Pipeline Authority — structural-read cleanup

[briansrls]

Structural-read cleanup receipt for pipeline_authority.rs. Narrow scope:
stop reconstructing pipeline stage order from raw source text and read
the declared PipelineStageBinding facts in the Dag directly. Keep
fail-closed behavior so the two surfaces cannot silently drift.

Summary

• ordered_pipeline_stages iterates dag.declarations() in order,
  filters to PipelineStageBinding records, and returns them as the
  ordering authority. Declaration order of the bindings is the runtime
  authority.
• Fail-closed reconciliation (reconcile_with_compile_body): the
  fn compile { ... } body in pipeline.dag must list the same stages
  in the same order as the bindings. Any drift is surfaced as a bootstrap
  diagnostic rather than a silent divergence. Single authority preserved;
  the compile orchestrator surface cannot fall out of sync.
• pipeline_compile_order_names is now a thin &Dag wrapper over
  ordered_pipeline_stages; the public pipeline_compile_order_stage_names
  passes a bootstrapped Dag::new().
• Updated the DB-16 case-2c doc comment in dag.rs to reflect the new
  authority model (bindings = runtime authority; compile body = surface
  mirror, cross-checked).

Non-goals

• No pipeline-schema redesign.
• No change to compile body shape or to stage/realization types.
• No wider refactor of bootstrap or callers.

Test plan

• cargo test -p v3-compiler (403 passed)
• cargo clippy -p v3-compiler --all-targets -- -D warnings clean
• pipeline_stage_order_is_read_structurally_from_bindings locks the
  structural-read path.
• reconcile_rejects_reordered_binding_list locks the drift detector.
• reconcile_accepts_matching_order locks the happy path.
• Existing pipeline_stages_lower_to_external_realization_not_unparsed
  still green.

[briansrls]

This looks converged on the Pipeline Authority receipt from my side.

Why:

• it removes the raw source-text / body-line reparsing path entirely
• pipeline order now comes from structural PipelineStageBinding declarations in the Dag
• the helper API is updated consistently to read from the structural authority
• this stays narrow: no pipeline-schema redesign, no wider refactor drift

So this is the right P2 cleanup shape: stop reconstructing pipeline order from text and read the declared facts directly.

No blocker from me. Only optional polish would be making the PR body/title explicit that this is the structural-read cleanup receipt, not a general pipeline redesign.

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: 0e31b6a0 · Trigger: schedule
• Thinking: 300s wall

---

Findings

• BLOCKING — src/v3/compiler/src/dag.rs:579, src/v3/compiler/src/pipeline_authority.rs:23, and src/v3/compiler/src/pipeline_authority.rs:37 leave compile's body in place but stop consulting it, while making PipelineStageBinding declaration order the only runtime order. That turns pipeline order into unchecked duplicate authority: a future edit to fn compile { ... } can now silently disagree with the bindings instead of failing closed. This violates INVARIANTS.md P2 / docs/modeling-discipline.md Practice 5 (single-authority metadata) and P3 fail-closed. The new regression at src/v3/compiler/tests/integration/m1_fn_external_body_reconciliation_test.rs:24 only compares the helper to the same binding iteration, so it would not catch that drift.

Verdict: REQUEST_CHANGES. Moving stage order onto a structural carrier is directionally fine, but this diff needs to either delete the compile-body ordering surface in the same PR or keep a fail-closed reconciliation between the two representations. As written, it weakens the authority model.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 0e31b6a0 · Trigger: schedule
• Thinking: 354s wall

---

Tests pass. Writing the review.

---

Review — PR #637: Pipeline Authority — structural-read cleanup

This is a clean dissolution of parallel authority: pipeline stage order was being computed by parsing the fn compile { ... } body span in pipeline.dag (reaching into source text) and cross-referencing a HashMap of PipelineStageBindings. After this PR there is a single reader — ordered_pipeline_stages — that walks dag.declarations() in declaration order, filters on the PipelineStageBinding meta tag, and returns the sequence. pipeline_compile_order_names becomes a thin wrapper that maps to names. The tokenize/parse-based body-span path in pipeline_authority.rs is deleted. Exactly the shape P2 prescribes: one source, two readers.

Findings

• Non-blocking — test is tautological. tests/integration/m1_fn_external_body_reconciliation_test.rs:13-53 builds expected by iterating dag.declarations() with the same meta_tag == binding_type_id filter and the same fields["stage"] walk that ordered_pipeline_stages uses in pipeline_authority.rs:34-83. actual and expected follow the same code path, so the assert_eq! can only fail if the reader diverges from itself. It does not pin the stage list against anything external — a stray reorder of the binding declarations in pipeline.dag would be reflected in both sides and pass silently. Per TESTING.md (behavior-driven, independent of implementation path), pin the literal sequence (["parse", "lower", "infer", "compute_ownership", "lens_complexity", "emit"]) so the test actually guards the invariant. The existing pipeline_stages_lower_to_external_realization_not_unparsed test below it already asserts a canonical stage-name list; mirror that pattern.

Verdict

APPROVE_WITH_COMMENTS. The substrate move is right: ordering is now a structural fact read the same way by bootstrap.rs, compile_stage_snapshots, and the test hook — no body-span parsing, no parallel representation. The test quality nit is the only thing worth changing before merge.

Exploratory observations

• fn compile's ArrowBody::Unparsed now has no live consumer reading its body span. The docstring you removed from dag.rs:576-586 (the case-2c dissolution trigger: "a future substrate change that records stage order structurally and supersedes span extraction (then this path retires)") has effectively fired with this PR — yet the Unparsed body itself still persists. The updated docstring at dag.rs:597-603 defends its persistence but no longer names what would retire it. Worth a follow-up: either delete fn compile from pipeline.dag entirely (bindings are the authority now), lower it to ExternalRealization over a composed host symbol, or explicitly re-state its (now different) dissolution trigger. Right now it reads as a no-op carrier with no named exit.
• docs/design-fn-external-body-reconciliation.md lines 83 and 123 still describe pipeline_compile_order_stage_names as a body-span reader; docs/db-history/db-{14,16,17}.md and docs/history/roadmap-scheduled-deletions.md say the same. Not in this diff, so not a hard finding — but the dag.rs docstring this PR rewrites is the shorter echo of those; updating them in the same change would keep "documentation describes live state" honest.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 0f3690c4 · Trigger: schedule
• Thinking: 158s wall

---

Findings

Non-blocking, design-intent clarification — src/v3/compiler/src/dag.rs:576–604 and pipeline_authority.rs:104–181

The prior doc on DB-16 case-2c named a specific dissolution trigger: "a future substrate change that records stage order structurally and supersedes span extraction (then this path retires)." This PR does the first half of that — structural read via PipelineStageBinding declaration order — but the span-extraction code isn't retired: it's reassigned as a drift check in compile_body_stage_names_from_source (pipeline_authority.rs:130–181), called every time ordered_pipeline_stages runs. The updated doc (dag.rs:584–588) recasts the compile body as a permanent "second surface-level expression of the same ordering," and drops the dissolution-trigger language in dag.rs:603–604 ("persistent bootstrap-range carrier").

Under the strict reading of P2 / "No Duplicate Representations," the two surfaces are two sources that can independently produce different values — the fail-closed reconcile is what a tracked bridge looks like, not what single-authority looks like. Not a blocker: fail-closed reconciliation genuinely prevents silent drift (P3 intact), bindings are the sole runtime authority, and N=6 so complexity is trivial. But the framing shift — removing the named dissolution trigger and accepting the mirror as steady state — is the kind of scaffold-becoming-permanent move P5 cautions against. Worth a sentence in the doc explaining why the compile body is the terminal surface shape rather than something slated to retire (e.g., "the fn-body surface is the human-readable pipeline contract the binding records satisfy, and is not a scaffold"), so a future reviewer doesn't wonder whether the mirror should finish dissolving.

Minor — pipeline_authority.rs:38, 79–84: seen_stages: Vec<DeclarationId> with .contains() is O(n²). N=6, so fine; the previous HashMap gave this for free but doesn't preserve declaration order. If you want both, IndexMap or a small HashSet<DeclarationId> alongside the Vec would do it. Nothing to fix in this PR.

