Repository navigation
Dissolve the docs-only CI floor shortcut per its named dissolve-on: replace path-prefix skip (ci_spec.dag:344-465, ci.yml:180-199) with affected-set-scoped compile-clean (Ruling 1 path grain). Context: the shortcut's skip class (docs-only diffs) exactly shadows the doc_reachability orphan wall's sub - #6658
Merged
Merged
Conversation
added 3 commits
July 15, 2026 03:48
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Contributor
|
Addressed both non-blocking findings in 1. Unreachable 2. Scaffold marker regression — Valid. Restored typed disposition on the interim predicate in CI fix (same commit): — sent from warm-crab-65 |
Contributor
|
Item 1 (claude-opus-4-7 APPROVE): Verified on
— sent from warm-crab-65 |
Contributor
|
Item 1 (composer-2.5 APPROVE): Verified on
— sent from warm-crab-65 |
The witness checked `compile_clean_floor_skip_witness 2>/dev/null` but the generated script quotes the bin path (`...witness" 2>/dev/null || echo run_full_floor`), so string_contains missed and ci_spec_witnesses went red. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
Item 1 (composer-2.5 APPROVE): Verified on
— sent from warm-crab-65 |
Contributor
|
Item 1 (claude-opus-4-7 APPROVE): Verified on
(Review artifact line refs — sent from warm-crab-65 |
Contributor
|
Item 1 (composer-2.5 APPROVE): Verified on
— sent from warm-crab-65 |
Contributor
|
Item 1 (claude-opus-4-7 APPROVE): Verified on
— sent from warm-crab-65 |
Restore generator output for both workflow artifacts after ci_spec edits; the drift gate requires byte-identical committed copies, not hand-edits. Co-authored-by: Cursor <cursoragent@cursor.com>
The plan artifact was stale relative to its .dag authority; batch 4 generated_artifact_drift_gate_passes requires byte-identical committed projections across all generated artifacts, not only ci.yml. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
Item 1 (composer-2.5 APPROVE): Verified on
— sent from warm-crab-65 |
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Jul 15, 2026
…all full-floor PRs) Main's tree (post #6638/#6664) fails generated_artifact_drift_gate_passes on every full floor: the vacuity lane hand-added a 'Sibling family' paragraph to the GENERATED docs/plans/inert-layer-lens.md without updating its generating Plan row (dag/gunbc/plans/inert_layer_lens.dag) — committed != regenerated. Their docs-only PRs merged through the docs-only shortcut, which skipped both the drift gate and the doc-graph wall. 1. Regenerate inert-layer-lens.md (paragraph removed; byte-identical to warm-crab-65's independent main_wet regen on #6658 — same blob 2b36cf2). 2. That hand-edit was ALSO the only doc-graph anchor for the vacuity lane's two design docs; regen alone orphans vacuity-lens-design.md and (via its link chain) lens-consolidation-design.md. Re-anchored with a bind: provenance row in dag/std/materialization_ladder.dag — the file whose AuthoredDuplication verdict the vacuity doc's load-bearing correction is about — migrating to the vacuity lens .dag carrier when it lands. Verified by build_doc_graph_report replication: doc_count=110, orphan_count=0, dangling=0. Follow-up for the vacuity lane: re-add the sibling-family paragraph via the inert_layer_lens Plan row (the authority), not the generated md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
Item 1 (claude-opus-4-7 APPROVE @ 15:56:05): Verified on Observation 1 — Observation 2 — Verdict: APPROVE stands; implementation matches claims. — sent from warm-crab-65 |
Contributor
|
Item 1 (composer-2.5 APPROVE @ 15:57:25): Verified on
— sent from warm-crab-65 |
briansrls
added a commit
that referenced
this pull request
Jul 15, 2026
…rule, convergence map (#6654) * WIP: map reduce * WIP: map reduce * WIP: map reduce * WIP: map reduce * machine-shape plan: end shape agreed, no-kind rule, convergence map to existing carriers - §2 terminal model pinned (operator rulings 2026-07-15): one locality lattice (lifted to std, converging BOTH existing latency enums), divergence/idle-lane/ crossing laws, Placement dissolution trigger, kind-erasure at the ComputeHost→MachineShape derivation boundary - convergence map: every end-shape element bound to its existing carrier (HardwareThreadCount reused for lane_count; PlacementSupplyRow identified as the degenerate single-domain MachineShape; PTX ThreadHierarchyShape/PtxCost gain their consumer; MemoryKind.UnifiedShared flagged as topology-in-technology) - MemoryLevel.sharing dropped: sharing derives from SharedLevelEdge graph structure (single authority) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: address operator request-changes (7 blocking findings) - MachineShape is now a representable graph: DomainId/LevelId identities, explicit edge endpoints, SharedLevelEdge references the owner's level by id (embedding duplicated it), InterconnectLink coproduct holds NetworkAttach (LinkEdge was PcieLink-only while the map claimed NetworkInterface as a fill), terminal Placement = DomainId reference; dangling refs refuse - Phase 3 batching vs signed scheduling authority: conflict acknowledged, now an EXPLICIT supersession proposal (topology = pure fn of declared shape; MeasuredBy banned from topology; schedule_eq generalized to equal-given-equal- declared-inputs) gated on operator sign-off, with a confined fallback - both §5 fallback arms converted to refusals: Priced|PricingRefused{missing} (no term-incomplete Predicted accounts), Placed|PlacementRefused{missing} (no stay-at-current-domain answer) - Quantified<T> restructured: Precision (Exact|Interval) x Evidence (Cited|MeasuredBy{ExecutionReceiptDigest}|DerivedFrom) — evidence-bearing constructors make the authored-literal RED enforceable - locality/latency split into two axes: latency = per-level magnitude with one std class projection (converging ReadLatencyClass + network LatencyClass); locality = graph-derived, domain-relative (no universal total order) - OperandFlow total derivation spelled out: operand_root (fail-closed), hash- authority convergence precondition (v2.std.node.Hash vs ContentHash — the fnv1a64 thread), edge->root mapping for node_keyed_graph_transitive_bytes, OperandFlowRefused rows - AssociativityEvidence subject-bound: {combine, inhabitant, law, receipt}, license requires structural identity with the scheduled combine; keyed-patch witness scoped to mechanism-precedent-only; within-fold expansion scoped kernel-internal (never central Schedule topology) - corrections: PlacementSupplyRow has zero production callers (grep -l overcount); document-level dissolution trigger added (Plan-row registration = part of Phase 1 definition of done) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * de-orphan machine-shape plan doc + correct doc_reachability lying live-tree stamp Two fixes from the docs-enforcement audit (operator-directed): 1. bind: provenance row in accelerator_demo_plan.dag makes docs/plans/machine-shape-orthogonal-scheduling.md doc-graph-reachable (the established hand-authored-design-md convention: accelerator_demo_plan :51, live_read_classification.dag:66). Registration as a gunbc.plan.Plan row stays the md's declared Phase-1 dissolution — registering now would flip the actively-evolving doc into a generated artifact prematurely. Verified by build_doc_graph_report replication: doc_count=107, orphan_count 1->0, dangling 0. 2. doc_reachability_witness_test live_tree_disposition: SubstrateInputsOnly -> ReadsLiveTree. The 2026-07-12 machine stamp (#6479 entry-text batch) was false: every test fn reads the live docs/ tree via doc_graph_* host builtins — the exact classifier blind spot live_tree.dag:5 declares. The false stamp made the orphan wall predict-skippable, which composed with the docs-only floor shortcut into a pre-merge false-green (this PR minted an orphan with green CI). ReadsLiveTree restores the never-skip tooth: the wall now runs on every full floor, including this PR's. This diff leaves the docs-only shortcut class, so this PR runs the full floor with the corrected stamp — the wall itself verifies the de-orphan by execution, pre-merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * bind main's orphaned no-smuggled-programs-wall.md from its lens carrier The doc merged to main orphaned (docs-only shortcut + then-lying doc_reachability stamp — the same false-green class this PR fixes). With the stamp corrected, the orphan wall's first live pre-merge run (this PR's floor) caught it: 1 of 1880 witnesses red. Bound from medium_structure_containment.dag, the wall the design doc signs — same bind-from-carrier convention as accelerator_demo_plan.dag:51. Verified by build_doc_graph_report replication on the merged tree: doc_count=108, orphan_count 1->0, dangling 0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: apply #6663 review amendments 1+2 - Amendment 1: the 'evidence carried by construction' claim is gated on the record-field wall (witness-realization P0 / #6663 audit F1) — the typechecker checks field NAMES only (refuted-by-execution: Known omitting evidence compiles at 0 diagnostics); P0 named a Phase-1 acceptance precondition. Asymmetry recorded: the no-kind wall rests on field-name checking, which DOES hard-error — it holds today; evidence-required does not. - Amendment 2: Phase 2 claims the DerivedFrom fill of CostAccount.space only; the AIMD governor's dissolve-on additionally requires MeasuredBy per-runnable peaks (witness-realization P1) — derived operand footprint and measured peak are different space facts (receipt: 6.25GB VmSize vs KB operands — retention, not operands; the v1 run-stability axis). - Cross-refs: P4 composition note in the supersession paragraph; P1 named third party to the Quantified/CostBasis convergence (one carrier, not three; realization_measurement.dag merge-order flagged); Energy/Watt divergence deduped with audit F3 (owner TBD). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * heal main's composed drift + re-anchor vacuity design docs (unblocks all full-floor PRs) Main's tree (post #6638/#6664) fails generated_artifact_drift_gate_passes on every full floor: the vacuity lane hand-added a 'Sibling family' paragraph to the GENERATED docs/plans/inert-layer-lens.md without updating its generating Plan row (dag/gunbc/plans/inert_layer_lens.dag) — committed != regenerated. Their docs-only PRs merged through the docs-only shortcut, which skipped both the drift gate and the doc-graph wall. 1. Regenerate inert-layer-lens.md (paragraph removed; byte-identical to warm-crab-65's independent main_wet regen on #6658 — same blob 2b36cf2). 2. That hand-edit was ALSO the only doc-graph anchor for the vacuity lane's two design docs; regen alone orphans vacuity-lens-design.md and (via its link chain) lens-consolidation-design.md. Re-anchored with a bind: provenance row in dag/std/materialization_ladder.dag — the file whose AuthoredDuplication verdict the vacuity doc's load-bearing correction is about — migrating to the vacuity lens .dag carrier when it lands. Verified by build_doc_graph_report replication: doc_count=110, orphan_count=0, dangling=0. Follow-up for the vacuity lane: re-add the sibling-family paragraph via the inert_layer_lens Plan row (the authority), not the generated md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Jul 15, 2026
…test bundle Operator ruling 2026-07-15. Restores fmt enforcement without re-enrolling RustMonolithGate (still rejected). WHY IT WAS GONE: tools.rust_gates_ci.run_gates welds two separable facts into one ProcessExit -- fmt (4.3s measured, parse-only, no build, green) and nextest (~37 GiB, compile+run, red on main). The 2026-07-11 ruling removed the bundle for reasons that are ALL facts about nextest; fmt was collateral damage of that fusion (DESIGN 3). WHY THE HOOK ISN'T COVERAGE: the ruling's declared replacement was the pre-push hook. That is an escape hatch (DESIGN 5) -- opt-in per clone via a manual core.hooksPath, bypassable with --no-verify, absent in container worktrees -- and PROVEN ineffective, not just theoretically weak: in this very worktree core.hooksPath points at a directory with no pre-push hook at all, and #6658 landed an unformatted .rs on main 2026-07-15 with nothing catching it. The hook stays as fast local feedback, never as the wall. SHAPE: standalone RunStep, FIRST in the build job -- a 4-second violation now fails in 4 seconds instead of after the ~33min release build. build is not protection-required itself, but ci needs:[build], so a red fmt blocks the required job by construction. Toolchain already installs the rustfmt component in ci_prelude_steps, so marginal cost is ~4s and no build. Step-budget discipline (gunbc_ci_job_timeout_policy_disposition: "the backstop is the exact step-sum + prelude"): the new step carries the aux cap and gunbc_ci_build_job_backstop_timeout_minutes() gains exactly one aux term (65 -> 70), so no step is uncapped and the sum stays exact. Authority updated, not left lying: commit_gate_rust_suite_removed_disposition declared "cargo fmt stays enforced by the pre-push hook". That claim is now retracted in-row and the fmt half marked reversed; the nextest half and the RustMonolithGate rejection are preserved verbatim. ci.yml regenerated through the emit authority (expected_ci_yml), never hand- edited; trailing-newline gotcha handled. GREEN-BY-EXECUTION: PASS generated_artifact_drift_witnesses <- the real drift gate, ci.yml byte-exact 0 FAILs across ci_yaml_serializer, ci_compile_jobs, placement_grain, rust_gates_ci, ci_budget_tree witnesses DISCRIMINATING RED: planted a fmt violation, ran the EXACT emitted step command -> exit 1 (caught); restored tree -> exit 0. The gate discriminates. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jul 16, 2026
