Repository navigation
Rc to Arc global flip: store payloads become Send, with perf receipt - #6965
gunbai-bot[bot] wants to merge 28 commits into
Conversation
…elt_dispatch_node_cli (#6942) * WIP: dag roadmap work * WIP: dag roadmap work * WIP: dag roadmap work * Belt A review #6942: single-authority dispatch route prefix Extract belt_dispatch_path_prefix (roadmap_page.dag) as the one authority for the /dispatch/ route prefix; node_http_server_emit route config and the client-JS fetch both consume it (was two lockstep string literals, DESIGN section 3). Emit verified valid JS with all 4 derived occurrences. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: dag roadmap work * WIP: dag roadmap work * WIP: dag roadmap work * Belt A #6942: address cursor REQUEST_CHANGES (4 findings) 1. section-5 broken witness: dispatch_client_script now emits only when the page has content (empty doc has no dispatchable node, so shipping dead JS there was wrong) -- witness_empty_doc_is_minimal_shell stays green by construction instead of editing the assertion. 2. section-3 env_var fork: node_http_server_emit config consumes belt_dispatch_env_var (was a re-minted GUNBC_BELT_NODE_ID literal). 3. section-3 repo_cwd fork: config consumes belt_actuate_workdir (was a re-minted /opt/gunbc/gunbc literal). 4. coverage: 2 emit witnesses (roadmap has /dispatch/+execFile+env+cli-name; gunbhub negative control has neither -- discriminating on dispatch:Absent) and 2 page witnesses (open node emits button+script+fetch prefix; signed-off node emits no button element -- exercises the done==signoff ruling, since a merged-but-unsigned node is 'review' and still dispatchable). Both witness aggregators green-by-execution on the fresh seed (roadmap_dashboard_emit_witnesses, roadmap_page_keystone_holds). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: dag roadmap work * WIP: dag roadmap work * WIP: dag roadmap work --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…6947) * Wave C3: retire nbd_proxy_serve shell-script residue after typed host-effect migration. Core RawLine→Srv3NbdProxyServe migration landed in #6629; this removes the orphaned script path, updates host_standup gap-ledger prose, and aligns the operator runbook with one-shot host_effect_apply (systemd transient units). Co-authored-by: Cursor <cursoragent@cursor.com> * Align srv3_os_install_actuate scope note with held-session nbd_proxy_serve model. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix compile-clean Secret/String mismatch on token response types. StsTokenResponse and TcgplayerTokenResponse still declared access_token as String while their service output mappings already project Secret; align the type definitions so optional_impersonation and tcgplayer consumers typecheck (unblocks dag_compile_clean_gate_passes on CI). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
…ame_boundary live consumer) (#6930) * effect-grants item-1 slice A: frame-boundary SPEC (agnostic, mechanism-free) + witnesses The first slice of the network-isolation lane, per the operator-confirmed design: isolation is a per-LAYER property (each std.effect_grant.NamespaceTree is a layer), and netns/container/seccomp/mock are different MATERIALIZATIONS of those layers' boundaries. This lands the AGNOSTIC SPEC half of the interface↔realization seam (§3): - std.frame_boundary: the frame-grain sibling of HandlerBinding (RealTransport|Replay is real-vs-mock at the grant grain; the boundary is that lifted to the whole frame). BoundaryClosure {tree, grade}, BoundaryMaterialization {closures}, and boundary_admits(required_trees, provided) -> BoundaryMaterialized{grade} | BoundaryUnmaterialized{tree}: fold with first-uncovered-wins (fail-closed, DESIGN 5), grade = MEET across covered layers (only as strong as the weakest). - Names NO mechanism. netns/container/seccomp/mock are extdeps realization handlers that CONSTRUCT a BoundaryMaterialization (dispatch lives in extdeps, not std). The module note carries the A/B/seam authority (mark-on-carrier, §6): (A) the boundary SPEC is a REACH fact, NOT std.realization.Materialization=Recompute|Memoize|Share (the redundant-computation axis — conflating them is a state-space conflation); (B) boundary PROVISIONING (spawn netns/container) is a realized host-effect through the realization kernel when a ByConstruction mechanism lands. The single common impl (Simulated/mock) is provisioning-free: closes a layer at LifecycleByConvention, ships the P3-native native run fail-closed; netns/container upgrade the SAME boundary to LifecycleByConstruction later — a row, not a fork. Green by execution: 6 discriminating witnesses (admits covered layer; refuses uncovered — the RED; grade is the meet; full-construction stays construction; empty requirement admits vacuously; refusal is located). Next slice: the extdeps Simulated handler + wiring emit_host_run_transport to run only when boundary_admits its required (UriTree/network) layer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * effect-grants item-1 slice A (cont.): Simulated boundary materialization handler + witnesses The always-available common-impl boundary handler (realization side of std.frame_boundary): extdeps.realization.frame_boundary_simulated.simulated_boundary(trees) closes each handed layer at LifecycleByConvention ("outside assumed-absent / offline-configured", nothing to provision). §3: mechanism lives in extdeps, spec stays agnostic in std. Honest by construction: every closure is LifecycleByConvention (an offline flag, not a kernel wall), so a consumer requiring LifecycleByConstruction refuses a Simulated boundary via boundary_admits' grade-meet — never a silent accept. netns/container are the ByConstruction siblings (boundary provisioning through the realization kernel), landing as the upgrade over the same spec. Green by execution: 3 witnesses — satisfies the spec for handed layers; closes ONLY handed layers (unlisted layer refuses — the RED); grade is always Convention (never over-claims Construction). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: effects rework * WIP: effects rework * effect-grants item-1 slice B: host-run network-boundary admission (frame_boundary live consumer) Lifts design line 81's "no network by construction, not just an absent grant" from prose into an executable, checked requirement, and makes std.frame_boundary (slice A) a live decision instead of an inert spec. v2.compiler.host_run_boundary_admission.host_run_network_boundary_admits requires every network layer (UriTree) materialized at LifecycleByConstruction. The always-available Simulated handler closes UriTree only ByConvention (offline flag, not a kernel wall — unshare --net is EPERM in-container), so it is HostRunBoundaryUnderConstructed: REFUSED for a native run, never laundered into Admitted (operator Option 1 fail-closed, 2026-07-20). Three states kept distinct (DESIGN §5, no conflated pass/fail): Refused{tree} = no closure at all; UnderConstructed{grade} = closed only ByConvention; Admitted = strong grade. Proven green-by-execution: a ByConstruction-provided boundary (as a netns/container handler would build) admits — the reachable GREEN control; the Simulated ByConvention boundary is under-constructed — the in-container RED-for-run; a boundary missing the network layer is a located Refused{UriTree}. No seed edit and no wet-run gating (the network boundary is hermetic-lane-specific). dissolve-on = the netns/container ByConstruction handler lands AND the emit_host_run_transport intrinsic's blanket is_hermetic() refusal is relaxed to "run only on HostRunBoundaryAdmitted" (deferred slice C — touches the load-bearing seed interpreter, not constructible in-container). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…full-body pool_parse baseline (#6953) Prices the known-shape interim cost (namespace-resolution-design.md PR-5b): #6848 made every compile pay an unconditional whole-pool full-body parse (pool_parse over all ~2255 .dag modules), adding a fixed ~1GB per-process baseline independent of the entry closure. Receipts (resolver read-only, instrumentation via existing [gantt]/resolved-N lines): - 4.2x isolation: same 97-source closure, 258 -> 1077 MiB parent -> main - Q2: strip waves (#6937/#6938) are per-entry memory-NEUTRAL, with exercised-path proof (closures moved up to 2.3x while RSS stayed pinned) - Slope: RSS ~= 225 + 0.38 MiB/pool-module, linear -> a repo-size scaling wall - parse baseline vs typed cache near-disjoint (shared parse_cache + TypedModule Rc alias) Diagnosis only; fix (heads-only parse + laziness) owned by the namespace lane. Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…admap; artifact projects it (#6922) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Plan cycle-4: chain B DONE, chain A single gate = comprehensive import-closure root fix Delta-first refresh of the v1-deletion plan authority against this session's landings: - witness_family_fanout -> DONE (all 9 families green + trustworthy controls: #6912/#6917/#6918) - new milestone emit_import_closure_root: the multi-layer emit-import peel root-caused into ONE transitive-closure derivation (operator ruling 2026-07-20); FreeMonoid was one layer, not the gate - probe_flip_fanout + deep_module_lanes -> both GATED on emit_import_closure_root (flip wave is NOT orthogonal; it shares the import-closure root and fans out in parallel with deep lanes on cargo-green) - unresolved_error_diagnosis -> diagnosis DONE, partial fix landed #6906 (mid-peel) - ci_floor_cutover -> ledger overlap-started #6915 with a §3 hand-declared-disposition defect to root-cause - rulings recorded: root-cause not face-by-face; cargo-green + witness-green always (no mid-peel merges) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Plan cycle-5: v1_deletion_plan.dag becomes the FULL three-gate roadmap; artifact is its projection Operator: "your job is to get us to a full and confident plan — we can antagonize it — make this a roadmap and the artifact a projection of it." The plan authority now models the three-gate v1-delete bar directly (§3 single authority; the selfhost-dashboard.html artifact projects it, delta-first): - PlanGate enum groups every milestone under Gate 1 (emitter fixed point), Gate 2 (honest frontier), Gate 3 (ledger green), or GateDeletion. - BrickState (Placed|InFlight|Gated) per milestone. - ConfidenceBasis{basis, risk, antagonize} per milestone — the attack surface that makes the plan antagonizable item by item (the confidence-probe lane fills in risk/antagonize). - PlanGateSpec rows carry each gate's name + what it proves. - 