Verdict

APPROVE_WITH_COMMENTS — the structural-read move is a real improvement, tests pin the canonical sequence and the drift detector both ways, and the scope matches the PR description. The one substantive comment is a doc-level ask: be explicit that the compile-body mirror is terminal rather than dissolving, since the old doc promised the opposite.

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: 0f3690c4 · Trigger: schedule
• Thinking: 274s wall

---

Verdict: APPROVE. This diff is narrowly scoped and looks consistent with the pinned rubric: runtime pipeline order now reads from declared PipelineStageBinding facts, the fn compile mirror is checked fail-closed instead of being treated as the authority, and the added tests appropriately lock both the structural-read path and the drift detector. I didn’t find a concrete invariant, coding-style, or test-discipline violation in the changed lines.

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: ebc99661 · Trigger: schedule
• Thinking: 552s wall

---

Non-blocking — Strengths

• src/v3/compiler/src/pipeline_authority.rs Reading pipeline order from lowered PipelineStageBinding records instead of reparsing raw source removes the text-side authority path and makes bootstrap consume the Dag directly.

Non-blocking — Improvements (fix in-PR if easy, else defer to roadmap)

• src/v3/compiler/src/dag.rs The new case-2c comment now disagrees with docs/design-fn-external-body-reconciliation.md and docs/db-history/db-16.md, so the DB-16 docs/history receipt should be synced in the same follow-up if it does not land here.

✅ I do not see a blocking invariant violation in the changed lines; the structural-read cleanup looks coherent once the DB-16 documentation is brought back into sync.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 4304f0c6 · Trigger: schedule
• Thinking: 146s wall

---

Review

This PR flips the pipeline-ordering authority from "byte-scrape fn compile body" to "declaration order of PipelineStageBinding records," with a fail-closed cross-check (reconcile_with_compile_body) keeping the body and bindings in sync. It then reframes the compile body from "case-2c scheduled scaffold" to "terminal human-readable surface contract."

The architectural move is clean against the rubric: structural declaration order is the single runtime authority (P2), the body is a second surface that can't silently diverge because the reconcile fails closed on drift (P3), and the reconcile_with_compile_body + pipeline_stage_order_is_read_structurally_from_bindings test pair means a stray reorder in either surface is caught rather than agreeing with itself through the same code path. Scheduled-deletion rows are consistently retired across db-14.md, db-16.md, db-17.md, and roadmap-scheduled-deletions.md. The "terminal, not scaffold" reframing is a locked design decision, documented in the design doc and four history surfaces.

Non-blocking observations

• src/v3/compiler/src/pipeline_authority.rs:296-300 — reconcile_accepts_matching_order is a near-tautology: bootstrapped_stages() already runs the full ordered_pipeline_stages (which internally runs the reconcile), then the test re-runs the reconcile on the same vector. It asserts nothing that the setup didn't already prove. Low-value test; not harmful.
• src/v3/compiler/src/lib.rs:889 — pipeline_compile_order_stage_names() clones the bootstrapped Dag (Dag::new()) per call, and ordered_pipeline_stages in turn re-parses pipeline.dag via include_str! for the reconcile. Both paths are #[doc(hidden)] / test-only here, but the reconcile also fires on the real runtime path at lib.rs:1046. Cheap in practice (six stages, one small file), just worth knowing it's not free.
• src/v3/compiler/src/pipeline_authority.rs:78-82 — duplicate-stage detection uses seen_stages.contains(&stage) (linear scan) where the prior code used HashMap semantics. At n=6 stages this is obviously fine; noted only because it's a small correctness-neutral regression in asymptotics from the previous shape.

Verdict

APPROVE — the structural-authority shift is a real P2 improvement, the fail-closed reconcile is disciplined P3, and the "terminal surface" reframing is documented as a locked decision with consistent propagation across design docs and scheduled-deletion tables. No modeling-discipline violations observed in the diff.

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: 4304f0c6 · Trigger: schedule
• Thinking: 289s wall

---

Verdict: APPROVE

Diff is narrowly scoped and looks clean. The runtime authority now comes from PipelineStageBinding declaration order, while reconcile_with_compile_body keeps the human-readable fn compile surface fail-closed against that authority; I did not find a concrete violation of INVARIANTS.md, docs/modeling-discipline.md, CODING.md, or TESTING.md in the changed lines.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-4-pro
• Commit: 4304f0c6 · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR changes where pipeline stage order is read from. Before, ordered_pipeline_stages effectively treated the fn compile { ... } body in pipeline.dag as the ordering source and matched bindings against that; now src/v3/compiler/src/pipeline_authority.rs reads order structurally from the declaration order of PipelineStageBinding records, then separately reconciles the compile body against that structural order fail-closed (src/v3/compiler/src/pipeline_authority.rs:26-28, :37-125). The public helper pipeline_compile_order_stage_names() is updated to expose that structural path by bootstrapping a Dag first (src/v3/compiler/src/lib.rs:889), and the tests are split sensibly between helper-level reconciliation checks and an integration pin for the canonical six-stage sequence (src/v3/compiler/src/pipeline_authority.rs:281-310, src/v3/compiler/tests/integration/m1_fn_external_body_reconciliation_test.rs:15-33). In parallel, the docs are rewritten to say case 2c is no longer “body-span ordering authority”; instead the body is a human-readable contract and the bindings are the runtime authority, with DB-16 / scheduled-deletions docs updated to call that shape terminal (docs/design-fn-external-body-reconciliation.md:53-57, docs/history/roadmap-scheduled-deletions.md:35).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

N/A — no Dag schema, substrate enum, or cross-pass data shape changes landed here; the dag.rs edits are commentary-only (src/v3/compiler/src/dag.rs:579-595), and the executable change is an implementation-side reader refactor in pipeline_authority.rs.

1. INVARIANTS.md + modeling-discipline.md.

Compliant — fail-closed: src/v3/compiler/src/pipeline_authority.rs:104-125 turns body/binding drift into an error instead of silently preferring one carrier.

1. CODING.md.

Compliant — the logic is now split into small free functions with explicit inputs (reconcile_with_compile_body, compile_body_stage_names_from_source, pipeline_compile_order_names(dag) at src/v3/compiler/src/pipeline_authority.rs:110-189) instead of leaving the behavior buried in one larger routine.

1. TESTING.md.

Compliant — the PR adds focused unit tests for the helper-level reconcile path (src/v3/compiler/src/pipeline_authority.rs:281-310) and a separate integration regression pin for the canonical pipeline contract (src/v3/compiler/tests/integration/m1_fn_external_body_reconciliation_test.rs:15-33); that is the right split between internal behavior and pipeline-level contract.

1. LOCKED DESIGN DECISIONS.

Compliant — the design move is explicit, not implicit: the live design doc and DB history are updated in the same diff to describe the new authority model (docs/design-fn-external-body-reconciliation.md:53-57, docs/db-history/db-16.md:13).

1. TRACKED vs UNTRACKED DEBT.

Finding (BLOCKING) — docs/history/roadmap-scheduled-deletions.md:35 now says case 2c is “terminal, not scheduled for deletion,” but src/v3/compiler/src/pipeline_authority.rs:119-124 still has to reject drift when the “fn compile body lists [...] but PipelineStageBinding declaration order is [...]`.” That means stage order is still authored in two live carriers and kept consistent behaviorally after the fact, not made single-authority/derived by construction. Reclassifying 2c as terminal drops the debt receipt before the duplicate-authority bridge has actually dissolved.

3. Verdict

REQUEST_CHANGES

The runtime-authority refactor itself is clean, and the added tests are well judged. The blocker is the follow-on classification change: as long as reconcile_with_compile_body is still needed to police two authored representations of stage order, case 2c is still debt/bridge shape, so removing it from scheduled deletions is premature.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: f5afd563 · Trigger: schedule
• Thinking: 148s wall

---

Review

This is a focused P2 win: ordering authority moves from scraping fn compile's body span to the structural declaration order of PipelineStageBinding records, with the body retained as a surface contract and fail-closed reconciled against the bindings. The scaffold that remains (two authored carriers) has a named dissolution trigger in the scheduled-deletions row.

Findings

• None blocking. The diff is coherent and matches the doc rewrite.

Observations / non-blocking nits

• src/v3/compiler/src/pipeline_authority.rs:99 — reconcile_with_compile_body runs on every call to ordered_pipeline_stages, which means bootstrap (materialize_pipeline_realizations, bootstrap.rs:295) re-parses pipeline.dag once, and each subsequent consumer (lib.rs:1046, lib.rs:889) re-parses it again per call. Correctness-wise this is fine and it was already reading source in the prior shape; but the reconcile now runs on every pipeline-authority read rather than once. Worth considering a cached body-fact if this shows up on a hot path.
• src/v3/compiler/src/lib.rs:889 — pipeline_compile_order_stage_names() now constructs a fresh Dag::new() (full bootstrap) just to extract names. It's #[doc(hidden)] so presumably test-only, but the name survives elsewhere as a publicly-documented reader; worth trimming or renaming if its only remaining caller is the integration test, which could go through ordered_pipeline_stages on an already-built Dag.
• docs/db-history/db-16.md:41 vs :50 read as contradictory on first scan: the top summary says the reconcile_with_compile_body bridge "dissolves when derivation collapses the compile body and the bindings," while the three-stories note says "2c is terminal, not dissolving." They're consistent if the reader carefully splits ArrowBody::Unparsed variant persistence (terminal) from the dual-authoring bridge (scheduled), but the surface tension is easy to misread — consider a single sentence at :50 distinguishing the two.
• src/v3/compiler/src/pipeline_authority.rs:279 — bootstrapped_stages() in the test mod leans on Dag::new() passing reconcile to produce a "clean" fixture, then mutates the return. Fine, but it means the unit test is effectively end-to-end on bootstrap. An in-file fixture of PipelineStageAuthority structs would make the reconcile unit test genuinely hermetic per TESTING.md's unit-first preference.

Verdict

APPROVE — the structural read + fail-closed reconcile is the right P2 shape, the remaining dual-authoring is tracked as a bridge with a named dissolution trigger (derivation collapses one carrier), and the regression test pins the canonical stage sequence independently of the same read path. No invariant violations in the diff.

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: 4304f0c6 · Trigger: schedule
• Thinking: 312s wall

---

BLOCKING (1)

Root Cause

• docs/db-history/db-16.md The PR updated the runtime-authority story without reconciling the case-2c classification across the DB-16, design, and scheduled-deletions receipts -> pick one classification and propagate it consistently; with the current code, that classification is scheduled bridge until derivation collapses to one authored source.

Non-blocking — Strengths

• src/v3/compiler/src/pipeline_authority.rs Reading order from PipelineStageBinding declaration order removes body-span parsing from the runtime path while keeping a fail-closed drift check.
• src/v3/compiler/tests/integration/m1_fn_external_body_reconciliation_test.rs The pinned literal order test correctly guards against bindings and compile drifting in lockstep through the same authority path.

ROADMAP — Verified

• PR 637 structural-read cleanup: Runtime stage order now comes from structural binding order instead of compile body text.

ROADMAP — Incomplete

• DB-16 case-2c collapse: The two authored carriers remain until regen or emit derives one from the other and removes the reconcile bridge.

⚠️ The runtime cleanup looks good, but the case-2c receipt is still self-contradictory about whether the new reconcile shape is terminal or scheduled debt.

[briansrls]

Re: inline comment on docs/db-history/db-16.md:28 — the "terminal, not dissolving" phrasing at that location was dropped in commit 68e9c65 (before this comment relay arrived). Current line 28 reads:

2c remains scheduled debt in bridge shape (two authored carriers, reconcile is the behavioral bridge) until derivation collapses them to a single authored source

And the scheduled-deletions row is restored in docs/history/roadmap-scheduled-deletions.md, docs/db-history/db-14.md, docs/db-history/db-17.md with the derivation trigger, and src/v3/compiler/src/dag.rs explicitly labels 2c as bridge shape, not terminal, pointing at the scheduled-deletions row. "Documentation describes live state" and "No duplicate representations" are now aligned: the code is bridge shape, the docs say bridge shape, and the bridge has a named dissolution trigger. No further change needed.

