openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
openemit-on-demand execution — prove the artifact path end-to-end(operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP)(operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
openworkload-class admission model(operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
openstateless frontend MVP on fabric(operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
openthree-way diff = the core fold with a lattice codomain — not a new differ(operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer(operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
openaffected-set lens(the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
openartifact-freshness gate(operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
Upcoming
openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired(the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary)(operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1)(operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
openresource-namespace-upsert-a — vocabulary only(#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
Done
reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan