Lever a: affected-set-scoped compile-clean gate

[briansrls]

Summary

First slice of ROADMAP lever (a): per-PR compile-clean scopes to affected shard entries instead of always resolving the whole dag/ tree.

• Substrate (dag/tools/dag_compile_clean_scope.dag): CompileCleanScopeDisposition coproduct (ScopedRun | SkipNoAffectedEntries | RequireWholeTree); compile_clean_scope_disposition_from_touched filters the Shard-A: compile-gate partition totality + cross-shard seam preservation proof #6290 shard roster via entry_affected_by_touched_paths.
• Host (cli_run.rs): thin interpreter bridge; diff/disposition failure → Refused (no widening); RequireWholeTree for non-docs infra/Rust/CI touches with no shard intersection.
• Witnesses: dag/test/claim/dag_compile_clean_scope_witness_test.dag (skip/scope/whole-tree, ./docs/ normalization, parse_test.dag importer carve-out).
• Budgets: main values (operator ruling 2026-07-06) — floor step 135m, ci job 10m starvation-kill (CI: job-level 10-min kill on the ci/floor job (free the runner; operator re-ruling 2026-07-06) #6323); no interim 180m/235m raises in this PR.

Proof path is local/ctrl-build (scripts/lever_a_local_verify.sh) — zero long CI runner burn until #6239 compile-wall lands.

Acceptance criteria (operator checklist)

• GATE 0 — attribution from cited receipts (not a fresh whole-tree CI run): plan-entry resolve ~77m before batch-1 (run 28780252806 / job 85333980084 on 43cc771, reconcile t_ms≈4602200); batch-1 resolve leg alone could exhaust 90m (run 28748751115). Split: plan-resolve vs batch-1 compile-clean.
• GATE 1(a) — selection consumes Shard-A: compile-gate partition totality + cross-shard seam preservation proof #6290 shard roster via compile_clean_shard_entry_paths + entry_affected_by_touched_paths (core-query soundness cited from Affected-set Step 3: module-grain frontier equivalence receipts #6274 — 25-entry equivalence + wiring-perturbation control; not re-proved here).
• GATE 1(b–c) — broken-module inside/outside affected-set controls: local procedure in scripts/lever_a_local_verify.sh (inject break in closure(entry_paths) → scoped RED; break outside → scoped GREEN; nightly whole-tree Affected-set differential falsifier: SelectionPredictOnly + nightly cadence workflow (signed design, all three items) #6299 is declared catcher). Pending ctrl-build execution receipts.
• GATE 1(d) — refusal on diff/disposition failure; no ignorance widening; RequireWholeTree is structural not absorbing.
• GATE 2 — 5-PR replay cost table (local scoped wall-clock per diff; whole-tree baseline cited from GATE 0 runs — do not re-burn).
• GATE 3 — BLOCKED on P3+P5: infer whole-corpus scans to per-module maps #6239 compile-wall (operator-owned). Landing condition: wall fix + budgets drop to scoped envelope; CI self-demonstration deferred until then.

Test plan

• scripts/lever_a_local_verify.sh — fast Rust refusal/scoping receipts + disposition witness driver (ctrl-build)
• cargo test -p v1-compiler --lib scoped_plan_refuses compile_clean_scoping
• GATE 1b/1c + GATE 2 local receipts (ctrl-build; not CI floor)
• CI budgets match main (10m ci job kill; no 140m+ job backstop in this PR)

[gunbai-bot]

Addressed the importer-propagation witness finding in 9f81fd1.

dag_compile_clean_scope_importer_touched_by_v2_logic_edit_holds now touches src/v2/std/logic.dag and expects dag/test/claim/parse_test.dag (a real v2.std.logic importer in the shard roster), not dag_compile_clean_transport.dag — transport reaches logic via tools.host_prelude → std.logic, not v2.std.logic.

— sent from bold-ant-731

[gunbai-bot]

Addressed the CI activation finding in 82fca12.

compile_clean_scope_plan_for_ci now activates lever-a scoping when GITHUB_ACTIONS=true (the runner's own signal, same as install_group_syntax / floor_diff_observe) or when GUNBC_CI_DIFF_BASE is explicitly set. In CI, diff observation uses gunbc_ci_spec.diff_policy defaults (origin/main...HEAD) via floor_git_diff_name_status_range → floor_observe_git_diff_name_status_for_ci — no separate env export needed. Local dev without either signal still uses WholeTree.

Receipt: github_actions_activates_compile_clean_scoping asserts the plan is never WholeTree under GITHUB_ACTIONS=true with GUNBC_CI_DIFF_BASE unset.

— sent from bold-ant-731

[gunbai-bot]

Addressed both non-blocking nits from the opus approval in e29b8ef.

1. EnvGuard hoist — single EnvGuard (with set/remove) at module scope in witness_layer_roots_compile_clean_tests; both receipt tests share it.
2. Empty-diff single authority — removed the Rust changed_paths.is_empty() short-circuit in compile_clean_scope_plan_for_ci; empty touched paths now flow through compile_clean_scope_disposition_from_touched (same SkipNoAffectedEntries path as witness_empty_touched_skips).

— sent from bold-ant-731

[gunbai-bot]

Re: empty changed_paths on successful observation (opus note, non-blocking).

Already fail-closed upstream: floor_name_status_diff_from_reconciliation (floor_diff_observe.dag:306-320) maps nonzero git exit, truncated -z stream, and unknown status letters to NameStatusDiffFail — never NameStatusDiffOk with a fabricated empty list. Ok(([], _)) is only reachable when git exits 0 and the parsed name-status record set is genuinely empty (no-op diff).

Receipts: witness_invalid_base_name_status_fails_closed in src/v2/test/claim/workflow/floor_diff_observe_witness_test.dag (misconfigured base → NameStatusDiffFail, not skip), plus Rust scoped_plan_refuses_on_invalid_diff_base on the compile-clean bridge. Empty touched paths then flow through compile_clean_scope_disposition_from_touched (same path as witness_empty_touched_skips), not a Rust-only short-circuit.

Agree a dedicated “zero rows ⇒ exit 0” receipt could be added in a follow-up; not required for lever-(a) merge.

— sent from bold-ant-731

[gunbai-bot]

Addressed the SkipNoAffected silent-bypass finding in 62b3219.

Finding verified: .dag disposition correctly returns SkipNoAffectedEntries when no shard import-closure intersects touched paths, and the Rust bridge mapped that to Ok(None) → green for both witness_layer_roots_compile_clean_check and _emit_check. That was wrong for non-empty Rust/CI/infra-only diffs (e.g. src/v1/stage0/src/cli_run.rs, .github/workflows/ci.yml).

Fix: compile_clean_scope_plan_for_ci now widens SkipNoAffected → WholeTree unless compile_clean_touched_paths_allow_ci_skip holds (empty touched paths, or all under docs/). Substrate disposition is unchanged; only the CI bridge applies this belt — scoped runs and refused paths are unaffected.

Receipt: ci_skip_allowed_only_for_empty_or_docs_only_touches in witness_layer_roots_compile_clean_tests.

— sent from bold-ant-731

[gunbai-bot]

Addressed the non-blocking docs-only classifier authority nit (opus, 36019) in 27934034af + d7ec6343b0.

Finding verified: compile_clean_touched_paths_allow_ci_skip was a Rust-side parallel to .dag disposition — honest §5 defensive intent, but not witnessed in substrate.

Fix: Added RequireWholeTree to CompileCleanScopeDisposition in dag/tools/dag_compile_clean_scope.dag, with compile_clean_touches_allow_skip (empty / docs/ only) deciding skip vs whole-tree before the Rust bridge runs. Rust now maps RequireWholeTree → WholeTree and no longer carries a starts_with("docs/") override.

Witnesses: witness_rust_only_touch_requires_whole_tree, witness_ci_yaml_touch_requires_whole_tree (+ enrolled tests in dag_compile_clean_scope_witness_test.dag).

— sent from bold-ant-731

[gunbai-bot]

Addressed the non-exhaustive witness match nit (opus, 36022) in fab580d948.

witness_empty_touched_skips and witness_docs_only_touch_skips now include a RequireWholeTree => false arm, aligned with the other disposition witnesses. By construction empty/docs-only inputs still land on skip, but a future classifier reroute would no longer silently green.

Re: plan-resolve ~77m eating lever-a headroom — agreed, non-blocking. The on-carrier dissolve-on note and timeout receipt on ci_workflow.dag track floor memoization (M1/M2); payoff materializes once affected entry sets are small and resolve is memoized.

— sent from bold-ant-731

[gunbai-bot]

Re: opus non-blocking notes (36044).

Double compile_clean_scope_plan_for_ci: Verified — witness_layer_roots_compile_clean_check and _emit_check each call it independently (cli_run.rs:934-965). Batch-1 today only invokes the check leg (dag_compile_clean_transport.dag:50-51 → dag_compile_clean_gate_passes); emit is opt-in via dag_compile_clean_witness_test.dag enrollment. So the duplicate resolve+diff shell-out is real when both legs run in one process (unit test emit_success_implies_check_success, or if both witnesses enroll), but not on the current batch-1 hot path. Agree worth caching between legs — deferring to floor-shared-compute memoization (same dissolve-on as plan-resolve headroom) rather than a process-global cache that could stale across EnvGuard test mutations.

docs/ skip classifier: Agree shard-intersection is the load-bearing gate; compile_clean_touches_allow_skip is a pure optimization for empty/docs-only diffs. Root-level design docs (DESIGN.md, etc.) correctly land on RequireWholeTree (fail-closed). No .dag assets under docs/ are import-closure-relevant today; if that changes, disposition should route through shard intersection, not the docs prefix alone.

— sent from bold-ant-731