… evidence carriers, Energy, scheduling-invariant refinement) (#6685) * WIP: map reduce * WIP: map reduce * WIP: map reduce * WIP: map reduce * machine-shape plan: end shape agreed, no-kind rule, convergence map to existing carriers - §2 terminal model pinned (operator rulings 2026-07-15): one locality lattice (lifted to std, converging BOTH existing latency enums), divergence/idle-lane/ crossing laws, Placement dissolution trigger, kind-erasure at the ComputeHost→MachineShape derivation boundary - convergence map: every end-shape element bound to its existing carrier (HardwareThreadCount reused for lane_count; PlacementSupplyRow identified as the degenerate single-domain MachineShape; PTX ThreadHierarchyShape/PtxCost gain their consumer; MemoryKind.UnifiedShared flagged as topology-in-technology) - MemoryLevel.sharing dropped: sharing derives from SharedLevelEdge graph structure (single authority) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: address operator request-changes (7 blocking findings) - MachineShape is now a representable graph: DomainId/LevelId identities, explicit edge endpoints, SharedLevelEdge references the owner's level by id (embedding duplicated it), InterconnectLink coproduct holds NetworkAttach (LinkEdge was PcieLink-only while the map claimed NetworkInterface as a fill), terminal Placement = DomainId reference; dangling refs refuse - Phase 3 batching vs signed scheduling authority: conflict acknowledged, now an EXPLICIT supersession proposal (topology = pure fn of declared shape; MeasuredBy banned from topology; schedule_eq generalized to equal-given-equal- declared-inputs) gated on operator sign-off, with a confined fallback - both §5 fallback arms converted to refusals: Priced|PricingRefused{missing} (no term-incomplete Predicted accounts), Placed|PlacementRefused{missing} (no stay-at-current-domain answer) - Quantified<T> restructured: Precision (Exact|Interval) x Evidence (Cited|MeasuredBy{ExecutionReceiptDigest}|DerivedFrom) — evidence-bearing constructors make the authored-literal RED enforceable - locality/latency split into two axes: latency = per-level magnitude with one std class projection (converging ReadLatencyClass + network LatencyClass); locality = graph-derived, domain-relative (no universal total order) - OperandFlow total derivation spelled out: operand_root (fail-closed), hash- authority convergence precondition (v2.std.node.Hash vs ContentHash — the fnv1a64 thread), edge->root mapping for node_keyed_graph_transitive_bytes, OperandFlowRefused rows - AssociativityEvidence subject-bound: {combine, inhabitant, law, receipt}, license requires structural identity with the scheduled combine; keyed-patch witness scoped to mechanism-precedent-only; within-fold expansion scoped kernel-internal (never central Schedule topology) - corrections: PlacementSupplyRow has zero production callers (grep -l overcount); document-level dissolution trigger added (Plan-row registration = part of Phase 1 definition of done) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * de-orphan machine-shape plan doc + correct doc_reachability lying live-tree stamp Two fixes from the docs-enforcement audit (operator-directed): 1. bind: provenance row in accelerator_demo_plan.dag makes docs/plans/machine-shape-orthogonal-scheduling.md doc-graph-reachable (the established hand-authored-design-md convention: accelerator_demo_plan :51, live_read_classification.dag:66). Registration as a gunbc.plan.Plan row stays the md's declared Phase-1 dissolution — registering now would flip the actively-evolving doc into a generated artifact prematurely. Verified by build_doc_graph_report replication: doc_count=107, orphan_count 1->0, dangling 0. 2. doc_reachability_witness_test live_tree_disposition: SubstrateInputsOnly -> ReadsLiveTree. The 2026-07-12 machine stamp (#6479 entry-text batch) was false: every test fn reads the live docs/ tree via doc_graph_* host builtins — the exact classifier blind spot live_tree.dag:5 declares. The false stamp made the orphan wall predict-skippable, which composed with the docs-only floor shortcut into a pre-merge false-green (this PR minted an orphan with green CI). ReadsLiveTree restores the never-skip tooth: the wall now runs on every full floor, including this PR's. This diff leaves the docs-only shortcut class, so this PR runs the full floor with the corrected stamp — the wall itself verifies the de-orphan by execution, pre-merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * bind main's orphaned no-smuggled-programs-wall.md from its lens carrier The doc merged to main orphaned (docs-only shortcut + then-lying doc_reachability stamp — the same false-green class this PR fixes). With the stamp corrected, the orphan wall's first live pre-merge run (this PR's floor) caught it: 1 of 1880 witnesses red. Bound from medium_structure_containment.dag, the wall the design doc signs — same bind-from-carrier convention as accelerator_demo_plan.dag:51. Verified by build_doc_graph_report replication on the merged tree: doc_count=108, orphan_count 1->0, dangling 0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: apply #6663 review amendments 1+2 - Amendment 1: the 'evidence carried by construction' claim is gated on the record-field wall (witness-realization P0 / #6663 audit F1) — the typechecker checks field NAMES only (refuted-by-execution: Known omitting evidence compiles at 0 diagnostics); P0 named a Phase-1 acceptance precondition. Asymmetry recorded: the no-kind wall rests on field-name checking, which DOES hard-error — it holds today; evidence-required does not. - Amendment 2: Phase 2 claims the DerivedFrom fill of CostAccount.space only; the AIMD governor's dissolve-on additionally requires MeasuredBy per-runnable peaks (witness-realization P1) — derived operand footprint and measured peak are different space facts (receipt: 6.25GB VmSize vs KB operands — retention, not operands; the v1 run-stability axis). - Cross-refs: P4 composition note in the supersession paragraph; P1 named third party to the Quantified/CostBasis convergence (one carrier, not three; realization_measurement.dag merge-order flagged); Energy/Watt divergence deduped with audit F3 (owner TBD). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * heal main's composed drift + re-anchor vacuity design docs (unblocks all full-floor PRs) Main's tree (post #6638/#6664) fails generated_artifact_drift_gate_passes on every full floor: the vacuity lane hand-added a 'Sibling family' paragraph to the GENERATED docs/plans/inert-layer-lens.md without updating its generating Plan row (dag/gunbc/plans/inert_layer_lens.dag) — committed != regenerated. Their docs-only PRs merged through the docs-only shortcut, which skipped both the drift gate and the doc-graph wall. 1. Regenerate inert-layer-lens.md (paragraph removed; byte-identical to warm-crab-65's independent main_wet regen on #6658 — same blob 2b36cf2). 2. That hand-edit was ALSO the only doc-graph anchor for the vacuity lane's two design docs; regen alone orphans vacuity-lens-design.md and (via its link chain) lens-consolidation-design.md. Re-anchored with a bind: provenance row in dag/std/materialization_ladder.dag — the file whose AuthoredDuplication verdict the vacuity doc's load-bearing correction is about — migrating to the vacuity lens .dag carrier when it lands. Verified by build_doc_graph_report replication: doc_count=110, orphan_count=0, dangling=0. Follow-up for the vacuity lane: re-add the sibling-family paragraph via the inert_layer_lens Plan row (the authority), not the generated md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: record operator rulings 5-8 (2026-07-15) - R5 compute_fabric relationship: Shape IS the degenerate one-axis MachineShape; market stays thin (no #5904 rebuild); Fabric = outermost rung of the recursive supply tower. Convergence-map row added. - R6 evidence carriers: staged convergence (Quantified for greenfield, P1 receipts reuse Evidence.MeasuredBy, CostBasis migrates on forced join); owner = #6663 lane. - R7 Energy: derived quantity (Power x Time), lands Phase 1, is the F3 dedupe. - R8 scheduling invariant REFINED not superseded (operator: determinism was being conflated with input-invariance — different machines are different inputs). Surviving wall: no UNSTABLE (MeasuredBy) inputs to topology; declared shape is a stable input; cross-host schedule_eq demoted to corollary under equal declared shapes. Phase 3 UNBLOCKED. Open list rewritten: law-carrier home, SymbolIndex sequencing, hash convergence (dispatched), P0 field wall (#6663) remain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: map reduce * machine-shape plan: reconcile §2/§3/§5/§8 with rulings 6-8 (cursor review on #6685) Five stale spots aligned: Energy divergence now records ruling 7 (was 'flagging for operator'); the Quantified/CostBasis rows in §2 and the convergence map record ruling 6's staged convergence (was 'open Q1'); §5's batching rule reads 'under the refinement' (was 'supersession'); §8's schedule_eq wall restated per ruling 8 (corollary under equal declared shapes, not unconditional). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jul 16, 2026
…; re-enroll cargo fmt in CI (de-fused from nextest) (#6691) * WIP: falsifier is failing * non_fold_residue roster: burn down 3 stale rows, backfill apply_role (#6637) The affected-set-falsifier has been red on every cold sweep since 2026-07-15 04:32 UTC (last green 07-14 23:10, run 29374839251). It was doing its job: three discovery witnesses returned Bool(false) against the whole corpus that per-PR selection had predict-skipped. This clears the two non_fold_residue ones; the inert_carrier one is a separate lens-precision question, left red deliberately rather than papered over. Stale rows deleted (roster 120 unique -> live 118; each verified as genuinely migrated, NOT merely gone lens-invisible -- the converge_cli_applied_knob_count trap): - nbd_proxy_serve.dag::shell_command_leading_lit_text - nbd_proxy_serve.dag::shell_rawline_starts_with_tool both fns DELETED by #6629 (P6 Part 2: RawLine body -> typed session-lease effect), firing the dissolve-on their rows carried. - emit_host.dag::run_test_claim_emit_vs_eval_verdict fn still exists (emit_host.dag:335) but #6650 enumerated its wildcard into three explicit constructor arms -- residue genuinely folded, no bare `_ =>` remains. Ratchet tightens. Unrostered row backfilled: bash_composition_recognizer.dag::apply_role, landed by #6637. Two-special-variant dispatch over TokenRole's 5 variants; the other three all reduce to the closed run, so enumerating would clone the general arm 3x. Same class as the orch_emit_let_step row above it (receipt #10). Green-by-execution (claim_batch, local): PASS non_fold_residue_no_unrostered_or_stale (src/v2/lens) PASS non_fold_residue_clean_holds (dag/test/claim) FAIL inert_carrier_no_unrostered_or_stale <- unchanged, see PR body Discriminating RED control: both nfr witnesses were red on this same tree before the roster edit and green after; no witness or assertion was weakened. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: falsifier is failing * WIP: falsifier is failing * Re-enroll cargo fmt in CI as a standalone step, de-fused from the nextest bundle Operator ruling 2026-07-15. Restores fmt enforcement without re-enrolling RustMonolithGate (still rejected). WHY IT WAS GONE: tools.rust_gates_ci.run_gates welds two separable facts into one ProcessExit -- fmt (4.3s measured, parse-only, no build, green) and nextest (~37 GiB, compile+run, red on main). The 2026-07-11 ruling removed the bundle for reasons that are ALL facts about nextest; fmt was collateral damage of that fusion (DESIGN 3). WHY THE HOOK ISN'T COVERAGE: the ruling's declared replacement was the pre-push hook. That is an escape hatch (DESIGN 5) -- opt-in per clone via a manual core.hooksPath, bypassable with --no-verify, absent in container worktrees -- and PROVEN ineffective, not just theoretically weak: in this very worktree core.hooksPath points at a directory with no pre-push hook at all, and #6658 landed an unformatted .rs on main 2026-07-15 with nothing catching it. The hook stays as fast local feedback, never as the wall. SHAPE: standalone RunStep, FIRST in the build job -- a 4-second violation now fails in 4 seconds instead of after the ~33min release build. build is not protection-required itself, but ci needs:[build], so a red fmt blocks the required job by construction. Toolchain already installs the rustfmt component in ci_prelude_steps, so marginal cost is ~4s and no build. Step-budget discipline (gunbc_ci_job_timeout_policy_disposition: "the backstop is the exact step-sum + prelude"): the new step carries the aux cap and gunbc_ci_build_job_backstop_timeout_minutes() gains exactly one aux term (65 -> 70), so no step is uncapped and the sum stays exact. Authority updated, not left lying: commit_gate_rust_suite_removed_disposition declared "cargo fmt stays enforced by the pre-push hook". That claim is now retracted in-row and the fmt half marked reversed; the nextest half and the RustMonolithGate rejection are preserved verbatim. ci.yml regenerated through the emit authority (expected_ci_yml), never hand- edited; trailing-newline gotcha handled. GREEN-BY-EXECUTION: PASS generated_artifact_drift_witnesses <- the real drift gate, ci.yml byte-exact 0 FAILs across ci_yaml_serializer, ci_compile_jobs, placement_grain, rust_gates_ci, ci_budget_tree witnesses DISCRIMINATING RED: planted a fmt violation, ran the EXACT emitted step command -> exit 1 (caught); restored tree -> exit 0. The gate discriminates. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Resolve merge conflict: drop duplicate nfr roster work, main landed it first main (#6680 lane) independently made the identical nfr roster fix while this PR was in review: same two nbd_proxy_serve stale rows deleted, same emit_host::run_test_claim_emit_vs_eval_verdict stale row deleted, and the same apply_role backfill added (its own wording, different position in the roster). Resolution takes MAIN's side wholesale. Keeping mine would have produced two apply_role rows -- harmless at use (the roster collapses to a BTreeSet) but a pointless redundancy, and re-litigating identical work for authorship is not a reason to diverge. cli_run.rs is now byte-identical to origin/main. This PR therefore reduces to the work main does NOT have, verified against origin/main: - the cargo fmt CI gate (de-fused from the nextest bundle) + its authority note amendment + regenerated ci.yml - the latent main fmt red fix (main still carries the unformatted import) Independent convergence on the roster is a receipt for the falsifier itself: two lanes hit the same cold-sweep reds and reached the same verdicts on which rows were genuinely migrated vs still live. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: falsifier is failing --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls
pushed a commit
that referenced
this pull request
Jul 25, 2026
…enceJob) Batch 4 breaches its clamp on every run of this PR — 571556ms (srv3-01) / 613864ms (srv2-02) against clamp_ms=420000 at units=74, authority gunbc.ci_spec gunbc_ci_floor_batch_clamp_params[3]. Both batch-4 groups PASS; it is the wall, not a witness. Per the operator ruling, six declared rows move off the per-PR floor to the 4-hour falsifier cadence: the three wave1_gate1_d_* rows (141s + 29s + 27s) and the three affected-set provenance walls (14s + 13s + 13s), measured in the run-30148859947 slow-witness tables. That removes ~237s of eval, landing batch 4 near 334-377s under the unchanged 420s clamp. The vehicle is NOT gunbc.ci_layer_roots falsifier_rehomed_bin_wet_rows. That roster is specifically the bin_witness_wet_entries per-row-budget overflow (constructor bin_wet, budget datum bin_witness_wet_per_row_wall_budget_seconds) and does not model CommitWitnessClaim rows; re-homing through it would mint a second re-home authority. Instead this extends the axis that already answers "where does this check run" — the enrollment surface — with a fourth variant, FalsifierCadenceJob, plus the batch that reads it. The batch lands in the SAME change as the surface deliberately: a surface tag with no consumer is enrollment-by-illusion, which is the state ~54 files under test/claim/long/ are already in (excluded from discovery at dir grain, not walked by the falsifier, enrolled nowhere) and it would present as a clean green diff. gauntlet_lane_enrollment_witness_test reds per-PR if a row ever sits on the surface without reaching a batch. Two entries split at the check_fn rather than moving whole, so each concern keeps per-PR coverage at the cheap grain and loses only the wet grain: affected_set_provenance_producer keeps its four <=161ms fns on the floor, parse_binding_fidelity keeps witness_resolve_distinct_param_bindings_holds. FOUND BY THE WALL, first execution: the doc-reachability witness (doc_graph_has_no_orphan_docs, doc_graph_has_no_dangling_links) rode surfaces: [GitPrePushHook] alone — enforced only by a mechanism this repo has already ruled is not an enforcement authority (opt-in per clone, bypassable with --no-verify, absent in container worktrees, proven ineffective by #6658). Orphaned docs and dangling links had no wall on any CI path. Fixed by adding the cadence surface, NOT by widening witness_enrollment_is_scheduled to accept the hook — widening the predicate until the failure disappears is the absorbing fallback, and would have re-buried the finding that surfaced it. Placement (PrTier | Gauntlet) is the intended end-state authority and is recorded as the dissolve-on, not wired here: PrTier is unwritable without a WarmCostReceipt whose measured_ms is within the 5s fast-lane budget, so wiring it onto all 36 CommitWitnessClaim rows needs a per-row measured receipt and the D2 warm-cost probe has not run. Fabricating those receipts is the fail-open the placement law exists to forbid; defaulting the unmeasured rows to Gauntlet would de-enroll all 36 at once. Encouraging convergence: the 5s law selects exactly the twelve rows measured over 5s and admits every other batch-4 row at <=1s, so placement and this surface agree on today's roster. dag_compile_clean_perturb_receipts_holds is deliberately NOT re-homed. It was retained by the 2026-07-23 ruling by name because it measured 53s, under the 60s per-row budget; it now measures 141s. Re-homing a row that got 2.7x slower answers the wrong question and would zero the deficit's frequency by construction. Its growth is diagnosed separately. Proven by execution: all three files compile clean (0 blocking errors); gauntlet_lane_enrollment_witness_test 3/3 green in 3ms, inside the fast lane. Both claims proven live by perturbation — reverting one re-home reds _rehomed_rows_are_cadence_enrolled_holds, and _is_never_bare_deenrollment_holds was RED against the live roster before the doc-reachability fix and green after. The RED control discriminates a synthetic bare de-enrollment. commit_witness_claim_roster_holds (the #7060 stale-pair class, live) PASS. No generated-artifact drift: the ymls invoke plan functions, so batches compute at run time and the falsifier picks up the new batch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk
briansrls
added a commit
that referenced
this pull request
Jul 25, 2026
#7251) Operator ruling 2026-07-25: "Pre-push hook restored to fmt-only per CLAUDE.md's documented contract; the witness corpus belongs to CI, not the push path." The hook was a shim that exec'd `claim_batch --pre-push`, which ran the affected-set witness corpus and would cargo-build claim_batch from inside the push when the binary was missing. That weight bought zero enforcement — a hook is opt-in per clone (core.hooksPath), bypassable with --no-verify, absent in container worktrees, and commit_workflow's own dispositions already record it PROVEN ineffective (#6658 landed an unformatted .rs on main and nothing caught it). Worst of both worlds by construction: no enforcement, but enough weight that a legitimately-red mid-lane branch feels unpushable — pressure that converts honest reds into workaround greens. Priced receipt: three rounds of hand-import workarounds, one decorative gate, and the normalization of --no-verify on the namespace type-binding lane today. A check that cannot enforce should at least be instant. CLAUDE.md already documents "pre-push runs cargo fmt" — this restores reality to the doc rather than changing policy. Mechanism: the hook body is now DERIVED from commit_gate_roster's GitPrePushHook enrollments via project_local_tidy_checks, so the roster stays the single authority and re-heavying requires a roster edit the emit witness reds on. The doc-reachability enrollment is dropped from that surface (it keeps its cadence through the floor's discovery-corpus scan of dag/test/claim). emit_freshness_path_fn / emit_glob_case_arms move to githooks_pre_commit_emit, their only remaining consumer. Nothing loses enforcement: cargo fmt is a required-path CI build step (ci needs:[build]), and the witness corpus is the required `ci` floor that also stamps the merge-admission receipt. Verified by execution: - clean tree -> exit 0 in 4.9s (was: corpus run + possible cargo build) - fmt drift -> exit 1, located diff + fix recipe (discriminating RED) - githooks_pre_push_emit_witnesses true (flipped to guard the new shape) - githooks_pre_push_plan_witnesses true - commit_workflow_witnesses true - generated_artifact_gate main_wet ExitSuccess (hook regenerated) Declined, per the ruling: branch-level expected-red exemption machinery. Building configuration so a non-authority check can be tolerated invests in a mechanism that should not carry this weight; slimming dissolves the need. No skip env var added — the heavy arms are gone from the model, not hidden behind a toggle (DESIGN §5 no-escape-hatches). Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jul 26, 2026
…s debugging it surfaced (supersedes #7162) (#7216) * D0 retention-truth close-out: unpin compile-clean memo, register all-hit keys, arm from loader closure The three post-merge retention defects from the ci-two-tier-placement-redesign §5 review (routed to the #7129 worker) plus the two §7 acceptance controls. Sequenced first: the falsifier cannot go green — and no downstream placement row can cite true retention receipts — until these hold. D0.1 — compile-clean aggregate memo unpin. The whole-tree gate resolved through resolved_graph_from_sources_with_index, pinning the aggregate ResolvedGraph (hence every TypedModule) in resolved_graph_memo for the process lifetime — a large slice of the measured 9.2GB resident floor. Thread a ResolvedGraphMemoShare::{Memoize,Ephemeral} flag: the gate resolves Ephemeral (no aggregate pin); per-entry discovery keeps memoizing. The per-module typed-cache warming that IS the gate's purpose is unaffected. D0.2 — prewarm all-hit registration. try_reconcile_all_cache_hits assembled and returned on all-hit WITHOUT index_record_schedule_module, so a prewarmed run armed retention referencing nothing (completion reported evictions while removing nothing). Record each confirmed hit in the probe, same key forms as the slow path. D0.3 — arm from the loader's exact closure (the #6985 Class-B root, third appearance). Arming used selection_adjacency; the discovery loader load_sources_for_entry_with_pool reaches wider via qualified-projection references from import-bearing files, so those modules were re-cached after eviction and never re-evicted or counted — an invisible resident leak. Arm from the loader itself (not a re-derived BFS that could become a fourth divergence); cost-neutral because the loader memoizes into entry_closure_sources, which discovery reuses. Removed the now-dead selection_closure_live_paths_with_facts. D0.4 — the two §7 acceptance controls. index_schedule_entry_completed dropped the resolved-graph pin unconditionally, so the eviction-disabled retain-all baseline understated peak retention; gate it on evict_enabled. The E2E control armed BEFORE prewarming (the order-blindness that let D0.2 pass green), so it never exercised the all-hit probe; restructure to prewarm -> clear graph memo -> arm -> re-resolve through the probe, and add a real-index retain-all RED. Verified green by execution: 7/7 schedule_retention tests, incl. the two restructured REDs (E2E arm-after-prewarm; real-index retain-all). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * D3 mechanism: two-tier CI placement axis (PrTier | Gauntlet) with fail-closed admission The placement-axis half of ci-two-tier-placement-redesign.md D3, buildable ahead of the D2 srv warm-cost probe. Placement is modeled as DATA (Placement = PrTier | Gauntlet), never per-site prose, with a FAIL-CLOSED admission law: a check is admissible as PrTier only with (a) a measured warm-cost receipt within the fast-lane budget AND (b) a hermetic/ephemeral classification; unmeasured or unclassified => inadmissible as PrTier, so its only valid placement is Gauntlet. No row rides the fast path by taste. The 5s threshold is REUSED from the single fast-lane authority (gunbc_ci_fast_lane_eval_budget_ms, v2.workflow.ci_floor_plan) — never a second 5s definition (DESIGN §3). Verified green by execution (claim_batch, 4 witnesses): - Gauntlet always admissible - a within-budget hermetic PrTier admissible - RED control: an over-budget (6000ms > 5s) PrTier is refused - RED control: an unclassified PrTier is refused The controls pin the threshold discriminatingly (1600ms admits, 6000ms refuses) and the classification gate (Hermetic admits, Unclassified refuses). Deferred to PR-1 (D2-gated): filling the roster of real checks with measured receipts (flipping rows to PrTier as srv warm-cost lands), wiring the law onto the live check rows, and the Gauntlet workflow split (D3b). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * D5 DiffBaseline: dissolve the origin/main literal into a typed single authority Per ci-two-tier-placement-redesign.md §11. Introduces DiffBaseline (MergeTarget | PushParent | OperatorOverride{ref}) as the single authority for "which git ref a diff/merge selects against", grounded on the extdeps.git atoms (GitRef, git_remote_ref_parts). resolve_diff_baseline is a pure, fail-closed fold over injected env values — a PushParent with no parent ref REFUSES rather than fabricating a ref. Live consequence fixed (site 1, floor selection): a stacked PR now selects against its real merge target (origin/$GITHUB_BASE_REF), not origin/main. DiffPolicy.base becomes a DiffBaseline; floor_diff_observe.floor_resolved_base resolves it at eval time from GITHUB_BASE_REF, fail-closed to UnifiedDiffFail (the floor widens to the full corpus) on an unresolvable base — never a silent wrong selection. Fork dissolution (no behavior change) — sites 2/3/4 re-ground the same literal onto the authority: merge_admission_produce (merges into main), roadmap_dispatch_actuator (branches from main), ci_workflow Push/PR triggers (main). The ci_merge_base_ref alias and the dead ci_merge_base_diff_range are deleted. Also carries the parked miscite fix (rust_tests_removed_disposition -> commit_gate_rust_suite_removed_disposition) in DESIGN.md / design_document.dag / ci_spec.dag, per plan §3.3. Verified by execution: ci_diff_baseline_witness_test (6/6, incl. the discriminating stacked-PR pair and the PushParent-refuses fail-closed control); ci_spec_witnesses (fetch renders "origin $GITHUB_BASE_REF"; single authority); roadmap_dispatch_actuator_witnesses. ci.yml + DESIGN.md regenerated via main_wet (drift clean; the two floor/regen fetch lines now expand $GITHUB_BASE_REF). floor_diff_observe_witness_test runs green in the floor's wet mode; its eval-time env reads are unmockable under claim_batch strict-hermetic, a PRE-EXISTING harness limitation confirmed by a clean-tree stash run of the same witness (this change adds no new hermetic red). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Progress/observation P0: the event model, five laws, one glyph authority P0 of the progress-and-observation lane (docs/plans/progress-observation-design.md, operator-signed 2026-07-23; §6b/§6c doctrine from #7169 folded in). Model only — no renderer, no emit site touched. ObservationEvent = subject (a typed containment path: run ⊃ batch ⊃ entry ⊃ module ⊃ phase) × Begin | Step{k,n} | Concluded{outcome} × measured facts. Outcomes are a closed sum with Refused DISTINCT from Failed — the reference implementation conflates them, which is how a deliberate refusal reads as a crash. Grounded on existing authorities rather than minted: - ancestry reuses std.effect_grant.path_is_prefix (one prefix relation, not a second walk) - over-budget arithmetic calls std.temporal_effect.stall_budget_verdict - change kind projects from std.change.KeyedDiffHunk — no second added/modified/removed enum - glyphs extend std.symbols + extdeps.render.glyphs rows (the one table), never a fork - module_path/source_path carry std's existing representation (std.decl_ref's), with convergence to QualifiedName/SourceRef declared, not assumed Derived, never hand-set: AttentionLevel from a supplied basis (the signed clamp constants — no threshold is invented in this module); BlockedOn from SchedulerHold, which is held in lockstep with the seed governor's HoldReason by execution; T from the heartbeat period the seed actually sleeps, declared a Scaffold with the measured quiet-time distribution as its dissolve-on. Construction over validation: the no-op sum is closed (docs-policy | uncovered | no-decls-touched | generated-artifact | departed-path), so a bare unlabelled "nothing" is unwritable rather than censused after the fact; uncovered derives a visible nudge, departed-path is typed as a widen and not a no-op. Green by execution, with discriminating REDs proven by perturbation: - 28 model conjuncts + 6 lockstep conjuncts PASS - orphaned law row (enforced_by names a missing declaration) → RED - Refused/Failed collapsed onto one glyph → RED (both distinctness and collapse laws) - glyph-table row perturbed → presentation moves → RED (single authority, by execution) Compile-clean attributed: the closure's 47 errors are pre-existing in std/measure.dag (46) and std/effect_grant.dag (1) — identical counts compiling those entries alone; zero attributable to this change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Review 42157: collapse the duplicate display tables into one authority Addresses the blocking finding on the three coproduct predicates, taking its stronger alternative (dissolve into the canonical surface) rather than only its weaker one (add a disposition receipt). The finding was right about the real defect: observation_class_is_intrinsic_anomaly was a second hand-written table beside observation_presentation, and a witness asserted the two agreed. That witness was validation standing exactly where construction was available — it conceded the tables could disagree and promised to notice. Fix: ObservationDensity (RoutineCollapsible | SummaryAlwaysShown | AnomalyExpanded) is now the one table. collapsible, expands_fully and intrinsic-anomaly are all derived projections of it, so disagreement is unwritable rather than detected. The three display states stay distinct — the run summary is neither routine nor an anomaly, which a single boolean would have forced it to borrow. Disposition receipts added for the remaining structural readers, matching the cited materialization_ladder pattern: outcome/class, subject/grain/hold, and selection no-op. Each states why it is Terminal and names its discriminating corpus rather than asserting terminality. Witness roles now separated and both proven by execution: - w_density_is_the_single_display_authority — the content check; reds when a class's density changes (verified: ClassRefused → RoutineCollapsible reds it, and reds ONLY it, since the projections cannot disagree) - w_presentation_projects_density_rather_than_restating_it plus the two collapse witnesses — construction guards; red when the presentation stops projecting density (verified: hardcoding collapsible: true reds all three) Full suite green: 30 model conjuncts, 6 lockstep conjuncts. Compile-clean unchanged — 47 errors, all pre-existing in std/measure.dag (46) and std/effect_grant.dag (1), zero attributable here. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Review 42166: ground PSI avg10 on std.measure.BasisPoint The finding is correct and the hard-blocker applies: avg10_centi was a percentage magnitude with a scale carried on bare Nat, and the note beside it self-justified the conflation rather than tracking it. Fix consumes an EXISTING carrier rather than minting one, which the corpus had already asked for in advance. std.measure.basis_point_dissolve_on warns: "else a third dimensionless-ratio use-case mints a third nickname" — this module is exactly that third use-case, so minting PerMille or a Percentage quantity would have walked into the failure the row names. BasisPoint's own note declares its semantic axis as utilization ratios, which is what a PSI stall share is. Resolution is exact rather than truncated: the governor reads one decimal of a percentage and a basis point is a hundredth of a percentage point, so 37.5 percent is 3750 with nothing lost. Percent (Dimensionless, One) would have truncated it. Note rewritten to state the grounding and the deliberate non-mint, replacing the self-justification. When the Ratio<Scale> unification that dissolve-on calls for lands, this field follows Percent and BasisPoint onto it with no change of meaning. Suite green: 31 model conjuncts, 6 lockstep conjuncts. Compile-clean unchanged — 47 pre-existing errors in std/measure.dag (46) and std/effect_grant.dag (1), zero attributable here. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Piece 3: derived per-batch floor clamp — delete the static wall-budget list Per ci-two-tier-placement-redesign.md §9.8 (operator 2026-07-24). Replaces the hand-set gunbc_ci_floor_batch_wall_budget_seconds list — a scalar wall budget that conflated workload size (diff-proportional selection), host speed, and per-unit cost creep — with a per-batch clamp computed at run time: clamp_ms = overhead_seconds*1000 + runtime_unit_count * per_unit_ms. The load-bearing row is the discovery witness batch (index 2): 300s + 1000ms per witness, so a full corpus of ~2316 witnesses clamps at ~44min (under the 55-min step cap, with headroom over the observed 1344-1629s walls) while a runaway reds proportionally, instead of the fixed 1320s that redded legitimate hub-file PRs. Fixed-count gate batches carry rate 0 at their measured basis; index 3 (wet corpora) stays a declared fixed overhead pending the D2 probe's wet-per-witness rate. Authority: gunbc.ci_spec FloorBatchClamp + gunbc_ci_floor_batch_clamp_params (index-aligned to the 7 batches; the cover-schedule witness pins the alignment) + gunbc_ci_floor_batch_clamp_note (carries the raise discipline from the kept static-era note). The 5s per-WITNESS max is unchanged — still the single gunbc_ci_fast_lane_eval_budget_ms authority, never redefined here. claim_executor reads the two index-aligned param lists fail-closed, derives the per-batch unit count from batch_results (corpus_witnesses for discovery aggregates, 1 per gate row — the runtime datum the static list ignored), computes the clamp at enforcement, and refuses over-clamp as a typed FLOOR-BATCH-OVER-BUDGET (never a widen). The GUNBC_FLOOR_BATCH_BUDGET_TIGHTEN_MS RED-control hook now lowers the COMPUTED clamp. The receipt emits batch_N_units / batch_N_clamp_ms / verdict; its unit test is updated. Both run_walk call sites carry the new param. Verified by execution: build clean; ci_floor_plan_witnesses green (the three new clamp witnesses + cover-schedule). The receipt verdict unit test and the fixture RED control (budget_red_control_plan; TIGHTEN_MS=0 -> clamp 0 -> the FLOOR-BATCH-OVER-BUDGET refusal) are the e2e enforcement confirmations; the fixture's control witness triggers a whole-tree emit that OOMs alongside a compile in this container, so both run as a clean post-commit confirmation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Finish #7146 adoption: regen ci.yml from merged authority, drop orphaned D5 witness The merge that adopted #7146's landed gunbc.diff_baseline (and dropped my redundant D5 gunbc.ci_diff_defaults) left two remnants: - .github/workflows/ci.yml carried an auto-merge artifact — the regen step and floor step fetched `origin $GITHUB_BASE_REF` (my dropped D5's bare-var form) instead of `origin main` (#7146's authority, which resolves the diff baseline at floor eval-time via resolve_diff_baseline, not at fetch time). Re-running `gunbc ci` regen re-derives ci.yml from the merged ci_workflow.dag, restoring the `origin main` fetch. - src/v2/test/claim/ci_diff_baseline_witness_test.dag imported the deleted gunbc.ci_diff_defaults module (my D5 authority), which would break the corpus compile. Its 6 witnesses are strictly superseded by #7146's landed dag/test/claim/diff_baseline_witness_test.dag (11 witnesses, with stronger fail-closed semantics on PR absent-base). Deleted as dead weight. Co-Authored-By: Claude <noreply@anthropic.com> * P1: the CI-log renderer, with the captured crawl window as its acceptance Second phase of the atomic P0-P3 observation PR (operator ruling: only finished work merges; a landed event model with no renderer is vocabulary nobody can see). gunbc.observation_ci_render projects the std.observation stream into append-only log lines. It computes nothing and holds no telemetry source — every number it prints arrives in an event or a heartbeat sample the process already had — which is precisely what makes replaying a real captured run possible rather than a synthetic fixture. FLAGSHIP ACCEPTANCE, green by execution: the fixture is run 30044816605's actual log, not a reconstruction. Its heartbeat at t=33m carried current=16107200512 swap=34359738368 psi_some_avg10=9.01 and named no subject at all, while the process sat inside v2.compiler.normalized_tree for 606984ms and disclosed that only at walk end. Re-rendered through the escalation law the same window produces named activity: identity-first heartbeats in human units (15.0 GiB, not the raw byte dump), the quiet module surfaced at T, and the memory-reclaim cause surfaced at 2T. Contracts from section 6b in force: plain-sentence tone, real emojis from the one glyph authority with the clock pulse, identity before vitals, durations on every outcome line, refusals restated at the end so log truncation cannot hide them, and relayed subject text neutralized through the existing GitHub guard so a child's stderr cannot mint workflow commands in the parent run. Law 4 made structural: line placement is DERIVED from attention, so a refusal cannot be written into a collapsed group — the group is exactly where a reader will not look. Escalation has two rates: reveal depth grows linearly (one tree level per threshold) while emission points double (T, 2T, 4T), so a window that stays quiet escalates without becoming a per-minute drumbeat, bounded by construction. Three REDs proven by perturbation, as the ruling requires: - planted silent phase (escalation never emits) reds responsiveness - an orphaned Begin reds the watchdog - a Refused placed inside a collapsed group reds Review 42203 (three findings, all correct, all fixed): - ci_gibibyte_tenths respelled the GiB scale factor as a literal; it now consumes std.measure.gibibyte_scale_factor_bytes, and the duration helper consumes seconds_per_minute plus a new milliseconds_per_second added beside its siblings in that authority. A unit authority forked inside a formatting helper is easy to miss because it looks like arithmetic. - the run summary picked the refused glyph whenever refusals+failures>0, so a failures-only run rendered as refused — collapsing at the last line exactly what the outcome sum exists to establish. Failures now dominate the glyph, refusals keep their own, both counts stay in the text. - an unavailable duration silently vanished from concluded lines, breaking the model's own rule that an absent measurement names its cause. It now says so. Each fix carries a witness; the summary fix carries its own RED. Suite green: 31 model, 6 lockstep, 18 renderer conjuncts. Compile-clean unchanged at 47 pre-existing errors, zero attributable here. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * P2: the interactive TTY renderer, a sibling projection of the same carriers Third phase of the atomic P0-P3 observation PR. gunbc.observation_tty_render projects the SAME std.observation stream the CI renderer projects — a sibling, not a successor and not a second model. The two differ only where the medium differs: a terminal can be repainted, so routine progress overwrites one line in place and stays quiet; a CI log cannot, so it appends. Everything they share — the event vocabulary, the density authority, the glyph table, the duration/byte/percent projections, the hold-cause text — is imported from the CI renderer or the model, never re-derived. A witness proves the sibling property by execution: the same event drives both surfaces and moves together. The three upgrades over the reference implementation are INHERITED from the shared carriers, not re-earned: outcome lines carry durations, Refused is distinct from Failed, and dwell escalation is recursive. The reference has none of the three; the TTY renderer gets them for free by projecting the same model. Law 4's asymmetry, expressed here as cursor action rather than group placement: repaint-vs-scroll is DERIVED from attention, so a refusal cannot be repainted away — overwriting it would erase it the instant the next line arrived, the terminal form of burying it in a collapsed group. Required preamble (no anonymous process), BlockedOn inline with named remaining (a bounded estimate prints the time; an unknown one prints why, never a fabricated ETA), and the reward animal on Final drawn deterministically from the one glyph authority so replay is preserved and a non-emoji terminal degrades to a word. Also in this commit: the self-host regen of the seed. P1 added milliseconds_per_second to dag/std/measure.dag, a seed-emitted module, so src/v1/stage0/src/std_measure.rs is regenerated to match — the required same-PR regen for a generated-artifact source edit. Fixed point verified by rebuilding regen_stage0 from the new seed and re-running to zero drift. Suite green: 31 model, 6 lockstep, 18 CI-renderer, 10 TTY-renderer conjuncts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * P3: the emit-site census wall Fourth and final phase of the atomic P0-P3 observation PR. gunbc.observation_emit_census is the census authority. Every place the floor emits a progress line is either a projection of the observation event stream or a counted frontier row with a reason and a dissolve-on — the same discipline the site lane uses for unthemed colours. EmitSiteDisposition is a closed sum, so a site cannot be half-classified, and there is no third arm for a site the census has not looked at: the roster's completeness is what the witness checks against the seed. The roster carries the structured-tag emit families that exist regardless of the CI rework: [floor-memory], [typecheck-attribution], [gantt], [governor], [measurement]. The named negative example the operator called out — the [floor-memory] raw byte dump — is a rostered frontier row, so the census already carries the very site it exists to kill, with its dissolve-on naming the P1 heartbeat projection that replaces it. Sequencing per the ruling and design section 6b: the CI two-tier rework rewrites the floor's emit sites, so the exhaustive per-print wall over the ~75 raw eprintlns in claim_executor is a declared frontier gated on this PR rebasing over that rework and re-censusing. Censusing sites about to be rewritten is the double-churn the operator ruled out. What lands now is the census model, the roster, and the executable hygiene witness — never a hidden zero: five families migrated-pending, the raw-print residue counted, and the witness holding the roster against the seed so it cannot rot into a lie. Executable, not inert: the witness reads the live seed and reds when a rostered marker has vanished (staleness — proven by a RED control) or when a frontier row lacks a real dissolve-on. The [floor-memory] shape is checked positively — still present, still classified frontier — so the census cannot quietly drop it. This completes P0-P3. Full suite green by execution: 31 model, 6 lockstep, 18 CI-renderer, 10 TTY-renderer, 6 census conjuncts, each with discriminating REDs proven by perturbation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Piece 3: name the clamp coefficient's measurement basis (operator addition, 2026-07-24) The 1000ms aggregate coefficient now records its basis in gunbc_ci_floor_batch_clamp_note: host class (srv arm64 self-hosted, capped) x the adaptive governor's realized worker width, denominated against the observed 0.58-0.70 s/witness (the 1344-1629s full-corpus fleet envelope over ~2316 witnesses). Naming the basis makes a future width or fleet change a deliberate re-sign of the constant, never a rediscovered fleet-wide red; the ~1.4-1.7x headroom over the observed top rate is exactly the >=~1.6x runaway the clamp catches, with sub-threshold creep owned by the gauntlet's per-cadence s/unit receipt. Co-Authored-By: Claude <noreply@anthropic.com> * Probe (①/②): emit a per-gate warm-cost TSV from the floor's existing timings Instruments claim_executor with write_gate_warm_cost_receipt — one row per gate/claim (eval wall + resolve + combined warm_ms) and a discovery row carrying the per-witness rate — derived from the ClaimResult timings the walk already records (operator ruling 2026-07-24: instrument the existing floor, no throwaway probe workflow). Written to target/floor-gate-warm-cost-receipt.tsv and mirrored to the log as [gate-warm-cost] rows so the placement probe lifts it from get_job_logs on a fleet run. This is the placement roster's measurement basis: a gate rides PrTier only if its measured warm cost is within the 5s fast-lane budget, else fail-closed to Gauntlet (v2.workflow.ci_placement). Every floor run now auto-emits it; run cold-then-warm on >=2 hosts and the roster records value + host basis. Verified green-by-execution locally (single-claim row); the discovery-row path verifies in the next full-corpus CI floor. Fail-closed on a write error, consistent with the other floor receipts; never a verdict term. Co-Authored-By: Claude <noreply@anthropic.com> * Flagship replay as a green witness — the before/after made executable The operator's "show me": proven-by-witness without a visible sample is the fluent-but-unseen trap. dag/test/claim/observation_crawl_replay_test.dag renders the captured crawl window of run 30044816605 through the P1 CI renderer as one assembled block and asserts it by execution: - names the module where the capture was silent ("still in witness discovery: entry 214 of 602, now typecheck v2.compiler.normalized_tree", surfaced at T, the memory-reclaim cause at 2T) - uses human units, never the raw byte dump (15.0 GiB, not 16107200512) - ends in a named refusal summary, not a silent 55-minute timeout observation_crawl_after_block() is the exact function the PR body's after-sample is produced from, so the pasted before/after is a projection of a green run rather than prose. Every input number is read off the real log. The earlier gunbc/observation_crawl_demo.dag (a run-entry that returned a String and so errored on the ProcessExit contract) is replaced by this witness — a green check is worth more than a run-entry that prints then fails. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Wiring flip (1/n): install the output policy BEFORE the naming walk — kill the [file] firehose The floor's [file] read firehose (2265 lines / ~99% of the log, measured by execution) was the pre-plan naming-hygiene walk reading the whole source tree at the OutputDecision Full default, because install_output_policy ran AFTER the walk (claim_executor.rs order). gunbc.output_policy already models Instrumentation => Suppressed at Normal (CI's default verbosity) and ShellTrace => Condensed — the walk just never saw the policy. Fix: install the policy (and group syntax) FIRST, before the naming walk and every subsequent corpus read, so all host-effect traces are funnelled per the .dag authority. Verified by execution on the minimal smoke plan: [file] read 2265 -> 0, total log 2613 -> 24 lines, claim still PASS (exit 0). The Ambient semantics hold — the policy's divergence rule (ExpectedOutcome/ObservedOutcome) still expands a captured stream on failure, so a red effect is never silenced; only the green firehose is. This is the highest-leverage lever of the observation-emit census flip (the echo class the census targets). Follow-on commits route the display families ([floor-memory], [gantt], [governor], [measurement], [t+..]) through the observation stream as Ambient projections (the ✅/🕐/🚫 format matching #7168's "after" block). Co-Authored-By: Claude <noreply@anthropic.com> * Wiring flip (2/n): render floor phase marks through the observation authority Step 2 of the flip (format), after step 1 (the [file] firehose, volume). The prelude phase marks are the visible display class in the short regen job's log; they now render through the single-authority observation renderer instead of a raw [t+…] byte string the seed would fork the format into. before: claim_executor: [t+86.1s] naming-hygiene walk complete after: ✅ naming-hygiene walk done in 48 seconds - New seed→.dag boundary gunbc.observation_seed_render: primitive args in, a rendered line out — exactly as cli_run.install_output_policy calls output_policy.resolve_channel_policy. A phase concluding is modelled as a Concluded event on a PhaseSegment subject, projected by ci_event_line ∘ ci_render_line, so the FORMAT stays single-authority in gunbc.observation_ci_render and the seed constructs no format of its own. - The raw [t+{:.1}s] eprintln is DELETED, not suppressed (grep-clean for the print). §5: on a renderer-unreachable failure the arm names the degradation loudly and never reproduces the old marker. - Per-phase walls (delta since the last mark), not a running t+, so the log itemizes which prelude phase is slow — the step toward the per-phase receipt keys the ci_spec prelude-coverage-hole follow-up (row a) calls for. - Green by execution: phase_mark_renders_through_the_observation_render_authority resolves the adapter through a real interpreter and asserts human units + the completed glyph + NO [t+ marker (the discriminating RED). The seed→.dag resolve is memoized, so the renderer resolves once and later marks are cache hits. Rust-called-.dag-unimported has precedent (output_policy.dag). Next in the series: the rostered census families. floor-memory (the flagship byte dump) needs its subject feed plumbed first so it renders honestly (entry X of Y, never a fabricated 0 of 0), then gantt/governor/typecheck-attribution, each flipping its census row (CountedFrontierSite → MigratedToObservation) with the witness restructured to assert the raw marker is gone — the "witness fixes" step of flip → witness fixes → roster. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Witness fix: roster the observation stack's one wildcard site (non_fold_residue) The progress-and-observation merge (#7168) added observation_ci_render.dag, whose ci_hold_cause_text names the two memory-pressure SchedulerHold variants specifically and gives the other five a generic cause via a top-level wildcard arm — a non_fold_residue site. It landed unrostered because per-PR affected-set selection predict-skips the corpus-read nfr witness (the masking class the roster's dated rows document), so it reds only on a cold whole-corpus sweep (falsifier / merge-to-main), not on the selected PR floor. That is the census wall doing its job on its own author. Roster it (gunbc.non_fold_residue, one FrontierRow, reason + dissolution trigger toward a total match), matching the established masking-class fix and preserving the observation author's design. Green by execution: observation_hold_cause_wildcard_is_rostered asserts the live roster now carries dag/gunbc/observation_ci_render.dag::ci_hold_cause_text via the same host reader the corpus scan uses — reds if the row's key drifts from the scan's {rel}::{fn} key or the hand edit malformed the 126-row list. design_register_lift_parity (the other cold-red thought to be surfaced by the merge) is NOT touched: this branch's gunbc.site.* inputs are byte-identical to main and recent main-push runs are green cold, so it is green here too — not attributable to this PR. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Wiring flip (4a/n): the floor-memory heartbeat's seed oracle + golden strings Foundation for migrating the [floor-memory] byte dump to the observation heartbeat. Adds gunbc.observation_seed_render.seed_heartbeat_line: the seed→.dag boundary that takes the primitives the heartbeat thread has (elapsed, batch label, entry position, memory vitals) and projects them through the one renderer (ci_heartbeat_line ∘ ci_render_line) — identity first, human units, no raw byte dump. The subject is batch-grain by construction: the floor walks entries in parallel, so there is no single active module to name, and the primitive interface carries none — never a fabricated per-module "now typecheck X". Green by execution: seed_heartbeat_line_renders_identity_first_in_human_units pins the exact bytes for two samples through the real interpreter: 🕐 33 minutes in — still in witness discovery: entry 214 of 602. memory 15.0 GiB, swap 32.0 GiB, pressure 9.0% 🕐 500ms in — still in self-host fixed-point: entry 0 of 2. memory unreadable (cgroup field unreadable), swap 0.0 GiB, pressure unreadable (cgroup field unreadable) The first is the captured crawl window re-rendered from the seed's own vitals (raw byte value absent); the second proves an unreadable cgroup field names its cause, never a fabricated zero (observation law 2 / §5). These golden strings are the oracle the Rust mirror is proven byte-equal to in 4b. Why a Rust mirror next, not an interpreter call: the heartbeat runs on a detached liveness thread in a memory-constrained context — resolving the renderer there would build a duplicate module index, consuming the very memory it watches (§2), and the thread exists to stay alive when the main interpreter is busy. 4b adds that mirror (proven == this oracle), plumbs the subject feed, wires it, deletes the byte dump, and flips the census row. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * File finding: shell.Env.Get realized as a printenv subprocess (transport-decomposition lane) Operator-directed finding (2026-07-24), do-not-fix-here. Records in the residual-shell census (§0b) a class distinct from that doc's shell-EMISSION axis: modeled ops whose interface shape is right but whose single hardwired transport is a shell escape where a NATIVE in-process handler is correct — the verbatim §3(b) N×M-adapter tell. shell.Env.Get (extdeps/shell/shell.dag:42) reads an env var the process already holds in its own environment by spawning `printenv` (wet_env_var, v1_interpreter.rs:5096). Reading your own environment is not a host effect; std::env::var is the native handler, chosen when locality is OnTarget, with shell/ssh reserved for a var on another host. Sibling: shell.Which.Check (`command -v`), already in the census. One root, three lanes. Not a floor-time lever (~ms/spawn); filed so the deficit is counted and prioritizable (§6), never absorbed into "it's only a few ms." Its native read is the lane's cheapest first consumer (a pure in-process read, no host_effect_apply even). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Wiring flip (5/n): shell-echo §5 split — routine Ambient, failure Anomaly self-describing The [shell]/$ echo class still printed at Normal after the firehose fix: it is the ShellTrace channel at Condensed, not the Instrumentation channel that [file] read rode. But naive "suppress ShellTrace at Normal" is a §5 fail-open — the failure stderr block rides the SAME channel via trace_emit(), so Suppressed would silence failures too. That Condensed was load-bearing. Root (operator's naming): one channel carrying two content classes with OPPOSITE attention — routine scaffolding (Ambient) and failure evidence (Anomaly) — a state-space conflation at the channel grain, exactly what the observation model dissolves by deriving attention per event, not per channel (law 4: routine collapses, anomaly expands). The fix uses the two EXISTING mechanisms, each governing its class — no third decision mechanism: - Routine ($ argv pre-spawn echo + [shell] done exit=… count) → the ShellTrace CHANNEL → Suppressed at Normal (Instrumentation's debug-only shape), Full at Verbose. - Failure evidence (stderr block) → the effect_stream DISPOSITION (SurfaceContent) ALONE, not the channel, so suppressing the routine echo cannot silence a failure. Two upgrades the disposition-gated block gains, both §5-correct now that the count is silent at Normal: 1. SELF-DESCRIBING — the block carries its own `$ <argv>`, so the failing command never scrolls away from its stderr (the pre-spawn echo it used to borrow from is gone at Normal). Strictly better than what suppression would have taken away. 2. SURFACES ON EMPTY STDERR — the block names the exit even when the command wrote nothing, because the routine count that used to carry the exit is now silent. Proven by execution: four-corner effect-stream suite kept; new discriminating RED at_normal_a_failing_effect_surfaces_its_command_a_passing_one_is_silent (passing → None; failing → `$ <argv>` + stderr) + stderr_block_surfaces_on_surface_content_even_with_empty_stderr. Channel witness updated (w_shell_trace_routine_is_debug_only: Suppressed at Normal). Convergence named in output_policy.dag: when shell effects become observation events, trace_emit(channel) stops being the gate and derived attention replaces this split. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Revert "Wiring flip (5/n): shell-echo §5 split" — approach was wrong, unbreak the branch This reverts commit 60a4496. Two defects, the second fatal to the approach: 1. Parse break (caught late): the witness carried `//` comments, but daglang has NO line-comment syntax — documentation is `data …_note: String` only. build_module_path_index scans every .dag at install_output_policy startup, so the parse error panicked the whole floor, not just that witness. LESSON: verify .dag by execution before pushing; a Rust-lib test does not exercise the .dag parse/resolve path. 2. The approach itself was wrong (the real reason for the full revert). Making ShellTrace Suppressed at Normal does not just silence the routine echo — effect_stream_disposition is GATED BY channel_decision: match channel_decision(channel, verbosity) { Suppressed => StreamSuppressed // failures silenced Condensed => divergence_disposition(…) // divergence surfaces, agreement counts Full => SurfaceContent } So Condensed-at-Normal is load-bearing TWICE (trace_emit AND the divergence disposition), and host-effect grouping keys on the same channel. Suppressing it is a §5 fail-open (a real failing effect's stderr goes silent at Normal); the Rust test passed only because it read the hardcoded EFFECT_STREAM_POLICY_FALLBACK, masking the installed-policy break. The alternative (route routine → Instrumentation, keep ShellTrace Condensed) leaves empty `##[group]` brackets and buries the failure block inside the collapsed section. FINDING for the redo: the channel↔disposition↔grouping coupling IS the "one channel, two content classes" conflation the operator named — and there is no clean immediate fix that does not touch it. The correct fix decouples the failure disposition from the routine channel verbosity (the "bigger lift" flagged as needing a design steer), which lands back at the operator's "Hold — I'll steer". The self-describing failure-block design (carries its own argv, surfaces on empty stderr) is sound and preserved in 60a4496's history for reuse. Branch returns to the green b35a4b3 state. Shell-echo goes back to HELD pending the disposition-decoupling design decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Wiring flip (4b/n): floor-memory heartbeat via render_heartbeat_line_mirror Flagship of the observation wiring flip: replace the [floor-memory] raw byte dump with the identity-first 🕐 heartbeat, proven byte-equal to the 4a seed oracle (seed_heartbeat_line). - render_heartbeat_line_mirror: pure Rust mirror of ci_heartbeat_line ∘ ci_render_line — the heartbeat thread cannot call the interpreter (duplicate module index under the memory envelope it watches). Discriminating RED render_heartbeat_line_mirror_matches_seed_oracle pins byte-equality on the crawl-window and unreadable-field goldens. - HeartbeatFeed (cli_run): process-global batch label + entries done/total, armed only when entry_total is known and non-zero (never a fabricated 0-of-0). Updated at batch-enter and at the existing index_schedule_entry_completed per-entry point (SingleClaim path increments per claim result). Discovery fills the total once the roster's entry-group count is known. - Delete the byte dump; keep the regime-disclosure line (marker stays for census hygiene). Flip floor_memory_site → MigratedToObservation; restructure census/lockstep witnesses (frontier 5→4, dump shape asserted gone). - Also: strip invalid // comments from output_policy_witness_test.dag that the shell-echo §5 commit left (dag has no // comments — parse Slash). Co-Authored-By: Cursor <cursoragent@cursor.com> Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * cargo fmt: claim_executor + cli_run after floor-memory 4b / main merge CI build failed at the fmt --all --check gate (assert_eq! wrapping + HeartbeatFeed Mutex.lock() chain). No behavior change. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [gantt] → Begin/Concluded PhaseSegment observation projection Compile-path trace_mark and GUNBC_FLOOR_GANTT emit through phase_begin_line / phase_concluded_line mirrors (byte-equal to the seed oracle; interpreter render from inside compile would recurse). Census row MigratedToObservation; raw t_ms/rss_mib shapes gone. Frontier 4→3. Verified via claim_batch on observation_emit_census_witnesses. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [governor] → ci_hold_cause_text / StatusBlocked observation projection HoldReason emits through seed_governor_hold_line (mirror render_governor_hold_line_mirror); hard/creep/receipt/startup lines lose the raw [governor] key=value shape. Census MigratedToObservation; frontier 3→2. Mirror↔oracle byte equality for PsiPressure and CurrentHighWater. Verified via claim_batch + memory_governor unit tests. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * cargo fmt: claim_executor after governor hold oracle RED Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Fix runtime_rust.dag: escape Rust format braces for daglang parse daglang treats {ident} inside string literals as interpolation; the gantt mirror's format!("{glyph}…") (and use std::sync::{Mutex,…}) panicked the regen self-compile. Escape as \{…\} so the emitted Rust keeps real braces. Emitter twin resynced; byte-equal to v1_rt.rs. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [typecheck-attribution] → ModuleSegment+PhaseSegment observation Per-module typecheck Begin/Concluded via typecheck_*_line mirrors (render_typecheck_*_line_mirror); 2s pathology threshold preserved. Census MigratedToObservation; frontier 2→1. Mirror↔oracle RED for the captured crawl fixture module. Verified via claim_batch. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [measurement] + shell-echo → ObservationEvents (one pass) Measurement peak-RSS/cgroup dumps project through ci_measurement_rss_line (seed_peak_rss_line ↔ render_peak_rss_line_mirror; identity-first, human GiB). Shell host-effects become ObservationEvents: Ambient Begin/Done still gated by ShellTrace; Anomaly Failed gated by effect_stream disposition alone (never silenced by ShellTrace Suppressed), with law-4 idempotent group_end, self- describing `$ argv (exit=N)`, and empty-stderr surfacing. ShellTrace/ disposition tables left unread for the interim Condensed-at-Normal split. Census: measurement + shell MigratedToObservation; tagged frontier count 0; 76 raw eprintln residue recounted. Standing check: claim_batch census witnesses PASS before push. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Fix GeneratedArtifact name collision in observation_model witnesses Whole-tree compile-clean failed: bare SelectionNoOp.GeneratedArtifact collided with v2.std.artifact.GeneratedArtifact and gunbc.generated_artifact.GeneratedArtifact. Mint via selection_noop_generated_artifact in the defining module so the variant resolves unambiguously. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Observation aesthetics: named-intent shell, glyph discipline, census bidir, failure-receipt miss Operator live-log review (run 30142403230) — four pieces in one pass: - Shell subjects are typed service.op intents; argv only in Failed.error. Ambient ShellTrace is Suppressed at Normal (silent scaffolding); Anomaly still surfaces via divergence alone (Quiet no longer forces StreamSuppressed). - Governor receipt uses StatusPulse (not Done glyph); peak RSS / governor / cgroup wrap in one "floor receipts" group. - Census roster grows four CountedFrontierSite rows ([floor-drain], [gate-warm-cost], [receipt], [file]) with a bidirectional hygiene witness. - Undeclared *_failure_receipt companions (NoMainFunction) treat as empty detail instead of stuffing failure_receipt_refused onto ordinary Bool(false) reds. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * Silence Ambient shell on gunbc run; roster #7205 resolve/assembly split tags Merge-admission stamp is `gunbc run`, which never installed output_policy — so ShellTrace fell back to Full and every Ambient Begin/Done still printed despite named-intent subjects. Install policy + group syntax at handle_run startup (same as claim_executor). Census grows [resolve-split]/[assembly-split] frontier rows so #7205's new tags stay bidirectional. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * Re-merge #7205 tip + native shell.Env.Get (kill printenv Anomaly clutter) Pull the two new #7205 commits (export_index canonical = fold element — kills the O(|bindings|^2) rescan). Route OnTarget shell.Env.Get through wet_env_var instead of printenv so optional floor_diff injections (GUNBC_CI_DIFF_*) no longer paint ❌ Anomaly Failed when unset — reading this process's env is not a host effect (§3(b) / shell-to-dag census 0b). Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * infer_semantics: unstale the slice control after #7196 admitted list slicing #7196 (bb4347d, on main) deliberately extended `check_slice_access_node` to admit ordered element collections — adding `base_is_list`, widening the refusal arm to `base_is_string || base_is_list`, and returning the base type rather than String on the list arm. `invalid_slice_returns_compiler_error_type` still pinned the withdrawn refusal, so it asserted one diagnostic where the compiler now correctly produces none: assertion `left == right` failed left: 0 right: 1 The witness went stale; the compiler did not. Repointed the negative control at a `Map` base — `ordered_element_collections()` (std_types.rs) holds `List` alone, so a Map is neither String nor an ordered element collection and must still refuse — and added the positive control #7196 admitted but never witnessed: a `List<Int>` slice yields no diagnostic and preserves `List`. Reproduced locally before the change (identical left 0 / right 1) and green after. Both controls proven live by perturbation: restoring the `List` base reds the negative control, expecting `String` reds the positive one. Note on how this reached main green: the witness never ran there. It is a binary witness whose transport (dag/tools/infer_semantics_witness_transport.dag) declares no dependency on v1_compiler_infer_access.rs, so the affected set cannot see the edge; main's run at bb4347d observed an empty diff and skipped 1761 of 2373 witnesses, this one among them. That selection escape is a separate defect and is not addressed here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * gunbc run: add --arg name=value, the missing parameter channel at the .dag seam `Commands::Run` was zero-arity by construction: `run_in_context` (v1_interpreter.rs:1543) ends in `call_function(ctx, &item_node, &[], &env)` — an empty argument slice — while `run_in_context_with_args` has sat twenty lines below at :1564 the whole time, already used internally by claim_executor.rs:166. Only the CLI flag was missing. The consequence is repo-wide and stated in the corpus itself (dag/gunbc/roadmap_belt_actuate.dag:689): "gunbc run --function cannot pass an argument (there is no --arg flag), so the node id enters through the environment". Every value that must reach a `.dag` entry crosses as an environment variable instead — 34 live GUNBC_* names across 77 read sites, including intra-process uses where sender and receiver share a PID (floor_skip_discovery_witness.rs:112-127 set_vars a synthetic diff and reads it back in the same process). The environment wins by economics, not design: adding a modeled parameter costs an edit to `cli_run`'s 29,626 lines of SeedRetained hand-Rust, adding an env var costs one line on each side, and `NamespaceTree` (dag/std/effect_grant.dag:26-31) has no environment arm, so no grant bounds it and no lens counts it. Named-only by construction: a `.dag` entry's parameters are named, so positional order across the CLI boundary would be an unchecked coincidence. A missing `=` or an empty name refuses with exit 2 before the compile runs (§5) rather than guessing a position, and one malformed spec refuses the whole list — a partial parse would silently drop a caller's argument. Values enter as `Value::Str`; no coercion is fabricated here. One path, not two: with an empty --arg list `run_in_context_with_args` passes the same empty slice `run_in_context` did, so the zero-arity path is unchanged rather than branched around. Threaded through the emission authority (src/v1/05_emit_rust.dag:10270 variant, :10495 match arm) and its seed mirror in v1_compiler_emit_rust.rs so regen stays a fixed point. Proven by execution against the built binary, not by typecheck: --arg node_id=roadmap-7 -> ExitSuccess, exit 0 --arg node_id=wrong-node -> callee received "wrong-node" (the value transports, not merely the flag parses), exit 1 --arg node_id -> exit 2, "expected `name=value`" --arg =orphan -> exit 2, "empty parameter name before `=`" --arg ok=1 broken also=2 -> exit 2, whole list refused no --arg -> zero-arity path unchanged Plus six unit tests (three of them RED controls) and `05_emit_rust.dag` compiled through the real pipeline: 0 blocking errors. Known gap, not papered over: the unit tests run under `cargo test`, which left CI on 2026-07-11 (gunbc.commit_workflow rust_tests_removed_disposition). An enrolled floor witness for this channel is a follow-on. Retiring the parameter-shaped env vars onto this flag — GUNBC_BELT_NODE_ID, GUNBC_CI_DIFF_*, CI_FLOOR_EXIT — is also follow-on; this commit adds the channel, it does not yet migrate the callers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * CI floor: give re-homed witnesses a real scheduled lane (FalsifierCadenceJob) Batch 4 breaches its clamp on every run of this PR — 571556ms (srv3-01) / 613864ms (srv2-02) against clamp_ms=420000 at units=74, authority gunbc.ci_spec gunbc_ci_floor_batch_clamp_params[3]. Both batch-4 groups PASS; it is the wall, not a witness. Per the operator ruling, six declared rows move off the per-PR floor to the 4-hour falsifier cadence: the three wave1_gate1_d_* rows (141s + 29s + 27s) and the three affected-set provenance walls (14s + 13s + 13s), measured in the run-30148859947 slow-witness tables. That removes ~237s of eval, landing batch 4 near 334-377s under the unchanged 420s clamp. The vehicle is NOT gunbc.ci_layer_roots falsifier_rehomed_bin_wet_rows. That roster is specifically the bin_witness_wet_entries per-row-budget overflow (constructor bin_wet, budget datum bin_witness_wet_per_row_wall_budget_seconds) and does not model CommitWitnessClaim rows; re-homing through it would mint a second re-home authority. Instead this extends the axis that already answers "where does this check run" — the enrollment surface — with a fourth variant, FalsifierCadenceJob, plus the batch that reads it. The batch lands in the SAME change as the surface deliberately: a surface tag with no consumer is enrollment-by-illusion, which is the state ~54 files under test/claim/long/ are already in (excluded from discovery at dir grain, not walked by the falsifier, enrolled nowhere) and it would present as a clean green diff. gauntlet_lane_enrollment_witness_test reds per-PR if a row ever sits on the surface without reaching a batch. Two entries split at the check_fn rather than moving whole, so each concern keeps per-PR coverage at the cheap grain and loses only the wet grain: affected_set_provenance_producer keeps its four <=161ms fns on the floor, parse_binding_fidelity keeps witness_resolve_distinct_param_bindings_holds. FOUND BY THE WALL, first execution: the doc-reachability witness (doc_graph_has_no_orphan_docs, doc_graph_has_no_dangling_links) rode surfaces: [GitPrePushHook] alone — enforced only by a mechanism this repo has already ruled is not an enforcement authority (opt-in per clone, bypassable with --no-verify, absent in container worktrees, proven ineffective by #6658). Orphaned docs and dangling links had no wall on any CI path. Fixed by adding the cadence surface, NOT by widening witness_enrollment_is_scheduled to accept the hook — widening the predicate until the failure disappears is the absorbing fallback, and would have re-buried the finding that surfaced it. Placement (PrTier | Gauntlet) is the intended end-state authority and is recorded as the dissolve-on, not wired here: PrTier is unwritable without a WarmCostReceipt whose measured_ms is within the 5s fast-lane budget, so wiring it onto all 36 CommitWitnessClaim rows needs a per-row measured receipt and the D2 warm-cost probe has not run. Fabricating those receipts is the fail-open the placement law exists to forbid; defaulting the unmeasured rows to Gauntlet would de-enroll all 36 at once. Encouraging convergence: the 5s law selects exactly the twelve rows measured over 5s and admits every other batch-4 row at <=1s, so placement and this surface agree on today's roster. dag_compile_clean_perturb_receipts_holds is deliberately NOT re-homed. It was retained by the 2026-07-23 ruling by name because it measured 53s, under the 60s per-row budget; it now measures 141s. Re-homing a row that got 2.7x slower answers the wrong question and would zero the deficit's frequency by construction. Its growth is diagnosed separately. Proven by execution: all three files compile clean (0 blocking errors); gauntlet_lane_enrollment_witness_test 3/3 green in 3ms, inside the fast lane. Both claims proven live by perturbation — reverting one re-home reds _rehomed_rows_are_cadence_enrolled_holds, and _is_never_bare_deenrollment_holds was RED against the live roster before the doc-reachability fix and green after. The RED control discriminates a synthetic bare de-enrollment. commit_witness_claim_roster_holds (the #7060 stale-pair class, live) PASS. No generated-artifact drift: the ymls invoke plan functions, so batches compute at run time and the falsifier picks up the new batch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * CI floor: operator-signed interim clamp raise, batch 4 420s -> 540s Signs the margin ruling for the budget family, not just this number. A clamp was doing double duty: merge-refusal threshold ("this must not merge") and growth detector ("something got slower — look"). Tight margins serve the second job and demonstrably worked — perturb's 53s -> 141s growth was caught precisely because the clamp was tight. But they make the FIRST job fire on host roulette, and a breach meaning "you landed on srv2-02" trains the on-call to rerun, which is crying-wolf wearing budget clothes. Policy signed here: clamps are sized to cover MEASURED fleet spread, so a breach means content grew, never which host answered. The growth-detector job moves to per-row trend receipts on the falsifier cadence — that piece is what makes a wider clamp safe, and it is sequenced next behind the perturb diagnosis. Basis for 540: post-re-home projection 377s (worst observed wall 613864ms minus the ~237s the six re-homed rows carried) x 1.2 worst observed spread = ~452s, + ~20% policy margin = 540 (whole-minute grain). Run ids: 30148859947 @ 619bba5 wall_ms=613864 units=74 srv2-02; 30163496549 @ 9f87967 wall_ms=571556 units=74 srv3-01 — identical content, 7.5% apart, which is the spread this funds. Enrollment that grew the batch: NONE. Batch 4 shrank this cycle (units 74 -> 68). The raise buys spread coverage on a batch that got smaller. Not the forbidden widen: batch 4's per_unit_ms is 0, which the clamp note already calls "a declared calibration gap, not a hidden default". 