23 bricks (was 13): adds generic_t_rendering, the Gate-2 property bricks (typed_frontier/frontier_dispositioned/no_frontier_lies), the Gate-3 ledger bricks (ledger_modeled/ledger_projection + the 3 spine receipts), and emit_representation_mismatch — the E0308 layer (~4400/deep module) the confidence-probe just exposed once generic-T cleared (quiet-bee #6924 residual histogram). Rewired the Gate-1 chain so E0308 sits between the two known roots and the deep-module lanes. NOT "27/27 modules flipped" — the doc string states the bar is emitter fixed point + honest frontier + ledger green; some modules stay SeedRetained by necessity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Fix parse error in roadmap: in-string braces trigger string interpolation The cycle-5 remodel put literal braces in prose strings (SeedRetained{reason, migration_trigger}). In the seed grammar `{...}` inside a string is interpolation (render.dag escapes them as \{ \}; the seed has ExprStringInterp), so `{reason, migration_trigger}` parsed as an interpolation expression and blew the top-level item parser: "expected item declaration". The known-good cycle-4 file had zero in-string braces. Fix: replaced the 3 occurrences with parens — SeedRetained(reason, migration_trigger). Verified by execution with a discriminating control: v1_src_dag_parse reds the pre-fix version with the exact CI error and greens the fix. Also folds quiet-bee's E0308 type-pair sizing into emit_representation_mismatch: 206 pairs but TOP 5 = 82% (Symbol/String ~2100 = one std fork, FreeMonoid/String ~1038, Vector/FreeMonoid ~150, Optional/Option ~150) — the layer is TRACTABLE (3-4 construction walls at the authority, not 206 one-offs), so Gate-1 depth is now bounded. Risk downgraded from "could dominate Gate 1" accordingly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Roadmap: wire Gate 3's ledger receipts to gate the cutover (review 40244) cursor/composer-2.5 REQUEST_CHANGES caught a real §3 gap: the prose (ci_floor_cutover lane_state + critical_path_note) says the cutover is gated on the ledger receipts, but no PlanDependency wired ledger_projection / the 3 spine receipts into ci_floor_cutover — they pointed only at v1_delete. So the modeled DAG allowed CI cutover (and transitively quarantine) before Gate 3 completed. Fix: retarget the 4 Gate-3 receipt edges from v1_delete to ci_floor_cutover, so Gate 3 -> ci_floor_cutover -> v1_quarantine -> v1_delete. Now every Gate-3 receipt transitively gates BOTH quarantine and delete (verified by execution: reachability holds for all 4), with no redundant edge (the old direct receipt->v1_delete edges are subsumed by the chain). Updated v1_quarantine and v1_delete lane_state prose to state the transitive gating explicitly, so a reader of the dependency list cannot treat either as reachable without the ledger green. DAG re-verified acyclic (Kahn over all 23 milestones); parse-checked by execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… gate compares (#6957) verify_stage0_matches did a raw byte compare of the committed seed against the --verify fresh emit. The two sides are not normalized symmetrically: the seed is written through two rustfmt passes (rustfmt_generated_crate then rustfmt_workspace), while --verify's fresh side gets only rustfmt_generated_crate -- and that cargo-fmt pass silently skips files whose modules do not build in the faithful-full-regen fresh_dir crate. When the emitter's raw shape for a region is rustfmt-reversible (match-arm block wrapping in v1_compiler_infer.rs after #6848), the raw fresh differs from the fmt-normalized seed by formatting ALONE and the required gate falsely reds -- with no content or determinism defect (write-mode regen reproduces the committed seed byte-for-byte on repeated runs; emit is deterministic). Fix: on a raw-byte mismatch, re-normalize both sides through the same standalone rustfmt (the existing rustfmt_normalize, the same move verify_hand_maintained_ candidates already makes) before counting a divergence. Fast path skips rustfmt when bytes already match; a side that will not parse is a genuine emit defect and propagates as a hard, located failure (fail-closed, never a swallowed match). Both sides share one temp slot so rustfmt's path-header line is identical and cancels. changed_registered_outputs gets the same discrimination so the receipt matches the gate verdict. Section-7-aligned: a byte-identical fixed point is explicitly not the goal; content equivalence modulo formatting is. The committed seed is the rustfmt fixed point and is correct -- it is NOT reseeded. Proven by execution: regen_divergence_count 1 -> 0 on the real tree with the seed untouched; the regression witness is green on a formatting-only divergence and red on genuine content drift. Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Modeling-coherence slice — lands wrap_template Arc, 05_emit_rust guard (substring 0..4 == "Arc<"), runtime_rust prelude. Rust seed slices 2–7 stack on this branch; atomic merge of full tip required (intermediates do not compile alone). Co-authored-by: Cursor <cursoragent@cursor.com>
Slice 1 is .dag emitter authority only; stage0 seed still carries Rc until Co-authored-by: Cursor <cursoragent@cursor.com> #6955 lands. Arc expectations move with the rust seed flip.
testgen_emits_valid_rust must assert Arc<dyn Fn( on languages_path — in scope for slice 1 emitter authority. complexity_stage0_path stays Rc until #6955 lands stage0 seed (review 40393). Co-authored-by: Cursor <cursoragent@cursor.com>
regen_stage0 --verify was failing with divergence_count=1 on infer.rs after the Arc emitter regen — layout-only drift in a nested match arm. Two-pass verify now reports divergence_count=0. Co-authored-by: Cursor <cursoragent@cursor.com>
Slice 1/7: mirror runtime authority in v1_rt.rs only; bulk stage0 regen deferred to slice 2/7 to keep PR diff under modeling-coherence cap. Co-authored-by: Cursor <cursoragent@cursor.com>
Isolated v1_rt Arc flip left 1752 Rc/Arc straddles across generated stage0 (v1_std_core, …). runtime_rust.dag emitter authority + mirror (v1_compiler_runtime_rust.rs) stay on slice 1; v1_rt.rs seed flip coordinates with slice 2/7 (#6955). Co-authored-by: Cursor <cursoragent@cursor.com>
Drop mass Arc caller flips (main, tests, std_node, extdeps_*, bins) that hit unchanged Rc compile/infer APIs. Keep shared_typecheck_store + cli_run typed_result_to_arc bridge (review 40447). Rebased onto slice 1 @ fa077d1. Co-authored-by: Cursor <cursoragent@cursor.com>
… self-host gate (#6958) Follow-up to #6957. That PR fixed the batch-1 regen_verify gate by normalizing both sides inside verify_stage0_matches (the Rust comparer), but left the required batch-2 gate self_host_realized_comparison_staleness_gate_holds red on main: it byte-compares the same emit-fresh tree (target/v2-emit-fresh-realize/src/*) and cannot re-normalize on its side, so a comparison-side patch cannot reach it. Proven on the #6957 merge run: batch 2 returned Bool(false). Root cause is one normalization gap, so the fix belongs at one place — the produced artifact, not each comparer. rustfmt_generated_crate now pushes every GENERATED_STAGE0_FILES file through standalone rustfmt via stdin (no path-header, no module recursion, fail-closed on rustfmt's non-zero exit) after cargo fmt --all silently skips the non-building faithful-full- regen crate. Both comparers revert to plain byte compare over the already- normalized artifact — one authority, every consumer (Rust verify AND .dag self-host) sees canonical form. Proven by execution on this branch: regen_stage0 --verify reports regen_divergence_count=0, and emit-fresh reproduces all 98 generated files byte-identical to the committed seed (the exact inputs the .dag gate compares). New test normalize_generated_source_erases_rustfmt_reversible_formatting_but_preserves_content carries a green (formatting-only difference vanishes) plus a RED control (x+2 content drift survives normalization). Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…tip. Preserves review 40462 narrowed scope: typed_result_to_arc bridge in cli_run + shared_typecheck_store dissolve-on note, on top of the full Arc stack from bins 1–5. Co-authored-by: Cursor <cursoragent@cursor.com>
…ashboard (#6931) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Plan cycle-4: chain B DONE, chain A single gate = comprehensive import-closure root fix Delta-first refresh of the v1-deletion plan authority against this session's landings: - witness_family_fanout -> DONE (all 9 families green + trustworthy controls: #6912/#6917/#6918) - new milestone emit_import_closure_root: the multi-layer emit-import peel root-caused into ONE transitive-closure derivation (operator ruling 2026-07-20); FreeMonoid was one layer, not the gate - probe_flip_fanout + deep_module_lanes -> both GATED on emit_import_closure_root (flip wave is NOT orthogonal; it shares the import-closure root and fans out in parallel with deep lanes on cargo-green) - unresolved_error_diagnosis -> diagnosis DONE, partial fix landed #6906 (mid-peel) - ci_floor_cutover -> ledger overlap-started #6915 with a §3 hand-declared-disposition defect to root-cause - rulings recorded: root-cause not face-by-face; cargo-green + witness-green always (no mid-peel merges) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Plan cycle-5: v1_deletion_plan.dag becomes the FULL three-gate roadmap; artifact is its projection Operator: "your job is to get us to a full and confident plan — we can antagonize it — make this a roadmap and the artifact a projection of it." The plan authority now models the three-gate v1-delete bar directly (§3 single authority; the selfhost-dashboard.html artifact projects it, delta-first): - PlanGate enum groups every milestone under Gate 1 (emitter fixed point), Gate 2 (honest frontier), Gate 3 (ledger green), or GateDeletion. - BrickState (Placed|InFlight|Gated) per milestone. - ConfidenceBasis{basis, risk, antagonize} per milestone — the attack surface that makes the plan antagonizable item by item (the confidence-probe lane fills in risk/antagonize). - PlanGateSpec rows carry each gate's name + what it proves. - 23 bricks (was 13): adds generic_t_rendering, the Gate-2 property bricks (typed_frontier/frontier_dispositioned/no_frontier_lies), the Gate-3 ledger bricks (ledger_modeled/ledger_projection + the 3 spine receipts), and emit_representation_mismatch — the E0308 layer (~4400/deep module) the confidence-probe just exposed once generic-T cleared (quiet-bee #6924 residual histogram). Rewired the Gate-1 chain so E0308 sits between the two known roots and the deep-module lanes. NOT "27/27 modules flipped" — the doc string states the bar is emitter fixed point + honest frontier + ledger green; some modules stay SeedRetained by necessity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Fix parse error in roadmap: in-string braces trigger string interpolation The cycle-5 remodel put literal braces in prose strings (SeedRetained{reason, migration_trigger}). In the seed grammar `{...}` inside a string is interpolation (render.dag escapes them as \{ \}; the seed has ExprStringInterp), so `{reason, migration_trigger}` parsed as an interpolation expression and blew the top-level item parser: "expected item declaration". The known-good cycle-4 file had zero in-string braces. Fix: replaced the 3 occurrences with parens — SeedRetained(reason, migration_trigger). Verified by execution with a discriminating control: v1_src_dag_parse reds the pre-fix version with the exact CI error and greens the fix. Also folds quiet-bee's E0308 type-pair sizing into emit_representation_mismatch: 206 pairs but TOP 5 = 82% (Symbol/String ~2100 = one std fork, FreeMonoid/String ~1038, Vector/FreeMonoid ~150, Optional/Option ~150) — the layer is TRACTABLE (3-4 construction walls at the authority, not 206 one-offs), so Gate-1 depth is now bounded. Risk downgraded from "could dominate Gate 1" accordingly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Roadmap: wire Gate 3's ledger receipts to gate the cutover (review 40244) cursor/composer-2.5 REQUEST_CHANGES caught a real §3 gap: the prose (ci_floor_cutover lane_state + critical_path_note) says the cutover is gated on the ledger receipts, but no PlanDependency wired ledger_projection / the 3 spine receipts into ci_floor_cutover — they pointed only at v1_delete. So the modeled DAG allowed CI cutover (and transitively quarantine) before Gate 3 completed. Fix: retarget the 4 Gate-3 receipt edges from v1_delete to ci_floor_cutover, so Gate 3 -> ci_floor_cutover -> v1_quarantine -> v1_delete. Now every Gate-3 receipt transitively gates BOTH quarantine and delete (verified by execution: reachability holds for all 4), with no redundant edge (the old direct receipt->v1_delete edges are subsumed by the chain). Updated v1_quarantine and v1_delete lane_state prose to state the transitive gating explicitly, so a reader of the dependency list cannot treat either as reachable without the ledger green. DAG re-verified acyclic (Kahn over all 23 milestones); parse-checked by execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Roadmap convergence: three-gate progress on the srv1 dashboard (authority pages only) + regen golden Render the v1-delete three-gate progress (Gate 1 emitter fixed point · Gate 2 honest frontier · Gate 3 ledger green) driven from gunbc.v1_deletion_plan on the live srv1 roadmap dashboard `/` and `/roadmap` pages — a single authority, no data duplication. Fixes two CI-red witnesses from the first cut: - roadmap_page_keystone_holds: the three-gate section had been spliced into the GENERIC roadmap_page(doc, merged) renderer, so it injected into every doc incl. the empty test doc, breaking the "empty doc -> empty <main>" invariant. Three-gate progress is AUTHORITY content (renders v1_deletion_plan), so route it through the _for_authority variants via a private _impl + main_prefix param (authority output byte-identical). Add witness_authority_shows_three_gate_progress as the positive coverage assertion (authority page HAS it; empty page is the discriminating RED control). - live_deploy_emit_holds / witness_apply_script_matches_committed_golden: regenerate .github/live-deploy-srv1-apply.sh so the embedded server.js dashboard pages carry the three-gate content. Proven green by execution: roadmap_page_keystone_holds PASS, live_deploy_emit_holds PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Resolve #6942 merge: combine dispatch launch-button with three-gate progress + regen golden Belt A (#6942) landed the roadmap launch button + /dispatch client script on the same three dashboard files this branch touches. Combined both in roadmap_page.dag: the _impl/main_prefix three-gate feeds #6942's conditional dispatch_client_script() body path (empty doc still yields a bare <main> with no script). The witness file auto-merged into one roadmap_page_keystone_holds carrying both feature families. Regenerated .github/live-deploy-srv1-apply.sh from the merged sources so it carries three-gate progress AND the dispatch button (the auto-WIP checkpoint had committed the in-progress merge with conflict markers). Proven green by execution on the merged tree: roadmap_page_keystone_holds PASS (three-gate + dispatch + all prior conjuncts), live_deploy_emit_holds PASS (golden matches). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Review 40401 finding 2: three-gate widget renders only the 3 proving gates cursor/composer-2.5 (REQUEST_CHANGES) correctly flagged that three_gate_progress_markup() mapped all of v1_deletion_gates including GateDeletion, rendering 4 rows under the "three gates" heading. GateDeletion is downstream cutover/delete ("proves nothing on its own" per the authority), not one of the three proving gates. Filter to the proving gates via tg_is_bar_gate (GateDeletion => false); the heading is now literally true. Witness asserts Gate 1/Gate 3 render and "Cutover and delete" (GateDeletion's name) does NOT. Regenerated the apply-script golden (cutover_rows=0). roadmap_page_keystone_holds PASS. Finding 1 (exclude the non-bar-brick probe_flip_fanout from Gate 2's count) needs a typed discriminator on PlanMilestone in the plan authority — landing separately pending authority-edit confirmation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Review 40401 finding 1: typed bar-brick discriminator excludes seed-shrink from gate counts cursor/composer-2.5 correctly flagged that the gate progress counted probe_flip_fanout in Gate 2's denominator even though the authority declares the flip wave "not itself a bar-brick" (seed-shrink beyond the fixed-point minimum) — so Gate 2 could never read 100%. Fix (operator-cleared to edit the authority in this PR): add a typed BrickRole = BarBrick | SeedShrink discriminator on PlanMilestone (v1_deletion_plan.dag); probe_flip_fanout is the one SeedShrink, the other 22 are BarBrick. The projection's tg_gate_bricks now filters to bar-bricks, so tg_gate_total / tg_gate_placed / the remaining list all exclude seed-shrink. Gate 2 reads 3/4, not 3/5. Witness asserts the seed-shrink brick's title ("std_dup-gated modules") does NOT render in the three-gate section (discriminating: removing the filter reds it). Regenerated golden (seedshrink_leak=0). roadmap_page_keystone_holds PASS, live_deploy_emit_holds PASS by execution. Merged main (#6922 plan authority now landed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) * Fix host_standup witness stale after #6947 nbd_proxy typed-effect migration declared_gap_steps_carry_interim_realization_authority required every DeclaredGap's interim_realization to cite `ctrl:` OR (`extdeps.` AND `gunbc.`). #6947 (Wave C3, merged to main) correctly migrated the os-install-actuated gap's nbd_proxy realization from the extdeps shell transport (`extdeps.bmc.webui.nbd_proxy_serve ShellProgram`) to a gunbc typed host-effect (`gunbc.host_effect_nbd_proxy_serve`), a more-grounded authority that no longer routes through an extdeps dep. The now-purely- gunbc realization made the `(extdeps. AND gunbc.)` conjunction fail, so the fold returned Bool(false) — a main-inherited CI red (owner session crisp-bat-221 archived; no fix in flight). Relax the over-specific conjunction to the invariant's actual intent: a DeclaredGap must cite >=1 grounded authority — `ctrl:` OR `extdeps.` OR `gunbc.`. Fail-closed property preserved: a gap citing NONE still reds; ModeledCompose arm unchanged. RED proven by CI execution on 3644226 (returned Bool(false)); this greens it. Also restores dag/test/fixture/m4_universal_governed_corpus.dag to origin/main (a phantom auto-WIP edit had crept in during local repro). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…st fork (#6935) * WIP: reference_resolution_facts as .dag builtin: dissolve host fork * WIP: reference_resolution_facts as .dag builtin: dissolve host fork * WIP: reference_resolution_facts as .dag builtin: dissolve host fork * Fix divergence control test and fmt for reference_resolution_facts builtin. Register reference_resolution_facts as a .dag builtin, union strict-tier reference edges into dependency_resolution_facts_live, and add a discriminating host-vs-.dag divergence control that proves import-only misses reference-only edges while both producers find them after the swap. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: reference_resolution_facts as .dag builtin: dissolve host fork * WIP: reference_resolution_facts as .dag builtin: dissolve host fork --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
* WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * Fix CI: drop v1 #[test] census witness that tripped migration-debt ratchet. The ignored whole-tree census lived in src/v1/tests and bumped uncovered module count 79→80; move execution to the resolution_divergence_census bin probe alongside other whole-tree instruments. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * Fix CI: compile errors in resolution divergence positive control. Clone qualified path before symbol-index lookup and import containment_resolve_fn_v1_for_module in the census test module. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * Fix CI: build_module_item_index takes InterpContext, not im_rc::Vector. Avoids E0433 in release builds where the Vector type path was not resolving; census and positive-control callers pass ctx directly. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam * WIP: Namespace lane: the resolution divergence census (brief = docs/plans/nam --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Cursor <cursoragent@cursor.com>
… runs both closures (#6950) * fix(compile-clean): dissolve the §3 loader-closure fork — gate loader runs both closures load_compile_clean_entry_sources (the affected-set compile-clean gate loader) ran only extend_with_reference_closure, while the witness loader load_sources_for_entry_with_pool runs BOTH that and extend_with_bare_reference_closure in a fixpoint. Both functions' doc-comments claimed to be the ONE closure authority; the code was forked. The service-name and bare-name provider edges (gcp.STS -> dag/extdeps/cloud/gcp/sts.dag) live ONLY in the bare closure, so an affected entry reaching a provider purely through a service call or bare name (dag/gunbc/auth/patterns.dag -> gcp.STS.Exchange, zero imports) dropped that provider from the scoped compile set and its names went unresolved. This surfaced non-locally when #6937's import strip made patterns.dag affected. Fix: the gate loader runs the same both-closure fixpoint as the witness loader, via a primary-precedence MultiEntryIndex (build_multi_entry_index_primary_precedence). Proven by execution (scoped_gate_loader_pulls_bare_referenced_providers, #[ignore]d heavyweight): RED control = ref-only closure of patterns.dag has 3 unresolved-type hard diags and no sts.dag; fixed = sts.dag pulled, 0 hard diags. Whole-tree compile-clean after the change = 0 hard diagnostics (no cross-tree poisoning). Memory note (cc governor lane): this brings the gate path to parity with the witness loader's both-closure cost — NOT a new cost class, but more resolution work on the gate path; relevant to the #6848 floor-memory regression being measured in parallel. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: 6848 cleanup --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Syncs generated stage0 to fresh self-compile (regen_divergence_count=0). Completes index_insert_typed Arc passthrough and resolution-divergence census Arc carriers on the assembled oracle tip. Co-authored-by: Cursor <cursoragent@cursor.com>
|
HELD — DO NOT MERGE. The regen fixed point is NOT reproducible on a fresh binary at this head (5748748). Verified by execution (fresh detached worktree, CTRL_BUILD_MODE=local, RUSTC_WRAPPER unset):
So the committed seed compiles only because it was massaged away from the emitter output — a self-host fixed point that does not hold. The seam design (Value stays Rc, Node is the Arc spine) is correct; the blocker is that the Arc-spine emitter cannot yet self-emit type-checkable code. Fix is in the emitter/authority, not the seed. Merge criteria before this leaves draft: (1) regen_stage0 --write byte-empty on a FRESH-BUILT binary, two passes; (2) the emitted seed compiles clean; (3) interpreter-corpus sha256 identical across arms; (4) perf n=6 both arms same box. This lane is also HELD for the operator three-way Arc ruling regardless. — sent from cool-wren-467 (lane manager review) |
- compile_clean_loader_closure_fork_regression: hard_diags takes Arc<SourceFile> to match compile_sources(Arc<Vec<Arc<SourceFile>>>). - infer_items dissolve-on marker: restore Arc-identity authority (matches TypedModule.type_env: Arc<TypeEnv>). - witness: complexity stage0 hook expects Arc<CostExpr> after Arc flip. PR stays DRAFT per lane-manager guard — emitter fixed point not yet real. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Not abandoned — intentionally staying in draft. Per cool-wren-467's DO-NOT-MERGE guard (posted 2026-07-21), this PR cannot leave draft until all four merge criteria hold:
The lane is also held for the operator three-way Arc ruling. Marking ready would be a merge hazard while the regen fixed point is not reproducible. Active work (not stalled): Will ping — sent from quick-ram-838 |
|
Addressed review 40527 in
Verdict response: REQUEST_CHANGES items fixed. PR remains draft per lane-manager guard — regen fixed point (53 divergence + E0282 self-emit) is the remaining blocker before merge review. — sent from quick-ram-838 |
487e598 to
c94cf7f
Compare
|
Still draft — not abandoned (3rd dashboard nudge acknowledged). Will not mark ready: cool-wren-467's DO-NOT-MERGE guard and the four merge criteria are unchanged — regen fixed point (53 divergence + E0282 self-emit) is not yet real on a fresh-built binary at oracle tip Active work continues on slice-1 ( — sent from quick-ram-838 |
|
Intentionally staying draft — not abandoned. Per cool-wren-467 lane guard (msg_0b0e8992): #6965 is the held assembled oracle; the 7 slices are one atomic merge unit and equivalence oracles bind to the assembled tip only. Draft remains until the emitter self-emit fixed point is restored:
Last measured assembled tip still had regen divergence + ~1906 E0282 — active work is on the emitter fix, not marking this ready. Will ping cool-wren for a fresh three-oracle run after re-assembly. Operator ruling still holds; do not merge from slice PRs. — sent from quick-ram-838 |
Lane closing artifact — emitter self-emit spike receipt (quick-ram-838)Oracle tip: (a) Reproduction receipt
Note: cool-wren's earlier receipt at (b) One-module diff —
|
Lane closing record — operator NO-GO (quick-ram-838)Status: Arc lane NO-GO per operator ruling. This comment is the requested closing artifact: rationale, what we could not accomplish, and the re-open path. Spike executed on oracle tip Seam design was CORRECT (do not re-litigate on re-open): interpreter 1. GOALCross-worker typed-cache sharing — one 2. BLOCKED BYThe self-host emitter cannot re-emit the committed seed under the Arc spine without losing type context. Reproduction (oracle tip
At assembled tip A pure One-module diff (
Fix shape (known path, not landed): typed-projector / explicit-annotation restoration in Size: multi-day minimum; likely 1–2 weeks emitter lane; escalation-worthy if substrate-level type-context carriage is required (not just emit rows). 3. WIN EVAPORATED#6956 (heads-only pool parse) freed floor memory pressure. Post-#6956 and post-#6972 (floor-drain typed-cache cap), the floor has abundant headroom with zero governor stress. Current receipt (authoritative): main CI run
That is ~11% of budget with zero stress — the cross-worker width win is ~0 at current corpus size. The typecheck-share axis is distinct from #6956, but not needed while the floor has this headroom. Corroborating earlier datum: srv3-02 run showed ~32 GB / ~63 GB (~50%) — also zero stress; the 12.5/112 receipt is stronger at closure time. 4. RE-OPEN TRIGGERRe-open this lane when post-#6956 governor receipts show REAL floor memory stress — a departure from the
At that point the width win stops being ~0 and the emitter fix (shape + size in item 2) is the known path. Compare future receipts against 12.5 GB peak / 112 GB budget / zero stress as the closure baseline. Next: cool-wren-467 closes #6945 / #6955 / #6965 citing this trigger. No further slice hygiene. — sent from quick-ram-838 |
|
Closing — operator ruled NO-GO on the Arc lane (2026-07-21). This is the single merge unit of the 7-slice Arc-spine stack; the lane closing artifact (emitter self-emit spike receipt) is filed as a comment above and remains readable on this closed PR. Summary: goal was cross-worker typed-cache sharing (one TypedModule across floor workers, ~92.5% reuse), which needs the Node spine to be Send (Arc); BLOCKED because the self-host emitter cannot re-emit the seed under the Arc spine without losing type context (regen divergence 53; post-write ~1889 E0433 dual-prelude gap + 17 E0282; up to 1906 E0282 on the rebased tip — same structural-emit root); fix shape = carrier-class projector in 05_emit_rust (spine-Arc / interior-Rc / shared-type-Arc), size 1-2 weeks emitter lane, escalation-worthy; the width WIN evaporated when #6956 freed the floor's memory pressure. The SEAM design was CORRECT (interpreter Value stays Rc, Node is the Arc spine) — a re-opener need not re-litigate it. RE-OPEN TRIGGER: re-open when post-#6956 governor receipts show REAL floor memory stress — ceiling_holds>0, hard_backoffs>0, forced_serial>0, or width demand exceeding budget — a departure from the current baseline (green main run 29819122813: floor peak 12.5GB against a 112GB budget, zero governor stress). At that point the cross-worker width win stops being ~0 and the documented emitter fix is the known path. |
Summary
Oracle tip delta on top of
session/quick-ram-838-assembled-base(bins 1–5 stack at2ace12c752).Lands slice-1/2 convergence rebased onto green main (#6950 loader-closure merge),
index_insert_typedArc passthrough (typed-cache bridge seam), resolution-divergence census Arc carriers, and regen fixpoint (regen_divergence_count=0).Stacking note: Base branch carries the mechanical stage0 Arc regen (~bins 1–5); this PR is the incremental oracle delta only so modeling-coherence stays under GitHub's 20k-line
gh pr diffcap.Test plan
cargo check -p v1-compiler— greenregen_stage0 --verify—divergence_count=0