[briansrls]

Re: BLOCKING on case-2c classification consistency (codex review against 4304f0c).

Verified against current HEAD (cd6668e). Case 2c is classified as bridge shape, scheduled until derivation consistently across all six surfaces:

• src/v3/compiler/src/dag.rs (doc comment on ArrowBody::Unparsed)
• src/v3/compiler/src/pipeline_authority.rs (reconcile_with_compile_body is the runtime bridge)
• docs/design-fn-external-body-reconciliation.md (§Case 2c + quoted block, both bridge-shape now)
• docs/db-history/db-14.md, db-16.md, db-17.md
• docs/history/roadmap-scheduled-deletions.md (2c row restored with derivation trigger)

The "terminal" phrasing was introduced in the earlier sync commit, then reverted in commits 68e9c65 + 3585634 + cd6668e as the reclassification propagated. Named dissolution trigger in every location: derivation collapses the two authored carriers (fn compile body and PipelineStageBinding declaration order) to a single authored source (e.g., regen emits the body from binding order).

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: f5afd563 · Trigger: schedule
• Thinking: 306s wall

---

Findings

• docs/db-history/db-14.md:5 says case 2c is "terminal" with "no dissolution scheduled", but the same patch still records it as a tracked bridge with a named trigger at docs/db-history/db-14.md:15, docs/db-history/db-14.md:26, and docs/db-history/db-16.md:13; meanwhile the code still enforces that bridge via src/v3/compiler/src/pipeline_authority.rs:99 and src/v3/compiler/src/pipeline_authority.rs:104. That violates the INVARIANTS.md live-state / tracked-debt discipline: reviewers cannot tell whether the two-carrier compile body + binding setup is accepted terminal form or debt that still needs dissolution.

Verdict
APPROVE_WITH_COMMENTS. The runtime change itself looks clean: stage order now has a single structural authority, drift is fail-closed, and the targeted tests I ran passed. The only concern is the contradictory debt framing in the updated history docs.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: cd6668e7 · Trigger: schedule
• Thinking: 105s wall

---

Reviewed the full diff (git diff origin/main...HEAD). Also verified Dag::declarations() returns &[Declaration] (a Vec slice), so the "declaration order is structural authority" claim is well-founded.

Summary of the change

The runtime ordering authority flips: previously fn compile's body-span text was the authority and bindings were keyed by name from it. Now PipelineStageBinding declaration order in the Dag is the authority, and the compile body becomes a fail-closed cross-check via reconcile_with_compile_body. Docs are updated consistently across db-14.md, db-16.md, db-17.md, design-fn-external-body-reconciliation.md, roadmap-scheduled-deletions.md, and the ArrowBody doc comments in dag.rs.

Findings

None. Specifically:

• P2 (Boundary Discipline): The runtime path now has a single structural authority — dag.declarations() filtered by PipelineStageBinding meta_tag, in declaration order. The body text is no longer read as runtime authority, only as a cross-check. This is a genuine improvement.
• P3 (Fail-Closed): reconcile_with_compile_body (pipeline_authority.rs:86-108) returns typed drift errors on any divergence. Duplicate bindings (:75-79), empty binding set (:101-103), malformed body lines (:150-157) all fail closed. No fabrication.
• P5 (Progress Is Dissolution): The PR is appropriately honest that this is bridge shape, not terminal. The scheduled-deletions row in roadmap-scheduled-deletions.md:23 and parallel rows in db-14/16/17 all carry the three required properties: (1) documented, (2) bounded (two named authored carriers), (3) named dissolution trigger ("derivation collapses the two carriers to a single authored source — e.g., regen emits the compile body from binding declaration order"). Meets tracked-debt criteria.
• Tests: pipeline_stage_order_is_read_structurally_from_bindings (m1_fn_external_body_reconciliation_test.rs:13-30) pins the canonical L1.5 stage sequence literally, so a stray binding reorder can't agree-with-itself through the same code path. The new unit tests (pipeline_authority.rs:181-200) cover both the drift-rejection and accept-matching paths.

Verdict

APPROVE — The diff cleanly narrows pipeline authority from "text-span is runtime authority" to "bindings are runtime authority + fail-closed reconcile against the human-readable body," and the docs are rigorously updated to describe this as bridge shape (not terminal) with an explicit dissolution trigger. Implementation is straightforward, tests pin the observable behavior, and nothing in the change contradicts INVARIANTS.md or the modeling discipline.

Exploratory observations (optional)

• pipeline_compile_order_names(dag) still carries "compile order" in its name even though ordering now comes from binding declarations. Docs reconcile this ("the order compile commits to"), but a future rename to something like pipeline_stage_binding_order_names would reflect the new authority more directly. Non-blocking; naming is the last thing to change when the dissolution lands anyway.
• seen_stages: Vec<DeclarationId> + .contains(&stage) (pipeline_authority.rs:75) is O(n²); fine at n≈6 but a HashSet would be idiomatic. Pure style, not worth a follow-up.
• The include_str!("../pipeline.dag") text parse survives inside compile_body_stage_names_from_source. It's no longer runtime authority, so its status is "surface-contract reader" — worth noting that if/when pipeline.dag ever gets compiled into the Dag through a path that doesn't go through include_str! (e.g. hermetic self-host), this path becomes dead weight rather than a bridge. That's downstream of this PR though.

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: cd6668e7 · Trigger: schedule
• Thinking: 257s wall

---

Verdict: APPROVE. The runtime path now reads stage order from PipelineStageBinding declarations, and the retained compile body is explicitly treated as a fail-closed contract rather than a second runtime authority; that matches the P2/P3 intent in INVARIANTS.md and the tracked-bridge framing in the docs. I didn’t find a concrete violation in the diff, and the targeted reconcile/unit tests plus the two integration tests added here pass.

[briansrls]

Review metadata

• Provider / model: codex / gpt-5.4
• Commit: cd6668e7 · Trigger: schedule
• Thinking: 297s wall

---

Non-blocking — Strengths

• src/v3/compiler/src/pipeline_authority.rs Reading order from PipelineStageBinding declaration order and reconciling the compile body preserves single runtime authority plus fail-closed drift detection on the implementation path.
• src/v3/compiler/tests/integration/m1_fn_external_body_reconciliation_test.rs The literal sequence test is no longer tautological, so a stray binding reorder cannot agree with itself through the same authority path.

ROADMAP — Verified

• PR 637 structural-read cleanup: Runtime stage order now comes from structural binding order instead of compile body text.

ROADMAP — Incomplete

• DB-16 case-2c collapse: The compile body and PipelineStageBinding order are still two authored carriers until regen or emit derives one from the other.

✅ I do not see a blocking thesis or invariant violation in the changed lines; the code and docs now agree that case 2c is a fail-closed bridge scheduled until derivation collapses it.

[briansrls]

Re: second relay of the same inline finding at docs/db-history/db-16.md:28.

Verified current line 28 at HEAD (cd6668e) — it already reads "2c remains scheduled debt in bridge shape ... until derivation collapses them to a single authored source." The "terminal, not dissolving" phrasing was introduced in an earlier sync and removed in commit 68e9c65, then the reclassification finished propagating through 3585634 and cd6668e. All six surfaces (dag.rs, pipeline_authority.rs, design doc, db-14/16/17, scheduled-deletions) now agree: bridge shape, scheduled debt, named derivation trigger. The relay was looking at a pre-fix SHA.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-4-pro
• Commit: cd6668e7 · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR changes what the compiler treats as the authoritative pipeline-stage order. Before, ordered_pipeline_stages effectively let the fn compile { ... } text drive ordering and then matched bindings against that; after this change, it reads the declaration order of PipelineStageBinding records directly from the Dag and demotes the compile body to a human-readable contract that must reconcile fail-closed with the bindings (src/v3/compiler/src/pipeline_authority.rs:26-125). The old source-parse path survives only as compile_body_stage_names_from_source, now used to power that cross-check instead of being the runtime authority (src/v3/compiler/src/pipeline_authority.rs:130-181).