540 funds that gap with a dated, dissolving interim rather than leaving a flat rate to fire on variance. It refuses exactly as before — only the threshold moved, on a stated measurement, not to make a red go away. Dissolve-on: the perturb diagnosis lands (141s = 38% of the remaining batch; returning it toward its 53s basis puts worst case near 350s, under even the retired 420) AND the D2 per-unit rate replaces the flat clamp. The wet-receipt 600s budget (the 707s falsifier red) has the same disease — ten-day-stale basis, zero spread allowance — and the policy above governs it, but its NUMBER is deliberately not moved here: it is gated on its own sccache-vs-growth attribution so the dosing lands with a measurement rather than by analogy. Host spread is not weather: srv1/srv2 still run pre-#7213 sccache units and are typed expected-latent-defective until re-provisioned, so part of the 7.5-20% collapses when the fleet lane re-converges them. Proven: ci_spec compiles clean; witness_floor_batch_clamp_params_cover_schedule, _overhead_all_positive, _rate_all_nonneg all PASS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * Extend the falsifier batch-count pin for the FalsifierCadenceJob batch 779e9dc appended gunbc_falsifier_cadence_witness_batch to gunbc_falsifier_batches() without extending falsifier_plan_structure_holds, which pins the schedule's batch count: let expected_batches = 1 + wet + probe + silent_pick + rehomed (length(xs: batches) == expected_batches) && ... So length was expected_batches + 1 and the witness returned false, redding ci_floor_plan_witnesses and with it batch 3 on run 30166208268. The pin worked exactly as designed — it exists to red when a batch is added without being declared, and that is what it did. Note what this masked: batch 3 failing stopped the walk before dependent batches, so batch 4 never ran on that run and the re-home + 540 clamp are still UNMEASURED in CI. The floor-batch-wall receipt read "3 batch(es), 0 over budget" — green on the batches that ran, not evidence about batch 4. The fix is not a count bump. falsifier_cadence_witness_batch_holds mirrors the silent-pick sibling and checks the batch's actual shape: SelectionApplied, zero scan_dirs, entry count matching falsifier_cadence_witness_entries(), Wet execution mode, spawns_host_compiler, and NOT heavy_whole_tree_resolve. The rehomed sibling is only counted, never shape-checked; this one is both. Proven live by perturbation, not just by going green: flipping the cadence batch's execution_mode from Wet to Hermetic reds falsifier_plan_structure_holds. Verified green together with ci_floor_optin_roster_witnesses, ci_corpus_discovery_flip_witnesses, and all three gauntlet_lane_enrollment_witness_test claims. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * Decode \xNN in .dag string literals — no authored colour had ever rendered process_escapes resolved exactly six escapes (\" \\ \n \t \{ \}) and fell through on everything else to concat("\\", next), preserving the backslash. So "\x1b" was never an ESC byte: it was the four characters backslash-x-1-b. Every ANSI code this repo authored in .dag emitted as literal text — extdeps/render/ansi.dag csi_esc, extdeps/render/terminal.dag's reset, and gunbc/ci_render.dag's red/reset. That is the `\x1b[38;5;196m🔥` seen in the TOP SLOWEST WITNESSES table of run 30167957464, which read as a renderer leaking colours onto the CI path and was neither: the raw GitHub log carries real escapes everywhere else, so the defect was the decode, not the target. Fixed at the authority (src/v1/01_tokenize.dag), not the generated seed, via the already-registered from_code_point builtin — no new builtin. The seed file is regenerated by regen_stage0; it is `// Generated by v1 compiler`. Regen produced exactly this one file's delta, so the self-host fixed point held across the change. The witness that should have caught this could not. It compared one undecoded literal against another (code == "\x1b[38;5;34m"), so both sides were equally wrong and it agreed with itself throughout — the vacuous-oracle shape DESIGN §5 names, a check satisfiable by editing the declaration while the realization lies. Its two replacements test properties of the DECODE rather than of the spelling: the first character's code point is 27, and the decoded string contains no backslash. Neither can be satisfied by editing a literal on either side. Both were proven RED against the pre-fix binary before regen was paid for, and green after. Unknown-escape passthrough is knowingly RETAINED, and marked rather than left silent: 🟡 dissolve-on tokenizer_unknown_escape_strict_close. Refusing today would red 142 occurrences across 38 files — overwhelmingly regex fragments (\' 28, \. 19, \| 13, \/ 12, \B 10) that intend the backslash to survive — so the strict close needs a raw-string carrier to migrate onto first, and lands with a corpus-wide compile receipt because it changes parse semantics for every lane that compiles through this tokenizer. Not the four sites a \x-only count suggests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * Layer 1: bind ExpectedOutcome from the call site, not the transport v1_interpreter.rs carried `let expected = ExpectedOutcome::ExpectSuccess` hardwired at dispatch_shell, with a comment saying where the declaration should live was still open. It is now read from the call site. The whole downstream apparatus already existed and was pinned — gunbc.output_policy's four corners, outcome_diverges, the Rust mirror in EFFECT_STREAM_POLICY_FALLBACK. Only the binding was missing, which is why output_policy.dag:105 could already describe the payoff in writing. WHERE IT LIVES, and the two homes that look right and are not: param_env is wrong because param_env IS the request: content_hash_service_inputs iterates op_node.params and looks each up there, so a service-op `input {}` would join the digest and two invocations differing only in what the caller expected would become different cache identities for the same request. The transport is wrong less obviously, and this is the trap. The nearest local precedent — transport_stdin, transport_response_format via find_property — points straight at it. But dispatch_service_wet receives the transport from op_node.transport.or(service_node.transport): the extdeps service-op DECLARATION, shared by every caller. Hanging the expectation there makes it a per-operation fact, so a red control and a genuine check both calling shell.Test.IsFile could not differ — and caller policy declared in extdeps is the DESIGN §3 layer inversion the original comment warned about. It would have compiled and read as green while being wrong twice. So it is a reserved argument on the call node, partitioned out in eval_method_call before bu…
briansrls
pushed a commit
that referenced
this pull request
Aug 15, 2026
Found by the prose-grain membership-versus-extent check: two notes I rewrote today shrank materially (1285 -> 499 bytes and 924 -> 631), so I enumerated what was inside them rather than trusting a four-line diff. gate_enrollment_surface_asymmetry_note existed to justify why gates and witnesses need SEPARATE scheduled-surface predicates. Its justification was one worked instance: GithubActionsCiRegenJob executed gates but not witnesses. My cut deleted that surface, so the two predicates now read GithubActionsCiJob or FalsifierCadenceJob and nothing else -- BYTE- IDENTICAL bodies. The note as I left it still called them "one law read against two projector sets", which is now false. Corrected to state the measured identity and its cause, and deliberately NOT to merge them: a gate and a witness remain different kinds, and a future surface executing one but not the other re-separates them. So this records one concept under two names as a declared §2 violation held open, rather than a fork nobody noticed or a de-fork decided by the lane that happened to expose it. The other shrunken note lost only regen-surface content, all of it deleted; its live facts (the law, GitPrePushHook counting for neither kind, the #6658 receipt) survive verbatim. Typechecks 0 blocking.
briansrls
pushed a commit
that referenced
this pull request
Sep 2, 2026
…five capability-grain rows, and the trigger now points at them (#9944) THE DEFECT. gunbc.rung_drop floor_cut declared six lost capabilities -- heal, the seven effect gates, the fmt gate, merge-admission stamping, the falsifier cadence, and the per-witness eval deadline -- under one restoration trigger: "this paragraph is rewritten as an ordinary present-tense description ... when the re-add queue closes". That is 4b(3)'s grain mismatch in its plainest form, a plural loss with a singular trigger whose actuation is a PROSE EDIT. AND THE PREDICATE HAS NO TRUTH CONDITIONS. "the re-add queue" has exactly one referent in the tree: a numbered list under Step 3 of docs/plans/floor-cut-replacement-plan.md, which gunbc.doc_graph_roots registers as a HandAuthoredDocBind -- a hand-authored document, so no .dag authority carries its contents. No membership object, no per-item disposition field, no closure predicate (searched .dag, .rs and .md). Its own item 8 proposes the falsifier cadence NEVER RETURNS, and an item that never returns cannot close by returning, so closure would need a per-item disposition nothing records. A row that cannot be retired by its trigger gets retired instead by someone judging the paragraph stale. FIVE ROWS, NOT SIX, AND THE ARITHMETIC IS SHOWN. Two of the six were already dispositioned and authoring rows for them would have been fabricated debt. GENERATED-ARTIFACT DRIFT is RESTORED -- gunbc#9415 enrolled the required generated-artifact phase -- so the effect-gates row states the fraction: 1 of 7 discharged, 6 outstanding. THE PER-WITNESS EVAL DEADLINE already carries its own drop at gunbc.witness_row_cost gunbc_ci_fast_lane_rule_note and is CITED, never re-declared. WHAT THE FIVE MEASURED, from the tree rather than from the paragraph under suspicion: - fmt: neither required lane runs cargo fmt at all; gunbc.commit_workflow already carries it as an Uncovered residual, and the hook is opt-in per clone and bypassable (#6658 landed an unformatted .rs with no hook catching it). - merge-admission: the receipt's producer is deleted, so a live consumer has no input. - heal: gunbc.ci_heal_credential survives and still cites gunbc.ci_workflow ci_heal_generated_artifacts_job -- and gunbc.ci_workflow does not exist in this tree. - falsifier cadence: no workflow runs a cold comparison; v2.std.live_tree records two carriers whose enforcement claim died with it. - effect gates: six of seven have no required consumer. EACH TRIGGER NAMES A CAPABILITY AND REFUSES THE ARTIFACT THAT WOULD LOOK LIKE ONE -- repairing heal's dangling citations heals nothing; a gate that reports without refusing is the inert tier; re-adding a merge_admission_gate that reads a receipt nobody writes reproduces today's state with more code; strengthening the pre-push hook re-imports pressure that converts honest reds into workaround greens. THE FALSIFIER CADENCE'S DISPOSITION IS OPEN AND SAYS SO. "Proposed: never returns" is a proposal in a hand-authored plan, not a ruling; a capability deliberately not returning is a scope removal and that is the operator's call. The row retires EITHER by the capability returning OR by an operator ruling it withdrawn -- and in the second case the carriers that named the cadence as their enforcement must be corrected in the same change. floor_cut ITSELF CHANGES IN THIS DIFF, or the fork would be the repair's own product: its trigger sentence now names the five rows and states that it retires when all five retire and by nothing else. Each of the five carries the same constraint from its own end, so the reading where someone retires floor_cut having read one sibling is closed. The narrative paragraph is untouched; splitting the 31,681-character blob remains its own item. FILED: gunbc.recurring_failure_mode fabricated_debt -- a declaration authored for an exposure that does not exist or is already declared elsewhere, whose trigger cannot fire because there is nothing to restore, with the two catches above as its receipts. Executed: generated-artifact projections regenerated from the authority; DESIGN.md and docs/design-ledgers.md carry all five rows and the new class; the rung-drop standing witness (test.claim.rung_drop_standing_partition_witness) passes. Claude-Session: https://claude.ai/code/session_01WJ1bx2PttQ55XYhFqt3HUx Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
warm-crab-65.Pushing to
session/warm-crab-65advances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan