: only Env+Exec, plus a fail-open inline mock_response that fabricates "(mock)" output for hermetic runs (the dsl authority is deliberately hermetic-fail-closed). build_module_index was HashMap last-insert-wins, so under the floor's dsl-first witness_layer_roots the v2 fork shadowed the authority → dsl/extdeps/tools/tools.dag:56:20: no field 'Which' on type 'shell' (the discovery-corpus red), while CLI src/v2-first invocations resolved the other way — two verdicts on one tree, order-dependent.

Fix: delete the fork (operator ruling: dsl is the authority; plan Q4 in docs/plans/shell-emission-model.dag answered by consolidation — one shape, transports as handlers).

2. The collision class is now unwritable

Both build_module_index and build_module_path_index now refuse loudly on a duplicate module path across roots, naming both files (DESIGN §3 single authority, §5 fail-closed — silent shadowing broke the floor). The overlay spec test co_root_overlay_last_root_wins_on_duplicate_module_path (whose only real consumer was this bug) is replaced by:

extdeps_shell_resolves_to_the_dsl_authority — pins the survivor
duplicate_module_path_across_roots_refuses_loudly — temp-dir two-root RED control + distinct-modules GREEN control

Corpus-wide scan: exactly one collision existed.

3. `extdeps_external_authority_gate` red — a module aliased its sibling's anchor

extdeps.bmc.webui.nbd_proxy_serve (#6097) imported extdeps_external_authority_anchor from extdeps.bmc.webui.nbd_proxy instead of declaring its own row; the gate's projector correctly reads only the module's own items → missing. It now declares its own cited anchor (same upstream, github.com/openbmc/jsnbd); the dead nbd_proxy_serve_transport_authority re-binding (zero consumers) is removed.

Also heals the pre-existing .gitignore drift (stale /provisioning/srv3/dnsmasq.conf row) so the generated-artifact gate is green here without depending on #6110/#6111 merge order.

Verification (by execution)

failing repro nbd_proxy_ws_path_for_vm_slot_index: PASS under both root orders (dsl-first and src/v2-first)
corpus_live_clean_tree_holds (the red sub-claim of the external-authority gate): PASS
generated-artifact drift gate: PASS · shell_mock_totality: PASS · nbd_proxy_serve structural witnesses: PASS
new unit tests RED/GREEN controls: PASS · cargo fmt --check clean

Notes

The wall is construction-first where it can be (refusal at index build, before any resolve), with the RED control proving it fires.
Evidence trail: both the .gitignore drift and this collision landed via stale-base merges — logged on the roadmap's merge-admission item (Roadmap reset: two pillars (get off v1 · own the compute fabric) + floor/audit + shelf #6110).

🤖 Generated with Claude Code

…d_proxy_serve anchor Three roots, one tree verdict: 1. src/v2/extdeps/shell.dag was a subset fork (Env+Exec only, fail-open inline mock_response) of the dsl authority dsl/extdeps/shell/shell.dag (Find/Env/Which/Exec, deliberately hermetic-fail-closed). Under dsl-first witness_layer_roots the module index silently last-insert-won to the v2 fork, so dsl/extdeps/tools/tools.dag:56 saw "no field 'Which' on type 'shell'" — and hermetic runs of dsl gates fabricated "(mock)" output. Fix: delete the fork (dsl is the authority, plan Q4 in docs/plans/shell-emission-model.dag answered by consolidation). 2. build_module_index / build_module_path_index were HashMap last-insert-wins: a duplicate module path across roots silently shadowed (DESIGN §3/§5). Now both refuse loudly with the colliding paths named. The overlay spec test (co_root_overlay_last_root_wins_on_duplicate_module_path) is replaced by extdeps_shell_resolves_to_the_dsl_authority + a temp-dir RED/GREEN control (duplicate_module_path_across_roots_refuses_loudly). Corpus-wide scan: exactly one collision existed; the wall makes the class unwritable. 3. extdeps.bmc.webui.nbd_proxy_serve (#6097) imported its sibling's extdeps_external_authority_anchor instead of declaring its own row — the external-authority gate correctly refused the alias. It now carries its own cited anchor (same upstream, github.com/openbmc/jsnbd); the dead re-binding alias is removed. Also heals the pre-existing .gitignore drift (stale /provisioning/srv3/ dnsmasq.conf row, #6097) so the drift gate is green on this branch. Verified by execution: failing discovery repro passes under BOTH root orders; corpus_live_clean_tree_holds PASS; drift gate PASS; shell_mock_totality PASS; nbd_proxy_serve witnesses PASS; unit tests (collision RED control + dsl-authority resolution) PASS; fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…sion is gone) cursor/composer-2.5 on #6112: strict_dependency_pool_index_panics_on_ cross_root_extdeps_shell_collision used the live-tree extdeps.shell collision as its fixture — this PR deletes that collision, flipping the assertion. Replaced with a synthetic two-temp-root duplicate: strict refuses with "duplicate module path" (RED control), primary-precedence indexes first-root-wins on the same fixture (GREEN control). The RED control no longer depends on a defect persisting in the real corpus. All 4 dependency_pool_index tests pass against release gunbc, including the two live-tree primary-precedence compiles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gunbai-bot · 2026-07-01T21:50:58Z

Review finding addressed in 5f44eb9: the strict-mode RED control now synthesizes its own two-temp-root duplicate (duplicate.across.roots) instead of depending on the live-tree extdeps.shell collision this PR deletes — strict refuses with duplicate module path, and a GREEN control proves primary-precedence indexes the same fixture first-root-wins. All 4 dependency_pool_index tests pass against release gunbc, including both live-tree primary-precedence compiles.

— sent from sunny-newt-884

…ndex walks The collision wall caught a real fail-open in CI: tests that pass the whole workspace as a source root (e.g. interp_recorded_fixture_test) were walking target/func_env_semantic_baseline_corpus/dsl/** — a corpus copy another test materializes under cargo's build-output dir — so every module there was indexed TWICE (source + stale copy), previously resolving order-dependently by silent last-insert-wins, now refused loudly by the wall. Root fix: both walkers (collect_dag_files, collect_dag_files_tolerant) skip a `target` dir that sits beside a Cargo.toml — cargo's own definition of build output. A source root passed FROM inside target/ is still walked; only descent into the output dir is refused. Verified by execution: reproduced the CI failure locally by materializing the corpus copy, then green post-fix (clock_now_record_then_hermetic_replay_holds PASS with the copy present); new unit test cargo_target_dir_output_never_enters_the_ module_index (exclusion GREEN + non-cargo layout still refuses RED); 16/16 module_path_index tests; 4/4 dependency_pool_index tests; fmt. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…trol to roadmap 2-merge-admission Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…in). Retriggers CI on the parse-fix commit; picks up #6112 extdeps.shell de-fork. Co-authored-by: Cursor <cursoragent@cursor.com>

* WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…s every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims, its discriminating RED witness, its last execution receipt; deliverable is the inventory artifact plus AT MOST one pilot red-control — do not fix (#6116) * WIP: 3-audit-gate-inventory: mechanism inventory with red-controls — census e * 3-audit-gate-inventory: mechanism inventory with red-controls + pilot deployed-gate control Census of every wired gate/lens/cache on the floor plan + commit_workflow: claims, discriminating RED witnesses, last execution receipts (docs/plans/mechanism-inventory-red-controls.md). Main-red receipt, the GatingComputedDeferred inert merge-admission gate, opt-out discovery enrollment, sccache freshness gap, and the synthetic-only lens tier are the ranked findings. Audit only — no fixes. Pilot red-control: merge_admission_deployed_gate_control_test.dag pins the fully-witnessed-model / switched-off-deployment gap by executing the deployed merge_admission_blocks_merge wrapper; perturb-proven (flip to GatingEnforced => FAIL, revert => PASS). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Reframe main-red as resolved incident receipt (#6112); link pilot control to roadmap 2-merge-admission Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…emit-partition (#6135) * WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap: derive 2-debash-orchestration (#6106) + 5-dual-rep-lens (#6104) done; flip 2-privilege-model (#6114); mark 2-emit-partition dispatched - authored_merged_prs += 6104, 6106 (operator merged both) - 2-privilege-model done: #6114 merged, live receipts on #6123/#6130 wet runs - 2-emit-partition now un-gated and dispatched (adhoc-2040cdfe-46b) - regen ROADMAP.md via generated_artifact_gate main_wet; drift gate + roadmap witnesses PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…led GitHub default) (#6154) * WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap: derive 2-debash-orchestration (#6106) + 5-dual-rep-lens (#6104) done; flip 2-privilege-model (#6114); mark 2-emit-partition dispatched - authored_merged_prs += 6104, 6106 (operator merged both) - 2-privilege-model done: #6114 merged, live receipts on #6123/#6130 wet runs - 2-emit-partition now un-gated and dispatched (adhoc-2040cdfe-46b) - regen ROADMAP.md via generated_artifact_gate main_wet; drift gate + roadmap witnesses PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Revert throwaway deploy-principal edits (restore live_deploy/apply + ci_deploy_access to main) The manual-deploy investigation surfaced two real bugs (dash/pipefail + principal fiction) but the fix belongs in the modeled grounded-principal lane, not anemic stopgap strings. Restoring these two files to origin/main clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI policy: 30-minute job timeout (workflow layer; GitHub 360min default stays modeled) Operator directive 2026-07-02: a healthy floor is ~9min solo — a job past 30min is pathological and must fail fast + release its runner slot instead of squatting toward the platform ceiling (observed: 6h-timeout jobs holding all 25 fleet slots in a self-sustaining queue deadlock, ~9h single-core claim_executor runs). - gunbc_ci_job_timeout_policy_minutes: Int = 30 (+ Terminal disposition carrying the rationale) - extdeps default_job_timeout_minutes = 360 deliberately unchanged (§3: it faithfully models GitHub's real platform default; policy lives in the workflow layer) - ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI emergency: roll back #6127 width-1 compile-clean sharding (30.9x regression) #6127 (merged 15:08 today) sharded compile-clean into ~1,605 per-module gunbc-compile subprocesses, each re-resolving its full import closure (sum-of-closures ~30.9x the monolith CPU), scheduled at WIDTH 1 because the width fold priced each single-module shard against a stale whole-corpus 4.24GiB RSS sample vs the 8GiB cap. Live regression: 8h57m wall / 8h07m CPU per job on an 87%-idle 128-core box. Pre-regression monolith green runs were 28-96min. Sets the modeled rollback valve GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1 on the ci job (env), restoring the whole-tree monolith compile-clean. Authority = the matching v2.workflow valve; rationale on ci_compile_clean_rollback_dissolution_trigger; Scaffold disposition bound, dissolves with the v2 authority once the in-process shard resolve pool lands. ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Back out #6127 rollback valve-flip; keep only the 30min timeout policy The GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE valve does NOT cleanly restore a green monolith floor: under the valve, gunbc_ci_floor_schedule_lens_holds() FAILs and batch-0 carries neither shards nor the monolith gate label (verified by execution with claim_batch --wet under GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1). The valve looks like a half-exercised scaffold from #6127. Flipping it and patching witnesses to match an unverified plan path would violate DESIGN §5 (ship only what runs green), so this PR keeps only the sound, approved part: - gunbc_ci_job_timeout_policy_minutes = 30 (workflow-layer; GitHub 360 default stays modeled) - disposition text reconciled: 30min is deliberately BELOW today's 28-96min floor — a fail-fast smoke alarm until the resolver single-thread fix lands (verification local meanwhile) The #6127 regression is better addressed by a clean revert of #6127 or a proper fix to the plan's rollback branch (load-bearing floor-plan work) — surfaced to the operator. ci.yml regenerated (timeout-only, no rollback env); drift gate PASS; both shard-b floor witnesses PASS at origin/main state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…#6164) * WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap: derive 2-debash-orchestration (#6106) + 5-dual-rep-lens (#6104) done; flip 2-privilege-model (#6114); mark 2-emit-partition dispatched - authored_merged_prs += 6104, 6106 (operator merged both) - 2-privilege-model done: #6114 merged, live receipts on #6123/#6130 wet runs - 2-emit-partition now un-gated and dispatched (adhoc-2040cdfe-46b) - regen ROADMAP.md via generated_artifact_gate main_wet; drift gate + roadmap witnesses PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Revert throwaway deploy-principal edits (restore live_deploy/apply + ci_deploy_access to main) The manual-deploy investigation surfaced two real bugs (dash/pipefail + principal fiction) but the fix belongs in the modeled grounded-principal lane, not anemic stopgap strings. Restoring these two files to origin/main clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI policy: 30-minute job timeout (workflow layer; GitHub 360min default stays modeled) Operator directive 2026-07-02: a healthy floor is ~9min solo — a job past 30min is pathological and must fail fast + release its runner slot instead of squatting toward the platform ceiling (observed: 6h-timeout jobs holding all 25 fleet slots in a self-sustaining queue deadlock, ~9h single-core claim_executor runs). - gunbc_ci_job_timeout_policy_minutes: Int = 30 (+ Terminal disposition carrying the rationale) - extdeps default_job_timeout_minutes = 360 deliberately unchanged (§3: it faithfully models GitHub's real platform default; policy lives in the workflow layer) - ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI emergency: roll back #6127 width-1 compile-clean sharding (30.9x regression) #6127 (merged 15:08 today) sharded compile-clean into ~1,605 per-module gunbc-compile subprocesses, each re-resolving its full import closure (sum-of-closures ~30.9x the monolith CPU), scheduled at WIDTH 1 because the width fold priced each single-module shard against a stale whole-corpus 4.24GiB RSS sample vs the 8GiB cap. Live regression: 8h57m wall / 8h07m CPU per job on an 87%-idle 128-core box. Pre-regression monolith green runs were 28-96min. Sets the modeled rollback valve GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1 on the ci job (env), restoring the whole-tree monolith compile-clean. Authority = the matching v2.workflow valve; rationale on ci_compile_clean_rollback_dissolution_trigger; Scaffold disposition bound, dissolves with the v2 authority once the in-process shard resolve pool lands. ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Back out #6127 rollback valve-flip; keep only the 30min timeout policy The GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE valve does NOT cleanly restore a green monolith floor: under the valve, gunbc_ci_floor_schedule_lens_holds() FAILs and batch-0 carries neither shards nor the monolith gate label (verified by execution with claim_batch --wet under GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1). The valve looks like a half-exercised scaffold from #6127. Flipping it and patching witnesses to match an unverified plan path would violate DESIGN §5 (ship only what runs green), so this PR keeps only the sound, approved part: - gunbc_ci_job_timeout_policy_minutes = 30 (workflow-layer; GitHub 360 default stays modeled) - disposition text reconciled: 30min is deliberately BELOW today's 28-96min floor — a fail-fast smoke alarm until the resolver single-thread fix lands (verification local meanwhile) The #6127 regression is better addressed by a clean revert of #6127 or a proper fix to the plan's rollback branch (load-bearing floor-plan work) — surfaced to the operator. ci.yml regenerated (timeout-only, no rollback env); drift gate PASS; both shard-b floor witnesses PASS at origin/main state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * docs: land enforcement-intent governance model (DESIGN thread + ROADMAP §3 node + sketch) Model the operator's recurring standing directives (complexity repo-wide, lenses-must-be-live, self-application, no dual-representation/anemia) as durable StandingIntent rows, gated fail-closed against LensContract + coverage receipts -- "ask once, compile forever". One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 -> LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses for the fractal/self-application layer). Un-shelves the lens-meta-wall lane into ROADMAP §3 with displaced-cost justification (the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * docs: enforcement-intent review refinements (consumer/mode/receipt/exemption types + roadmap A-E split) Operator design-review deltas before the model becomes load-bearing: - ConsumerKind / ConsumerRequirement replace the hardwired FloorGate — merge-admission, pre-push, periodic-actuator, deploy-readback are valid consumers (gate leg 4 = consumer_satisfies). - EnforcementMode order (Advisory < AuditOnly < Blocking) modeled with enforcement_mode_satisfies; no overloaded >=. - CoverageReceipt shape added; the gate reads receipts, never self-declared contract claims (a red_control:Present whose receipt is RedControlFailedToFlip still reds). - ScopeSatisfaction / NarrowingReason type the whole-corpus-narrowing path (BootstrapBlocked / TypeReflectionUnavailable / ExternalRuntimeOnly / ExplicitOperatorExemption) — not a stringly hatch. - StandingIntent admission rule (recurring + displaced cost + scoped + mechanism class + receiptable) keeps the carrier from becoming a preference dump. - ROADMAP node split into parent + children A-E with explicit A->B->C-before-object-rules dependency. DESIGN.md entry unchanged (its "mechanism claiming enforcement" wording was already the refinement). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * docs: fix #6164 review — edit .dag AUTHORITIES not generated artifacts; de-nickname PropertyClass Addresses cursor REQUEST_CHANGES (all three findings valid): - DESIGN.md / ROADMAP.md are EMITTED from gunbc.design_document / gunbc.roadmap_authority. My hand-edits to the generated artifacts were drift (a §3 parallel-representation of the authority, and would fail the generated-artifact drift gate). Moved the enforcement-intent content INTO the authorities (open_threads_blocks li + section_3 node + un-shelve prose) and regenerated (claim_batch main_wet). Drift gate now PASSES: committed == emitted. - Removed the PropertyClass nickname (git-grep empty; a fork of the existing LensIdV0 lens-property coproduct at src/v2/lens/registry.dag:10) — the exact §3 sin this PR argues against. StandingIntent.property now reuses LensIdV0. Fitting that a single-authority PR forked its own authority; caught by review, fixed at the source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

… overlay Revert per-root-only collision detection (reopened extdeps.shell last-wins). Keep #6112 tree-wide panic with same_canonical_file for path spelling; skip the named ingest-manifest stub only when a later root hosts the emitted overlay (source_root_ingest / compiler_closure gates). Co-authored-by: Cursor <cursoragent@cursor.com>

* CI: docs/**-only floor shortcut with fail-closed merge admission. - Model docs-only floor skip in ci_spec.dag (docs/** allowlist only; CI substrate + generated-artifact carriers excluded); stamp Skipped via CI_FLOOR_DISPOSITION=documentation_only_skipped (not Success). - Admit Skipped receipts in merge-admission; witnesses for script, disposition mapping, and admission path. - Floor step timeout 90m / job backstop 115m; deploy job backstop 10m (separate from floor budget). - Path-alias dedup in load_sources_for_entry_with_index using same_canonical_file (rebased onto main's entry_source fix). Co-authored-by: Cursor <cursoragent@cursor.com> * CI: bump release-build step timeout to 30m (receipt-backed). Cold v1-compiler release compile exceeded the shared 15m rust-gate budget on srv1-08/09 (runs 28746525941, 28746406899) before floor could start. Split gunbc_ci_release_build_step_timeout_minutes from rust_tests gate; job backstop 130 = 30+90+5+5. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Audit: witnesses that never execute their .dag subject * fix: rustfmt module-index collision guard in cli_run.rs Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Audit: witnesses that never execute their .dag subject * fix: restore tree-wide module collision wall with path-alias + ingest overlay Revert per-root-only collision detection (reopened extdeps.shell last-wins). Keep #6112 tree-wide panic with same_canonical_file for path spelling; skip the named ingest-manifest stub only when a later root hosts the emitted overlay (source_root_ingest / compiler_closure gates). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Cursor <cursoragent@cursor.com>

gunbai-bot Bot mentioned this pull request Jul 1, 2026

Revert #6107: CI back on srv1/srv2 (ubicloud bought no wall-clock — the cost is the serial compile-clean gate) #6111

Merged

briansrls merged commit fb35cd3 into main Jul 1, 2026
1 of 2 checks passed

briansrls deleted the fable/defork-extdeps-shell branch July 1, 2026 22:44

briansrls added a commit that referenced this pull request Jul 1, 2026

Merge origin/main (post-#6112 main-green fix)

a5cbf42

briansrls added a commit that referenced this pull request Jul 1, 2026

Reframe main-red as resolved incident receipt (#6112); link pilot con…

e10b936

…trol to roadmap 2-merge-admission Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gunbai-bot Bot mentioned this pull request Jul 1, 2026

CD deploy: require srv1 target-host proof before LocalShell apply #6115

Merged

2 of 3 tasks

briansrls added a commit that referenced this pull request Jul 1, 2026

Merge origin/main: resolve ci.yml deploy runner conflict (keep srv1 p…

710951a

…in). Retriggers CI on the parse-fix commit; picks up #6112 extdeps.shell de-fork. Co-authored-by: Cursor <cursoragent@cursor.com>

gunbai-bot Bot mentioned this pull request Jul 5, 2026

CI: docs/**-only floor shortcut #6281

Merged

2 tasks

Navigation Menu

Repository navigation

Fix main-red: de-fork extdeps.shell + loud module-collision wall + nbd_proxy_serve anchor - #6112

Fix main-red: de-fork extdeps.shell + loud module-collision wall + nbd_proxy_serve anchor#6112
briansrls merged 3 commits into
mainfrom
fable/defork-extdeps-shell

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gunbai-bot Bot commented Jul 1, 2026

What

1. extdeps.shell was declared twice — and the index silently picked the wrong one

2. The collision class is now unwritable

3. extdeps_external_authority_gate red — a module aliased its sibling's anchor

Verification (by execution)

Notes

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

1. `extdeps.shell` was declared twice — and the index silently picked the wrong one

3. `extdeps_external_authority_gate` red — a module aliased its sibling's anchor