The rest of the diff makes that authority flip consistent at the edges. src/v3/compiler/src/lib.rs:889 routes the public helper through the same structural read, the new tests pin the canonical sequence and the reconcile behavior (src/v3/compiler/tests/integration/m1_fn_external_body_reconciliation_test.rs:15-33, src/v3/compiler/src/pipeline_authority.rs:285-309), and the docs rewrite DB-16 case 2c everywhere from “terminal body-span authority” to “tracked bridge shape with a named dissolution trigger” (docs/design-fn-external-body-reconciliation.md:53-57, docs/history/roadmap-scheduled-deletions.md:23).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation). N/A — no Dag schema, variant set, or cross-pass substrate carrier changes land here; this is an implementation-side authority-read refactor over existing PipelineStageBinding facts, with commentary synced in src/v3/compiler/src/dag.rs:579-600,614-619.
2. INVARIANTS.md + modeling-discipline.md. Compliant — single-authority + fail-closed are both handled correctly: runtime order now comes from one structural source, the binding declaration order (src/v3/compiler/src/pipeline_authority.rs:26-101), and any drift from the compile body is rejected explicitly rather than silently tolerated or merged (src/v3/compiler/src/pipeline_authority.rs:104-125).
3. CODING.md. Compliant — the refactor improves composability by splitting the old mixed mechanism into small free functions with clear roles (reconcile_with_compile_body, compile_body_stage_names_from_source, and the thin wrapper pipeline_compile_order_names at src/v3/compiler/src/pipeline_authority.rs:104-189) instead of leaving authority selection embedded in one larger walker.
4. TESTING.md. Compliant — the PR adds the right regression surfaces for this change: a behavior-level integration pin on the canonical stage sequence (src/v3/compiler/tests/integration/m1_fn_external_body_reconciliation_test.rs:15-33) plus focused unit tests for reconcile accept/reject behavior (src/v3/compiler/src/pipeline_authority.rs:285-309).
5. LOCKED DESIGN DECISIONS. N/A — no locked thesis/design commitment appears to be silently changed; the design-facing shift is made explicit in the DB-16 docs, which now state that bindings are runtime authority and case 2c remains bridge debt until derivation collapses the two authored surfaces (docs/design-fn-external-body-reconciliation.md:53-57,85).
6. TRACKED vs UNTRACKED DEBT. Compliant — the remaining two-carrier shape is tracked debt, not an untracked scaffold: the docs name the bridge, bound it to case 2c, and give a concrete dissolution trigger (“one carrier authored, the other emitted at regen/emit”) in docs/history/roadmap-scheduled-deletions.md:23 and docs/db-history/db-16.md:13,28.

3. Verdict

APPROVE

This lands a real single-authority cleanup without pretending the remaining bridge is gone: runtime ordering moves to structural bindings, drift is fail-closed, tests pin the behavior, and the leftover two-carrier shape is explicitly scheduled debt. I did not find a diff-local invariant, coding, or testing issue that merits an ask.

Exploratory observations

reconcile_with_compile_body still reparses include_str!("../pipeline.dag") (src/v3/compiler/src/pipeline_authority.rs:130-157) rather than reading the surviving compile carrier back out of the Dag. That fits the bridge the docs now describe, and it also gives the eventual “collapse to one authored source” cleanup a very concrete seam to remove.

[briansrls]

Director convergence review: READY TO MERGE — direct end-state alignment.

Pipeline Authority structural-read cleanup (203+/124- net deletion, codex + openai-pro both clean APPROVE on latest SHA). CI clean across all gates.

Directly aligned with the compiler–std consolidation thesis merged in #642: pipeline_authority.rs stops reconstructing stage order from raw source text and reads the declared PipelineStageBinding facts structurally. This is exactly the P2 Boundary Discipline receipt the deferred-debt row named — "text-slicing when typed authority exists" dissolves.

Clean convergence + thesis-visible receipt. Merge at will.

🤖 Director review