From 6c2db710c72743f14af1e00bcb8b4700c353a90c Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 14:39:24 +0000 Subject: [PATCH 01/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/v1_deletion_plan.dag | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index cbb92757577..cf8b55274f9 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -24,13 +24,14 @@ type PlanDependency { data v1_deletion_milestones: List = [ PlanMilestone { id: ^std_dup_assembly_fix, title: "One harness fix: cssl std-seed-link closure assembly collides dag/std with the seed std (E0255) — single root; post-discharge census 2026-07-19 puts ~13 modules on this fix (3 Gate-A + 10 tail at first census); the 6 formerly-unresolved modules cleared emit via KeySource but remain on a separate cargo UNRESOLVED bucket", parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "LANDED+CAPTURED 2026-07-19 (#6876)" }, - PlanMilestone { id: ^probe_flip_fanout, title: "Probe + flip the std_dup-gated modules (~13 at cargo stage after 2026-07-19 re-probe); each probe/flip is an independent lane once the assembly fix lands", parallelism: FanOutWide, fan_width: 13, days_low: 2, days_high: 5, lane_state: "SINGLE GATE — 2026-07-19 re-probe on merged main (TSVs #6891): 18 of 19 candidates FreeMonoid-import-emission ONLY (13 tail + 5 bucket); materialization_carriers adds v2_std_text closure-manifest (same class, manifest grain, same package). Measure LANDED #6888; std_dup all 3 faces LANDED (#6885/#6886/#6883). FreeMonoid pass EXECUTING (neat-swift-795: instance-patch both grains + dissolve-on naming build_shared_types/emit_faithful_text_carrier_import_lines and the pub-mod closure list as derivation targets). Flip PR #6881 HELD DRAFT until per-module receipts green; flip set refreshes to the actual green set on pass merge" }, + PlanMilestone { id: ^probe_flip_fanout, title: "Probe + flip the std_dup-gated modules (~13 at cargo stage after 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root fix reaches cargo-green", parallelism: FanOutWide, fan_width: 13, days_low: 2, days_high: 5, lane_state: "GATED on emit_import_closure_root (operator 2026-07-20: the flip wave is NOT orthogonal — it shares the emit-import-closure root with the deep lanes, so running it before the root fix hits the SAME wall). 2026-07-19 re-probe (TSVs #6891) read 18 of 19 candidates as FreeMonoid-import ONLY + materialization_carriers closure-manifest — but FreeMonoid proved to be ONE layer of a multi-layer import-closure peel now being root-caused. Measure LANDED #6888; std_dup all 3 faces LANDED (#6885/#6886/#6883). Fans out IN PARALLEL with deep_module_lanes the moment the root fix reaches cargo-green. Flip PR #6881 HELD DRAFT; flip set refreshes to the actual green set on root-fix merge" }, PlanMilestone { id: ^wrap_decision_predicate, title: "ONE structural Rc wrap-decision predicate in the emitter (ownership-fact derived, never a name roster) — the gate on every Rc-heavy deep module", parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 7, lane_state: "LANDED — predicate merged as #6776 (wrap_decision_gate, fail-closed Rc ownership wrapping) + UseSiteVerdict catalog #6877; this row was STALE (still said running) until verified by execution 2026-07-20 (valiant-dove-723: claim_batch wrap_decision_predicate_witness_holds 7 sub-witnesses + gate smoke green on main; 06_translate routes type_shell and value_expression through wrap_decision_gate, WrapGateInapplicable passes through unchanged — no silent Rc default)" }, - PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out after the predicate lands (also need std_dup fixed)", parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "UNBLOCKED on the predicate axis 2026-07-20 (wrap_decision LANDED #6776, verified by execution) + std_dup LANDED #6876; fan-out fires when the FreeMonoid pass merges (emitter files locked until then); probe baseline TSVs for the 4 deep lanes in preparation (valiant-dove-723)" }, - PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE 2026-07-19: all 6 emit 0-diagnostics post-KeySource; 5/6 cargo-gated on FreeMonoid only; materialization_carriers = emitter closure-manifest gap (emits crate::v2_std_text:: refs, omits module from closure lib.rs — verified by execution, harness projects faithfully). Both roots ride the FreeMonoid package (neat-swift-795), two distinct receipts" }, + PlanMilestone { id: ^emit_import_closure_root, title: "ONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "SINGLE CHAIN-A GATE (operator ruling 2026-07-20: root-cause the import closure into one derivation, do NOT peel face-by-face; cargo-green + witness-green at ALL times, no mid-peel merges). #6906 landed FreeMonoid + std_measure module-manifest + partial nested-struct (mid-peel; main green, no module flipped) — but FreeMonoid was NOT the last layer (re-probe falsified it: nested-struct sibling imports CacheInterfaceCatalogIoSemantics + a distinct generic-T class remain). neat-swift-795 pivoting #6919 to the comprehensive derivation; DRAFT until representative cargo-green (>=1 nested-struct module + materialization_carriers) AND witness-green (regen --verify divergence 0, witness families stay green). generic-T (E0425, 04_infer) is a DISTINCT class (generic rendering, NOT import closure) scoped separately" }, + PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once the import-closure root fix reaches cargo-green", parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_import_closure_root (wrap_decision LANDED #6776 + std_dup LANDED #6876 both cleared; the remaining gate is the comprehensive import-closure derivation). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green. OPEN: whether the deep modules also hit generic-T (04_infer) — if so the deep-emitter fixed point needs that distinct fix too" }, + PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE + PARTIAL FIX LANDED 2026-07-20 (#6906): all 6 emit 0-diagnostics; FreeMonoid + std_measure module-manifest + partial nested-struct import closure merged (mid-peel). The remaining import-closure layers are absorbed into emit_import_closure_root (the comprehensive root fix) — this milestone's diagnosis deliverable is DONE; the fix continues under that gate" }, PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral fixed point on the v2 side (2-generation equivalence, not byte identity)", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "blocked on deep_module_lanes" }, PlanMilestone { id: ^witness_realization_kernel, title: "v2 execution path kernel: emit a witness to native code + run harness + scheduler (the piece that replaces the v1 interpreter for CI) — serial kernel, then families fan out", parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 5, lane_state: "LANDED 2026-07-19 #6879 (da0e7c3d) at full bar; kernel handoff (partition, seams, traps) and the six-family diagnosis table durable as comments on the PR; stern-lark-430 closed out clean" }, - PlanMilestone { id: ^witness_family_fanout, title: "Per-witness-family realization lanes (claim families, wet receipts, lens gates) once the kernel runs one family end-to-end", parallelism: FanOutWide, fan_width: 5, days_low: 4, days_high: 8, lane_state: "DISPATCHED 2026-07-19 on kernel merge: lane 1 emit_host_add landed with the kernel; family scaffolds #6893/#6894/#6895 MERGED (match+loop genuine agreement; fold/meet_join/variant_construct/field_access/complement quarantined typed+counted). Consolidated diagnosis: emitter CLEAN across all 9 families — every gap is eval/harness-side (the side v1-deletion removes). Eval-repair arc on ONE owner (swift-stag-662): field_access+complement (meet_join un-quarantines by consumption) -> fold closure-arg support -> hand-roster tripwire decides enumerate-vs-derive-from-ingest before variant_construct" }, + PlanMilestone { id: ^witness_family_fanout, title: "Per-witness-family realization lanes (claim families, wet receipts, lens gates) once the kernel runs one family end-to-end", parallelism: FanOutWide, fan_width: 5, days_low: 4, days_high: 8, lane_state: "DONE 2026-07-20 — all 9 witness families GREEN with trustworthy controls. #6912 (eval-repair consolidation: field_access/complement/meet_join/variant_construct admission roots) + #6917 (fold closure-arg: structural RuntimeClosure at edge grain, both oracle legs real, un-quarantine receipt) + #6918 (field_access RED-control fail-open fix — the wrong-fixture control could not go red when behavior was wrong; §5 coverage-by-illusion, now discriminating). Emitter was CLEAN across all 9; every fix was eval/harness-side (the side v1-deletion removes). Chain B serial fan-out COMPLETE; swift-stag/witty-owl/smart-hawk closed out" }, PlanMilestone { id: ^trigger_renegotiation, title: "DECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept later re-emit), or exclude from the 2-week scope", parallelism: DecisionGate, fan_width: 1, days_low: 0, days_high: 0, lane_state: "RESOLVED 2026-07-20 (operator): do NOT wait on the namespace terminal — it is dragging. Renegotiate 03_resolve/03_name_resolve + body-producer tail triggers to emit under the current design with a declared later re-emit; the frontier-row renegotiation rides the flip-wave refresh" }, PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "blocked on witness_family_fanout + probe_flip_fanout" }, PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point + ci_floor_cutover + unresolved_error_diagnosis + trigger_renegotiation" }, From 8e4b6760fc2fa0ebbe0c2126b70399de5d5d9bc4 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 14:40:08 +0000 Subject: [PATCH 02/32] Plan cycle-4: chain B DONE, chain A single gate = comprehensive import-closure root fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Delta-first refresh of the v1-deletion plan authority against this session's landings: - witness_family_fanout -> DONE (all 9 families green + trustworthy controls: #6912/#6917/#6918) - new milestone emit_import_closure_root: the multi-layer emit-import peel root-caused into ONE transitive-closure derivation (operator ruling 2026-07-20); FreeMonoid was one layer, not the gate - probe_flip_fanout + deep_module_lanes -> both GATED on emit_import_closure_root (flip wave is NOT orthogonal; it shares the import-closure root and fans out in parallel with deep lanes on cargo-green) - unresolved_error_diagnosis -> diagnosis DONE, partial fix landed #6906 (mid-peel) - ci_floor_cutover -> ledger overlap-started #6915 with a §3 hand-declared-disposition defect to root-cause - rulings recorded: root-cause not face-by-face; cargo-green + witness-green always (no mid-peel merges) Co-Authored-By: Claude Fable 5 --- dag/gunbc/v1_deletion_plan.dag | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index cf8b55274f9..d4ee6b1ce02 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -33,7 +33,7 @@ data v1_deletion_milestones: List = [ PlanMilestone { id: ^witness_realization_kernel, title: "v2 execution path kernel: emit a witness to native code + run harness + scheduler (the piece that replaces the v1 interpreter for CI) — serial kernel, then families fan out", parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 5, lane_state: "LANDED 2026-07-19 #6879 (da0e7c3d) at full bar; kernel handoff (partition, seams, traps) and the six-family diagnosis table durable as comments on the PR; stern-lark-430 closed out clean" }, PlanMilestone { id: ^witness_family_fanout, title: "Per-witness-family realization lanes (claim families, wet receipts, lens gates) once the kernel runs one family end-to-end", parallelism: FanOutWide, fan_width: 5, days_low: 4, days_high: 8, lane_state: "DONE 2026-07-20 — all 9 witness families GREEN with trustworthy controls. #6912 (eval-repair consolidation: field_access/complement/meet_join/variant_construct admission roots) + #6917 (fold closure-arg: structural RuntimeClosure at edge grain, both oracle legs real, un-quarantine receipt) + #6918 (field_access RED-control fail-open fix — the wrong-fixture control could not go red when behavior was wrong; §5 coverage-by-illusion, now discriminating). Emitter was CLEAN across all 9; every fix was eval/harness-side (the side v1-deletion removes). Chain B serial fan-out COMPLETE; swift-stag/witty-owl/smart-hawk closed out" }, PlanMilestone { id: ^trigger_renegotiation, title: "DECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept later re-emit), or exclude from the 2-week scope", parallelism: DecisionGate, fan_width: 1, days_low: 0, days_high: 0, lane_state: "RESOLVED 2026-07-20 (operator): do NOT wait on the namespace terminal — it is dragging. Renegotiate 03_resolve/03_name_resolve + body-producer tail triggers to emit under the current design with a declared later re-emit; the frontier-row renegotiation rides the flip-wave refresh" }, - PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "blocked on witness_family_fanout + probe_flip_fanout" }, + PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "witness_family_fanout DONE (dep satisfied); still gated on probe_flip_fanout/emit_import_closure_root for the v2-emitted-execution half. Verification ledger OVERLAP-STARTED #6915 (proactive_verification_ledger.dag: 3 spine receipts + 9 family receipts, typed dispositions, no fabricated green). DEFECT to root-cause (sharp-bee review on #6915): the 5 family dispositions are HAND-DECLARED literals — now stale/lying after #6912/#6917/#6918 greened all 5 KnownRed families; fix = PROJECT dispositions from the ci_layer_roots.dag probe_red carrier so the ledger self-updates (§3 single authority), then execute the spine receipts to green (no soak)" }, PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point + ci_floor_cutover + unresolved_error_diagnosis + trigger_renegotiation" }, PlanMilestone { id: ^v1_delete, title: "Delete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking times; test/verify proactively). Ledger = enumerated executed receipts: whole-corpus cold v1-vs-v2 witness parity with zero unexplained divergence, compile-clean parity, regen behavioral fixed point, per-family equals receipts — each a deliberate run, none an elapsed-time claim", parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 1, lane_state: "blocked on v1_quarantine + the executed verification ledger" } ] @@ -42,6 +42,8 @@ data v1_deletion_dependencies: List = [ PlanDependency { before: ^std_dup_assembly_fix, after: ^probe_flip_fanout }, PlanDependency { before: ^std_dup_assembly_fix, after: ^deep_module_lanes }, PlanDependency { before: ^wrap_decision_predicate, after: ^deep_module_lanes }, + PlanDependency { before: ^emit_import_closure_root, after: ^probe_flip_fanout }, + PlanDependency { before: ^emit_import_closure_root, after: ^deep_module_lanes }, PlanDependency { before: ^deep_module_lanes, after: ^emitter_fixed_point }, PlanDependency { before: ^witness_realization_kernel, after: ^witness_family_fanout }, PlanDependency { before: ^witness_family_fanout, after: ^ci_floor_cutover }, @@ -53,4 +55,4 @@ data v1_deletion_dependencies: List = [ PlanDependency { before: ^v1_quarantine, after: ^v1_delete } ] -data v1_deletion_critical_path_note: String = "Two serial chains dominate the calendar and they RUN IN PARALLEL with each other: (A) deep_module_lanes -> emitter_fixed_point (5..10 lane-days remaining; wrap_decision_predicate already LANDED #6776 — see CORRECTION below) and (B) witness_family_fanout -> ci_floor_cutover (6..12 lane-days remaining; witness_realization_kernel LANDED #6879). Everything else fans out beside them. v1_quarantine lands when BOTH chains finish (original projection: day ~12 optimistic, day ~17 realistic). v1_delete = quarantine + executed verification ledger green (no calendar soak). UPDATE 2026-07-19 (cycle-2): std_dup_assembly_fix LANDED+CAPTURED (#6876); ~13 std_dup modules unblocked for flip-wave pending emitter prereqs (Measure neat-swift in flight, FreeMonoid queued, Optional proud-deer); 6 unresolved cargo residue distinct (ROOT-CAUSED emitter-gap). Chain B (stern-lark-430) dispatched. UPDATE 2026-07-20 (cycle-3): chain B serial segment DONE — kernel #6879 merged, family scaffolds #6893/#6894/#6895 merged, six-family diagnosis says emitter clean everywhere / gaps all eval-side, eval-repair arc consolidated on one owner; chain A single gate = FreeMonoid pass executing, flip wave up to 19 modules behind it; module-identity tasks 1-5 all merged (#6889/#6890/#6892/#6898), task 4 at bar (#6899). Operator rulings 2026-07-20: trigger_renegotiation RESOLVED (do not wait on namespace terminal); NO SOAK — v1_delete gates on the executed proactive-verification ledger, never elapsed time. CORRECTION 2026-07-20: wrap_decision_predicate was ALREADY LANDED (#6776 + #6877) — the running row was stale; verified by execution on main. Chain A therefore has ONE remaining serial gate (FreeMonoid pass), after which the flip wave AND the deep-module fan-out both fire." +data v1_deletion_critical_path_note: String = "Two serial chains dominate the calendar and they RUN IN PARALLEL with each other: (A) deep_module_lanes -> emitter_fixed_point (5..10 lane-days remaining; wrap_decision_predicate already LANDED #6776 — see CORRECTION below) and (B) witness_family_fanout -> ci_floor_cutover (6..12 lane-days remaining; witness_realization_kernel LANDED #6879). Everything else fans out beside them. v1_quarantine lands when BOTH chains finish (original projection: day ~12 optimistic, day ~17 realistic). v1_delete = quarantine + executed verification ledger green (no calendar soak). UPDATE 2026-07-19 (cycle-2): std_dup_assembly_fix LANDED+CAPTURED (#6876); ~13 std_dup modules unblocked for flip-wave pending emitter prereqs (Measure neat-swift in flight, FreeMonoid queued, Optional proud-deer); 6 unresolved cargo residue distinct (ROOT-CAUSED emitter-gap). Chain B (stern-lark-430) dispatched. UPDATE 2026-07-20 (cycle-3): chain B serial segment DONE — kernel #6879 merged, family scaffolds #6893/#6894/#6895 merged, six-family diagnosis says emitter clean everywhere / gaps all eval-side, eval-repair arc consolidated on one owner; chain A single gate = FreeMonoid pass executing, flip wave up to 19 modules behind it; module-identity tasks 1-5 all merged (#6889/#6890/#6892/#6898), task 4 at bar (#6899). Operator rulings 2026-07-20: trigger_renegotiation RESOLVED (do not wait on namespace terminal); NO SOAK — v1_delete gates on the executed proactive-verification ledger, never elapsed time. CORRECTION 2026-07-20: wrap_decision_predicate was ALREADY LANDED (#6776 + #6877) — the running row was stale; verified by execution on main. Chain A therefore has ONE remaining serial gate (FreeMonoid pass), after which the flip wave AND the deep-module fan-out both fire. UPDATE 2026-07-20 (cycle-4): chain B serial segment is DONE — witness_family_fanout COMPLETE (all 9 families green + trustworthy controls, #6912/#6917/#6918); only ci_floor_cutover remains on chain B (ledger overlap-started #6915, §3 disposition-projection defect to root-cause + spine receipts to execute; no soak). Chain A CORRECTION: the 'FreeMonoid single gate' framing was FALSIFIED — self-emitting is a MULTI-LAYER emit-import-closure peel (FreeMonoid was one layer; #6906's re-probe surfaced nested-struct sibling imports + a distinct generic-T class). #6906 landed FreeMonoid + partial (mid-peel). Operator rulings 2026-07-20: (1) ROOT-CAUSE the import closure into ONE comprehensive derivation (new milestone emit_import_closure_root) rather than peel face-by-face; (2) cargo-green + witness-green at ALL times — NO mid-peel merges (this reverses the #6906 exception); (3) the flip wave is NOT orthogonal (it shares the import-closure root) so it fans out IN PARALLEL with deep_module_lanes right AFTER the root fix, never before. Chain-A single gate is now emit_import_closure_root (neat-swift-795, #6919 pivoted); both probe_flip_fanout and deep_module_lanes fire on its cargo-green. Pole B (ci_floor_cutover ledger) is the genuinely-orthogonal parallel lane runnable now." From d5f15cae7abc8598fa66cf859414be5ac14c074b Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 15:43:57 +0000 Subject: [PATCH 03/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/v1_deletion_plan.dag | 79 +++++++++++++++++++++++++++------- 1 file changed, 63 insertions(+), 16 deletions(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index d4ee6b1ce02..6b86eacc21a 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -3,18 +3,37 @@ module gunbc.v1_deletion_plan import std.types { String, Int, List } import v2.std.node { Symbol } -data v1_deletion_plan_doc: String = "Dependency graph for reaching v2-self-hosted with v1 deleted (operator target 2026-07-19: ~2 weeks). A milestone is a node; a PlanDependency edge means the earlier milestone must land before the later can complete (not before it can START — overlap is the point). parallelism names what is forcibly serial vs fan-out-wide: ForciblySerial = one lane, its duration is on the critical path; FanOutWide = width-many lanes concurrently once its prerequisites land; DecisionGate = zero-cost operator ruling that unblocks scope. Estimates are lane-days low..high, honest not promised. This file is the plan authority; the chat/prose rendering is a projection of it (delta-first: edit here)." +data v1_deletion_plan_doc: String = "Roadmap to v2-self-hosted with v1 deleted (operator target 2026-07-19: ~2 weeks). THIS FILE IS THE PLAN AUTHORITY — the self-host artifact (selfhost-dashboard.html) is a PROJECTION of it (delta-first: edit here, re-render there; DESIGN section 3 single authority). The bar is THREE GATES: v1 deletes when ALL THREE read done — Gate 1 (GateEmitterFixedPoint) = the emitter re-emits itself as a behavioral 2-generation fixed point, NOT byte identity; Gate 2 (GateHonestFrontier) = every compiler module is SelfEmitted or SeedRetained{reason, migration_trigger}, wall-enforced, no orphaned-enrollment lie; Gate 3 (GateLedgerGreen) = the proactive verification ledger green BY EXECUTION (cold whole-corpus v1-vs-v2 parity + compile-clean parity + regen fixed point + per-family receipts), no calendar soak. GateDeletion holds the cutover + delete actions downstream of all three. This is NOT '27/27 modules flipped' — some modules stay SeedRetained by necessity (the host-effect/bootstrap kernel, self_host.dag flips last). Each milestone is a BRICK placed under a gate; brick_state = Placed | InFlight | Gated; every brick carries a ConfidenceBasis (basis = why we believe it closes, risk = what would falsify it, antagonize = the probe/receipt that attacks it) so the plan is attackable item by item — that is the deliverable. A milestone is a node; a PlanDependency edge means the earlier must LAND before the later can COMPLETE (not before it can START — overlap is the point). parallelism: ForciblySerial = one lane on the critical path; FanOutWide = width-many concurrent lanes once prereqs land; DecisionGate = zero-cost operator ruling. Estimates are lane-days low..high, honest not promised." type PlanParallelism = ForciblySerial | FanOutWide | DecisionGate +type PlanGate = GateEmitterFixedPoint | GateHonestFrontier | GateLedgerGreen | GateDeletion + +type BrickState = Placed | InFlight | Gated + +type ConfidenceBasis { + basis: String, + risk: String, + antagonize: String +} + +type PlanGateSpec { + gate: PlanGate, + name: String, + proves: String +} + type PlanMilestone { id: Symbol, title: String, + gate: PlanGate, + brick_state: BrickState, parallelism: PlanParallelism, fan_width: Int, days_low: Int, days_high: Int, - lane_state: String + lane_state: String, + confidence: ConfidenceBasis } type PlanDependency { @@ -22,20 +41,36 @@ type PlanDependency { after: Symbol } +data v1_deletion_gates: List = [ + PlanGateSpec { gate: GateEmitterFixedPoint, name: "Gate 1 — the emitter re-emits itself", proves: "The v2 .dag emitter, emitted to Rust and rebuilt, is behaviorally equivalent to the seed on a discriminating corpus (a 2-generation fixed point, not byte identity — byte-fixpoint is an explicit non-goal because it would cement the seed's warts). This is THE critical path: until the emitter can emit itself, there is no v2 to delete v1 in favor of." }, + PlanGateSpec { gate: GateHonestFrontier, name: "Gate 2 — honest typed frontier", proves: "Every one of the 27 compiler modules is a typed row: SelfEmitted (green by execution) or SeedRetained{reason, migration_trigger} (countable, prioritizable). No silent escape hatch, and no orphaned enrollment (a receipt enrolled but never executed is a lie the wall must catch). The point is not that all 27 self-emit — it is that the frontier tells the TRUTH about which do and why the rest do not." }, + PlanGateSpec { gate: GateLedgerGreen, name: "Gate 3 — verification ledger green by execution", proves: "The proactive verification ledger is green because deliberate runs were EXECUTED — whole-corpus cold v1-vs-v2 witness parity with zero unexplained divergence, compile-clean parity, regen behavioral fixed point, and per-family equals receipts — never because a calendar interval elapsed. No soak: the operator is explicitly suspicious of soaking time as a substitute for a run." }, + PlanGateSpec { gate: GateDeletion, name: "Cutover and delete", proves: "Downstream of all three gates: CI floor runs on the v2-emitted path, the seed crates are frozen off the build path (products still build), and finally src/v1 + stage0 are deleted. These are actions that FIRE once the bar reads done; they prove nothing on their own." } +] + data v1_deletion_milestones: List = [ - PlanMilestone { id: ^std_dup_assembly_fix, title: "One harness fix: cssl std-seed-link closure assembly collides dag/std with the seed std (E0255) — single root; post-discharge census 2026-07-19 puts ~13 modules on this fix (3 Gate-A + 10 tail at first census); the 6 formerly-unresolved modules cleared emit via KeySource but remain on a separate cargo UNRESOLVED bucket", parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "LANDED+CAPTURED 2026-07-19 (#6876)" }, - PlanMilestone { id: ^probe_flip_fanout, title: "Probe + flip the std_dup-gated modules (~13 at cargo stage after 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root fix reaches cargo-green", parallelism: FanOutWide, fan_width: 13, days_low: 2, days_high: 5, lane_state: "GATED on emit_import_closure_root (operator 2026-07-20: the flip wave is NOT orthogonal — it shares the emit-import-closure root with the deep lanes, so running it before the root fix hits the SAME wall). 2026-07-19 re-probe (TSVs #6891) read 18 of 19 candidates as FreeMonoid-import ONLY + materialization_carriers closure-manifest — but FreeMonoid proved to be ONE layer of a multi-layer import-closure peel now being root-caused. Measure LANDED #6888; std_dup all 3 faces LANDED (#6885/#6886/#6883). Fans out IN PARALLEL with deep_module_lanes the moment the root fix reaches cargo-green. Flip PR #6881 HELD DRAFT; flip set refreshes to the actual green set on root-fix merge" }, - PlanMilestone { id: ^wrap_decision_predicate, title: "ONE structural Rc wrap-decision predicate in the emitter (ownership-fact derived, never a name roster) — the gate on every Rc-heavy deep module", parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 7, lane_state: "LANDED — predicate merged as #6776 (wrap_decision_gate, fail-closed Rc ownership wrapping) + UseSiteVerdict catalog #6877; this row was STALE (still said running) until verified by execution 2026-07-20 (valiant-dove-723: claim_batch wrap_decision_predicate_witness_holds 7 sub-witnesses + gate smoke green on main; 06_translate routes type_shell and value_expression through wrap_decision_gate, WrapGateInapplicable passes through unchanged — no silent Rc default)" }, - PlanMilestone { id: ^emit_import_closure_root, title: "ONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "SINGLE CHAIN-A GATE (operator ruling 2026-07-20: root-cause the import closure into one derivation, do NOT peel face-by-face; cargo-green + witness-green at ALL times, no mid-peel merges). #6906 landed FreeMonoid + std_measure module-manifest + partial nested-struct (mid-peel; main green, no module flipped) — but FreeMonoid was NOT the last layer (re-probe falsified it: nested-struct sibling imports CacheInterfaceCatalogIoSemantics + a distinct generic-T class remain). neat-swift-795 pivoting #6919 to the comprehensive derivation; DRAFT until representative cargo-green (>=1 nested-struct module + materialization_carriers) AND witness-green (regen --verify divergence 0, witness families stay green). generic-T (E0425, 04_infer) is a DISTINCT class (generic rendering, NOT import closure) scoped separately" }, - PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once the import-closure root fix reaches cargo-green", parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_import_closure_root (wrap_decision LANDED #6776 + std_dup LANDED #6876 both cleared; the remaining gate is the comprehensive import-closure derivation). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green. OPEN: whether the deep modules also hit generic-T (04_infer) — if so the deep-emitter fixed point needs that distinct fix too" }, - PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE + PARTIAL FIX LANDED 2026-07-20 (#6906): all 6 emit 0-diagnostics; FreeMonoid + std_measure module-manifest + partial nested-struct import closure merged (mid-peel). The remaining import-closure layers are absorbed into emit_import_closure_root (the comprehensive root fix) — this milestone's diagnosis deliverable is DONE; the fix continues under that gate" }, - PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral fixed point on the v2 side (2-generation equivalence, not byte identity)", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "blocked on deep_module_lanes" }, - PlanMilestone { id: ^witness_realization_kernel, title: "v2 execution path kernel: emit a witness to native code + run harness + scheduler (the piece that replaces the v1 interpreter for CI) — serial kernel, then families fan out", parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 5, lane_state: "LANDED 2026-07-19 #6879 (da0e7c3d) at full bar; kernel handoff (partition, seams, traps) and the six-family diagnosis table durable as comments on the PR; stern-lark-430 closed out clean" }, - PlanMilestone { id: ^witness_family_fanout, title: "Per-witness-family realization lanes (claim families, wet receipts, lens gates) once the kernel runs one family end-to-end", parallelism: FanOutWide, fan_width: 5, days_low: 4, days_high: 8, lane_state: "DONE 2026-07-20 — all 9 witness families GREEN with trustworthy controls. #6912 (eval-repair consolidation: field_access/complement/meet_join/variant_construct admission roots) + #6917 (fold closure-arg: structural RuntimeClosure at edge grain, both oracle legs real, un-quarantine receipt) + #6918 (field_access RED-control fail-open fix — the wrong-fixture control could not go red when behavior was wrong; §5 coverage-by-illusion, now discriminating). Emitter was CLEAN across all 9; every fix was eval/harness-side (the side v1-deletion removes). Chain B serial fan-out COMPLETE; swift-stag/witty-owl/smart-hawk closed out" }, - PlanMilestone { id: ^trigger_renegotiation, title: "DECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept later re-emit), or exclude from the 2-week scope", parallelism: DecisionGate, fan_width: 1, days_low: 0, days_high: 0, lane_state: "RESOLVED 2026-07-20 (operator): do NOT wait on the namespace terminal — it is dragging. Renegotiate 03_resolve/03_name_resolve + body-producer tail triggers to emit under the current design with a declared later re-emit; the frontier-row renegotiation rides the flip-wave refresh" }, - PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "witness_family_fanout DONE (dep satisfied); still gated on probe_flip_fanout/emit_import_closure_root for the v2-emitted-execution half. Verification ledger OVERLAP-STARTED #6915 (proactive_verification_ledger.dag: 3 spine receipts + 9 family receipts, typed dispositions, no fabricated green). DEFECT to root-cause (sharp-bee review on #6915): the 5 family dispositions are HAND-DECLARED literals — now stale/lying after #6912/#6917/#6918 greened all 5 KnownRed families; fix = PROJECT dispositions from the ci_layer_roots.dag probe_red carrier so the ledger self-updates (§3 single authority), then execute the spine receipts to green (no soak)" }, - PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point + ci_floor_cutover + unresolved_error_diagnosis + trigger_renegotiation" }, - PlanMilestone { id: ^v1_delete, title: "Delete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking times; test/verify proactively). Ledger = enumerated executed receipts: whole-corpus cold v1-vs-v2 witness parity with zero unexplained divergence, compile-clean parity, regen behavioral fixed point, per-family equals receipts — each a deliberate run, none an elapsed-time claim", parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 1, lane_state: "blocked on v1_quarantine + the executed verification ledger" } + PlanMilestone { id: ^wrap_decision_predicate, title: "ONE structural Rc wrap-decision predicate in the emitter (ownership-fact derived, never a name roster) — the gate on every Rc-heavy deep module", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 7, lane_state: "LANDED #6776 (wrap_decision_gate, fail-closed Rc ownership wrapping) + UseSiteVerdict catalog #6877; verified by execution 2026-07-20 (valiant-dove-723: claim_batch wrap_decision_predicate_witness_holds 7 sub-witnesses + gate smoke green on main; 06_translate routes type_shell and value_expression through the gate, WrapGateInapplicable passes through unchanged — no silent Rc default)", confidence: ConfidenceBasis { basis: "By execution — 7 sub-witnesses green on main plus the gate smoke; the predicate is ownership-fact-derived so the bad Rc wrap is UNWRITABLE (construction), not flagged after the fact", risk: "A use-site whose ownership the derivation mis-classifies silently falls to a wrap default", antagonize: "wrap_decision_predicate_witness_holds runs over the corpus; a mis-wrap reds it — the RED control is the discriminating fixture" } }, + PlanMilestone { id: ^std_dup_assembly_fix, title: "One harness fix: cssl std-seed-link closure assembly collides dag/std with the seed std (E0255) — single root; post-discharge census 2026-07-19 puts ~13 modules on this fix (3 Gate-A + 10 tail); the 6 formerly-unresolved modules cleared emit via KeySource but stay on a separate cargo UNRESOLVED bucket", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "LANDED+CAPTURED 2026-07-19 (#6876)", confidence: ConfidenceBasis { basis: "Single root (cssl closure assembly collided dag/std with seed std, E0255); the post-discharge census placed ~13 modules on the one fix", risk: "A module the census missed carries a second assembly collision not on this root", antagonize: "the cssl closure-assembly probe over the flip candidate set surfaces a residual collision" } }, + PlanMilestone { id: ^emit_import_closure_root, title: "ONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "SINGLE CHAIN-A GATE (operator 2026-07-20: root-cause the closure into ONE derivation, do NOT peel face-by-face; cargo-green + witness-green at ALL times, no mid-peel merges). #6919 (neat-swift-795) pivoted to the comprehensive derivation; DRAFT until representative cargo-green (>=1 nested-struct module + materialization_carriers) AND witness-green (regen --verify divergence 0, witness families stay green). #6906 landed FreeMonoid + std_measure + partial nested-struct (mid-peel; main green, no module flipped)", confidence: ConfidenceBasis { basis: "The closure is a mechanical transitive walk over names the emitted constructs already reference; the representative bar is by-execution on real modules, not first_error", risk: "A residual reference class the walk misses — rustc masks downstream layers behind first_error, so a new layer can surface AFTER the representative bar (FreeMonoid was one layer, falsified as the whole gate)", antagonize: "neat-swift ships the FULL residual rustc histogram (every E-code + count on 02_parse + materialization_carriers) on each layer-clear push, not just first_error; the confidence-probe throwaway branch peels AHEAD past the closure to force-expose layer N+1 before we commit" } }, + PlanMilestone { id: ^generic_t_rendering, title: "Generic-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "IN FLIGHT (quiet-bee-205, Pole A-2). E0425 unbound T in 04_infer. Scoped SEPARATELY from emit_import_closure_root (operator 2026-07-20: distinct root). Root located; fix = thread the generic param names into the fold acc-type + refuse an unbound TypeVariable in render_rust_type (construction, never a string-scan of the emitted text)", confidence: ConfidenceBasis { basis: "Root located to the fold acc-type fallback plus render_rust_type; the threading shape is the same as the already-landed #6881 fn_generic_param_names", risk: "Generic-T interleaves with import-closure on the same modules (a fix-order coupling), or is deeper than the 04_infer surface it first showed on", antagonize: "quiet-bee ships the full residual histogram on clear; the peel-ahead branch stacks generic-T ON TOP of the import closure to expose interaction before either commits" } }, + PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE + PARTIAL FIX LANDED 2026-07-20 (#6906): all 6 emit 0-diagnostics; FreeMonoid + std_measure module-manifest + partial nested-struct import closure merged (mid-peel). The remaining import-closure layers are absorbed into emit_import_closure_root — this milestone's DIAGNOSIS deliverable is done; the fix continues under that gate", confidence: ConfidenceBasis { basis: "All 6 modules emit 0-diagnostics; the diagnosis deliverable is complete and the residual work is folded into emit_import_closure_root", risk: "0-diagnostics emit is NOT evidence of correct call-shape — a runtime call-shape defect can hide behind a clean compile (compile-clean is arity-blind)", antagonize: "require an EXECUTING-consumer receipt on signature changes, never the 0-diagnostics count alone" } }, + PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T reach cargo-green", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_import_closure_root + generic_t_rendering (wrap_decision #6776 + std_dup #6876 already cleared). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green", confidence: ConfidenceBasis { basis: "All 8 deep modules already emit 0-diagnostics and refuse on the SAME root as the flip wave (TSVs #6916), so the root fix is expected to clear them wholesale, not one-by-one", risk: "A deep module (especially 04_infer, the generic-heavy one) hits a THIRD layer past import-closure + generic-T", antagonize: "the confidence-probe peel-ahead hacks past both known roots on a throwaway branch to surface layer 3 BEFORE the lanes commit" } }, + PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on deep_module_lanes. Byte-fixpoint is an explicit NON-goal (it would force v2 to reproduce the seed's warts); the bar is behavioral equivalence on a discriminating corpus", confidence: ConfidenceBasis { basis: "Behavioral equivalence on a discriminating corpus is the operator-set bar; the emit machinery is already proven on the shallow modules that self-emit today", risk: "The emitted emitter diverges from the seed on a discriminating input the corpus does not cover", antagonize: "regen_stage0 --emit-fresh + --verify divergence 0 plus a discriminating RED that goes red when the re-emit is wrong" } }, + PlanMilestone { id: ^typed_frontier, title: "The self-host frontier is a typed row per module: SelfEmitted | SeedRetained{reason, migration_trigger} — no silent escape hatch (the DecodeFidelity/Lossless boundary)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED (src/v2/compiler/self_host/frontier.dag). Each compiler module is a FrontierQualifiedModuleBinding with a disposition; SeedRetained carries reason + migration_trigger, so a seed-retained module is countable and prioritizable, never a silent hole", confidence: ConfidenceBasis { basis: "frontier.dag exists and every module is a typed row with a disposition; the Lossless boundary is modeled", risk: "The disposition enum admits a state that reads honest but is not (SelfEmitted with a dead receipt, or a stale SeedRetained reason)", antagonize: "the no_frontier_lies wall plus the frontier audit (confidence-probe Phase 2) attack exactly that gap" } }, + PlanMilestone { id: ^frontier_dispositioned, title: "All 27 compiler modules dispositioned: 6 SelfEmitted (03_body_producer, 03_normalize, 07_target_carriers, discovery_enumeration, parse_engine_hooks, use_site_verdict) + 21 SeedRetained, each with a reason + trigger. The bar is NOT 27/27 SelfEmitted — some stay SeedRetained by necessity", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — 27/27 rows present in frontier.dag (count SelfEmitted vs SeedRetained there for the live number). The host-effect kernel, bootstrap, and self_host.dag itself stay SeedRetained by necessity; the flip wave (probe_flip_fanout) grows the SelfEmitted count but is seed-shrink beyond the minimum, not a bar-brick", confidence: ConfidenceBasis { basis: "27 rows counted in frontier.dag; the 6 SelfEmitted are verified by execution", risk: "A SeedRetained reason is stale (the module could self-emit now, so the frontier UNDERSTATES progress) or a SelfEmitted receipt is orphaned (OVERSTATES it)", antagonize: "the frontier audit samples SeedRetained rows for false-retention AND verifies every one of the 6 SelfEmitted receipts actually executes" } }, + PlanMilestone { id: ^no_frontier_lies, title: "No orphaned enrollment: every frontier receipt names an EXECUTING consumer; an enrolled-but-never-run receipt itself reds (the #6856 coverage-by-illusion class)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — the admission invariant (module-identity-storage-binding Phase 0): SelfEmitted receipts run on the falsifier wet cadence; quarantined known-red rows run on a probe cadence EXPECTING red so greening is a counted un-quarantine event. 'Enrolled, zero executions' reds", confidence: ConfidenceBasis { basis: "The wall is executable and runs over the corpus, not a grep", risk: "The wall itself goes inert (coverage-by-illusion one level up — a lens that exists but nothing gates on)", antagonize: "the executable hygiene backstop keeps every lens wired-or-deleted; the frontier audit confirms the wall actually fires" } }, + PlanMilestone { id: ^trigger_renegotiation, title: "DECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope", gate: GateHonestFrontier, brick_state: InFlight, parallelism: DecisionGate, fan_width: 1, days_low: 0, days_high: 0, lane_state: "RESOLVED 2026-07-20 (operator): do NOT wait on the namespace terminal — it is dragging. Renegotiate 03_resolve/03_name_resolve + body-producer tail triggers to emit under the current design with a declared later re-emit; the frontier-row renegotiation rides the flip-wave refresh", confidence: ConfidenceBasis { basis: "Operator-decided; the decision is made, only the mechanical frontier-row update remains", risk: "The row update lags and leaves a stale trigger on the frontier", antagonize: "the flip-wave refresh updates the rows and the no_frontier_lies wall catches a stale trigger" } }, + PlanMilestone { id: ^probe_flip_fanout, title: "Probe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum", gate: GateHonestFrontier, brick_state: Gated, parallelism: FanOutWide, fan_width: 13, days_low: 2, days_high: 5, lane_state: "GATED on emit_import_closure_root (+ generic_t_rendering for the generic-heavy candidates). The emitter fixed point (Gate 1) only needs the emitter modules to self-emit, so the flip wave GROWS the SelfEmitted count but is not itself a bar-brick. 2026-07-19 re-probe (TSVs #6891) read 18 of 19 candidates as import-closure-only. Fans out IN PARALLEL with deep_module_lanes on root-fix cargo-green. Flip PR #6881 HELD DRAFT; the flip set refreshes to the actual green set on root-fix merge", confidence: ConfidenceBasis { basis: "18 of 19 candidates read as import-closure-only after the re-probe; each flip is an independent lane once the root clears", risk: "The re-probe read only first_error, so a candidate may hide a second layer past import-closure", antagonize: "the full residual histogram per candidate on clear; each flip lands by-execution (cargo-green + witness-green), never on a probe prediction" } }, + PlanMilestone { id: ^witness_realization_kernel, title: "v2 execution path kernel: emit a witness to native code + run harness + scheduler (the piece that replaces the v1 interpreter for CI) — serial kernel, then families fan out", gate: GateLedgerGreen, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 5, lane_state: "LANDED 2026-07-19 #6879 (da0e7c3d) at full bar; kernel handoff (partition, seams, traps) and the six-family diagnosis table durable as comments on the PR; stern-lark-430 closed out clean", confidence: ConfidenceBasis { basis: "Landed at full bar by execution; the kernel runs a family end-to-end", risk: "The kernel's partition/seams do not generalize to a family the diagnosis table did not cover", antagonize: "the 9 family lanes all exercised it and all went green — the generalization is proven, not assumed" } }, + PlanMilestone { id: ^witness_family_fanout, title: "Per-witness-family realization lanes (claim families, wet receipts, lens gates) once the kernel runs one family end-to-end", gate: GateLedgerGreen, brick_state: Placed, parallelism: FanOutWide, fan_width: 5, days_low: 4, days_high: 8, lane_state: "DONE 2026-07-20 — all 9 witness families GREEN with trustworthy controls. #6912 (eval-repair consolidation) + #6917 (fold closure-arg: structural RuntimeClosure at edge grain, both oracle legs real, un-quarantine receipt) + #6918 (field_access RED-control fail-open fix — the wrong-fixture control could not go red when behavior was wrong; section-5 coverage-by-illusion, now discriminating). Emitter was CLEAN across all 9; every fix was eval/harness-side (the side v1-deletion removes)", confidence: ConfidenceBasis { basis: "All 9 families green by execution WITH discriminating RED controls (the #6918 fix made the field_access control able to go red on a wrong fixture)", risk: "A family's green rests on a non-discriminating control (the exact #6918 class recurring elsewhere)", antagonize: "each control was checked to go red on a wrong fixture; ledger_projection (Pole B) re-derives the dispositions from the probe_red carrier so a silent regression reds" } }, + PlanMilestone { id: ^ledger_modeled, title: "The proactive verification ledger is modeled: 3 spine receipts (cold parity, compile-clean, regen fixed point) + 9 family receipts, typed dispositions, no fabricated green", gate: GateLedgerGreen, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "LANDED #6915 (proactive_verification_ledger.dag). Typed dispositions; no soak — every receipt is a deliberate executed run, not an elapsed-time claim", confidence: ConfidenceBasis { basis: "proactive_verification_ledger.dag exists with typed receipt rows for the 3 spine + 9 family checks", risk: "A disposition is a hand-declared literal that goes stale — exactly the Pole B defect: 5 family dispositions were hand-literals, lying after the eval PRs greened them", antagonize: "ledger_projection (Pole B #6923) projects dispositions from the probe_red carrier so they self-update; until it lands, the hand-literals ARE the attack surface" } }, + PlanMilestone { id: ^ledger_projection, title: "The ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)", gate: GateLedgerGreen, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "IN FLIGHT (gentle-bee, Pole B #6923). The genuinely-ORTHOGONAL Gate-3 lane runnable NOW (no Gate-1 dependency). Fixes the section-3 defect: 5 KnownRedPendingUnquarantine literals stale/lying after #6912/#6917/#6918 greened them", confidence: ConfidenceBasis { basis: "Root located — the probe_red carrier already holds the truth; the fix projects from it (single authority) rather than re-declaring the dispositions", risk: "The carrier does not cover every family, leaving a residue still hand-declared", antagonize: "gentle-bee executes the projection over all 9 families; a coverage gap reds it" } }, + PlanMilestone { id: ^cold_parity_receipt, title: "Spine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on emitter_fixed_point (no v2 emission = no cold parity to run). The falsifier cadence already carries the deterministic whole-tree cold control (GUNBC_CI_COMPILE_CLEAN_COLD_CONTROL); this brick is the deliberate v1-vs-v2 comparison over it", confidence: ConfidenceBasis { basis: "The cold-control mechanism already exists in the falsifier cadence; this receipt is a comparison, not new machinery", risk: "Cannot execute until Gate 1 lands — the deepest cross-gate dependency, so a divergence would surface late", antagonize: "run it the moment the emitter fixed point lands, counted per-family, with no elapsed-time substitute permitted" } }, + PlanMilestone { id: ^compile_clean_parity_receipt, title: "Spine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. Compile-clean is already the CI gate for v1; the receipt runs it on the v2 path", confidence: ConfidenceBasis { basis: "Compile-clean is already the v1 CI gate; the receipt just runs it on the v2-emitted path", risk: "0-diagnostics compile is arity-blind — clean does not imply behaviorally equal", antagonize: "paired with cold_parity_receipt (the behavioral leg), never standing alone as the equality claim" } }, + PlanMilestone { id: ^regen_fixed_point_receipt, title: "Spine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. The self-host fixed-point step executed as a ledger receipt, scoped at its own closure (regen skip authority)", confidence: ConfidenceBasis { basis: "regen_stage0 --emit-fresh + --verify is the existing self-host proof harness", risk: "The fixed point holds for the emitter but a downstream module regresses", antagonize: "--verify divergence 0 over the FULL regen input set, never a sampled subset" } }, + PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on emitter_fixed_point + probe_flip_fanout (the v2-emitted-execution half) + the ledger receipts. witness_family_fanout DONE. This is the cutover ACTION: CI stops using the v1 interpreter and runs the v2-emitted path", confidence: ConfidenceBasis { basis: "The ledger bricks supply the parity evidence; the cutover is the switch once they are green", risk: "The cutover exposes a CI-only path the per-family receipts did not cover", antagonize: "cold_parity_receipt runs the FULL corpus cold, not just the enrolled families" } }, + PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point + ci_floor_cutover + unresolved_error_diagnosis + trigger_renegotiation (all three gates reading done)", confidence: ConfidenceBasis { basis: "Quarantine is a build-path change (freeze the seed crates, ensure nothing depends on them) once all three gates read done", risk: "A product or CI step still references a seed crate", antagonize: "the products-can-build check — verify nothing in CI or products depends on src/v1 before flipping" } }, + PlanMilestone { id: ^v1_delete, title: "Delete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 1, lane_state: "blocked on v1_quarantine + the executed verification ledger (cold parity + compile-clean + regen fixed point + per-family receipts, all green by execution)", confidence: ConfidenceBasis { basis: "A mechanical removal once quarantine holds and the ledger is green BY EXECUTION", risk: "Deleting too early on a soak-substituted green (the operator's explicit worry)", antagonize: "gate on the enumerated executed receipts, never elapsed time — the ledger is the wall" } } ] data v1_deletion_dependencies: List = [ @@ -44,15 +79,27 @@ data v1_deletion_dependencies: List = [ PlanDependency { before: ^wrap_decision_predicate, after: ^deep_module_lanes }, PlanDependency { before: ^emit_import_closure_root, after: ^probe_flip_fanout }, PlanDependency { before: ^emit_import_closure_root, after: ^deep_module_lanes }, + PlanDependency { before: ^generic_t_rendering, after: ^probe_flip_fanout }, + PlanDependency { before: ^generic_t_rendering, after: ^deep_module_lanes }, PlanDependency { before: ^deep_module_lanes, after: ^emitter_fixed_point }, PlanDependency { before: ^witness_realization_kernel, after: ^witness_family_fanout }, + PlanDependency { before: ^ledger_modeled, after: ^ledger_projection }, + PlanDependency { before: ^witness_family_fanout, after: ^ledger_projection }, PlanDependency { before: ^witness_family_fanout, after: ^ci_floor_cutover }, PlanDependency { before: ^probe_flip_fanout, after: ^ci_floor_cutover }, + PlanDependency { before: ^emitter_fixed_point, after: ^ci_floor_cutover }, + PlanDependency { before: ^emitter_fixed_point, after: ^cold_parity_receipt }, + PlanDependency { before: ^emitter_fixed_point, after: ^compile_clean_parity_receipt }, + PlanDependency { before: ^emitter_fixed_point, after: ^regen_fixed_point_receipt }, PlanDependency { before: ^emitter_fixed_point, after: ^v1_quarantine }, PlanDependency { before: ^ci_floor_cutover, after: ^v1_quarantine }, PlanDependency { before: ^unresolved_error_diagnosis, after: ^v1_quarantine }, PlanDependency { before: ^trigger_renegotiation, after: ^v1_quarantine }, + PlanDependency { before: ^ledger_projection, after: ^v1_delete }, + PlanDependency { before: ^cold_parity_receipt, after: ^v1_delete }, + PlanDependency { before: ^compile_clean_parity_receipt, after: ^v1_delete }, + PlanDependency { before: ^regen_fixed_point_receipt, after: ^v1_delete }, PlanDependency { before: ^v1_quarantine, after: ^v1_delete } ] -data v1_deletion_critical_path_note: String = "Two serial chains dominate the calendar and they RUN IN PARALLEL with each other: (A) deep_module_lanes -> emitter_fixed_point (5..10 lane-days remaining; wrap_decision_predicate already LANDED #6776 — see CORRECTION below) and (B) witness_family_fanout -> ci_floor_cutover (6..12 lane-days remaining; witness_realization_kernel LANDED #6879). Everything else fans out beside them. v1_quarantine lands when BOTH chains finish (original projection: day ~12 optimistic, day ~17 realistic). v1_delete = quarantine + executed verification ledger green (no calendar soak). UPDATE 2026-07-19 (cycle-2): std_dup_assembly_fix LANDED+CAPTURED (#6876); ~13 std_dup modules unblocked for flip-wave pending emitter prereqs (Measure neat-swift in flight, FreeMonoid queued, Optional proud-deer); 6 unresolved cargo residue distinct (ROOT-CAUSED emitter-gap). Chain B (stern-lark-430) dispatched. UPDATE 2026-07-20 (cycle-3): chain B serial segment DONE — kernel #6879 merged, family scaffolds #6893/#6894/#6895 merged, six-family diagnosis says emitter clean everywhere / gaps all eval-side, eval-repair arc consolidated on one owner; chain A single gate = FreeMonoid pass executing, flip wave up to 19 modules behind it; module-identity tasks 1-5 all merged (#6889/#6890/#6892/#6898), task 4 at bar (#6899). Operator rulings 2026-07-20: trigger_renegotiation RESOLVED (do not wait on namespace terminal); NO SOAK — v1_delete gates on the executed proactive-verification ledger, never elapsed time. CORRECTION 2026-07-20: wrap_decision_predicate was ALREADY LANDED (#6776 + #6877) — the running row was stale; verified by execution on main. Chain A therefore has ONE remaining serial gate (FreeMonoid pass), after which the flip wave AND the deep-module fan-out both fire. UPDATE 2026-07-20 (cycle-4): chain B serial segment is DONE — witness_family_fanout COMPLETE (all 9 families green + trustworthy controls, #6912/#6917/#6918); only ci_floor_cutover remains on chain B (ledger overlap-started #6915, §3 disposition-projection defect to root-cause + spine receipts to execute; no soak). Chain A CORRECTION: the 'FreeMonoid single gate' framing was FALSIFIED — self-emitting is a MULTI-LAYER emit-import-closure peel (FreeMonoid was one layer; #6906's re-probe surfaced nested-struct sibling imports + a distinct generic-T class). #6906 landed FreeMonoid + partial (mid-peel). Operator rulings 2026-07-20: (1) ROOT-CAUSE the import closure into ONE comprehensive derivation (new milestone emit_import_closure_root) rather than peel face-by-face; (2) cargo-green + witness-green at ALL times — NO mid-peel merges (this reverses the #6906 exception); (3) the flip wave is NOT orthogonal (it shares the import-closure root) so it fans out IN PARALLEL with deep_module_lanes right AFTER the root fix, never before. Chain-A single gate is now emit_import_closure_root (neat-swift-795, #6919 pivoted); both probe_flip_fanout and deep_module_lanes fire on its cargo-green. Pole B (ci_floor_cutover ledger) is the genuinely-orthogonal parallel lane runnable now." +data v1_deletion_critical_path_note: String = "Two serial chains dominate the calendar and RUN IN PARALLEL with each other: (A) emit_import_closure_root + generic_t_rendering -> deep_module_lanes -> emitter_fixed_point (Gate 1; wrap_decision_predicate #6776 and std_dup_assembly_fix #6876 already LANDED) and (B) witness_family_fanout -> ledger_projection + the spine receipts -> ci_floor_cutover (Gate 3; witness_realization_kernel #6879 LANDED, witness_family_fanout DONE — all 9 families green). Gate 2 (the honest frontier) is largely PLACED and independent — only trigger_renegotiation (decided) and the seed-shrink flip wave remain. Everything fans out beside the two chains. v1_quarantine lands when all three gates read done; v1_delete = quarantine + the executed verification ledger green (NO calendar soak). CYCLE-5 REMODEL 2026-07-20: this file is now the FULL three-gate roadmap (operator: 'your job is to get us to a full and confident plan — we can antagonize it — make this a roadmap and the artifact a projection of it'). Every milestone is a brick under a PlanGate with a brick_state and a ConfidenceBasis (basis/risk/antagonize) so each item is attackable; the confidence-probe lane (error-histogram + frontier audit + throwaway peel-ahead) is the antagonizing that fills in the risk/antagonize fields. Chain-A CORRECTION carried forward: the 'FreeMonoid single gate' framing was FALSIFIED — self-emitting is a MULTI-LAYER emit-import-closure peel (FreeMonoid was one layer; #6906's re-probe surfaced nested-struct sibling imports + a distinct generic-T class, now split into generic_t_rendering). Operator rulings 2026-07-20: (1) root-cause the import closure into ONE comprehensive derivation, not a face-by-face peel; (2) cargo-green + witness-green at ALL times — NO mid-peel merges (reverses the #6906 exception); (3) the flip wave is NOT orthogonal (it shares the import-closure root) so it fans out IN PARALLEL with deep_module_lanes right AFTER the root fix, never before. Pole B (ledger_projection) is the genuinely-orthogonal Gate-3 lane runnable now. The three-gate reading is NOT '27/27 modules flipped' — some modules stay SeedRetained by necessity; the bar is emitter fixed point + honest frontier + ledger green." From 850ab278de2ed81d72145a16eb65a05e290ce27d Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 15:49:34 +0000 Subject: [PATCH 04/32] Plan cycle-5: v1_deletion_plan.dag becomes the FULL three-gate roadmap; artifact is its projection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Operator: "your job is to get us to a full and confident plan — we can antagonize it — make this a roadmap and the artifact a projection of it." The plan authority now models the three-gate v1-delete bar directly (§3 single authority; the selfhost-dashboard.html artifact projects it, delta-first): - PlanGate enum groups every milestone under Gate 1 (emitter fixed point), Gate 2 (honest frontier), Gate 3 (ledger green), or GateDeletion. - BrickState (Placed|InFlight|Gated) per milestone. - ConfidenceBasis{basis, risk, antagonize} per milestone — the attack surface that makes the plan antagonizable item by item (the confidence-probe lane fills in risk/antagonize). - PlanGateSpec rows carry each gate's name + what it proves. - 23 bricks (was 13): adds generic_t_rendering, the Gate-2 property bricks (typed_frontier/frontier_dispositioned/no_frontier_lies), the Gate-3 ledger bricks (ledger_modeled/ledger_projection + the 3 spine receipts), and emit_representation_mismatch — the E0308 layer (~4400/deep module) the confidence-probe just exposed once generic-T cleared (quiet-bee #6924 residual histogram). Rewired the Gate-1 chain so E0308 sits between the two known roots and the deep-module lanes. NOT "27/27 modules flipped" — the doc string states the bar is emitter fixed point + honest frontier + ledger green; some modules stay SeedRetained by necessity. Co-Authored-By: Claude Fable 5 --- dag/gunbc/v1_deletion_plan.dag | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index 6b86eacc21a..4a5af0c1353 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -54,7 +54,8 @@ data v1_deletion_milestones: List = [ PlanMilestone { id: ^emit_import_closure_root, title: "ONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "SINGLE CHAIN-A GATE (operator 2026-07-20: root-cause the closure into ONE derivation, do NOT peel face-by-face; cargo-green + witness-green at ALL times, no mid-peel merges). #6919 (neat-swift-795) pivoted to the comprehensive derivation; DRAFT until representative cargo-green (>=1 nested-struct module + materialization_carriers) AND witness-green (regen --verify divergence 0, witness families stay green). #6906 landed FreeMonoid + std_measure + partial nested-struct (mid-peel; main green, no module flipped)", confidence: ConfidenceBasis { basis: "The closure is a mechanical transitive walk over names the emitted constructs already reference; the representative bar is by-execution on real modules, not first_error", risk: "A residual reference class the walk misses — rustc masks downstream layers behind first_error, so a new layer can surface AFTER the representative bar (FreeMonoid was one layer, falsified as the whole gate)", antagonize: "neat-swift ships the FULL residual rustc histogram (every E-code + count on 02_parse + materialization_carriers) on each layer-clear push, not just first_error; the confidence-probe throwaway branch peels AHEAD past the closure to force-expose layer N+1 before we commit" } }, PlanMilestone { id: ^generic_t_rendering, title: "Generic-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "IN FLIGHT (quiet-bee-205, Pole A-2). E0425 unbound T in 04_infer. Scoped SEPARATELY from emit_import_closure_root (operator 2026-07-20: distinct root). Root located; fix = thread the generic param names into the fold acc-type + refuse an unbound TypeVariable in render_rust_type (construction, never a string-scan of the emitted text)", confidence: ConfidenceBasis { basis: "Root located to the fold acc-type fallback plus render_rust_type; the threading shape is the same as the already-landed #6881 fn_generic_param_names", risk: "Generic-T interleaves with import-closure on the same modules (a fix-order coupling), or is deeper than the 04_infer surface it first showed on", antagonize: "quiet-bee ships the full residual histogram on clear; the peel-ahead branch stacks generic-T ON TOP of the import closure to expose interaction before either commits" } }, PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE + PARTIAL FIX LANDED 2026-07-20 (#6906): all 6 emit 0-diagnostics; FreeMonoid + std_measure module-manifest + partial nested-struct import closure merged (mid-peel). The remaining import-closure layers are absorbed into emit_import_closure_root — this milestone's DIAGNOSIS deliverable is done; the fix continues under that gate", confidence: ConfidenceBasis { basis: "All 6 modules emit 0-diagnostics; the diagnosis deliverable is complete and the residual work is folded into emit_import_closure_root", risk: "0-diagnostics emit is NOT evidence of correct call-shape — a runtime call-shape defect can hide behind a clean compile (compile-clean is arity-blind)", antagonize: "require an EXECUTING-consumer receipt on signature changes, never the 0-diagnostics count alone" } }, - PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T reach cargo-green", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_import_closure_root + generic_t_rendering (wrap_decision #6776 + std_dup #6876 already cleared). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green", confidence: ConfidenceBasis { basis: "All 8 deep modules already emit 0-diagnostics and refuse on the SAME root as the flip wave (TSVs #6916), so the root fix is expected to clear them wholesale, not one-by-one", risk: "A deep module (especially 04_infer, the generic-heavy one) hits a THIRD layer past import-closure + generic-T", antagonize: "the confidence-probe peel-ahead hacks past both known roots on a throwaway branch to surface layer 3 BEFORE the lanes commit" } }, + PlanMilestone { id: ^emit_representation_mismatch, title: "Emit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa). The largest emitter peel layer and likely the deepest root (the 'ground each primitive into its realization' open thread at scale)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 8, lane_state: "EXPOSED 2026-07-20 by the confidence-probe antagonizing (quiet-bee #6924 residual histogram once generic-T cleared): E0308 is the dominant residual (~4400/deep module, uniform shape across all three) and was MASKED behind rustc first_error until import-closure + generic-T peeled it open. Owner TBD; couples to the numeric-tower grounding (#5428) generalized to every primitive. This is the layer that makes emitter_fixed_point depth genuinely uncertain — sizing it (E0308 bucketed by mismatching type-pair) is the active antagonizing", confidence: ConfidenceBasis { basis: "The class is identified — E0308 type-mismatch, ~4400/module, UNIFORM shape across 04_infer/06_translate/05_emit, so a single root signature not scattered noise", risk: "It is the model-vs-realization fork (a known deep open thread) surfacing at scale; grounding every primitive into its realization may exceed the 2-week window, so this brick could DOMINATE Gate 1", antagonize: "bucket the ~4400 E0308 by the type pair that mismatches (which modeled type vs which native) to size the true root count — a few root pairs x many sites (tractable) or many roots (deep); quiet-bee producing this next" } }, + PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_representation_mismatch (which is itself gated on emit_import_closure_root + generic_t_rendering) (wrap_decision #6776 + std_dup #6876 already cleared). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green", confidence: ConfidenceBasis { basis: "All 8 deep modules already emit 0-diagnostics and refuse on the SAME root as the flip wave (TSVs #6916), so the root fix is expected to clear them wholesale, not one-by-one", risk: "A deep module (especially 04_infer, the generic-heavy one) hits a THIRD layer past import-closure + generic-T", antagonize: "the confidence-probe peel-ahead hacks past both known roots on a throwaway branch to surface layer 3 BEFORE the lanes commit" } }, PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on deep_module_lanes. Byte-fixpoint is an explicit NON-goal (it would force v2 to reproduce the seed's warts); the bar is behavioral equivalence on a discriminating corpus", confidence: ConfidenceBasis { basis: "Behavioral equivalence on a discriminating corpus is the operator-set bar; the emit machinery is already proven on the shallow modules that self-emit today", risk: "The emitted emitter diverges from the seed on a discriminating input the corpus does not cover", antagonize: "regen_stage0 --emit-fresh + --verify divergence 0 plus a discriminating RED that goes red when the re-emit is wrong" } }, PlanMilestone { id: ^typed_frontier, title: "The self-host frontier is a typed row per module: SelfEmitted | SeedRetained{reason, migration_trigger} — no silent escape hatch (the DecodeFidelity/Lossless boundary)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED (src/v2/compiler/self_host/frontier.dag). Each compiler module is a FrontierQualifiedModuleBinding with a disposition; SeedRetained carries reason + migration_trigger, so a seed-retained module is countable and prioritizable, never a silent hole", confidence: ConfidenceBasis { basis: "frontier.dag exists and every module is a typed row with a disposition; the Lossless boundary is modeled", risk: "The disposition enum admits a state that reads honest but is not (SelfEmitted with a dead receipt, or a stale SeedRetained reason)", antagonize: "the no_frontier_lies wall plus the frontier audit (confidence-probe Phase 2) attack exactly that gap" } }, PlanMilestone { id: ^frontier_dispositioned, title: "All 27 compiler modules dispositioned: 6 SelfEmitted (03_body_producer, 03_normalize, 07_target_carriers, discovery_enumeration, parse_engine_hooks, use_site_verdict) + 21 SeedRetained, each with a reason + trigger. The bar is NOT 27/27 SelfEmitted — some stay SeedRetained by necessity", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — 27/27 rows present in frontier.dag (count SelfEmitted vs SeedRetained there for the live number). The host-effect kernel, bootstrap, and self_host.dag itself stay SeedRetained by necessity; the flip wave (probe_flip_fanout) grows the SelfEmitted count but is seed-shrink beyond the minimum, not a bar-brick", confidence: ConfidenceBasis { basis: "27 rows counted in frontier.dag; the 6 SelfEmitted are verified by execution", risk: "A SeedRetained reason is stale (the module could self-emit now, so the frontier UNDERSTATES progress) or a SelfEmitted receipt is orphaned (OVERSTATES it)", antagonize: "the frontier audit samples SeedRetained rows for false-retention AND verifies every one of the 6 SelfEmitted receipts actually executes" } }, @@ -78,9 +79,10 @@ data v1_deletion_dependencies: List = [ PlanDependency { before: ^std_dup_assembly_fix, after: ^deep_module_lanes }, PlanDependency { before: ^wrap_decision_predicate, after: ^deep_module_lanes }, PlanDependency { before: ^emit_import_closure_root, after: ^probe_flip_fanout }, - PlanDependency { before: ^emit_import_closure_root, after: ^deep_module_lanes }, + PlanDependency { before: ^emit_import_closure_root, after: ^emit_representation_mismatch }, PlanDependency { before: ^generic_t_rendering, after: ^probe_flip_fanout }, - PlanDependency { before: ^generic_t_rendering, after: ^deep_module_lanes }, + PlanDependency { before: ^generic_t_rendering, after: ^emit_representation_mismatch }, + PlanDependency { before: ^emit_representation_mismatch, after: ^deep_module_lanes }, PlanDependency { before: ^deep_module_lanes, after: ^emitter_fixed_point }, PlanDependency { before: ^witness_realization_kernel, after: ^witness_family_fanout }, PlanDependency { before: ^ledger_modeled, after: ^ledger_projection }, From b0b9617b2d226b47b9a7f2b4d055b84f4fa9ce6d Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 15:57:27 +0000 Subject: [PATCH 05/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/v1_deletion_plan.dag | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index 4a5af0c1353..2b8d231def7 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -3,7 +3,7 @@ module gunbc.v1_deletion_plan import std.types { String, Int, List } import v2.std.node { Symbol } -data v1_deletion_plan_doc: String = "Roadmap to v2-self-hosted with v1 deleted (operator target 2026-07-19: ~2 weeks). THIS FILE IS THE PLAN AUTHORITY — the self-host artifact (selfhost-dashboard.html) is a PROJECTION of it (delta-first: edit here, re-render there; DESIGN section 3 single authority). The bar is THREE GATES: v1 deletes when ALL THREE read done — Gate 1 (GateEmitterFixedPoint) = the emitter re-emits itself as a behavioral 2-generation fixed point, NOT byte identity; Gate 2 (GateHonestFrontier) = every compiler module is SelfEmitted or SeedRetained{reason, migration_trigger}, wall-enforced, no orphaned-enrollment lie; Gate 3 (GateLedgerGreen) = the proactive verification ledger green BY EXECUTION (cold whole-corpus v1-vs-v2 parity + compile-clean parity + regen fixed point + per-family receipts), no calendar soak. GateDeletion holds the cutover + delete actions downstream of all three. This is NOT '27/27 modules flipped' — some modules stay SeedRetained by necessity (the host-effect/bootstrap kernel, self_host.dag flips last). Each milestone is a BRICK placed under a gate; brick_state = Placed | InFlight | Gated; every brick carries a ConfidenceBasis (basis = why we believe it closes, risk = what would falsify it, antagonize = the probe/receipt that attacks it) so the plan is attackable item by item — that is the deliverable. A milestone is a node; a PlanDependency edge means the earlier must LAND before the later can COMPLETE (not before it can START — overlap is the point). parallelism: ForciblySerial = one lane on the critical path; FanOutWide = width-many concurrent lanes once prereqs land; DecisionGate = zero-cost operator ruling. Estimates are lane-days low..high, honest not promised." +data v1_deletion_plan_doc: String = "Roadmap to v2-self-hosted with v1 deleted (operator target 2026-07-19: ~2 weeks). THIS FILE IS THE PLAN AUTHORITY — the self-host artifact (selfhost-dashboard.html) is a PROJECTION of it (delta-first: edit here, re-render there; DESIGN section 3 single authority). The bar is THREE GATES: v1 deletes when ALL THREE read done — Gate 1 (GateEmitterFixedPoint) = the emitter re-emits itself as a behavioral 2-generation fixed point, NOT byte identity; Gate 2 (GateHonestFrontier) = every compiler module is SelfEmitted or SeedRetained(reason, migration_trigger), wall-enforced, no orphaned-enrollment lie; Gate 3 (GateLedgerGreen) = the proactive verification ledger green BY EXECUTION (cold whole-corpus v1-vs-v2 parity + compile-clean parity + regen fixed point + per-family receipts), no calendar soak. GateDeletion holds the cutover + delete actions downstream of all three. This is NOT '27/27 modules flipped' — some modules stay SeedRetained by necessity (the host-effect/bootstrap kernel, self_host.dag flips last). Each milestone is a BRICK placed under a gate; brick_state = Placed | InFlight | Gated; every brick carries a ConfidenceBasis (basis = why we believe it closes, risk = what would falsify it, antagonize = the probe/receipt that attacks it) so the plan is attackable item by item — that is the deliverable. A milestone is a node; a PlanDependency edge means the earlier must LAND before the later can COMPLETE (not before it can START — overlap is the point). parallelism: ForciblySerial = one lane on the critical path; FanOutWide = width-many concurrent lanes once prereqs land; DecisionGate = zero-cost operator ruling. Estimates are lane-days low..high, honest not promised." type PlanParallelism = ForciblySerial | FanOutWide | DecisionGate @@ -43,7 +43,7 @@ type PlanDependency { data v1_deletion_gates: List = [ PlanGateSpec { gate: GateEmitterFixedPoint, name: "Gate 1 — the emitter re-emits itself", proves: "The v2 .dag emitter, emitted to Rust and rebuilt, is behaviorally equivalent to the seed on a discriminating corpus (a 2-generation fixed point, not byte identity — byte-fixpoint is an explicit non-goal because it would cement the seed's warts). This is THE critical path: until the emitter can emit itself, there is no v2 to delete v1 in favor of." }, - PlanGateSpec { gate: GateHonestFrontier, name: "Gate 2 — honest typed frontier", proves: "Every one of the 27 compiler modules is a typed row: SelfEmitted (green by execution) or SeedRetained{reason, migration_trigger} (countable, prioritizable). No silent escape hatch, and no orphaned enrollment (a receipt enrolled but never executed is a lie the wall must catch). The point is not that all 27 self-emit — it is that the frontier tells the TRUTH about which do and why the rest do not." }, + PlanGateSpec { gate: GateHonestFrontier, name: "Gate 2 — honest typed frontier", proves: "Every one of the 27 compiler modules is a typed row: SelfEmitted (green by execution) or SeedRetained(reason, migration_trigger) (countable, prioritizable). No silent escape hatch, and no orphaned enrollment (a receipt enrolled but never executed is a lie the wall must catch). The point is not that all 27 self-emit — it is that the frontier tells the TRUTH about which do and why the rest do not." }, PlanGateSpec { gate: GateLedgerGreen, name: "Gate 3 — verification ledger green by execution", proves: "The proactive verification ledger is green because deliberate runs were EXECUTED — whole-corpus cold v1-vs-v2 witness parity with zero unexplained divergence, compile-clean parity, regen behavioral fixed point, and per-family equals receipts — never because a calendar interval elapsed. No soak: the operator is explicitly suspicious of soaking time as a substitute for a run." }, PlanGateSpec { gate: GateDeletion, name: "Cutover and delete", proves: "Downstream of all three gates: CI floor runs on the v2-emitted path, the seed crates are frozen off the build path (products still build), and finally src/v1 + stage0 are deleted. These are actions that FIRE once the bar reads done; they prove nothing on their own." } ] @@ -57,7 +57,7 @@ data v1_deletion_milestones: List = [ PlanMilestone { id: ^emit_representation_mismatch, title: "Emit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa). The largest emitter peel layer and likely the deepest root (the 'ground each primitive into its realization' open thread at scale)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 8, lane_state: "EXPOSED 2026-07-20 by the confidence-probe antagonizing (quiet-bee #6924 residual histogram once generic-T cleared): E0308 is the dominant residual (~4400/deep module, uniform shape across all three) and was MASKED behind rustc first_error until import-closure + generic-T peeled it open. Owner TBD; couples to the numeric-tower grounding (#5428) generalized to every primitive. This is the layer that makes emitter_fixed_point depth genuinely uncertain — sizing it (E0308 bucketed by mismatching type-pair) is the active antagonizing", confidence: ConfidenceBasis { basis: "The class is identified — E0308 type-mismatch, ~4400/module, UNIFORM shape across 04_infer/06_translate/05_emit, so a single root signature not scattered noise", risk: "It is the model-vs-realization fork (a known deep open thread) surfacing at scale; grounding every primitive into its realization may exceed the 2-week window, so this brick could DOMINATE Gate 1", antagonize: "bucket the ~4400 E0308 by the type pair that mismatches (which modeled type vs which native) to size the true root count — a few root pairs x many sites (tractable) or many roots (deep); quiet-bee producing this next" } }, PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_representation_mismatch (which is itself gated on emit_import_closure_root + generic_t_rendering) (wrap_decision #6776 + std_dup #6876 already cleared). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green", confidence: ConfidenceBasis { basis: "All 8 deep modules already emit 0-diagnostics and refuse on the SAME root as the flip wave (TSVs #6916), so the root fix is expected to clear them wholesale, not one-by-one", risk: "A deep module (especially 04_infer, the generic-heavy one) hits a THIRD layer past import-closure + generic-T", antagonize: "the confidence-probe peel-ahead hacks past both known roots on a throwaway branch to surface layer 3 BEFORE the lanes commit" } }, PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on deep_module_lanes. Byte-fixpoint is an explicit NON-goal (it would force v2 to reproduce the seed's warts); the bar is behavioral equivalence on a discriminating corpus", confidence: ConfidenceBasis { basis: "Behavioral equivalence on a discriminating corpus is the operator-set bar; the emit machinery is already proven on the shallow modules that self-emit today", risk: "The emitted emitter diverges from the seed on a discriminating input the corpus does not cover", antagonize: "regen_stage0 --emit-fresh + --verify divergence 0 plus a discriminating RED that goes red when the re-emit is wrong" } }, - PlanMilestone { id: ^typed_frontier, title: "The self-host frontier is a typed row per module: SelfEmitted | SeedRetained{reason, migration_trigger} — no silent escape hatch (the DecodeFidelity/Lossless boundary)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED (src/v2/compiler/self_host/frontier.dag). Each compiler module is a FrontierQualifiedModuleBinding with a disposition; SeedRetained carries reason + migration_trigger, so a seed-retained module is countable and prioritizable, never a silent hole", confidence: ConfidenceBasis { basis: "frontier.dag exists and every module is a typed row with a disposition; the Lossless boundary is modeled", risk: "The disposition enum admits a state that reads honest but is not (SelfEmitted with a dead receipt, or a stale SeedRetained reason)", antagonize: "the no_frontier_lies wall plus the frontier audit (confidence-probe Phase 2) attack exactly that gap" } }, + PlanMilestone { id: ^typed_frontier, title: "The self-host frontier is a typed row per module: SelfEmitted | SeedRetained(reason, migration_trigger) — no silent escape hatch (the DecodeFidelity/Lossless boundary)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED (src/v2/compiler/self_host/frontier.dag). Each compiler module is a FrontierQualifiedModuleBinding with a disposition; SeedRetained carries reason + migration_trigger, so a seed-retained module is countable and prioritizable, never a silent hole", confidence: ConfidenceBasis { basis: "frontier.dag exists and every module is a typed row with a disposition; the Lossless boundary is modeled", risk: "The disposition enum admits a state that reads honest but is not (SelfEmitted with a dead receipt, or a stale SeedRetained reason)", antagonize: "the no_frontier_lies wall plus the frontier audit (confidence-probe Phase 2) attack exactly that gap" } }, PlanMilestone { id: ^frontier_dispositioned, title: "All 27 compiler modules dispositioned: 6 SelfEmitted (03_body_producer, 03_normalize, 07_target_carriers, discovery_enumeration, parse_engine_hooks, use_site_verdict) + 21 SeedRetained, each with a reason + trigger. The bar is NOT 27/27 SelfEmitted — some stay SeedRetained by necessity", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — 27/27 rows present in frontier.dag (count SelfEmitted vs SeedRetained there for the live number). The host-effect kernel, bootstrap, and self_host.dag itself stay SeedRetained by necessity; the flip wave (probe_flip_fanout) grows the SelfEmitted count but is seed-shrink beyond the minimum, not a bar-brick", confidence: ConfidenceBasis { basis: "27 rows counted in frontier.dag; the 6 SelfEmitted are verified by execution", risk: "A SeedRetained reason is stale (the module could self-emit now, so the frontier UNDERSTATES progress) or a SelfEmitted receipt is orphaned (OVERSTATES it)", antagonize: "the frontier audit samples SeedRetained rows for false-retention AND verifies every one of the 6 SelfEmitted receipts actually executes" } }, PlanMilestone { id: ^no_frontier_lies, title: "No orphaned enrollment: every frontier receipt names an EXECUTING consumer; an enrolled-but-never-run receipt itself reds (the #6856 coverage-by-illusion class)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — the admission invariant (module-identity-storage-binding Phase 0): SelfEmitted receipts run on the falsifier wet cadence; quarantined known-red rows run on a probe cadence EXPECTING red so greening is a counted un-quarantine event. 'Enrolled, zero executions' reds", confidence: ConfidenceBasis { basis: "The wall is executable and runs over the corpus, not a grep", risk: "The wall itself goes inert (coverage-by-illusion one level up — a lens that exists but nothing gates on)", antagonize: "the executable hygiene backstop keeps every lens wired-or-deleted; the frontier audit confirms the wall actually fires" } }, PlanMilestone { id: ^trigger_renegotiation, title: "DECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope", gate: GateHonestFrontier, brick_state: InFlight, parallelism: DecisionGate, fan_width: 1, days_low: 0, days_high: 0, lane_state: "RESOLVED 2026-07-20 (operator): do NOT wait on the namespace terminal — it is dragging. Renegotiate 03_resolve/03_name_resolve + body-producer tail triggers to emit under the current design with a declared later re-emit; the frontier-row renegotiation rides the flip-wave refresh", confidence: ConfidenceBasis { basis: "Operator-decided; the decision is made, only the mechanical frontier-row update remains", risk: "The row update lags and leaves a stale trigger on the frontier", antagonize: "the flip-wave refresh updates the rows and the no_frontier_lies wall catches a stale trigger" } }, From 7940484545aaf4138b12b59863231c5a91de383c Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 16:05:22 +0000 Subject: [PATCH 06/32] Fix parse error in roadmap: in-string braces trigger string interpolation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cycle-5 remodel put literal braces in prose strings (SeedRetained{reason, migration_trigger}). In the seed grammar `{...}` inside a string is interpolation (render.dag escapes them as \{ \}; the seed has ExprStringInterp), so `{reason, migration_trigger}` parsed as an interpolation expression and blew the top-level item parser: "expected item declaration". The known-good cycle-4 file had zero in-string braces. Fix: replaced the 3 occurrences with parens — SeedRetained(reason, migration_trigger). Verified by execution with a discriminating control: v1_src_dag_parse reds the pre-fix version with the exact CI error and greens the fix. Also folds quiet-bee's E0308 type-pair sizing into emit_representation_mismatch: 206 pairs but TOP 5 = 82% (Symbol/String ~2100 = one std fork, FreeMonoid/String ~1038, Vector/FreeMonoid ~150, Optional/Option ~150) — the layer is TRACTABLE (3-4 construction walls at the authority, not 206 one-offs), so Gate-1 depth is now bounded. Risk downgraded from "could dominate Gate 1" accordingly. Co-Authored-By: Claude Fable 5 --- dag/gunbc/v1_deletion_plan.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index 2b8d231def7..12b6c3936cf 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -54,7 +54,7 @@ data v1_deletion_milestones: List = [ PlanMilestone { id: ^emit_import_closure_root, title: "ONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "SINGLE CHAIN-A GATE (operator 2026-07-20: root-cause the closure into ONE derivation, do NOT peel face-by-face; cargo-green + witness-green at ALL times, no mid-peel merges). #6919 (neat-swift-795) pivoted to the comprehensive derivation; DRAFT until representative cargo-green (>=1 nested-struct module + materialization_carriers) AND witness-green (regen --verify divergence 0, witness families stay green). #6906 landed FreeMonoid + std_measure + partial nested-struct (mid-peel; main green, no module flipped)", confidence: ConfidenceBasis { basis: "The closure is a mechanical transitive walk over names the emitted constructs already reference; the representative bar is by-execution on real modules, not first_error", risk: "A residual reference class the walk misses — rustc masks downstream layers behind first_error, so a new layer can surface AFTER the representative bar (FreeMonoid was one layer, falsified as the whole gate)", antagonize: "neat-swift ships the FULL residual rustc histogram (every E-code + count on 02_parse + materialization_carriers) on each layer-clear push, not just first_error; the confidence-probe throwaway branch peels AHEAD past the closure to force-expose layer N+1 before we commit" } }, PlanMilestone { id: ^generic_t_rendering, title: "Generic-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "IN FLIGHT (quiet-bee-205, Pole A-2). E0425 unbound T in 04_infer. Scoped SEPARATELY from emit_import_closure_root (operator 2026-07-20: distinct root). Root located; fix = thread the generic param names into the fold acc-type + refuse an unbound TypeVariable in render_rust_type (construction, never a string-scan of the emitted text)", confidence: ConfidenceBasis { basis: "Root located to the fold acc-type fallback plus render_rust_type; the threading shape is the same as the already-landed #6881 fn_generic_param_names", risk: "Generic-T interleaves with import-closure on the same modules (a fix-order coupling), or is deeper than the 04_infer surface it first showed on", antagonize: "quiet-bee ships the full residual histogram on clear; the peel-ahead branch stacks generic-T ON TOP of the import closure to expose interaction before either commits" } }, PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE + PARTIAL FIX LANDED 2026-07-20 (#6906): all 6 emit 0-diagnostics; FreeMonoid + std_measure module-manifest + partial nested-struct import closure merged (mid-peel). The remaining import-closure layers are absorbed into emit_import_closure_root — this milestone's DIAGNOSIS deliverable is done; the fix continues under that gate", confidence: ConfidenceBasis { basis: "All 6 modules emit 0-diagnostics; the diagnosis deliverable is complete and the residual work is folded into emit_import_closure_root", risk: "0-diagnostics emit is NOT evidence of correct call-shape — a runtime call-shape defect can hide behind a clean compile (compile-clean is arity-blind)", antagonize: "require an EXECUTING-consumer receipt on signature changes, never the 0-diagnostics count alone" } }, - PlanMilestone { id: ^emit_representation_mismatch, title: "Emit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa). The largest emitter peel layer and likely the deepest root (the 'ground each primitive into its realization' open thread at scale)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 8, lane_state: "EXPOSED 2026-07-20 by the confidence-probe antagonizing (quiet-bee #6924 residual histogram once generic-T cleared): E0308 is the dominant residual (~4400/deep module, uniform shape across all three) and was MASKED behind rustc first_error until import-closure + generic-T peeled it open. Owner TBD; couples to the numeric-tower grounding (#5428) generalized to every primitive. This is the layer that makes emitter_fixed_point depth genuinely uncertain — sizing it (E0308 bucketed by mismatching type-pair) is the active antagonizing", confidence: ConfidenceBasis { basis: "The class is identified — E0308 type-mismatch, ~4400/module, UNIFORM shape across 04_infer/06_translate/05_emit, so a single root signature not scattered noise", risk: "It is the model-vs-realization fork (a known deep open thread) surfacing at scale; grounding every primitive into its realization may exceed the 2-week window, so this brick could DOMINATE Gate 1", antagonize: "bucket the ~4400 E0308 by the type pair that mismatches (which modeled type vs which native) to size the true root count — a few root pairs x many sites (tractable) or many roots (deep); quiet-bee producing this next" } }, + PlanMilestone { id: ^emit_representation_mismatch, title: "Emit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "EXPOSED then SIZED 2026-07-20 by the confidence-probe antagonizing (quiet-bee #6924). EXPOSED: E0308 dominates the residual (~4400/deep module, uniform across all three) and was MASKED behind rustc first_error until import-closure + generic-T peeled it open. SIZED (type-pair histogram, n=4261, 206 distinct pairs): TOP 5 pairs = 82 percent — Symbol/String ~2100 sites (ONE fork: v2.std.text String vs host String), FreeMonoid-rope/String ~1038, Vector/FreeMonoid ~150, Optional/Option ~150. TRACTABLE: 3-4 construction walls at the authority, NOT 206 one-offs. Owner TBD; couples to the numeric-tower grounding (#5428) generalized to the remaining primitives", confidence: ConfidenceBasis { basis: "SIZED by execution — 206 pairs but heavily skewed, TOP 5 = 82 percent, and the dominant Symbol/String (~2100 sites) is ONE known section-3 fork (v2.std.text vs host String); so it is a few construction walls times many sites, not many independent roots", risk: "Each wall (Symbol/String, Vector/FreeMonoid, Optional/Option grounding) touches a load-bearing std authority, so it is real grounding work not a one-liner; the ~740 tail sites (18 percent) may hide a few more roots", antagonize: "verified by the same residual histogram dropping toward 0 as each wall lands — Symbol/String first (the 82 percent lever); a stalled count reveals an unmodeled root" } }, PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_representation_mismatch (which is itself gated on emit_import_closure_root + generic_t_rendering) (wrap_decision #6776 + std_dup #6876 already cleared). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green", confidence: ConfidenceBasis { basis: "All 8 deep modules already emit 0-diagnostics and refuse on the SAME root as the flip wave (TSVs #6916), so the root fix is expected to clear them wholesale, not one-by-one", risk: "A deep module (especially 04_infer, the generic-heavy one) hits a THIRD layer past import-closure + generic-T", antagonize: "the confidence-probe peel-ahead hacks past both known roots on a throwaway branch to surface layer 3 BEFORE the lanes commit" } }, PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on deep_module_lanes. Byte-fixpoint is an explicit NON-goal (it would force v2 to reproduce the seed's warts); the bar is behavioral equivalence on a discriminating corpus", confidence: ConfidenceBasis { basis: "Behavioral equivalence on a discriminating corpus is the operator-set bar; the emit machinery is already proven on the shallow modules that self-emit today", risk: "The emitted emitter diverges from the seed on a discriminating input the corpus does not cover", antagonize: "regen_stage0 --emit-fresh + --verify divergence 0 plus a discriminating RED that goes red when the re-emit is wrong" } }, PlanMilestone { id: ^typed_frontier, title: "The self-host frontier is a typed row per module: SelfEmitted | SeedRetained(reason, migration_trigger) — no silent escape hatch (the DecodeFidelity/Lossless boundary)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED (src/v2/compiler/self_host/frontier.dag). Each compiler module is a FrontierQualifiedModuleBinding with a disposition; SeedRetained carries reason + migration_trigger, so a seed-retained module is countable and prioritizable, never a silent hole", confidence: ConfidenceBasis { basis: "frontier.dag exists and every module is a typed row with a disposition; the Lossless boundary is modeled", risk: "The disposition enum admits a state that reads honest but is not (SelfEmitted with a dead receipt, or a stale SeedRetained reason)", antagonize: "the no_frontier_lies wall plus the frontier audit (confidence-probe Phase 2) attack exactly that gap" } }, From 3635cdc94b2d58ced85025def5d4a036485263b9 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 16:24:28 +0000 Subject: [PATCH 07/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/v1_deletion_plan.dag | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index 12b6c3936cf..4cce9ac6fb6 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -97,10 +97,10 @@ data v1_deletion_dependencies: List = [ PlanDependency { before: ^ci_floor_cutover, after: ^v1_quarantine }, PlanDependency { before: ^unresolved_error_diagnosis, after: ^v1_quarantine }, PlanDependency { before: ^trigger_renegotiation, after: ^v1_quarantine }, - PlanDependency { before: ^ledger_projection, after: ^v1_delete }, - PlanDependency { before: ^cold_parity_receipt, after: ^v1_delete }, - PlanDependency { before: ^compile_clean_parity_receipt, after: ^v1_delete }, - PlanDependency { before: ^regen_fixed_point_receipt, after: ^v1_delete }, + PlanDependency { before: ^ledger_projection, after: ^ci_floor_cutover }, + PlanDependency { before: ^cold_parity_receipt, after: ^ci_floor_cutover }, + PlanDependency { before: ^compile_clean_parity_receipt, after: ^ci_floor_cutover }, + PlanDependency { before: ^regen_fixed_point_receipt, after: ^ci_floor_cutover }, PlanDependency { before: ^v1_quarantine, after: ^v1_delete } ] From 3a74767899cb8a64e199c51c0c2e02af2bc678bc Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 16:26:13 +0000 Subject: [PATCH 08/32] Roadmap: wire Gate 3's ledger receipts to gate the cutover (review 40244) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cursor/composer-2.5 REQUEST_CHANGES caught a real §3 gap: the prose (ci_floor_cutover lane_state + critical_path_note) says the cutover is gated on the ledger receipts, but no PlanDependency wired ledger_projection / the 3 spine receipts into ci_floor_cutover — they pointed only at v1_delete. So the modeled DAG allowed CI cutover (and transitively quarantine) before Gate 3 completed. Fix: retarget the 4 Gate-3 receipt edges from v1_delete to ci_floor_cutover, so Gate 3 -> ci_floor_cutover -> v1_quarantine -> v1_delete. Now every Gate-3 receipt transitively gates BOTH quarantine and delete (verified by execution: reachability holds for all 4), with no redundant edge (the old direct receipt->v1_delete edges are subsumed by the chain). Updated v1_quarantine and v1_delete lane_state prose to state the transitive gating explicitly, so a reader of the dependency list cannot treat either as reachable without the ledger green. DAG re-verified acyclic (Kahn over all 23 milestones); parse-checked by execution. Co-Authored-By: Claude Fable 5 --- dag/gunbc/v1_deletion_plan.dag | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index 4cce9ac6fb6..e1f63ec7be3 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -70,8 +70,8 @@ data v1_deletion_milestones: List = [ PlanMilestone { id: ^compile_clean_parity_receipt, title: "Spine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. Compile-clean is already the CI gate for v1; the receipt runs it on the v2 path", confidence: ConfidenceBasis { basis: "Compile-clean is already the v1 CI gate; the receipt just runs it on the v2-emitted path", risk: "0-diagnostics compile is arity-blind — clean does not imply behaviorally equal", antagonize: "paired with cold_parity_receipt (the behavioral leg), never standing alone as the equality claim" } }, PlanMilestone { id: ^regen_fixed_point_receipt, title: "Spine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. The self-host fixed-point step executed as a ledger receipt, scoped at its own closure (regen skip authority)", confidence: ConfidenceBasis { basis: "regen_stage0 --emit-fresh + --verify is the existing self-host proof harness", risk: "The fixed point holds for the emitter but a downstream module regresses", antagonize: "--verify divergence 0 over the FULL regen input set, never a sampled subset" } }, PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on emitter_fixed_point + probe_flip_fanout (the v2-emitted-execution half) + the ledger receipts. witness_family_fanout DONE. This is the cutover ACTION: CI stops using the v1 interpreter and runs the v2-emitted path", confidence: ConfidenceBasis { basis: "The ledger bricks supply the parity evidence; the cutover is the switch once they are green", risk: "The cutover exposes a CI-only path the per-family receipts did not cover", antagonize: "cold_parity_receipt runs the FULL corpus cold, not just the enrolled families" } }, - PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point + ci_floor_cutover + unresolved_error_diagnosis + trigger_renegotiation (all three gates reading done)", confidence: ConfidenceBasis { basis: "Quarantine is a build-path change (freeze the seed crates, ensure nothing depends on them) once all three gates read done", risk: "A product or CI step still references a seed crate", antagonize: "the products-can-build check — verify nothing in CI or products depends on src/v1 before flipping" } }, - PlanMilestone { id: ^v1_delete, title: "Delete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 1, lane_state: "blocked on v1_quarantine + the executed verification ledger (cold parity + compile-clean + regen fixed point + per-family receipts, all green by execution)", confidence: ConfidenceBasis { basis: "A mechanical removal once quarantine holds and the ledger is green BY EXECUTION", risk: "Deleting too early on a soak-substituted green (the operator's explicit worry)", antagonize: "gate on the enumerated executed receipts, never elapsed time — the ledger is the wall" } } + PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point (Gate 1) + ci_floor_cutover (itself gated on Gate 3 — ledger_projection + the 3 spine receipts) + unresolved_error_diagnosis + trigger_renegotiation (Gate 2). So all three gates read done before quarantine, Gate 3 reached transitively through the cutover — the DAG has no path to quarantine that skips the ledger", confidence: ConfidenceBasis { basis: "Quarantine is a build-path change (freeze the seed crates, ensure nothing depends on them) once all three gates read done", risk: "A product or CI step still references a seed crate", antagonize: "the products-can-build check — verify nothing in CI or products depends on src/v1 before flipping" } }, + PlanMilestone { id: ^v1_delete, title: "Delete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 1, lane_state: "blocked on v1_quarantine, which transitively requires the executed verification ledger: Gate 3 (ledger_projection + cold parity + compile-clean + regen fixed point) gates the ci_floor_cutover that gates quarantine, so no DAG path reaches delete without the ledger green by execution (per-family receipts included). No calendar soak", confidence: ConfidenceBasis { basis: "A mechanical removal once quarantine holds and the ledger is green BY EXECUTION", risk: "Deleting too early on a soak-substituted green (the operator's explicit worry)", antagonize: "gate on the enumerated executed receipts, never elapsed time — the ledger is the wall" } } ] data v1_deletion_dependencies: List = [ From 8ae0e8dafff18928ce1e41d695f08a1d612e68ef Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 17:23:00 +0000 Subject: [PATCH 09/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/roadmap_page.dag | 112 +++++++++++++++++++++++++++++++++++- dag/gunbc/roadmap_style.dag | 13 +++++ 2 files changed, 124 insertions(+), 1 deletion(-) diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index 88fabdd281a..b5942f89af0 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -16,9 +16,118 @@ import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, PlainLin import gunbc.roadmap_document { RoadmapDocument, RoadmapSection } import gunbc.roadmap_authority { roadmap_authority, authored_merged_prs } import gunbc.roadmap_spawner { spawn_frontier, SpawnFrontier } +import gunbc.v1_deletion_plan { + v1_deletion_gates, v1_deletion_milestones, PlanGateSpec, PlanMilestone, + PlanGate, GateEmitterFixedPoint, GateHonestFrontier, GateLedgerGreen, GateDeletion, + BrickState, Placed, InFlight, Gated, +} fn roadmap_page_max_depth() -> Int { 8 } +fn gate_index(g: PlanGate) -> Int { + match g { + GateEmitterFixedPoint => 0 + GateHonestFrontier => 1 + GateLedgerGreen => 2 + GateDeletion => 3 + } +} + +fn gate_eq(a: PlanGate, b: PlanGate) -> Bool { gate_index(g: a) == gate_index(g: b) } + +fn brick_is_placed(bs: BrickState) -> Bool { + match bs { + Placed => true + InFlight => false + Gated => false + } +} + +fn brick_is_remaining(bs: BrickState) -> Bool { + match bs { + Placed => false + InFlight => true + Gated => true + } +} + +fn brick_state_class(bs: BrickState) -> String { + match bs { + Placed => "placed" + InFlight => "inflight" + Gated => "gated" + } +} + +fn brick_state_label(bs: BrickState) -> String { + match bs { + Placed => "done" + InFlight => "in flight" + Gated => "gated" + } +} + +fn gate_bricks(g: PlanGate) -> List { + filter(v1_deletion_milestones, m => gate_eq(a: m.gate, b: g)) +} + +fn gate_total(g: PlanGate) -> Int { count(gate_bricks(g: g)) } + +fn gate_placed(g: PlanGate) -> Int { + count(filter(gate_bricks(g: g), m => brick_is_placed(bs: m.brick_state))) +} + +fn gate_percent(placed: Int, total: Int) -> Int { + if total == 0 { 0 } else { placed * 100 / total } +} + +fn gate_count_label(placed: Int, total: Int) -> String { + concat(to_string(placed), concat(" / ", to_string(total))) +} + +fn bar_fill(pct: Int) -> MarkupNode { + ElementNode { + tag: "div", + attrs: [ + MarkupAttr { name: "class", value: "bar-fill" }, + MarkupAttr { name: "style", value: concat("width: ", concat(to_string(pct), "%")) }, + ], + children: [], + } +} + +fn brick_li(m: PlanMilestone) -> MarkupNode { + el_class("li", concat("brick brick-", brick_state_class(bs: m.brick_state)), [ + el_class("span", "brick-state", [ txt(brick_state_label(bs: m.brick_state)) ]), + el_class("span", "brick-title", [ txt(m.title) ]), + ]) +} + +fn gate_remaining_ul(g: PlanGate) -> MarkupNode { + el_class("ul", "bricks", + map(filter(gate_bricks(g: g), m => brick_is_remaining(bs: m.brick_state)), m => brick_li(m: m))) +} + +fn gate_progress_row(spec: PlanGateSpec) -> MarkupNode { + let total = gate_total(g: spec.gate) + let placed = gate_placed(g: spec.gate) + el_class("section", "gate-row", [ + el_class("div", "gate-head", [ + el_class("span", "gate-name", [ txt(spec.name) ]), + el_class("span", "gate-count", [ txt(gate_count_label(placed: placed, total: total)) ]), + ]), + el_class("div", "gate-bar", [ bar_fill(pct: gate_percent(placed: placed, total: total)) ]), + gate_remaining_ul(g: spec.gate), + ]) +} + +fn three_gate_progress_markup() -> MarkupNode { + el_class("section", "three-gate-progress", + concat( + [ el("h2", [ txt("v1-delete bar: three gates") ]) ], + map(v1_deletion_gates, spec => gate_progress_row(spec: spec)))) +} + fn txt(s: String) -> MarkupNode { TextNode { text: s } } fn el(tag: String, children: List) -> MarkupNode { @@ -230,6 +339,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark el("body", [ el("header", [ el("h1", [ txt("gunbc — daily workspace") ]) ]), el_class("main", "daily-workspace", [ + three_gate_progress_markup(), roadmap_frontier_markup(frontier: frontier, merged: merged), ]), ]), @@ -240,7 +350,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark fn roadmap_page(doc: RoadmapDocument, merged: List) -> MarkupNode { let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged)) let secs = map(doc.sections, s => section_markup(s: s, merged: merged)) - let main_children = concat(lead, secs) + let main_children = concat([ three_gate_progress_markup() ], concat(lead, secs)) ElementNode { tag: "html", attrs: [], diff --git a/dag/gunbc/roadmap_style.dag b/dag/gunbc/roadmap_style.dag index 9a590d11a2a..40e03df5ff7 100644 --- a/dag/gunbc/roadmap_style.dag +++ b/dag/gunbc/roadmap_style.dag @@ -47,5 +47,18 @@ fn roadmap_css() -> String { css_rule(selector: ".frontier-ready h2", props: "color: #856404"), css_rule(selector: ".frontier-upcoming h2", props: "color: #084298"), css_rule(selector: ".frontier-done h2", props: "color: #0a3622"), + css_rule(selector: ".three-gate-progress", props: "display: flex; flex-direction: column; gap: 12px; margin-bottom: 24px"), + css_rule(selector: ".three-gate-progress h2", props: "margin: 0 0 4px"), + css_rule(selector: ".gate-row", props: "border: 1px solid #e0e0e0; border-radius: 6px; padding: 12px 16px; background: #fff"), + css_rule(selector: ".gate-head", props: "display: flex; justify-content: space-between; align-items: baseline; margin-bottom: 6px"), + css_rule(selector: ".gate-name", props: "font-weight: 600; font-size: 14px"), + css_rule(selector: ".gate-count", props: "font-family: ui-monospace, monospace; font-size: 13px; color: #555; font-variant-numeric: tabular-nums"), + css_rule(selector: ".gate-bar", props: "height: 10px; border-radius: 5px; background: #eef1f4; overflow: hidden; margin-bottom: 8px"), + css_rule(selector: ".bar-fill", props: "height: 100%; background: #2da44e"), + css_rule(selector: "ul.bricks", props: "list-style: none; padding-left: 0; display: flex; flex-direction: column; gap: 3px"), + css_rule(selector: "li.brick", props: "font-size: 12px; padding: 1px 0; color: #444; display: flex; align-items: baseline"), + css_rule(selector: ".brick-state", props: "display: inline-block; flex: 0 0 auto; width: 62px; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.03em; margin-right: 8px"), + css_rule(selector: ".brick-inflight .brick-state", props: "color: #9a6700"), + css_rule(selector: ".brick-gated .brick-state", props: "color: #999"), ], "\n") } From 773e9a9dc93cdac73cffad1d131e220a6c7da59a Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 17:33:30 +0000 Subject: [PATCH 10/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/test/claim/zzz_daily_probe.dag | 42 ++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 dag/test/claim/zzz_daily_probe.dag diff --git a/dag/test/claim/zzz_daily_probe.dag b/dag/test/claim/zzz_daily_probe.dag new file mode 100644 index 00000000000..4399154a9ba --- /dev/null +++ b/dag/test/claim/zzz_daily_probe.dag @@ -0,0 +1,42 @@ +module test.claim.zzz_daily_probe + +import gunbc.roadmap_page { + roadmap_daily_workspace_page_for_authority, + roadmap_page_for_authority, + three_gate_progress_markup, +} +import extdeps.languages.html { EmitOk, EmitRejected, try_serialize_html_source } +import std.markup { MarkupNode, ElementNode, MarkupAttr } + +fn zzz_three_gate_html() -> String { + match try_serialize_html_source(node: ElementNode { tag: "div", attrs: [], children: [three_gate_progress_markup()] }) { + EmitOk { html: h } => h + EmitRejected { reason: r } => concat("REJECTED:", r) + } +} + +fn witness_zzz_three_gate_alone() -> Bool { + string_contains(s: zzz_three_gate_html(), pattern: "gate-row") +} + +fn zzz_daily_html() -> String { + match try_serialize_html_source(node: roadmap_daily_workspace_page_for_authority()) { + EmitOk { html: h } => h + EmitRejected { reason: r } => concat("REJECTED:", r) + } +} + +fn witness_zzz_daily_page() -> Bool { + string_contains(s: zzz_daily_html(), pattern: "three-gate-progress") +} + +fn zzz_roadmap_html() -> String { + match try_serialize_html_source(node: roadmap_page_for_authority()) { + EmitOk { html: h } => h + EmitRejected { reason: r } => concat("REJECTED:", r) + } +} + +fn witness_zzz_roadmap_page() -> Bool { + string_contains(s: zzz_roadmap_html(), pattern: "three-gate-progress") +} From e2fbaf6de0f19da1e63140df4aa66ddb4443ea37 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 17:44:00 +0000 Subject: [PATCH 11/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/roadmap_page.dag | 3 +-- dag/test/claim/zzz_daily_probe.dag | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index b5942f89af0..b1508fb9fe1 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -339,7 +339,6 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark el("body", [ el("header", [ el("h1", [ txt("gunbc — daily workspace") ]) ]), el_class("main", "daily-workspace", [ - three_gate_progress_markup(), roadmap_frontier_markup(frontier: frontier, merged: merged), ]), ]), @@ -350,7 +349,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark fn roadmap_page(doc: RoadmapDocument, merged: List) -> MarkupNode { let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged)) let secs = map(doc.sections, s => section_markup(s: s, merged: merged)) - let main_children = concat([ three_gate_progress_markup() ], concat(lead, secs)) + let main_children = concat(lead, secs) ElementNode { tag: "html", attrs: [], diff --git a/dag/test/claim/zzz_daily_probe.dag b/dag/test/claim/zzz_daily_probe.dag index 4399154a9ba..62529273901 100644 --- a/dag/test/claim/zzz_daily_probe.dag +++ b/dag/test/claim/zzz_daily_probe.dag @@ -5,9 +5,33 @@ import gunbc.roadmap_page { roadmap_page_for_authority, three_gate_progress_markup, } +import gunbc.node_http_server_emit { roadmap_dashboard_served_static_route_table } +import gunbc.live_deploy.emit { expected_live_deploy_apply_script } +import gunbc.generated_artifact { + GeneratedArtifact, RunnerDeployArtifact, LiveDeployRetractScriptArtifact, + LiveDeployApplyScriptArtifact, RoadmapArtifact, +} +import gunbc.generated_artifact_emit { artifact_generate } import extdeps.languages.html { EmitOk, EmitRejected, try_serialize_html_source } import std.markup { MarkupNode, ElementNode, MarkupAttr } +fn witness_zzz_apply_script_gen() -> Bool { + string_contains(s: expected_live_deploy_apply_script(), pattern: "server.js") +} + +fn witness_zzz_route_table() -> Bool { + count(roadmap_dashboard_served_static_route_table().routes) == 5 +} + +fn zzz_gen_ok(a: GeneratedArtifact) -> Bool { + artifact_generate(a: a) == artifact_generate(a: a) +} + +fn witness_zzz_runner_deploy_gen() -> Bool { zzz_gen_ok(a: RunnerDeployArtifact) } +fn witness_zzz_retract_gen() -> Bool { zzz_gen_ok(a: LiveDeployRetractScriptArtifact) } +fn witness_zzz_apply_via_artifact() -> Bool { zzz_gen_ok(a: LiveDeployApplyScriptArtifact) } +fn witness_zzz_roadmap_md_gen() -> Bool { zzz_gen_ok(a: RoadmapArtifact) } + fn zzz_three_gate_html() -> String { match try_serialize_html_source(node: ElementNode { tag: "div", attrs: [], children: [three_gate_progress_markup()] }) { EmitOk { html: h } => h From ce909b61b7d79386f409ba7ba5ab68046b8e31c2 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 17:54:31 +0000 Subject: [PATCH 12/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/roadmap_page.dag | 55 +++++++++++++------------ dag/test/claim/zzz_daily_probe.dag | 66 ------------------------------ 2 files changed, 28 insertions(+), 93 deletions(-) delete mode 100644 dag/test/claim/zzz_daily_probe.dag diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index b1508fb9fe1..04596def74c 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -24,7 +24,7 @@ import gunbc.v1_deletion_plan { fn roadmap_page_max_depth() -> Int { 8 } -fn gate_index(g: PlanGate) -> Int { +fn tg_gate_index(g: PlanGate) -> Int { match g { GateEmitterFixedPoint => 0 GateHonestFrontier => 1 @@ -33,9 +33,9 @@ fn gate_index(g: PlanGate) -> Int { } } -fn gate_eq(a: PlanGate, b: PlanGate) -> Bool { gate_index(g: a) == gate_index(g: b) } +fn tg_gate_eq(a: PlanGate, b: PlanGate) -> Bool { tg_gate_index(g: a) == tg_gate_index(g: b) } -fn brick_is_placed(bs: BrickState) -> Bool { +fn tg_brick_is_placed(bs: BrickState) -> Bool { match bs { Placed => true InFlight => false @@ -43,7 +43,7 @@ fn brick_is_placed(bs: BrickState) -> Bool { } } -fn brick_is_remaining(bs: BrickState) -> Bool { +fn tg_brick_is_remaining(bs: BrickState) -> Bool { match bs { Placed => false InFlight => true @@ -51,7 +51,7 @@ fn brick_is_remaining(bs: BrickState) -> Bool { } } -fn brick_state_class(bs: BrickState) -> String { +fn tg_brick_state_class(bs: BrickState) -> String { match bs { Placed => "placed" InFlight => "inflight" @@ -59,7 +59,7 @@ fn brick_state_class(bs: BrickState) -> String { } } -fn brick_state_label(bs: BrickState) -> String { +fn tg_brick_state_label(bs: BrickState) -> String { match bs { Placed => "done" InFlight => "in flight" @@ -67,25 +67,25 @@ fn brick_state_label(bs: BrickState) -> String { } } -fn gate_bricks(g: PlanGate) -> List { - filter(v1_deletion_milestones, m => gate_eq(a: m.gate, b: g)) +fn tg_gate_bricks(g: PlanGate) -> List { + filter(v1_deletion_milestones, m => tg_gate_eq(a: m.gate, b: g)) } -fn gate_total(g: PlanGate) -> Int { count(gate_bricks(g: g)) } +fn tg_gate_total(g: PlanGate) -> Int { count(tg_gate_bricks(g: g)) } -fn gate_placed(g: PlanGate) -> Int { - count(filter(gate_bricks(g: g), m => brick_is_placed(bs: m.brick_state))) +fn tg_gate_placed(g: PlanGate) -> Int { + count(filter(tg_gate_bricks(g: g), m => tg_brick_is_placed(bs: m.brick_state))) } -fn gate_percent(placed: Int, total: Int) -> Int { +fn tg_gate_percent(placed: Int, total: Int) -> Int { if total == 0 { 0 } else { placed * 100 / total } } -fn gate_count_label(placed: Int, total: Int) -> String { +fn tg_gate_count_label(placed: Int, total: Int) -> String { concat(to_string(placed), concat(" / ", to_string(total))) } -fn bar_fill(pct: Int) -> MarkupNode { +fn tg_bar_fill(pct: Int) -> MarkupNode { ElementNode { tag: "div", attrs: [ @@ -96,28 +96,28 @@ fn bar_fill(pct: Int) -> MarkupNode { } } -fn brick_li(m: PlanMilestone) -> MarkupNode { - el_class("li", concat("brick brick-", brick_state_class(bs: m.brick_state)), [ - el_class("span", "brick-state", [ txt(brick_state_label(bs: m.brick_state)) ]), +fn tg_brick_li(m: PlanMilestone) -> MarkupNode { + el_class("li", concat("brick brick-", tg_brick_state_class(bs: m.brick_state)), [ + el_class("span", "brick-state", [ txt(tg_brick_state_label(bs: m.brick_state)) ]), el_class("span", "brick-title", [ txt(m.title) ]), ]) } -fn gate_remaining_ul(g: PlanGate) -> MarkupNode { +fn tg_gate_remaining_ul(g: PlanGate) -> MarkupNode { el_class("ul", "bricks", - map(filter(gate_bricks(g: g), m => brick_is_remaining(bs: m.brick_state)), m => brick_li(m: m))) + map(filter(tg_gate_bricks(g: g), m => tg_brick_is_remaining(bs: m.brick_state)), m => tg_brick_li(m: m))) } -fn gate_progress_row(spec: PlanGateSpec) -> MarkupNode { - let total = gate_total(g: spec.gate) - let placed = gate_placed(g: spec.gate) +fn tg_gate_progress_row(spec: PlanGateSpec) -> MarkupNode { + let total = tg_gate_total(g: spec.gate) + let placed = tg_gate_placed(g: spec.gate) el_class("section", "gate-row", [ el_class("div", "gate-head", [ el_class("span", "gate-name", [ txt(spec.name) ]), - el_class("span", "gate-count", [ txt(gate_count_label(placed: placed, total: total)) ]), + el_class("span", "gate-count", [ txt(tg_gate_count_label(placed: placed, total: total)) ]), ]), - el_class("div", "gate-bar", [ bar_fill(pct: gate_percent(placed: placed, total: total)) ]), - gate_remaining_ul(g: spec.gate), + el_class("div", "gate-bar", [ tg_bar_fill(pct: tg_gate_percent(placed: placed, total: total)) ]), + tg_gate_remaining_ul(g: spec.gate), ]) } @@ -125,7 +125,7 @@ fn three_gate_progress_markup() -> MarkupNode { el_class("section", "three-gate-progress", concat( [ el("h2", [ txt("v1-delete bar: three gates") ]) ], - map(v1_deletion_gates, spec => gate_progress_row(spec: spec)))) + map(v1_deletion_gates, spec => tg_gate_progress_row(spec: spec)))) } fn txt(s: String) -> MarkupNode { TextNode { text: s } } @@ -339,6 +339,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark el("body", [ el("header", [ el("h1", [ txt("gunbc — daily workspace") ]) ]), el_class("main", "daily-workspace", [ + three_gate_progress_markup(), roadmap_frontier_markup(frontier: frontier, merged: merged), ]), ]), @@ -349,7 +350,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark fn roadmap_page(doc: RoadmapDocument, merged: List) -> MarkupNode { let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged)) let secs = map(doc.sections, s => section_markup(s: s, merged: merged)) - let main_children = concat(lead, secs) + let main_children = concat([ three_gate_progress_markup() ], concat(lead, secs)) ElementNode { tag: "html", attrs: [], diff --git a/dag/test/claim/zzz_daily_probe.dag b/dag/test/claim/zzz_daily_probe.dag deleted file mode 100644 index 62529273901..00000000000 --- a/dag/test/claim/zzz_daily_probe.dag +++ /dev/null @@ -1,66 +0,0 @@ -module test.claim.zzz_daily_probe - -import gunbc.roadmap_page { - roadmap_daily_workspace_page_for_authority, - roadmap_page_for_authority, - three_gate_progress_markup, -} -import gunbc.node_http_server_emit { roadmap_dashboard_served_static_route_table } -import gunbc.live_deploy.emit { expected_live_deploy_apply_script } -import gunbc.generated_artifact { - GeneratedArtifact, RunnerDeployArtifact, LiveDeployRetractScriptArtifact, - LiveDeployApplyScriptArtifact, RoadmapArtifact, -} -import gunbc.generated_artifact_emit { artifact_generate } -import extdeps.languages.html { EmitOk, EmitRejected, try_serialize_html_source } -import std.markup { MarkupNode, ElementNode, MarkupAttr } - -fn witness_zzz_apply_script_gen() -> Bool { - string_contains(s: expected_live_deploy_apply_script(), pattern: "server.js") -} - -fn witness_zzz_route_table() -> Bool { - count(roadmap_dashboard_served_static_route_table().routes) == 5 -} - -fn zzz_gen_ok(a: GeneratedArtifact) -> Bool { - artifact_generate(a: a) == artifact_generate(a: a) -} - -fn witness_zzz_runner_deploy_gen() -> Bool { zzz_gen_ok(a: RunnerDeployArtifact) } -fn witness_zzz_retract_gen() -> Bool { zzz_gen_ok(a: LiveDeployRetractScriptArtifact) } -fn witness_zzz_apply_via_artifact() -> Bool { zzz_gen_ok(a: LiveDeployApplyScriptArtifact) } -fn witness_zzz_roadmap_md_gen() -> Bool { zzz_gen_ok(a: RoadmapArtifact) } - -fn zzz_three_gate_html() -> String { - match try_serialize_html_source(node: ElementNode { tag: "div", attrs: [], children: [three_gate_progress_markup()] }) { - EmitOk { html: h } => h - EmitRejected { reason: r } => concat("REJECTED:", r) - } -} - -fn witness_zzz_three_gate_alone() -> Bool { - string_contains(s: zzz_three_gate_html(), pattern: "gate-row") -} - -fn zzz_daily_html() -> String { - match try_serialize_html_source(node: roadmap_daily_workspace_page_for_authority()) { - EmitOk { html: h } => h - EmitRejected { reason: r } => concat("REJECTED:", r) - } -} - -fn witness_zzz_daily_page() -> Bool { - string_contains(s: zzz_daily_html(), pattern: "three-gate-progress") -} - -fn zzz_roadmap_html() -> String { - match try_serialize_html_source(node: roadmap_page_for_authority()) { - EmitOk { html: h } => h - EmitRejected { reason: r } => concat("REJECTED:", r) - } -} - -fn witness_zzz_roadmap_page() -> Bool { - string_contains(s: zzz_roadmap_html(), pattern: "three-gate-progress") -} From 62d7915815c6b98ec342ca631f7fcf4be7d6f23e Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 18:33:32 +0000 Subject: [PATCH 13/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/roadmap_page.dag | 112 +------------------------------------ 1 file changed, 1 insertion(+), 111 deletions(-) diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index 04596def74c..88fabdd281a 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -16,118 +16,9 @@ import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, PlainLin import gunbc.roadmap_document { RoadmapDocument, RoadmapSection } import gunbc.roadmap_authority { roadmap_authority, authored_merged_prs } import gunbc.roadmap_spawner { spawn_frontier, SpawnFrontier } -import gunbc.v1_deletion_plan { - v1_deletion_gates, v1_deletion_milestones, PlanGateSpec, PlanMilestone, - PlanGate, GateEmitterFixedPoint, GateHonestFrontier, GateLedgerGreen, GateDeletion, - BrickState, Placed, InFlight, Gated, -} fn roadmap_page_max_depth() -> Int { 8 } -fn tg_gate_index(g: PlanGate) -> Int { - match g { - GateEmitterFixedPoint => 0 - GateHonestFrontier => 1 - GateLedgerGreen => 2 - GateDeletion => 3 - } -} - -fn tg_gate_eq(a: PlanGate, b: PlanGate) -> Bool { tg_gate_index(g: a) == tg_gate_index(g: b) } - -fn tg_brick_is_placed(bs: BrickState) -> Bool { - match bs { - Placed => true - InFlight => false - Gated => false - } -} - -fn tg_brick_is_remaining(bs: BrickState) -> Bool { - match bs { - Placed => false - InFlight => true - Gated => true - } -} - -fn tg_brick_state_class(bs: BrickState) -> String { - match bs { - Placed => "placed" - InFlight => "inflight" - Gated => "gated" - } -} - -fn tg_brick_state_label(bs: BrickState) -> String { - match bs { - Placed => "done" - InFlight => "in flight" - Gated => "gated" - } -} - -fn tg_gate_bricks(g: PlanGate) -> List { - filter(v1_deletion_milestones, m => tg_gate_eq(a: m.gate, b: g)) -} - -fn tg_gate_total(g: PlanGate) -> Int { count(tg_gate_bricks(g: g)) } - -fn tg_gate_placed(g: PlanGate) -> Int { - count(filter(tg_gate_bricks(g: g), m => tg_brick_is_placed(bs: m.brick_state))) -} - -fn tg_gate_percent(placed: Int, total: Int) -> Int { - if total == 0 { 0 } else { placed * 100 / total } -} - -fn tg_gate_count_label(placed: Int, total: Int) -> String { - concat(to_string(placed), concat(" / ", to_string(total))) -} - -fn tg_bar_fill(pct: Int) -> MarkupNode { - ElementNode { - tag: "div", - attrs: [ - MarkupAttr { name: "class", value: "bar-fill" }, - MarkupAttr { name: "style", value: concat("width: ", concat(to_string(pct), "%")) }, - ], - children: [], - } -} - -fn tg_brick_li(m: PlanMilestone) -> MarkupNode { - el_class("li", concat("brick brick-", tg_brick_state_class(bs: m.brick_state)), [ - el_class("span", "brick-state", [ txt(tg_brick_state_label(bs: m.brick_state)) ]), - el_class("span", "brick-title", [ txt(m.title) ]), - ]) -} - -fn tg_gate_remaining_ul(g: PlanGate) -> MarkupNode { - el_class("ul", "bricks", - map(filter(tg_gate_bricks(g: g), m => tg_brick_is_remaining(bs: m.brick_state)), m => tg_brick_li(m: m))) -} - -fn tg_gate_progress_row(spec: PlanGateSpec) -> MarkupNode { - let total = tg_gate_total(g: spec.gate) - let placed = tg_gate_placed(g: spec.gate) - el_class("section", "gate-row", [ - el_class("div", "gate-head", [ - el_class("span", "gate-name", [ txt(spec.name) ]), - el_class("span", "gate-count", [ txt(tg_gate_count_label(placed: placed, total: total)) ]), - ]), - el_class("div", "gate-bar", [ tg_bar_fill(pct: tg_gate_percent(placed: placed, total: total)) ]), - tg_gate_remaining_ul(g: spec.gate), - ]) -} - -fn three_gate_progress_markup() -> MarkupNode { - el_class("section", "three-gate-progress", - concat( - [ el("h2", [ txt("v1-delete bar: three gates") ]) ], - map(v1_deletion_gates, spec => tg_gate_progress_row(spec: spec)))) -} - fn txt(s: String) -> MarkupNode { TextNode { text: s } } fn el(tag: String, children: List) -> MarkupNode { @@ -339,7 +230,6 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark el("body", [ el("header", [ el("h1", [ txt("gunbc — daily workspace") ]) ]), el_class("main", "daily-workspace", [ - three_gate_progress_markup(), roadmap_frontier_markup(frontier: frontier, merged: merged), ]), ]), @@ -350,7 +240,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark fn roadmap_page(doc: RoadmapDocument, merged: List) -> MarkupNode { let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged)) let secs = map(doc.sections, s => section_markup(s: s, merged: merged)) - let main_children = concat([ three_gate_progress_markup() ], concat(lead, secs)) + let main_children = concat(lead, secs) ElementNode { tag: "html", attrs: [], From b7d98250524984a55a1e7691ce1a9935a68d132a Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 18:44:02 +0000 Subject: [PATCH 14/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/roadmap_page.dag | 112 ++++++++++++++++++++++++++++++++++++- 1 file changed, 111 insertions(+), 1 deletion(-) diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index 88fabdd281a..04596def74c 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -16,9 +16,118 @@ import gunbc.roadmap_status { RoadmapItem, DerivableLine, AuthoredLine, PlainLin import gunbc.roadmap_document { RoadmapDocument, RoadmapSection } import gunbc.roadmap_authority { roadmap_authority, authored_merged_prs } import gunbc.roadmap_spawner { spawn_frontier, SpawnFrontier } +import gunbc.v1_deletion_plan { + v1_deletion_gates, v1_deletion_milestones, PlanGateSpec, PlanMilestone, + PlanGate, GateEmitterFixedPoint, GateHonestFrontier, GateLedgerGreen, GateDeletion, + BrickState, Placed, InFlight, Gated, +} fn roadmap_page_max_depth() -> Int { 8 } +fn tg_gate_index(g: PlanGate) -> Int { + match g { + GateEmitterFixedPoint => 0 + GateHonestFrontier => 1 + GateLedgerGreen => 2 + GateDeletion => 3 + } +} + +fn tg_gate_eq(a: PlanGate, b: PlanGate) -> Bool { tg_gate_index(g: a) == tg_gate_index(g: b) } + +fn tg_brick_is_placed(bs: BrickState) -> Bool { + match bs { + Placed => true + InFlight => false + Gated => false + } +} + +fn tg_brick_is_remaining(bs: BrickState) -> Bool { + match bs { + Placed => false + InFlight => true + Gated => true + } +} + +fn tg_brick_state_class(bs: BrickState) -> String { + match bs { + Placed => "placed" + InFlight => "inflight" + Gated => "gated" + } +} + +fn tg_brick_state_label(bs: BrickState) -> String { + match bs { + Placed => "done" + InFlight => "in flight" + Gated => "gated" + } +} + +fn tg_gate_bricks(g: PlanGate) -> List { + filter(v1_deletion_milestones, m => tg_gate_eq(a: m.gate, b: g)) +} + +fn tg_gate_total(g: PlanGate) -> Int { count(tg_gate_bricks(g: g)) } + +fn tg_gate_placed(g: PlanGate) -> Int { + count(filter(tg_gate_bricks(g: g), m => tg_brick_is_placed(bs: m.brick_state))) +} + +fn tg_gate_percent(placed: Int, total: Int) -> Int { + if total == 0 { 0 } else { placed * 100 / total } +} + +fn tg_gate_count_label(placed: Int, total: Int) -> String { + concat(to_string(placed), concat(" / ", to_string(total))) +} + +fn tg_bar_fill(pct: Int) -> MarkupNode { + ElementNode { + tag: "div", + attrs: [ + MarkupAttr { name: "class", value: "bar-fill" }, + MarkupAttr { name: "style", value: concat("width: ", concat(to_string(pct), "%")) }, + ], + children: [], + } +} + +fn tg_brick_li(m: PlanMilestone) -> MarkupNode { + el_class("li", concat("brick brick-", tg_brick_state_class(bs: m.brick_state)), [ + el_class("span", "brick-state", [ txt(tg_brick_state_label(bs: m.brick_state)) ]), + el_class("span", "brick-title", [ txt(m.title) ]), + ]) +} + +fn tg_gate_remaining_ul(g: PlanGate) -> MarkupNode { + el_class("ul", "bricks", + map(filter(tg_gate_bricks(g: g), m => tg_brick_is_remaining(bs: m.brick_state)), m => tg_brick_li(m: m))) +} + +fn tg_gate_progress_row(spec: PlanGateSpec) -> MarkupNode { + let total = tg_gate_total(g: spec.gate) + let placed = tg_gate_placed(g: spec.gate) + el_class("section", "gate-row", [ + el_class("div", "gate-head", [ + el_class("span", "gate-name", [ txt(spec.name) ]), + el_class("span", "gate-count", [ txt(tg_gate_count_label(placed: placed, total: total)) ]), + ]), + el_class("div", "gate-bar", [ tg_bar_fill(pct: tg_gate_percent(placed: placed, total: total)) ]), + tg_gate_remaining_ul(g: spec.gate), + ]) +} + +fn three_gate_progress_markup() -> MarkupNode { + el_class("section", "three-gate-progress", + concat( + [ el("h2", [ txt("v1-delete bar: three gates") ]) ], + map(v1_deletion_gates, spec => tg_gate_progress_row(spec: spec)))) +} + fn txt(s: String) -> MarkupNode { TextNode { text: s } } fn el(tag: String, children: List) -> MarkupNode { @@ -230,6 +339,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark el("body", [ el("header", [ el("h1", [ txt("gunbc — daily workspace") ]) ]), el_class("main", "daily-workspace", [ + three_gate_progress_markup(), roadmap_frontier_markup(frontier: frontier, merged: merged), ]), ]), @@ -240,7 +350,7 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark fn roadmap_page(doc: RoadmapDocument, merged: List) -> MarkupNode { let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged)) let secs = map(doc.sections, s => section_markup(s: s, merged: merged)) - let main_children = concat(lead, secs) + let main_children = concat([ three_gate_progress_markup() ], concat(lead, secs)) ElementNode { tag: "html", attrs: [], From d6c7bb0cbe74eab679cdf4db72a44a85410a5a9a Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 19:14:03 +0000 Subject: [PATCH 15/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/tools/zzz_regen_apply.dag | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 dag/tools/zzz_regen_apply.dag diff --git a/dag/tools/zzz_regen_apply.dag b/dag/tools/zzz_regen_apply.dag new file mode 100644 index 00000000000..6ce4c97fbf5 --- /dev/null +++ b/dag/tools/zzz_regen_apply.dag @@ -0,0 +1,15 @@ +module tools.zzz_regen_apply + +import extdeps.filesystem.filesystem_io { Filesystem } +import gunbc.live_deploy.emit { expected_live_deploy_apply_script, expected_live_deploy_retract_script } +import std.process { ProcessExit, ExitSuccess, exit_failure } + +func regen_live_deploy_goldens() -> ProcessExit { + let a = Filesystem.Write(path: ".github/live-deploy-srv1-apply.sh", content: expected_live_deploy_apply_script()) + if a.success { + let r = Filesystem.Write(path: ".github/live-deploy-srv1-retract.sh", content: expected_live_deploy_retract_script()) + if r.success { ExitSuccess } else { exit_failure(reason: concat("retract write failed: ", r.error)) } + } else { + exit_failure(reason: concat("apply write failed: ", a.error)) + } +} From 1f2818cdc922be1b26d231fb9031a044b701da5c Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 19:45:34 +0000 Subject: [PATCH 16/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/roadmap_page.dag | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index 04596def74c..0d3a1de1f92 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -325,7 +325,7 @@ fn roadmap_frontier_markup(frontier: SpawnFrontier, merged: List) -> Markup ]) } -fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> MarkupNode { +fn roadmap_daily_workspace_page_impl(doc: RoadmapDocument, merged: List, main_prefix: List) -> MarkupNode { let frontier = spawn_frontier(doc: doc, merged: merged) ElementNode { tag: "html", @@ -338,19 +338,18 @@ fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> Mark ]), el("body", [ el("header", [ el("h1", [ txt("gunbc — daily workspace") ]) ]), - el_class("main", "daily-workspace", [ - three_gate_progress_markup(), + el_class("main", "daily-workspace", concat(main_prefix, [ roadmap_frontier_markup(frontier: frontier, merged: merged), - ]), + ])), ]), ], } } -fn roadmap_page(doc: RoadmapDocument, merged: List) -> MarkupNode { +fn roadmap_page_impl(doc: RoadmapDocument, merged: List, main_prefix: List) -> MarkupNode { let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged)) let secs = map(doc.sections, s => section_markup(s: s, merged: merged)) - let main_children = concat([ three_gate_progress_markup() ], concat(lead, secs)) + let main_children = concat(main_prefix, concat(lead, secs)) ElementNode { tag: "html", attrs: [], From 9430d96f61a339273b29cc9fb5c61a03ca6f28d9 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 19:56:05 +0000 Subject: [PATCH 17/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/gunbc/roadmap_page.dag | 12 ++++++++++-- dag/test/claim/roadmap_page_witness_test.dag | 9 +++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index 0d3a1de1f92..2abc21e0009 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -367,10 +367,18 @@ fn roadmap_page_impl(doc: RoadmapDocument, merged: List, main_prefix: List< } } +fn roadmap_page(doc: RoadmapDocument, merged: List) -> MarkupNode { + roadmap_page_impl(doc: doc, merged: merged, main_prefix: []) +} + fn roadmap_page_for_authority() -> MarkupNode { - roadmap_page(doc: roadmap_authority(), merged: authored_merged_prs()) + roadmap_page_impl(doc: roadmap_authority(), merged: authored_merged_prs(), main_prefix: [ three_gate_progress_markup() ]) +} + +fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List) -> MarkupNode { + roadmap_daily_workspace_page_impl(doc: doc, merged: merged, main_prefix: []) } fn roadmap_daily_workspace_page_for_authority() -> MarkupNode { - roadmap_daily_workspace_page(doc: roadmap_authority(), merged: authored_merged_prs()) + roadmap_daily_workspace_page_impl(doc: roadmap_authority(), merged: authored_merged_prs(), main_prefix: [ three_gate_progress_markup() ]) } diff --git a/dag/test/claim/roadmap_page_witness_test.dag b/dag/test/claim/roadmap_page_witness_test.dag index f863885a9bd..e425fac8426 100644 --- a/dag/test/claim/roadmap_page_witness_test.dag +++ b/dag/test/claim/roadmap_page_witness_test.dag @@ -37,6 +37,14 @@ fn witness_authority_differs_from_empty() -> Bool { !(authority_page_html() == empty_doc_html()) } +fn witness_authority_shows_three_gate_progress() -> Bool { + let authority = authority_page_html() + let empty = empty_doc_html() + string_contains(s: authority, pattern: "class=\"three-gate-progress\"") + && string_contains(s: authority, pattern: "v1-delete bar: three gates") + && !string_contains(s: empty, pattern: "class=\"three-gate-progress\"") +} + fn depth_chain_html(fuel: Int) -> String { let parent = gunbc.roadmap_authority.authored(id: "p", done: false, content: "parent-node") let child = gunbc.roadmap_authority.authored(id: "c", done: false, content: "child-node-title") @@ -74,6 +82,7 @@ test fn roadmap_page_keystone_holds() -> Bool { witness_authority_serializes_with_structure() && witness_empty_doc_is_minimal_shell() && witness_authority_differs_from_empty() + && witness_authority_shows_three_gate_progress() && witness_depth_cap_fails_honest() && witness_bold_title_renders_strong() } From 80144e996b883c20cea638ebf977fbc03135fa72 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 20:53:17 +0000 Subject: [PATCH 18/32] Roadmap convergence: three-gate progress on the srv1 dashboard (authority pages only) + regen golden MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Render the v1-delete three-gate progress (Gate 1 emitter fixed point · Gate 2 honest frontier · Gate 3 ledger green) driven from gunbc.v1_deletion_plan on the live srv1 roadmap dashboard `/` and `/roadmap` pages — a single authority, no data duplication. Fixes two CI-red witnesses from the first cut: - roadmap_page_keystone_holds: the three-gate section had been spliced into the GENERIC roadmap_page(doc, merged) renderer, so it injected into every doc incl. the empty test doc, breaking the "empty doc -> empty
" invariant. Three-gate progress is AUTHORITY content (renders v1_deletion_plan), so route it through the _for_authority variants via a private _impl + main_prefix param (authority output byte-identical). Add witness_authority_shows_three_gate_progress as the positive coverage assertion (authority page HAS it; empty page is the discriminating RED control). - live_deploy_emit_holds / witness_apply_script_matches_committed_golden: regenerate .github/live-deploy-srv1-apply.sh so the embedded server.js dashboard pages carry the three-gate content. Proven green by execution: roadmap_page_keystone_holds PASS, live_deploy_emit_holds PASS. Co-Authored-By: Claude Fable 5 --- .github/live-deploy-srv1-apply.sh | 30 ++++++++++++++++++++++++++++-- dag/tools/zzz_regen_apply.dag | 15 --------------- 2 files changed, 28 insertions(+), 17 deletions(-) delete mode 100644 dag/tools/zzz_regen_apply.dag diff --git a/.github/live-deploy-srv1-apply.sh b/.github/live-deploy-srv1-apply.sh index 158c2067205..29af15243a7 100644 --- a/.github/live-deploy-srv1-apply.sh +++ b/.github/live-deploy-srv1-apply.sh @@ -219,7 +219,20 @@ code { background: #f0f0f0; padding: 1px 4px; border-radius: 3px; font-size: 12p .frontier-bucket h2 { font-size: 14px; font-weight: 600; margin: 0 0 8px; text-transform: uppercase; letter-spacing: 0.04em } .frontier-ready h2 { color: #856404 } .frontier-upcoming h2 { color: #084298 } -.frontier-done h2 { color: #0a3622 }gunbc — daily workspace

gunbc — daily workspace

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — daily workspace

gunbc — daily workspace

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — roadmap

gunbc — roadmap

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; +.frontier-done h2 { color: #0a3622 } +.three-gate-progress { display: flex; flex-direction: column; gap: 12px; margin-bottom: 24px } +.three-gate-progress h2 { margin: 0 0 4px } +.gate-row { border: 1px solid #e0e0e0; border-radius: 6px; padding: 12px 16px; background: #fff } +.gate-head { display: flex; justify-content: space-between; align-items: baseline; margin-bottom: 6px } +.gate-name { font-weight: 600; font-size: 14px } +.gate-count { font-family: ui-monospace, monospace; font-size: 13px; color: #555; font-variant-numeric: tabular-nums } +.gate-bar { height: 10px; border-radius: 5px; background: #eef1f4; overflow: hidden; margin-bottom: 8px } +.bar-fill { height: 100%; background: #2da44e } +ul.bricks { list-style: none; padding-left: 0; display: flex; flex-direction: column; gap: 3px } +li.brick { font-size: 12px; padding: 1px 0; color: #444; display: flex; align-items: baseline } +.brick-state { display: inline-block; flex: 0 0 auto; width: 62px; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.03em; margin-right: 8px } +.brick-inflight .brick-state { color: #9a6700 } +.brick-gated .brick-state { color: #999 }gunbc — roadmap

gunbc — roadmap

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; const server = require('http').createServer((req, res) => { const method = req.method || 'GET'; const rawUrl = req.url || '/'; const path = rawUrl.split('?')[0] || '/'; diff --git a/dag/tools/zzz_regen_apply.dag b/dag/tools/zzz_regen_apply.dag deleted file mode 100644 index 6ce4c97fbf5..00000000000 --- a/dag/tools/zzz_regen_apply.dag +++ /dev/null @@ -1,15 +0,0 @@ -module tools.zzz_regen_apply - -import extdeps.filesystem.filesystem_io { Filesystem } -import gunbc.live_deploy.emit { expected_live_deploy_apply_script, expected_live_deploy_retract_script } -import std.process { ProcessExit, ExitSuccess, exit_failure } - -func regen_live_deploy_goldens() -> ProcessExit { - let a = Filesystem.Write(path: ".github/live-deploy-srv1-apply.sh", content: expected_live_deploy_apply_script()) - if a.success { - let r = Filesystem.Write(path: ".github/live-deploy-srv1-retract.sh", content: expected_live_deploy_retract_script()) - if r.success { ExitSuccess } else { exit_failure(reason: concat("retract write failed: ", r.error)) } - } else { - exit_failure(reason: concat("apply write failed: ", a.error)) - } -} From f919317cac32aee0ab3b6f8cbc788a51f288058c Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 22:18:31 +0000 Subject: [PATCH 19/32] Resolve #6942 merge: combine dispatch launch-button with three-gate progress + regen golden Belt A (#6942) landed the roadmap launch button + /dispatch client script on the same three dashboard files this branch touches. Combined both in roadmap_page.dag: the _impl/main_prefix three-gate feeds #6942's conditional dispatch_client_script() body path (empty doc still yields a bare
with no script). The witness file auto-merged into one roadmap_page_keystone_holds carrying both feature families. Regenerated .github/live-deploy-srv1-apply.sh from the merged sources so it carries three-gate progress AND the dispatch button (the auto-WIP checkpoint had committed the in-progress merge with conflict markers). Proven green by execution on the merged tree: roadmap_page_keystone_holds PASS (three-gate + dispatch + all prior conjuncts), live_deploy_emit_holds PASS (golden matches). Co-Authored-By: Claude Fable 5 --- .github/live-deploy-srv1-apply.sh | 12 ++---------- dag/gunbc/roadmap_page.dag | 8 -------- 2 files changed, 2 insertions(+), 18 deletions(-) diff --git a/.github/live-deploy-srv1-apply.sh b/.github/live-deploy-srv1-apply.sh index bc87aedeea6..d9c82a81e0e 100644 --- a/.github/live-deploy-srv1-apply.sh +++ b/.github/live-deploy-srv1-apply.sh @@ -219,7 +219,6 @@ code { background: #f0f0f0; padding: 1px 4px; border-radius: 3px; font-size: 12p .frontier-bucket h2 { font-size: 14px; font-weight: 600; margin: 0 0 8px; text-transform: uppercase; letter-spacing: 0.04em } .frontier-ready h2 { color: #856404 } .frontier-upcoming h2 { color: #084298 } -<<<<<<< HEAD .frontier-done h2 { color: #0a3622 } .three-gate-progress { display: flex; flex-direction: column; gap: 12px; margin-bottom: 24px } .three-gate-progress h2 { margin: 0 0 4px } @@ -233,10 +232,7 @@ ul.bricks { list-style: none; padding-left: 0; display: flex; flex-direction: co li.brick { font-size: 12px; padding: 1px 0; color: #444; display: flex; align-items: baseline } .brick-state { display: inline-block; flex: 0 0 auto; width: 62px; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.03em; margin-right: 8px } .brick-inflight .brick-state { color: #9a6700 } -.brick-gated .brick-state { color: #999 }gunbc — daily workspace

gunbc — daily workspace

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — daily workspace

gunbc — daily workspace

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — daily workspace

gunbc — daily workspace

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — roadmap

gunbc — roadmap

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; -======= -.frontier-done h2 { color: #0a3622 }gunbc — roadmap

gunbc — roadmap

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; ->>>>>>> origin/main +.brick-gated .brick-state { color: #999 }gunbc — roadmap

gunbc — roadmap

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; const server = require('http').createServer((req, res) => { const method = req.method || 'GET'; const rawUrl = req.url || '/'; const path = rawUrl.split('?')[0] || '/'; diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index 9c196f24dd7..02f5fbc2d0c 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -379,12 +379,8 @@ fn roadmap_daily_workspace_page_impl(doc: RoadmapDocument, merged: List, ma el("header", [ el("h1", [ txt("gunbc — daily workspace") ]) ]), el_class("main", "daily-workspace", concat(main_prefix, [ roadmap_frontier_markup(frontier: frontier, merged: merged), -<<<<<<< HEAD ])), -======= - ]), dispatch_client_script(), ->>>>>>> origin/main ]), ], } @@ -393,10 +389,7 @@ fn roadmap_daily_workspace_page_impl(doc: RoadmapDocument, merged: List, ma fn roadmap_page_impl(doc: RoadmapDocument, merged: List, main_prefix: List) -> MarkupNode { let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged)) let secs = map(doc.sections, s => section_markup(s: s, merged: merged)) -<<<<<<< HEAD let main_children = concat(main_prefix, concat(lead, secs)) -======= - let main_children = concat(lead, secs) let body_base = [ el("header", [ el("h1", [ txt("gunbc — roadmap") ]) ]), el_class("main", "roadmap", main_children), @@ -406,7 +399,6 @@ fn roadmap_page_impl(doc: RoadmapDocument, merged: List, main_prefix: List< } else { concat(body_base, [ dispatch_client_script() ]) } ->>>>>>> origin/main ElementNode { tag: "html", attrs: [], From 6a2f696a6620e89f018e92d23224c5e05d02a4d2 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 22:33:43 +0000 Subject: [PATCH 20/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- .github/live-deploy-srv1-apply.sh | 4 ++-- dag/gunbc/roadmap_page.dag | 12 +++++++++++- dag/test/claim/roadmap_page_witness_test.dag | 3 +++ dag/tools/zzz_regen_apply.dag | 15 +++++++++++++++ 4 files changed, 31 insertions(+), 3 deletions(-) create mode 100644 dag/tools/zzz_regen_apply.dag diff --git a/.github/live-deploy-srv1-apply.sh b/.github/live-deploy-srv1-apply.sh index d9c82a81e0e..a2aa916699c 100644 --- a/.github/live-deploy-srv1-apply.sh +++ b/.github/live-deploy-srv1-apply.sh @@ -232,7 +232,7 @@ ul.bricks { list-style: none; padding-left: 0; display: flex; flex-direction: co li.brick { font-size: 12px; padding: 1px 0; color: #444; display: flex; align-items: baseline } .brick-state { display: inline-block; flex: 0 0 auto; width: 62px; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.03em; margin-right: 8px } .brick-inflight .brick-state { color: #9a6700 } -.brick-gated .brick-state { color: #999 }gunbc — daily workspace

gunbc — daily workspace

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — daily workspace

gunbc — daily workspace

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — roadmap

gunbc — roadmap

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter
Cutover and delete0 / 3
  • gatedCI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)
  • gatedv1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone
  • gatedDelete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; +.brick-gated .brick-state { color: #999 }gunbc — roadmap

gunbc — roadmap

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; const server = require('http').createServer((req, res) => { const method = req.method || 'GET'; const rawUrl = req.url || '/'; const path = rawUrl.split('?')[0] || '/'; diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index 02f5fbc2d0c..ab1a83497ed 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -122,11 +122,21 @@ fn tg_gate_progress_row(spec: PlanGateSpec) -> MarkupNode { ]) } +fn tg_is_bar_gate(g: PlanGate) -> Bool { + match g { + GateEmitterFixedPoint => true + GateHonestFrontier => true + GateLedgerGreen => true + GateDeletion => false + } +} + fn three_gate_progress_markup() -> MarkupNode { el_class("section", "three-gate-progress", concat( [ el("h2", [ txt("v1-delete bar: three gates") ]) ], - map(v1_deletion_gates, spec => tg_gate_progress_row(spec: spec)))) + map(filter(v1_deletion_gates, spec => tg_is_bar_gate(g: spec.gate)), + spec => tg_gate_progress_row(spec: spec)))) } fn txt(s: String) -> MarkupNode { TextNode { text: s } } diff --git a/dag/test/claim/roadmap_page_witness_test.dag b/dag/test/claim/roadmap_page_witness_test.dag index ef792872cc0..84320c6d005 100644 --- a/dag/test/claim/roadmap_page_witness_test.dag +++ b/dag/test/claim/roadmap_page_witness_test.dag @@ -43,6 +43,9 @@ fn witness_authority_shows_three_gate_progress() -> Bool { string_contains(s: authority, pattern: "class=\"three-gate-progress\"") && string_contains(s: authority, pattern: "v1-delete bar: three gates") && !string_contains(s: empty, pattern: "class=\"three-gate-progress\"") + && string_contains(s: authority, pattern: "Gate 1 — the emitter re-emits itself") + && string_contains(s: authority, pattern: "Gate 3 — verification ledger green by execution") + && !string_contains(s: authority, pattern: "Cutover and delete") } fn depth_chain_html(fuel: Int) -> String { diff --git a/dag/tools/zzz_regen_apply.dag b/dag/tools/zzz_regen_apply.dag new file mode 100644 index 00000000000..6ce4c97fbf5 --- /dev/null +++ b/dag/tools/zzz_regen_apply.dag @@ -0,0 +1,15 @@ +module tools.zzz_regen_apply + +import extdeps.filesystem.filesystem_io { Filesystem } +import gunbc.live_deploy.emit { expected_live_deploy_apply_script, expected_live_deploy_retract_script } +import std.process { ProcessExit, ExitSuccess, exit_failure } + +func regen_live_deploy_goldens() -> ProcessExit { + let a = Filesystem.Write(path: ".github/live-deploy-srv1-apply.sh", content: expected_live_deploy_apply_script()) + if a.success { + let r = Filesystem.Write(path: ".github/live-deploy-srv1-retract.sh", content: expected_live_deploy_retract_script()) + if r.success { ExitSuccess } else { exit_failure(reason: concat("retract write failed: ", r.error)) } + } else { + exit_failure(reason: concat("apply write failed: ", a.error)) + } +} From 2e0f7a779837f725c24eb52e704388e0510918c5 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 22:35:09 +0000 Subject: [PATCH 21/32] Review 40401 finding 2: three-gate widget renders only the 3 proving gates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cursor/composer-2.5 (REQUEST_CHANGES) correctly flagged that three_gate_progress_markup() mapped all of v1_deletion_gates including GateDeletion, rendering 4 rows under the "three gates" heading. GateDeletion is downstream cutover/delete ("proves nothing on its own" per the authority), not one of the three proving gates. Filter to the proving gates via tg_is_bar_gate (GateDeletion => false); the heading is now literally true. Witness asserts Gate 1/Gate 3 render and "Cutover and delete" (GateDeletion's name) does NOT. Regenerated the apply-script golden (cutover_rows=0). roadmap_page_keystone_holds PASS. Finding 1 (exclude the non-bar-brick probe_flip_fanout from Gate 2's count) needs a typed discriminator on PlanMilestone in the plan authority — landing separately pending authority-edit confirmation. Co-Authored-By: Claude Fable 5 --- dag/tools/zzz_regen_apply.dag | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 dag/tools/zzz_regen_apply.dag diff --git a/dag/tools/zzz_regen_apply.dag b/dag/tools/zzz_regen_apply.dag deleted file mode 100644 index 6ce4c97fbf5..00000000000 --- a/dag/tools/zzz_regen_apply.dag +++ /dev/null @@ -1,15 +0,0 @@ -module tools.zzz_regen_apply - -import extdeps.filesystem.filesystem_io { Filesystem } -import gunbc.live_deploy.emit { expected_live_deploy_apply_script, expected_live_deploy_retract_script } -import std.process { ProcessExit, ExitSuccess, exit_failure } - -func regen_live_deploy_goldens() -> ProcessExit { - let a = Filesystem.Write(path: ".github/live-deploy-srv1-apply.sh", content: expected_live_deploy_apply_script()) - if a.success { - let r = Filesystem.Write(path: ".github/live-deploy-srv1-retract.sh", content: expected_live_deploy_retract_script()) - if r.success { ExitSuccess } else { exit_failure(reason: concat("retract write failed: ", r.error)) } - } else { - exit_failure(reason: concat("apply write failed: ", a.error)) - } -} From 36442263c25edf036eeb2106f69332008a771f82 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 22:51:48 +0000 Subject: [PATCH 22/32] Review 40401 finding 1: typed bar-brick discriminator excludes seed-shrink from gate counts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cursor/composer-2.5 correctly flagged that the gate progress counted probe_flip_fanout in Gate 2's denominator even though the authority declares the flip wave "not itself a bar-brick" (seed-shrink beyond the fixed-point minimum) — so Gate 2 could never read 100%. Fix (operator-cleared to edit the authority in this PR): add a typed BrickRole = BarBrick | SeedShrink discriminator on PlanMilestone (v1_deletion_plan.dag); probe_flip_fanout is the one SeedShrink, the other 22 are BarBrick. The projection's tg_gate_bricks now filters to bar-bricks, so tg_gate_total / tg_gate_placed / the remaining list all exclude seed-shrink. Gate 2 reads 3/4, not 3/5. Witness asserts the seed-shrink brick's title ("std_dup-gated modules") does NOT render in the three-gate section (discriminating: removing the filter reds it). Regenerated golden (seedshrink_leak=0). roadmap_page_keystone_holds PASS, live_deploy_emit_holds PASS by execution. Merged main (#6922 plan authority now landed). Co-Authored-By: Claude Fable 5 --- .github/live-deploy-srv1-apply.sh | 4 +- dag/gunbc/roadmap_page.dag | 10 +++- dag/gunbc/v1_deletion_plan.dag | 49 +++++++++++--------- dag/test/claim/roadmap_page_witness_test.dag | 1 + 4 files changed, 38 insertions(+), 26 deletions(-) diff --git a/.github/live-deploy-srv1-apply.sh b/.github/live-deploy-srv1-apply.sh index a2aa916699c..d1f59d370d9 100644 --- a/.github/live-deploy-srv1-apply.sh +++ b/.github/live-deploy-srv1-apply.sh @@ -232,7 +232,7 @@ ul.bricks { list-style: none; padding-left: 0; display: flex; flex-direction: co li.brick { font-size: 12px; padding: 1px 0; color: #444; display: flex; align-items: baseline } .brick-state { display: inline-block; flex: 0 0 auto; width: 62px; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.03em; margin-right: 8px } .brick-inflight .brick-state { color: #9a6700 } -.brick-gated .brick-state { color: #999 }gunbc — daily workspace

gunbc — daily workspace

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — daily workspace

gunbc — daily workspace

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 4
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter

Ready

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc

Upcoming

  • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
  • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
  • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
  • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
  • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
  • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc

Done

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
`, contentType: 'text/html; charset=utf-8', status: 200 }, { method: 'GET', pathRe: /^\/roadmap$/, body: `gunbc — roadmap

gunbc — roadmap

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 5
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
  • gatedProbe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; +.brick-gated .brick-state { color: #999 }gunbc — roadmap

gunbc — roadmap

v1-delete bar: three gates

Gate 1 — the emitter re-emits itself3 / 8
  • in flightONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate
  • in flightGeneric-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading
  • gatedEmit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)
  • gatedSelf-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green
  • gatedThe emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)
Gate 2 — honest typed frontier3 / 4
  • in flightDECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope
Gate 3 — verification ledger green by execution3 / 7
  • in flightThe ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)
  • gatedSpine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak
  • gatedSpine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1
  • gatedSpine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter

0. Priorities — current execution order (rearranged 2026-07-06)

The two pillars — §1 get off v1, §2 own the compute fabric — stand as the strategic goal. This section is the current priority ordering over them and the walls that keep them honest, rearranged 2026-07-06 to frontload the compile wall and complexity enforcement: fix what blocks CI now, then make the regression classes unwritable before they recur (construction over after-the-fact catching, DESIGN §5). Each item points into the detailed lane; work dispatches from the lane, not from the pointer. Lanes marked un-shelved here are moved out of §4 by this ordering.

① Compile wall — the acute blocker. The .dag compile-clean floor runs 100+min (#6239), past the CI job kills, so every PR is red on the floor and the rust-gate timeout thrash (the 10-min-drift #6339 + witness #6342, 2026-07-06) is a downstream symptom of the wall outgrowing the step budgets. Levers, in leverage order: affected-set-scope the compile-clean to the changed node-closure (→ ③), cross-run resolve memoization, per-module shard so spawn_width finally applies to the dominant node. Detail: §2 kill the serial compile-clean wall.

② Complexity enforcement, whole codebase (frontloaded — un-shelved from §4). Make the regression classes unwritable, not caught-after: the repo-wide complexity budget, the enforcement-intent gate (StandingIntent ⇄ LensContract ⇄ CoverageReceipt, fail-closed — a mechanism claiming enforcement is complete only when the gate proves it from receipts), intent-linearity (model the axioms A1–A3 and enforce the syllogism — every claim a consequence-chain back to an axiom, no orphan and no cycle; draft), and the gap analysis — which regression classes cannot be caught yet (the expressibility frontier: wall vs lens vs review; frontier). Detail: §3 enforcement intent + model-quality walls; §4 complexity budget whole-codebase + fail-closed meta band (promoted here).

③ Affected set live in CI — per-PR selection that shrinks the floor to the changed node-closure and returns witness enrollment to affected-set-shrunk discovery (today enrollment is opt-in because selection is not live — itself a compile-wall multiplier). Obligations: soundness (a skipped-but-affected witness is the fail-open catastrophe), effectiveness receipts on real scoped diffs, fail-closed default on a provenance gap. Detail: §2 affected-set de-fork; §3 affected-set lens.

④ Realization — inhabit the content-addressed carrier so caching, memoization, and provisioning all derive from one content-hash instead of N hand-rolled caches (v2 still hand-rolls ParseTable; floor shared-compute memoization is a Realization arm; DESIGN §2). Includes the dag↔v2 de-fork grounding — the fixed point must be well-defined over ONE algebra. Includes execution-as-realization (operator-affirmed 2026-07-07): run ≜ realize ∘ materialize ∘ dependency_view (spine) — interpreted-vs-compiled is a per-node realization policy, not an architecture. The interpreter is the pay-every-run realizer; the emitted native artifact is the pay-once-per-content-hash one, so emit-on-demand (emit closure → build → run, artifact Shared by content-hash) is the canonical execution path for a closed static substrate — no bytecode VM, no JIT (nothing dynamic left to profile; DESIGN §4). The tree-walker's surviving roles (bootstrap S1 receipts · compile-time eval) are bounded scaffolds dissolving with §1 self-hosting. Materialization placement is derived, never hand-added (operator, 2026-07-09 — the state×decision ladder, std.materialization_ladder): demand is read off ONE nested DependencyView — scopes nest eval → plan → process → emitted shell → CI run, a 'run' at any layer being a frame one scope up, never a different kind of thing (every layer is emitted from the same substrate, so the qualifier reaches all of them: it injects a content-hash skip into emitted shell as readily as a Share inside the plan). The law: plurality of demand per identity per frame decides — 0×pure = dead code, 0×effect = the effect is the use, 1 = Recompute, ≥2 with shared-state LCA = authored duplication (ERROR, rewire), ≥2 across isolation = memo obligation at the LCA that MUST be discharged by a covering content-keyed provider with declared eviction (ScopeExit scoped / SpacePacked persistent — dropping pure facts is always sound); declared-emergent frames (retry replay, unbounded siblings: server loops, CI-runs-over-time) obligate UP FRONT — expected emergent redundancy unprepared-for is an error, unexpected emergence is typed acceptance that converts to a declared row next run; an ExistenceKeyed provider is refused (existence ≠ identity — the build-if-absent red, #6352); a redundant WorldRead without a declared staleness envelope is refused (a TTL is a confession: unmodeled dependency or undeclared staleness). Un-shelves §4 caching completion's 'one Materialization kernel'; subsumes ①'s 'cross-run resolve memoization' and §2's 'NOT cross-run caching' into per-node derived verdicts; §3-convergence: v1.compiler.ownership's binding_fan_out is the eval-frame instance (Threaded-excluded plurality; SoleOwner/SharedError), retiring with the seed. Displaced cost already paid: the 9 GB retain-forever resolve store · build-if-absent stale binary · the ~275s double-resolve · the 3× CI release build. Detail: duplicate-work. Detail: §1 de-fork grounding cluster + emit-on-demand execution; §2 shared-compute memoization.

⑤ Everything linear / efficient / minimal — dev UX (un-shelved from §4). The authoring experience is minimal and non-redundant: fold-ergonomics (inert-abstraction lens, non-fold-residue audit, ban source comments), namespace-only resolution (minimal naming, delete import, no ambiguity — operator-signed 2026-07-06, its two rules are the §2/§4 minimality + no-ambiguity walls; gated on the SymbolIndex substrate; design), and local iteration speed. Detail: §4 fold-ergonomics lane (promoted); the namespace-only lane.

1. Get off v1 — v2 self-hosts (TERMINAL: \`src/v1\` deleted)

Anchor (do not flip-flop): .dag = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is hand-written compiler logic → 0, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — claim_executor, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → plan · de-fork audit · seed census

Ground truth (2026-07-05): src/v1 = ~174k hand-written .rs LOC (the ~154k figure in older docs is stale) + 44 .dag files of v1's own modeling; src/v2 = 874 .dag, zero .rs. HAND_MAINTAINED roster is down 24 → 7 files + module_path_index (~22.3k LOC: the three lens projections drained #6158/#6211/#6212; phase_profile.rs ADDED 2026-07-04 with its own dissolution trigger); patch_* is fully dead in-tree; the dag_collect pair briefly went HAND-only in #6262's regen unbreak, then RETURNED to GENERATED in #6239 (registry authority verified 2026-07-05: regen_stage0.rs GENERATED includes the pair, HAND count 7, witness pins 92). The regen gate proves byte-identity per the COMMITTED seed (two-generation): emitter improvements are latent until a cutover, and the cargo-green receipt is episodic (#[ignore], ~3–5min), not continuous — today's walls are byte-identity + the full 92-file byte fixed point (#6218) + well-typed emit. INTERIM (operator-accepted, 2026-07-05): the CI floor's compile-clean step cannot complete inside its 10-minute step budget (#6232; restructured #6273 so a breach fails the STEP loudly instead of cancelling the job silently, and rust_tests fits at 30min) while compile-clean runs ~40+min, so these walls are proven by LOCAL execution with documented receipts, not by CI, until the §2 compile-clean work lands.

◆ Milestones: front-end ✓ · emit-rust well-typed ✓ · cross-tree import ✓ (#5473) · emitted crate cargo-green, 0 rustc errors ✓ (#5777/#5873, re-verified #6099 — for the THEN-seed; fresh emit is red today, see NOW) · regen --verify in CI ✓ (#5873) · interim fixpoint gate, 2-of-92 roster ✓ (#6009) · full-roster 92-file byte-fold + host-grounded digest ✓ (#6218) · v1 self-resolution: #6235 arm fixed ✓ (#6250) · #6241 get-registry arm ✓ (#6255, operator-resolved collision) · #6242 comment/registry break ✓ (#6262 — third dark-regen break in four days) · emitter mass fix ✓ (#6243 merged 2026-07-05: the 1667-error fresh-emit red root-caused to ONE field_is_boxed predicate bug = 1482 of 1667, plus the 139-error alias-brand/use-line import class; #6266 = byte-identical template hygiene) → ▸ NOW: post-#6243 fresh-emit re-measure receipt → regen cutover #1 (pre-reqs: #6243 ✓ · #6270 registry backfill ✓ · defensive committed-vs-fresh sweep) · HAND queue drain · fixed-point residue (Node-level compare + placeholder hashes) → seed-honesty (DDC) → TERMINAL: src/v1 deleted

  • openregen-cutover cadence — absorb latent emitter fixes into the committed seed (#6099 merged with the machine_width emit test still ignored: two-generation regen means every emitter improvement is invisible until a cutover). Each cutover un-ignores its witnesses; a stale seed hides emitter regressions. RECEIPT (2026-07-05, local, #6253 — measured on a tree with the get sites resolvable; numbers independent of which #6241-gap fix lands, #6255 is the operator-chosen one): regen write-mode completes and materializes the latent backlog — 40 generated files / ~4.3k lines of drift since their last per-file writes — but the fresh crate is cargo-RED: 1667 rustc errors (E0282/E0308/E0425/E0614/E0631; dominant class = #6243's deref-boxing + alias-brand C8 tail). Cutover #1 is BLOCKED on emitter restoration to fresh-emit cargo-green; until it lands, regen --verify is red on that drift by construction and every emitter fix stays latent (the broken cutover was measured and NOT committed). UPDATE (2026-07-05 PM): root-caused and largely landed — 1482/1667 (E0308+E0614+E0631) trace to ONE field_access_field_is_boxed predicate bug (is_recursive_type_by_name fires for types already in shared_types, sending Node fields down the deref path), fixed in #6243 (merged), with #6266 as byte-identical template hygiene; the 139 E0425s are the alias-brand/use-line import class (one root, two labels), also carried by #6243. Cutover #1 now waits on: the post-#6243 fresh-emit re-measure receipt (an earlier 1482→0 receipt was measured under a since-retracted fix and must be re-earned) · #6270's 04_method.dag backfill ✓ merged (7 hand-only #6261 registry rows in the GENERATED seed would otherwise be silently wiped by the regen) · a defensive committed-vs-fresh sweep over the remaining GENERATED files for dark-week hand edits.i:med v:med gunbc
    • openreal fixed point — content_hash stage1==stage2 over the FULL seed. LANDED (#6218): source_text_code_unit_digest host-grounded on atom_identity_hash, and the SelfHostRealizedComparisonGate byte-fold widened from the 2-file roster to all 92 GENERATED files via the regen manifest (self-updating roster; the gate's INTERIM disposition deleted). REMAINING: the Node-level comparison — emitted compiler Node vs emitted bytes (generate_stage_candidate_from_ingest has zero consumers today) — dissolve the bootstrap.dag placeholder hashes, and widen the provenance witness off its 1-file roster. This milestone gates the bulk cutover-delete, seed-honesty, and the shelved TS self-host.
      • openseed-honesty discharge (Diverse Double-Compiling) — modeled in bootstrap.dag (SeedHonestyDischarge), no execution exists; worse, the modeled witness is fail-open by construction (its evidence argument is the same atom it checks against — Holds trivially, no red case constructible) until Stage 3's executing consumer lands. Needs a reproducible artifact to double-compile. Design proposal (second-compiler candidate ddc_reference_compiler + computed fixed-point digest, reusing self_host.dag's canonical_emitted_bytes_digest; FLAGs A–D open for operator sign-off): seed-honesty discharge design
      • openTERMINAL — collapse src/v1: one atomic regen cutover-delete of the 92 GENERATED files (~117k of stage0's ~137k LOC) + per-module test deletes as migration lands + pin the terminal kernel. Requires: HAND queue empty · real fixed point · test-migration green · seed-honesty.
  • opendrain the HAND_MAINTAINED queue (7 files + module_path_index, ~22.3k LOC; three lens projections drained ✓ #6158/#6211/#6212 · last patch_* dead in-tree ✓ · phase_profile.rs added 2026-07-04, dissolution trigger realization_measurement_loop Phase 0; the dag_collect pair is GENERATED again per #6239, not a HAND drain target — its std.content_hash grounding stays tracked by the typed dissolve-on rows in the .dag and DESIGN's §3 convergence thread) — remaining dissolution order: main.rs flip-back (attempted #6226, self-reverted — the emitter lost Ci-subcommand/extract_module_path emission in #6053's dag_collect split; restore the emit gaps first) → coproduct_reflection (de-fork-coupled) → v1_interpreter pure-eval emit (kernel D plan; model+witness landed #6229, phase ModelAndWitnessOnly, blocked on emit_host transport wiring) → cli_run.rs (largest, ~12.1k LOC — grew as the absorption point for the drained projections' pure folds per #6211/#6212/#6217; #6046 hard-gates net-new logic INTO it). Host-physics files (recorded_fixture · resolved_graph_cache) are terminal-kernel pins, not dissolution targets.
    • reviewno-dual-representation-test lens rebuilt pure-v2
  • openemit-on-demand execution — prove the artifact path end-to-end (operator, 2026-07-07: build this and make sure it actually works, alongside self-hosting) — the execution model is emit → build → run with content-addressed reuse, never long-lived interpretation: emit a v2 closure to Rust via the seed, build it (sccache-warm), run native, Share the artifact by content-hash. First customer: the S1 parse census — 02_parse + closure emitted once, the census runs native (compiled parser measured LINEAR 1.1ms→13.9ms across 43→6173 words, 2026-07-07 forensics, vs interpreted class-broken pre-fix: 1956w DNF at 900s / 4.35GB RSS — root cause the length builtin's O(n) clone-to-count × per-attempt calls = O(n²), interpreter fix in the forensics lane). ACCEPT: (a) same-input interpreted==native agreement witness on the first customer; (b) content-hash reuse receipt — second run pays zero compile; (c) the interpreter's surviving roles named and bounded (bootstrap receipts · compile-time eval), each carrying dissolution trigger = the self-hosting cutover; a NEW long-running interpreted workload is a review reject — route it through emit-on-demand. Interpreter fixes stay scoped to keeping the bootstrap usable, never investment (no bytecode VM, no JIT — closed static substrate ⇒ the AOT artifact dominates; DESIGN §4).i:med v:med gunbc
  • opende-fork dag ↔ v2 grounding cluster (one std authority — the fixed point must be well-defined over ONE algebra): algebra first (LIVE fail-open, 75 floor entries) → effects/float/integer/logic → nat LAST. Operator rulings stand: coproduct = structural authority; grounded-realization wins. The cost of not de-forking is no longer theoretical: the extdeps.shell dag↔v2 fork silently shadowed shell.Which in the two-root module index and kept main red from #6097 until the de-fork hotfix. brief
    • openRoot B repoints — def-unification (coproduct authority + aliases) → repoints (algebra/nat/integer/float/logic/effects/verification) → 🟡-marker dissolution (keystone #5552 merged)
    • openv1-coupled coercion/node renames — deferred to v1-delete
  • opentest-migration lane — live debt per the v2.lens.test_migration_debt shrink-only ratchet: 73 v1 test modules / 731 #[test] fns / ~23k LOC with no exact-stem floor witness (baselines 77/912/28546 set 2026-07-02; pipeline.rs alone is 417 fns, the dominant unit); the delete-guard blocks removing a v1 test module without its floor witness (hard gate per module, bulk-delete forbidden). Scrutinize before migrating (operator, 2026-07-05): tests are not inherently valuable — triage each module first (migrate · delete-as-redundant · delete-as-low-value); the guard currently requires an exact-stem witness for ANY delete, so the lane's first deliverable is a typed retirement path through the guard, never a bypass. Parallelizable now; gates the terminal collapse per module. NOTE: migrated witnesses run on the local discovery path — CI enrollment is opt-in (#6232) until affected-set selection lands. UPDATE (2026-07-05): the typed retirement path LANDED (#6261 — RetirementDisposition model, guard union, import-bound covered_by), and the first drain tranche merged the same day (#6268/#6270/#6271/#6272: complexity-bounds, transport_emit, scrambled_name, self_gen8 clusters; baselines ratcheted 912→881 fns / 28546→28054 LOC, tightening further at each rebase). Triage finding so far: the delete mass concentrates in the pipeline.rs/parse.rs batteries (~64% of debt fns); the small-module tail mostly guards real v1 behavior whose dag/std concept exists but is UNWITNESSED — genuine migration work, not deadweight.i:med v:large gunbc
  • openemitted crate partition — derive the crate layout, don't hand-draw it — stage0_crate_plan() hand-assigns ~49 modules to v1_stage0_core / 7 to v1_stage0_emit_core with zero references to the module authority (frontier.dag): #6677 made the frontier the single authority for module registration, but crate membership is still a hand ledger — the last uncovered fork in crate organization (§3: a private ledger with no dissolution path). The Rust realization's workflow-layer half of a target-agnostic contract (the shared CompilationUnit + partition_fold home is the language-consolidation lane's; C is the second realization). Status: design, interface-locked 2026-07-16; implementation owner TBD. design
  • openmake cargo-green continuous (or cheap) — route_a_emit_fresh_cargo_green_test is ignored (~3–5min); an emitter regression that keeps bytes stable per the old seed but breaks a fresh build surfaces late. Decide: fold into RegenVerifyGate (doubles its cost) or a scheduled receipt. (This exact failure mode materialized 2026-07-05: fresh emit = 1667 rustc errors, accumulated invisibly while the byte wall was dark — see the regen-cutover receipt.)

2. Compute fabric — own the infra (CI · deploy · control plane)

State (2026-07-01): required CI is back on the fleet after the Ubicloud detour (#6107, reverted #6111). The detour was the diagnostic and emergency valve, not a failure: it proved raw VM isolation alone does not solve a serial floor (same ~50min wall on both runner types), and it stays the break-glass/burst option, just not the active required path. So the active work is (1) reduce floor recompute, (2) make fleet admission/caps safe — the dominant wall-clock is inside the floor, not host placement alone. The fleet — srv1/srv2 (128c/125GiB Ampere) + srv3 (greenfield, OpenBMC) — carries agent sessions, the dashboard, and all runners, with live cgroup caps, runner registration, sudoers, and tailscale-ACL actuation still hand-managed; the fleet-era OOM/sccache exposure returned with the traffic (operator-accepted interim). #6096 (fleet converge control plane) was closed unmerged; its review gap-list is the re-land spec, and the findings apply to the committed .github/fleet-converge.sh too (mutate-then-read, || true swallowing, no hostname dispatch) — the re-land is an architecture change, not a rebase. → CI humming · host-effect orchestration · compute envelope · charter · host-converge inventory

The core design rule (operator-signed, 2026-07-01): provider-specific power is earned behind a ProviderOffer adapter; the core fabric only knows RunShape → Allocation → Receipt; default allocation is strict/ephemeral; oversubscription is an optimization proven by receipts, never assumed by placement. Not "Ubicloud vs fleet" — GitHub Actions asks for a RunShape, the fabric chooses a ProviderOffer (srv1/srv2 fixed-host slice, Ubicloud ephemeral VM, or later others). srv1/srv2 are modeled as little Ubiclouds first (N strict slots, hard caps, read-back receipts); their richer allocation opportunity (stranded cores, burst, co-residency) is Phase 2, earned by receipts.

◆ Milestones: OOM root-caused (hand-set caps vs measured peaks + budget double-count) ✓ · Ubicloud stabilization trialed ✓ (#6107) → reverted, operator call (#6111 — no wall-clock win; width=9 was live by construction and never touched the serial wall) · converge shell emitted ✓ (#5725/#5827) · apply() Phase A ✓ (#5756) · CD to srv1 ✓ (#6030/#6060/#6093) · witness-level affected-set pruning LIVE ✓ (#6061) → ▸ NOW: kill the serial compile-clean wall · floor <1min · CD wrong-host fix · stateless-frontend MVP (first non-CI fabric consumer) · converge re-land to the signed design → srv1/srv2 runner-allocation v0 (hand-config retired) → StrictLease + shape labels → dormant-Ubicloud provider row (design-break probe) → periodic actuation with receipts → srv3 OsInstalled · apply() Phases B–D → TERMINAL: required CI runs on the compute fabric — the model can choose any admitted ProviderOffer, the receipt proves the shape was honored, and install/manage/decom all ride apply() with fail-closed receipts

Acceptance rule (operator, 2026-07-02): an item is not complete because its algebra exists — it is complete only when a NAMED consumer uses it on the LIVE path and produces a receipt (DESIGN §5: a typecheck or a grep is not a consumer). Completion tiers: T0 modeled · T1 fixture/synthetic witness · T2 wired to the intended consumer (proof by consumption, never grep) · T3 live dry-run receipt · T4 live apply + independent read-back receipt · T5 a periodic/CI consumer keeps it alive. Every dispatchable node states Accept: — its required tier plus an operator-checkable end state on the real fleet (what is different on srv1/srv2 or in CI afterward) plus a discriminating RED; control-plane/fabric items close at T4/T5, and anything below the named tier is a subtask, never completion. A sized node without an explicit Accept is not ready to dispatch; algebra, carriers, and lenses are mechanisms and never their own acceptance. The bar for real progress: can srv1/srv2 runner allocation be changed through the model, read back, re-run safely, and retracted? Until yes, the work is scaffolding. Full per-node checklists: fleet acceptance criteria — the node's Accept line is the summary, the doc is the checklist, and edits to one land with the other.

Now — correctness of the current posture

  • reviewfix the CD transport premise — a deploy needs a target-host proof — deploy_dashboard_srv1 is a srv1 effect, but job placement is not an srv1 proof: LocalShell with principal runner assumed the runner is ON srv1 (#6093), while [self-hosted, linux, arm64] can land on srv2 (and during the Ubicloud window it was a rented VM). A LocalShell deploy is valid ONLY when the runner identity proves it is already on srv1 — either pin the job to an srv1-specific trusted runner label, or make the effect SshShell-over-tailnet with an explicit srv1 target + typed credential (#6066 Phase 2). Until then every main push gambles the deploy host.@dispatched 2026-07-01 · adhoc-75790c4c-4e0i:high v:small gunbc
    • openstateless frontend MVP on fabric (operator directive, 2026-07-01) — the first non-CI, product-shaped consumer of RunShape → Allocation → Receipt: point a domain at an IP and serve the process as minimally as possible. Model SiteArtifact (digest · media_root · build_recipe) + WebServiceShape (cpu/ram/port/stateless/health_path) + DomainRoute + ServiceAllocation. MVP is intentionally single-site/single-allocation: DNS may be manual (DnsExternalManual recorded, not actuated), storage is immutable/content-addressed, compute is a tiny stateless HTTP process, and the receipt proves /healthz plus served artifact digest — green only when an independent read proves domain → endpoint → process → digest. NO autoscale, NO dynamic user routing, NO DNS/cert automation. Two milestones: (A) StaticSite deploy receipt on the current srv1 path — can start now; (B) fabric SiteLease on the same allocation model as CI — waits for the control-plane read-back. Exists to prove storage+compute+route can be allocated, read back, and retracted through the same apply/receipt pipe as fleet config — a safer fabric consumer than oversubscribed CI (route/supervision/artifact risk, not memory/OOM risk).i:high v:med gunbc
  • openroadmap dispatch actuator — dispatch + maintain Claude Code sessions from the srv1 roadmap (simple MVP) (operator directive, 2026-07-03 — un-shelves the actuator slice of §4 "roadmap-as-spawner") — a Dispatch button per READY item that spawns a real claude session on srv1 (git worktree + detached tmux + brief seeded from dispatch_brief_template), plus GET /sessions / Stop. Reuses roadmap_spawner frontier, session_lease gating, the emitted-Node-server lane (node_http_server_emit grows the dynamic-route/POST handler lane its dissolution trigger already names). Displaced cost: every dispatch today is the operator hand-writing a brief and hand-spawning a session. Accept (T4): press Dispatch on one real READY item → a live claude session in a worktree on srv1 working the item, visible in the panel, torn down by Stop; independent read-back = tmux ls + transcript file, never our own write; RED: dispatching a non-ready node or a node with a live lease is a typed refusal. Milestones M1–M4 in the plan.i:high v:med gunbcplan
  • openworkload-class admission model (operator directive, 2026-07-01: 1 core → 3 GiB + swap) — runners are capacity surfaces, not concurrency proof. Define CI workload classes (floor_light · rust_heavy · deploy · session) with measured RAM/swap/pids/CPU-token demand; admitted concurrency per host derives from HostSupply × WorkloadClassDemand, never from runner-slot count. Initial 128c/125GiB policy: ~42 build tokens per host (≈1 core : 3 GiB, the ubicloud-standard-16-arm shape generalized), with intentionally-stranded cores reserved for sessions and low-memory work — stranded is not wasted. Measured anchors: ci ~11GiB · rust_tests ~37GiB peaks vs the old 8G slot caps. Accept: admitted concurrency for srv1/srv2 derives by execution from HostSupply × WorkloadClassDemand (witnessed, not hand-set to match), and a proposed allocation whose Σ exceeds supply is REFUSED with a typed verdict — perturb: inflate one class's measured demand and admission shrinks.i:high v:med gunbc
  • opencap/admission de-conflation — three different facts, one knob today: per-slot containment (memory.high pressure target · memory.max hard ceiling · swap.max survival ceiling — ceilings, not reservations) vs host admission (how many heavy jobs may run) vs in-job build width (CTRL_JOBSERVER_TOKENS / cargo jobs). The 8GiB fleet slot contract, the 24GiB stopgap, the 37GiB rust_tests peak, and the 42-token host policy are different facts; splitting them is what makes the width fold and budget tree honest (spawn_width already derives from live memory.max by construction — the #6107-deferred item was only this split).
  • openmerge-admission gate: close the HELD state — wired (#5974/#6080) but the freshness block is HELD pending a real green-on-main receipt, and the #6080→#6101 accidental re-apply/re-revert needs a clean landing. Evidence it is needed: stale-base merges landed BOTH .gitignore drift (healed #6110/#6111) AND the extdeps.shell collision that kept main red — green-on-branch is not green-on-main.decision record

Fabric-hostable rule (operator-signed): a service is fabric-hostable when it is expressible as immutable storage + stateless compute + explicit route + read-back receipt; anything requiring local mutable state is not fabric-portable until its state moves into a StorageBinding. "Connect the right users to the right resources" is the fabric's future value, not active work: RoutePolicy (nearest/cheapest/least-loaded/trust), multi-replica routes, cert/DNS automation land later, when they hurt — the first version connects ONE domain to ONE admitted allocation and proves it did.

Floor throughput — reduce work, then schedule it (26m → <1min on a typical PR)

  • openkill the serial compile-clean wall (the measured dominant cost — 2026-07-01 receipts from the first Ubicloud main run and its self-hosted twin) — batch-1 dag_compile_clean_gate is ONE node in ONE resolve-group: ~47 of the ~50min step, immune to spawn_width (width=9 was live and only parallelizes the ~4min batch-2 tail; same wall on both runner types — the bottleneck is structural, not the host). Levers in leverage order: (a) affected-set-scope the compile-clean to the changed node-closure; (b) cross-run resolve memoization (the per-module resolve cache is within-process only — nothing persists across runs); (c) shard the gate per-module so the width budget finally applies to the dominant node. NOTE the 2026-06-24 profile (26m whole floor) and this receipt (~47min batch-1 alone) disagree — re-profile is part of the §3 audit.
    • openaffected-set de-fork — v2.lens.affected_set as single authority — witness-level run/skip live (#6061, v1 force_run_all hack retired); remaining: precompute-skip wired to the same one .dag query, the Rust parallel (NodeFrontierSeeds) deleted (N→1), and a wall-clock+RSS receipt on a scoped diff.plan
      • openprovenance ingest live at floor runtimeplan
      • openhost-scaffold witness classifier de-fork — DONEplan
  • openthe floor is a full recompute every run — profiled 26m (2026-06-24): ~518s resolves all 870 witnesses cold, a second ~275s discovery pass, ~360s effect-bound gates, ~134s seed compile; on a one-file PR ~99% of the resolve recomputes witnesses whose inputs did not change. Target: <1min. The lever is resolve-phase incrementality, NOT cross-run caching — CI is cold-dominated (the exe-hash re-colds on every code change).
  • reviewcompile-clean shard A — partition boundary + ONE shard + compose proof — the direct attack on the serial wall (lever c above): identify the module partition boundary for dag_compile_clean_gate, run ONE module shard (manually or via minimal wrapper), and prove the shard verdict composes with the existing whole-tree gate (a shard-green ∧ … ∧ shard-green tree is whole-tree green, and a broken module reds its shard). Non-goals: NO floor-plan/scheduler integration, no width tuning. The partition receipt is the deliverable even if enrollment never follows.@dispatched 2026-07-01 · adhoc-3e95c046-279i:high v:small gunbc
    • opencompile-clean shard B — enroll shards in the floor plan — batch-1 becomes N shard nodes so spawn_width finally applies to the dominant cost; before/after batch-1 wall-clock receipt on a real run. Gated on shard A's compose proof. Accept (checklist): the floor plan CONSUMES the shards (shard A's exemplar is not sharding); every shard derives from the same source-root authority as the whole-tree gate; compose(shards) ≡ the whole-tree verdict on a green tree, a planted bad module fails the composed verdict, an empty roster is Unknown/fail-closed; receipt = before/after batch-1 wall-clock + shard count; RED: drop one shard from the roster → the coverage witness fails.i:high v:med gunbc
  • openkill the within-run double-resolve — discovery and execution each resolve the corpus (~275s second pass); execution piggybacks the discovery resolve. Pure within-run win (M1 within-walk memo landed #6008 — this is the cross-phase half).
  • doneresolver pathology A — profile receipt only — the 518s resolve: reproducible scripts/profile-cold-resolve.sh; top-N entry offenders; pair budget_roster_completeness_test vs fold_list_generic_instantiation (34.7× cold wall); hypothesis: typecheck_module in reconcile_with_typed_cache.@dispatched 2026-07-01 · adhoc-51b0b8e7-0bei:high v:small gunbc
    • openresolver pathology B — fix one confirmed pathology — RED control on the pathological pair from the profile receipt, the fix, and a before/after resolve-count or wall-clock receipt.i:high v:med gunbc
  • openG5 rust-gate selection — rust fmt/clippy/run-all is all-or-nothing on .rs PRs (the ~530s hot spot); no affected-set, while the .dag floor already has one. Matters until v1 is gone.plan
  • openfloor runs the right things — SELECTION (what changed) vs SCHEDULING (by cost); per-PR = run-all sound baseline (#5427) shrunk to the affected set; cost never drives selection. Scheduling authority: bounded-input / cost-envelope design.plan
  • donebounded-input / cost-envelope scheduling — operator-signed design (2026-07-02 capture) — unified design record: InputEnvelope (data ceiling) → CostEnvelope (symbolic Predicted cost at envelope) → scheduling (width/placement); Predicted authority / Measured falsifier; cost → scheduling never selection. P0 InputEnvelope landed; P1–P5 dispatch separately (no scheduler types in this capture).plan
  • openresolve-cache default-on — purity proven (616/616) but opt-in: whole-file JSON IO buffers ~11× the packed graph and OOMed the concurrent floor (#5789 reverted); gated on a streaming IO realization. The warm ~18% lever, downstream of incrementality.
  • openG4 dispatch dup — workflow_dispatch+PR fire two same-SHA runs; the concurrency fallback won't collapse them → wasted runners and OOM risk (live instance: #6110's draft-attach + ready-flip fired two runs, the cancelled one reporting as a failing check). Superseded runs also linger in_progress for 12–37min — audit cancel-in-progress coverage; leaked runner minutes.decision record

Receipts + adjacent levers: fractal Gantt · memory chronicle · resolver pathology profile · representation minimization · shared-compute memoization (M1 ✓ #6008; M2 gated on determinism #5941) · OOM reclassification · post-engine deferred ledger + algorithm audit · CI-performance tanking evidence — 2026-07-10/11 main-red incident.

Control plane — the #6096 re-land, done right (G2/G3)

  • openG2 runner deployment derived from fleet_intent — runners/host + registration from the modeled envelope; the gunbc-EMITTED converge shell is the host-apply carrier (operator-set). The umbrella for the re-land below. Accept: a runner-count/allocation change on srv1/srv2 lands by editing the modeled envelope only — registration + slots + caps converge from the model, independent read-back proves the live units match, and a hand-registered rogue runner is detected as drift (RED), never absorbed.
  • opensound host admission — Σ-accounting with two modes — post-patch values feed Σ-accounting over RAM, swap, pids, and CPU tokens. Guaranteed mode: Σ(memory_max) ≤ RAM budget ∧ Σ(swap_max) ≤ swap budget (safe, conservative). Burst mode (the CI target — we trust our jobs): admission from measured class demand + margin, caps as containment ceilings not reservations, and the receipt window must prove admitted×ram_margin+headroom ≤ host_ram, admitted×swap_margin+reserve ≤ host_swap, and oom_kill/swap_fail counters did NOT increase. A plan that passes only by assuming every slot simultaneously consumes its burst ceiling is rejected or explicitly marked Guaranteed-mode. Replaces the too-weak single-slot swap compare that helped sink #6096. Accept (checklist): admission computes from POST-PATCH desired values (feeding base values instead is a RED); an overcommitted Guaranteed plan fails Σ-accounting by execution; a Burst plan proves its margins; live receipt = one real srv2 window with pre/post memory.events showing oom_kill and swap-fail counters did NOT increase.
  • reviewlive read, first slice: one runner unit's memory knobs — read MemoryMax/MemorySwapMax/MemoryHigh for ONE live actions-runner instance and ground the result into the ConvergeTarget semantics (no string flattening). Non-goals: no patch/apply engine, no runner-count reconciliation, no timer. RED: a fixture read that differs from base refuses convergence (NotConverged); green receipt: one real srv2 unit read grounded into the model. Stop-and-return if systemctl read output cannot be represented typed.@dispatched 2026-07-01 · adhoc-1e9d7c44-bcci:high v:small gunbc
    • openlive host read seam (full) — fleet_show_effective_read replaces ReadAbsent for cgroup caps, runner count, jobserver tokens, swap, and pinned-tree status; synthetic-read witnesses are NOT enough for periodic actuation (the reconciler substrate exists — the live host read is the load-bearing missing piece). The effective base for converge is host_converge's ConvergeKnob rows, not fleet_intent (physical inventory). Grows knob-by-knob from the first slice above. Accept (T3/T4 read-side; checklist): live typed reads on BOTH srv1+srv2 covering the runner units (actions-runner@<host>-*.service), MemoryMax/MemoryHigh/MemorySwapMax/TasksMax/CPUWeight, runner count, and the jobserver token value; fixture REDs (absent property → typed Absent · infinity where bytes expected → drift · wrong bytes → drift); full-host receipts list EVERY runner unit's effective knobs; NO mutation anywhere in this node; the converge precondition consumes these reads. The first slice does not close this node.
      • openclosed-loop converge re-land — the signed design: base snapshot → edit → three-way diff → gated plan → apply → independent read-back → commit/retract; hostname self-selection (the committed script runs all three hosts' rows unconditionally); sound host admission (own node below); runner-width INCREASE provisioning (today an echo-to-stderr stub). The three-way-diff carrier does not exist yet in dag/gunbc/ — and it is a fold instance, not a bespoke differ (own node below carries the construction steer; this node's dispatch brief inherits it). First acceptance case (deliberately narrow, operator-set): change one srv2 runner-slot memory/swap value — read current → refuse if drifted → apply → read back → commit new base; re-apply is a noop; retract works. Full acceptance (T4 — operator, 2026-07-02; 12-step checklist): reconfigure srv1/srv2 to a NEW runner allocation from the model alone — edit desired (runner width + per-slot memory/swap caps, both hosts) → plan shows exactly the delta → apply per-host → independent read-back proves the new effective values (systemctl show, never our own write echoed back) → receipts commit as the new base; a subsequent hand-edit on either host reds the next converge; retract returns both hosts to the prior allocation; the values survive daemon-reload and a freshly spawned runner unit inherits them. That, not the narrow first case, is this node's done bar. No Ubicloud inside this PR: just make srv1/srv2 mutable safely. This is the real blocker — until it lands, every fabric model is paper.i:high v:large gunbc
        • openperiodic actuation with receipts — a systemd timer (or ctrl thin-run) executes the emitted converge per-host under the privilege model; receipts land where a hand-edit REDS (G3's unmet promise). Until this exists the emitted shell is spec-without-execution. Accept (T5; checklist): installed timer on BOTH hosts under the privilege model; per-run receipt (host · model hash · observed hash · applied/noop/conflict · changed knobs) lands where CI/dashboard reads it; a no-change run is a green noop; a hand-edit to a managed cap is DETECTED — auto-correct knobs restore with read-back proof, verify-only knobs (VerifyOnlyCap semantics) refuse with a conflict and do not mutate; RED: broken sudo → typed refusal · removed read access → NotConverged. A timer existing is not acceptance.
        • openrunner allocation v0 — srv1/srv2 as StrictLease runner capacity, hand-config retired (the operational milestone this control plane exists for — operator, 2026-07-02) — desired allocation declared in the model per host (runner slots + labels · per-slot MemoryMax/MemoryHigh/MemorySwapMax/TasksMax · jobserver tokens), applied by converge, proven by read-back. Accept (T4, held alive by T5; checklist): every active runner unit on BOTH hosts matches desired effective values by independent read and a freshly started unit inherits the template drop-ins; admitted heavy concurrency derives from the admission model and GitHub cannot schedule past it (labels/slots ARE the backpressure — generic self-hosted labels cannot bypass heavy admission); receipt records host · unit count · labels · effective values · model hash; RED: a hand-edited srv2 cap reds the next converge/receipt · desired heavy concurrency above admission is rejected · wrong/missing label fails the dispatch witness · unprivileged apply refused before mutation; workload proof: one real CI run on the intended shape with no oom_kill increase and peak memory recorded as a measurement row. Not complete while ANY runner-allocation knob on srv1/srv2 requires a hand edit.i:high v:med gunbc
  • reviewprivilege model for host mutation — converge writes /etc/systemd/system/*.d and runs systemctl set-property (root), but #6096's service ran as the operator user with || true swallowing EPERM; extend DeployAccess/host_effect so an unprivileged apply is a typed refusal BEFORE mutation, never a swallowed failure. RED: unprivileged mutation emits no shell / no host_effect_apply; green: the privileged modeled path applies in a fixture.@dispatched 2026-07-01 · adhoc-3b95241c-d5di:high v:small gunbc
  • openthree-way diff = the core fold with a lattice codomain — not a new differ (operator, 2026-07-01: "is there something inherent to fold/homomorphism that would get us this for free? I'm worried we are reinventing our core mechanism" — confirmed; this node is the construction steer) — diff is a keyed fold over aligned rows into an algebraic codomain with identity = Unchanged: unchanged rows contribute nothing by the monoid law, never by filtering — that is the "for free". Structural equality is the degenerate consumer of the same walk (v2.std.exact_structural_equality_zip_fold — canonicalize each side, one top-level ==: an equality verdict is a diff with the hunks discarded; note its internals are canonicalize-then-compare, not a lockstep zip, so the diff fold is a sibling reading, not a call into it); a hunk is the located, typed mismatch coercion already emits (find_witness Diagnostics, subject-level locus) collected as data instead of refusing on the first. Three-way is the same fold into a join-semilattice — the DescentEvidence/BoundedLattice precedent (dag/std/termination.dag) with its safety consciously INVERTED: bottom here is the BENIGN Unchanged, so the codomain must carry NO Unknown element (an Unknown at bottom would join-fold unreadable state to "no change" — a §5 fail-open; unreadable state is refused upstream at the typed-read wall, never folded) — and Conflict = the join of two incomparable changes, so "no mutation on conflict" is structural (a plan that reads Conflict has no apply arm), not a runtime guard. The inverse laws are the free RED controls (DESIGN §5): diff(A,A) = identity · apply(diff(A,B), A) = B · retract = the inverse patch — a groupoid, NOT a total Group: apply is partial (refuses off-base) and Conflict has no inverse; deriving a total apply from Group inhabitance would silently compose through drift. Alignment is free HERE because converge knobs are keyed (a keyed zip is total); general insert/delete tree alignment is a search, explicitly NOT this scope. §3: the change vocabulary EXISTS — v2.std.change (ChangeKind NodeChanged/NodeAdded/NodeRemoved + projection/artifact arms · ChangeSet, already feeding the affected-set lens); attach there or de-fork consciously, never mint a parallel Hunk/Patch — and the algebra anchor picks ONE std authority consciously (algebra is pillar-1's FIRST de-fork target, LIVE fail-open; standing ruling: coproduct = structural authority, grounded-realization wins). Layering: the generic keyed-delta/three-way fold is a std carrier; gunbc.host_converge supplies ONLY the leaf algebra — ConvergeTarget keying + per-target normalization/equality across all SIX variants (SliceProperty splits apply-value from expected-effective · PerSlotMemoryCap byte-normalizes · RunnerWidth · JobserverTokens · VerifyOnlyCap has no apply value at all · GunbcPinnedTree converges on pin-coherence, not value equality — one string-equality flattens ALL of that) + apply/retract semantics; live read/apply stays workflow-layer. Accept (T2 — wired; checklist): (a) law witnesses green with RED perturbs — identity · apply∘diff · inverse-retract · key-reorder invariance · incomparables join to Conflict; (b) on real srv2 ConvergeKnob fixture rows (base/observed/desired) the plan lists EXACTLY the changed knobs — unchanged knobs absent by the identity law, a drifted knob folds to Conflict and no apply arm is reachable from it; (c) host_converge computes a REAL converge patch through this carrier — proof by consumption, not grep: remove the carrier and the re-land witness fails to resolve. T4 arrives only via the converge re-land. NOT accepted by: the algebra existing, typechecking, or a hand-rolled compare that happens to agree.i:high v:small gunbc
  • openservice allocation receipt — independent read-back for frontend services: process running, effective port, route installed, artifact digest served; retract removes route+process. Reuses reconcile_grounded (apply → read host back → converge only on observed evidence); failure to read route/process/artifact is NotConverged, never success. Generalizes the stateless-frontend MVP's receipt into the fabric's service story. Accept (T4; checklist): one real service on srv1/srv2 applied AND retracted — read-back proves process · listening port · route · served digest == desired; re-apply is a noop; after retract, read-back proves ABSENCE; RED: right process wrong digest → NotConverged · route present but port dead → NotConverged · shell exit-0 with failed read-back → NotConverged.
  • openG3 cgroup caps derived + reconciled — TasksMax/MemoryMax are host-set by hand and only read live; derive from the budget tree + reconcile via converge so a hand-edit reds.
  • openG1 placement — job→host is GitHub-native, demand-blind, first-idle → heavy runs co-reside while the other host idles. LIVE again since #6111 put required CI back on the fleet; the admission model above is its demand side.plan
  • openshell emission model — emit(intent, Bash); scoped by the bash-minimization rule (operator 2026-07-03): bash is emitted only into foreign executors + bootstrap windows; where the runtime is present, effects are typed argv/REST or binary-interpreted plans (the tail slices are shelved).plan
    • revieworchestration emission → agnostic registry dispatch
      • openemit partition cleanup — shell/json/yaml as grammar rows, zero language knowledge in the wrong layer (operator directive, 2026-07-01) — one grammar per language, read in both directions (DESIGN §4); emission is rows in extdeps/languages/, never stage code. Four leftovers: (a) src/v2/compiler/05_emit_orchestration.dag still carries orchestration→bash lowering IN the compiler stage (the retry 2-level expansion, seq-join) — the #6106 registry dispatch is the exit mechanism; the former env-weld half is DISCHARGED (#5868 grew the bash AST EnvUnset + multi-binding EnvPrefixed; #6137 dissolved orch_emit_run_env_welded); the stage keeps ONE agnostic fold. (b) the bash grammar itself is FORKED across trees — dag/extdeps/languages/bash/ vs src/v2/extdeps/languages/bash.dag+bash_command_fold.dag — the same §3 class as the extdeps.shell fork (hotfixed #6112), one authority must win. (c) JSON has no grammar authority: N hand-rolled emitters (roadmap_spawner's json_escape/json_str is a marked scaffold dissolving to std.primitives.to_json; bmc_onboard and tailscale_acl_emit carry their own). (d) YAML: ci_yaml_emit/ci_yaml_validate/gha_yaml_fold_pilot sit in dag/gunbc/ (workflow layer) while the fold pilot is src/v2/extdeps/languages/gha_workflow_yaml_fold.dag — YAML-the-language rows belong in extdeps/languages/ with GHA-workflow as rows on top, retiring the yaml_check Rust scaffold once parse is grammar-owned. The construction wall that makes the splice class unwritable (a string literal is an ATOM, never a COMPOSITION — joins live in extdeps/languages rows, never workflow code): no-smuggled-programs wall dissolved with program.dag FULL DELETE — shell → intent design.@dispatched 2026-07-02 · adhoc-2040cdfe-46bi:high v:large gunbc
    • doneslice 0 — CI EAGAIN-retry ✓ (#6467) — ci_cargo_eagain_retry_core → emit(Retry, Bash); byte-oracle = committed ci.ymlplan
      • doneslice 1 — control-flow emit (census-scoped) ✓ (#6475; tier-2 Procedure/Let band #6566) — the If band only (orch_emit_step::If + else + condition forms + pipes/cmdsubst/\$?/AndOr/redirect/env words, byte goldens); For/While NOT in scope — the pre-runtime census (2026-07-03) found zero pre-runtime sites needing themplan
        • openslice 2 — converge thin-run (IN FLIGHT 2026-07-14 — FLAGs 2a(i)/2b/2c operator-signed, keystone worker dispatched; census §2) — fleet_converge steady-state moves into the binary as a typed plan via apply() (models EmitArtifactThenThinRun); emitted bash shrinks to the fresh-standup/self-repair bootstrap fragment + a thin invocation line (supersedes 'emit the whole .github/fleet-converge.sh')plan
    • openshell→intent Phase 1 — agnostic orchestration emit — MERGED (#6832), operator sign-off PENDING — While/BoundedPoll/general Retry (N-level escalation) emit via 05_emit_orchestration + bash grammar rows; byte goldens orchestration_*_emit_test; production consumer ci_floor_peak_emit.dag. Flip to done: true + sign(operator) on sign-off (mirrors 6-shell-slice2).plan
  • openapply() Phases B–F — B host_exec→apply() (gated on srv3 OsInstalled) · C Redfish live (partially via #6097) · D converge lane = EmitArtifactThenThinRun handler (first ctrl LOC deleted) · E pull-mode self-converge (autoinstall plants the on-host agent; the push star retires) · F decom. Phase A landed (#5756).plan
    • opentemporal-effect-spine-a — temporal realization spine (T1 vocabulary) (operator 2026-07-02; not a workflow engine) — std.temporal_effect: durable facts + plan_next_step_from_prior_receipt_and_lease (single prior+lease; list fold is consumer-side); 🟡 markers on stringly receipt labels + derived step id. RED: approval/lease/read-back gates. Non-goals: live mutation, DB, scheduler. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
      • opensrv3-install-reconcile-a — dry-run reconcile entrypoint (queued; gated on temporal-effect-spine-a + os-install-deduction-a) — InstallAttemptIntent + workflow steps as data; srv3_os_install_reconcile folds preflight + diagnostic + temporal spine; dry-run first. Accept (T3): dry-run receipt on srv1 actuator host.i:high v:med gunbc
    • openos-install-deduction-a — preflight + KVM diagnostic vocabulary (T1) (operator 2026-07-02; deduction half; NOT wired to srv3_os_install_diagnostic until reconcile-a) — gunbc.os_install_deduction: fold_nbd_proxy_os_install_preflight_verdict (NBD-proxy/on-ISO actuator scope — NoCloudNet incomplete for this path only), storage policy on payload, TargetDiskState, weak KVM verdicts (KvmFirmwareIdleObserved, KvmSuggestsOsBooted; OsInstalled reserved for router read-back). RED: remove storage flips ReadyToBoot; KVM login ≠ OsInstalled. Non-goals: live mutation, monitoring product, DB. Accept (T1): witness suite green.@dispatched 2026-07-02 · zesty-bat-588i:high v:small gunbc
  • opensrv3 → OsInstalled — finish the greenfield install over the solve-driven NBD-proxy actuator (#6097, live BMC); proves the install band end-to-end.plan
    • openresource-namespace-upsert-a — vocabulary only (#6134 srv3 bringup follow-up; operator reshape 2026-07-03) — std.upsert_decision (ObservationVerdict + UpsertDecision<P>); domain modules gunbc.file_access, gunbc.session_lease, gunbc.install_media. RED: foreign process on 10809=Conflict not kill; outside-namespace chmod=Refuse; drifted seeded ISO plans Remaster not Converged. Non-goal: live srv3 mutation.i:high v:small gunbc
    • openinstall-media-generic-layer — extract Ubuntu flavor from process — split extdeps/os/install_media.dag generic shapes (fetch/remaster/serve verdicts) from ubuntu_* flavor rows; move .gunbc-content-hash sidecar + remaster policy to gunbc/install_media_*; mandatory before second OS/distro. Post-#6134.i:high v:med gunbc
    • opennbd-serve-held-session-lease — NbdProxyServeSession intent with port/pid/cmdline/ISO/token fingerprint; classification + plan INSTANTIATE std.upsert_decision (ObservationVerdict + UpsertDecision<P>; domain facts as the P payload — do NOT mint a parallel lease vocabulary, cf. the fork-census 2026-07-03). RED: foreign 10809 no kill; stale matching session drains only. Live consumer: srv3 actuator.i:high v:med gunbc
    • opensrv3-boot-action-diagnostic — Redfish vs ipmitool fallback state machine — separate transports for BmcBootAction; boot refused unless serve RunningExpected; NoRebootObserved → optional IpmiResetFallback with separate approval; OutOfBandHostActionReceipt until modeled.i:high v:small gunbc
    • openos-install generic naming cleanup — rename generic behavior tests/modules away from srv3_* where testing credential resolution, remaster classification, workflow escalation; keep srv3 only in instance fixtures (srv3_pre_install_lease_table, srv3_seeded_install_media_artifact). Post-#6134.

Fabric dispatch — RunShape → Allocation → Receipt (GitHub is the queue, not the scheduler)

  • openStrictLease allocation model (Policy 0) — every provider exposes strict, non-oversubscribed RunShape offers first: one allocation consumes its declared RAM/swap/CPU budget, period. srv1/srv2 are modeled like ephemeral providers (N fixed slots, hard cgroup caps, read-back receipts before work); Ubicloud is a provider offer with EphemeralVm isolation. Burst/oversubscription explicitly out of scope. Four nouns, no scheduler: RunShape (arch/cpu_tokens/ram/swap/disk/duration/trust/workload_class) · ProviderOffer (provider/isolation/limits/oversubscription_policy/cost) · Allocation (shape×offer→target+lease) · Receipt (effective limits observed, peak usage, pressure/OOM events, release result). Accept (checklist): one real CI job runs under a StrictLease allocation on srv1/srv2 whose Receipt proves effective limits == the offer's declared limits (read back from the live cgroup, never asserted), and a second job requesting more than remaining capacity is refused a lease rather than co-scheduled.i:high v:med gunbc
    • openCI shape labels — runs-on as a projection of the fabric model — ci.yml emits runs-on labels derived from RunShape (e.g. gunbc-shape-ci-42c-128g), never host names; the runner registration/converge layer ensures the right runners carry those labels. GitHub remains the queue and runner availability is the backpressure: register slots per shape at safe strict capacity (e.g. 2 shape-rust-heavy + more light), NOT 10 equivalent heavy runners when only 2 heavy jobs are safe. A fabric-control-plane allocator (a .dag control server minting leases/JIT runners before dispatch) is the LATER architecture — only after srv1/srv2 are safely mutable and readable.
    • openProviderOffer rows + the dormant-Ubicloud design-break probe — srv1/srv2 fixed-host slots and Ubicloud ephemeral VMs inhabit the same offer type; add the Ubicloud row Dormant (16 vCPU/48GiB arm64, oversubscription: None) without running it. Acceptance = adding the offer changes no scheduler/control-plane invariant: witnesses prove (a) allocation accepts both SrvHostSlot and UbicloudVmOffer, (b) host-mutation code REFUSES Ubicloud offers (no cgroup target to mutate), (c) deploy-to-srv1 refuses LocalShell unless the allocation target proves host=srv1, (d) emitted labels encode shape, not provider host details. If adding Ubicloud forces a special case anywhere, the abstraction is wrong — this probe answers "does our design break?" before it can cost anything.
      • openBurstLease (Policy 1) — oversubscription earned by receipts — co-resident allocations on one host only after pressure/OOM/swap receipts prove the measured peaks allow it; StrictLease stays the default and the fallback. This is where stranded cores come back (sessions, compression, IO, smaller jobs) — on 128c/125GiB, strict memory allocation strands CPU and that is correct: the first goal is non-death, not full utilization. Gated on the sound-host-admission receipts and the live read seam.

Ordering (operator-signed): ① CD target-host proof → ② stateless-frontend MVP receipt (milestone A, on the existing deploy path) → ③ live read seam + privilege model → ④ one converge hunk closed-loop end-to-end (the narrow srv2 acceptance case) → ⑤ service allocation generalized from the frontend MVP → ⑥ StrictLease + shape labels; register srv1/srv2 slots by shape → ⑦ dormant Ubicloud row proves no design break → ⑧ CI jobs move to shape labels → ⑨ receipts (effective limits · peaks · OOM/swap pressure) → ⑩ BurstLease / dynamic routing / richer placement. ①–④ make infra changeable (everything else is paper until then); ⑤ proves the fabric is not just CI; ⑥ fixes backpressure with no scheduler; ⑦ validates the abstraction before we depend on it; ⑧–⑨ make CI consume the model; ⑩ recovers stranded cores.

Fleet hardening — make our metal safe for the load it carries

  • openthe return happened ungated — #6111 put required CI back on srv1/srv2 by operator call, accepting interim OOM/sccache exposure; the items below are the gates the return should have had, now owed as hardening. Ubicloud remains the burst/fallback offer (and the slot-shape template the admission model generalizes).
    • openSessionSliceEnforcement + verified-effective caps — agent-session cgroups have no citable verified-effective cap (the residual over-commit vector on srv1/srv2); the humming apply-rule stands: runner caps must not tighten while sessions are uncapped and oomd is absent.
    • openOOM classification consumer — ClusteredOutOfMemoryKill is modeled but absent from the active infra-retry signature roster; build the consumer so an OOM is first-class, never EAGAIN-shaped.plan
  • openresource-aware scheduler (implementation) — implements the signed bounded-input / cost-envelope scheduling design: (A) per-shard peak-RSS plumbing → (B) Runnable.cost with Predicted CostEnvelope → (C) scheduler reads cost, static side-channel deleted → (D) Measured falsifies Predicted, calibration loop retires data rows (#5431 instrument). Construction invariant: more memory → more width → more throughput, no .dag edits. tracker
  • openresource budget tree — admission (construction) · conserve-lens (honest residue) · runtime reconcile (fail-closed handler), three verdicts never conflated; subsumes spawn-width/placement/compile-jobs as consumer leaves. Protective only when paired with an enforcement actuator (cgroup memory.max, operator-fenced).carriergrounding
  • openone Placement authority — jobs (GitHub) · threads (spawn_width) · sessions (ctrl capacity) are 3 forks of "put work on a host"; Placement/Materialization are modeled but inert — CI consuming them is the lane's real deliverable.

3. The floor — audit what we have (does it actually do what it claims?)

Both pillars ride the CI floor: tree-wide marker-driven witness discovery · compile-clean gate · generated-artifact drift gates (this document is one) · regen --verify (#5873) · doc-graph reachability · emit-determinism (#5941) · the interim self-host comparison (#6009). Those stand. The floor's expansion lanes (testgen, wiring-liveness, complexity gates, lens meta-walls) are shelved — a new wall must displace a measured cost on a pillar path to un-shelve (the enforcement-intent gate below is the first such un-shelve, 2026-07-02: displaced cost = the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join, plus CI-killing quadratics and repeated dual-representation/anemia rediscovery).

Audit directive (operator, 2026-07-01): thoroughly audit what we have and what it actually does. For each load-bearing mechanism, prove by execution that it does what it claims, with a discriminating perturb that goes RED when the behavior is wrong — a typecheck or a grep is not a consumer (DESIGN §5), and a wired gate can still be vacuous. A mechanism claim without a red-control is unverified, whatever its docs say. The reset's own mapping found the pattern live: the committed converge shell is spec-without-execution (§2), the fixpoint gate self-declares interim (2-of-92 files), cargo-green is an ignored test. Highest-stakes mechanisms first:

Audit — green by execution, red by perturbation

  • openaffected-set lens (the operator's named example) — witness-level skip is LIVE on the floor (#6061); prove it: (a) soundness — construct a diff that MUST re-run a witness and assert it runs (a skipped-but-affected witness is the fail-open catastrophe); (b) effectiveness — receipts on real scoped diffs (skip counts + wall-clock delta, not claims); (c) fail-closed default — a provenance gap falls back to run-all, witnessed RED-on-perturb. The node-closure half (#6105) inherits the same receipt obligation before it may prune.i:high v:med gunbc
  • donemechanism inventory with red-controls — census every wired gate/lens/cache (floor-plan roster + commit_workflow): what it claims · its discriminating RED witness · its last execution receipt. Anything without a red-control gets one or gets demoted/deleted. The inert-lens backstop (#5433) covers wiring; this covers claim-vs-behavior.@dispatched 2026-07-01 · adhoc-c67edbed-916i:med v:large gunbcplan
  • opencache honesty re-receipt — re-run the warm==cold purity oracle against CURRENT main (616/616 was pre-reset), and close the sccache exit-0-no-binary class (below); a cache that lies is worse than no cache.
  • openartifact-freshness gate (operator ask: "we need a freshness gate, if we don't already have one") — we half-do: the per-PR drift gate proves committed==emitted for the PR's OWN tree, but drift still LANDED on main (.gitignore stale vs its authority since #6097; found and healed by #6110/#6111) because admission never re-validates against CURRENT main — green-on-branch is not green-on-main. The closing mechanism is the §2 merge-admission freshness block (HELD); this item is its receipt pair: (a) reproduce the landed-drift path as a RED witness, (b) confirm the freshness block refuses it once un-HELD.i:med v:small gunbc
  • openone tree, one verdict — 2026-07-01 live finding: dag_compile_clean_gate was GREEN while the discovery-corpus resolve of the same tree was RED (extdeps.shell module collision, silent last-root-wins shadowing; de-fork + loud-collision wall shipped as the hotfix). Two resolve paths gave two verdicts on one corpus — enumerate every place a module index is built, and make their collision/ordering semantics ONE authority so a gate cannot be green on a tree the floor cannot resolve.
  • openenforcement intent + model-quality walls (operator-directed 2026-07-02; §3 un-shelve — displaced cost: repeated manual "what is enforced, by what lens, over what corpus" joins; CI-killing quadratics; repeated dual-representation/anemia rediscovery) — model the operator's recurring standing directives as durable StandingIntent rows and gate the relationship (intent ⇄ LensContract ⇄ CoverageReceipt) fail-closed, so a mechanism claiming enforcement is complete only when the gate proves the claim from receipts, not self-declared contract claims. One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 → LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses). Anti-overcomplication: no lens may claim repo-wide / blocking / complete / self-applying unless the gate can prove it. Rollout: rows live; gate Blocking on contract consistency; object rules AuditOnly until receipts land. Children, A→C before object rules D/E: A StandingIntent carrier + LensContract extension (ConsumerKind/ConsumerRequirement NOT hardwired to FloorGate; EnforcementMode order Advisory < AuditOnly < Blocking modeled) · B enforcement_intent_gate contract-consistency reds (over CoverageReceipts) · C complexity.repo-wide first proof (3 legs red today, no decl_facts dep) · D complexity R1 accumulator-in-copied-port object rule (HOLDS behind #6155) · E anemia/consolidation first model-quality consumers (suggest a consolidation target, not just warn). design

Cost / risk / benefit — the floor's unmodeled optimization

  • openmodel cost/risk/benefit — "what do we actually run" is one optimization, not a pile of policies (operator working session 2026-07-12) — affected-set, wet/dry (mocks), receipt/long, ReadsLiveTree never-skip, and the test-kind names (test/receipt/demo/integration, WitnessKind, TestClassification) are all unmodeled proxies for argmax(benefit − cost) under a budget — hand-tuned stand-ins (mostly astrology) that exist because cost/risk/benefit were never first-class. Root anemia: test fn bakes in cost ≈ 0, run always, which is false (s1_closure ≈ 10min wet). Invariant that keeps it fail-closed: you may trade fidelity for cost (mocks, skips, deferrals), but the risk you trade away must stay observable on a cadence — deferred-and-detected, never silent (§5; a silent widen is the absorbing fallback). This inverts the tree's current wet-is-sacred default: wet is just the highest-cost fidelity point, usually not worth it. Bootstrappable now: a claim's expected internal work is inspectable (inputs/expected-output node shape) and its effects enumerable (which service ops, how many times via fold/loop bounds), each effect carrying a latency expectation; the floor already MEASURES wall_nanos/cgroup-peak per claim, so cost = measured receipt now → graph-derived later (§4). Landed as approximation in #6506 (Stages 0–2): hermetic-by-default floor, a flat hand-set 5s per-witness budget (fail-closed EvalBudgetExceeded), and a test/claim/long/ cadence — right shape, interim stand-ins; forward work is Stages 3–5. Missing pieces (highlighted, not papered over): no per-effect cost model; cost only bounded by the flat 5s budget, not derived from the graph (fail-closed = expensive on unknown fold bounds); the budget is flat/hand-set, not a per-run wall-clock allocated by value/cost; benefit unmodeled — only footholds are the §5 lower bound (no discriminating red ⟹ ~0 gate-value ⟹ drop, this is what a pure demo is) and observed red-frequency; the proxies aren't yet reconciled to the axes. Sequence: cost first (compute/resources, from what's measurable now) with budget-aware admission and counted typed deferrals (never silent skip) → benefit second (§5 lower bound + red-frequency, declared interim for the rest) → then affected-set/wet-dry/cadence/test-kinds collapse into derived readings and the qualitative vocabulary is deleted, not extended.cost/risk/benefit model

Open floor holes

  • opennightly full-corpus selector-backstop — per-PR selection is only sound because nightly runs everything; ⚠ CI-gen load-bearing
  • opentree-scoped builtin registry (fail-closed) — the global seed registry leaks intrinsics into the substrate compile, making compile-clean falsely green; instance fix #5452, class fix (partition) openforce-check plan
  • openkill sccache false-greens — exit-0-no-binary; build-verify asserts the artifact exists + is fresh (partly landed in ci.yml)

4. Shelved (parked 2026-07-01 — not deleted)

Every lane below was live roadmap before the reset. Shelved = plan docs and carriers stay in place, nothing dispatches from here, and the git-history ROADMAP.md holds the full pre-reset detail (structure, milestones, sign-off states). Un-shelve by PR into §1–§3, priced in displaced cost. (2026-07-06: the complexity budget whole-codebase, fail-closed meta band, and fold-ergonomics lanes are un-shelved into §0's priority order ② and ⑤ — this reshuffle is that PR; their nodes stay catalogued here until relocated into their §2/§3 lanes.)

  • openfold-ergonomics lane — inert-abstraction lens · non-fold-residue audit · staging combinator · ban source comments charter residue catalogue debt sample audit eval-bind PROPOSE
  • openfail-closed meta band — Value::Null split (the deep root) · Disposition carrier · reference grounding · cardinality refinement · expressibility frontier · reachability-completeness lens · axiom+syllogism lens · self-applying lenses · inert-lens promotion + gate-hygiene residue lockdown fork plan Disposition reference grounding cardinality P1 where-lowering frontier inert-layer lens axiom lens self-applying construction rule
  • openrust-gate .dag→rust coverage wall (edge-b) + stage0 clone-census ratchet brief
  • opencomplexity budget whole-codebase + the algebraic-rewrite construction engine (O(n²)→O(n) catalog, Unknown dissolution) rewrite plan
  • opentestgen oracle + wiring-liveness family (compile-time wiring lens ✓ #5679 · pre-send guard ✓ #5683 stand; the generator/preflight expansion parks) method wiring
  • opencaching completion — realize(subject) one door (P2) · M5 fixture-store · native content(T) (P5) · B1 generic-instantiation / B2 cross-tree content-hash blockers · one Materialization kernel · shared secrets model loop M4 M5
  • openCI inline-shell de-fork · interpreter terminal-output de-fork (seed forks of modeled authorities; both shrink as v1 burns down) emission-ingestion
  • openidea machine — ingest-at-large · English closure/round-trip · cross-media (JSON/react/diagram) · Medium homomorphisms · format-model C4–C6 · fidelity compose-up · eval generalization · invert-hand-maintained residue plan format reconciliation invert
  • openshell-emission slices 3–4 (census-rescoped) — live_deploy → thin-run/typed-effect candidate (runtime-present; not a golden to freeze) · bmc_token_federation (two Do rows) → ci_workflow RunSteps → githooks thin shim plan
  • openTypeScript first-class emit + TS self-host — END GOAL UNCHANGED (both realizations, per plan do-not-relitigate); resumes after the Rust fixed point gap census
  • openlanguage-target self-host frontier — the get-to-self-host path for all emission languages (Rust as model; Verilog/SPICE/LLVM as design-stress falsifiers); solve resolved as higher-order not a primitive frontier solve rationale
  • openHTML/React + live dashboard lane — page ✓ (#6010) and srv1 deploy ✓ (#6030) keep running as-is; interactivity · idea-input · demo park. The minimal stateless-frontend fabric slice is active in §2 only as a storage+compute+route consumer, not as the full dashboard/product lane (the CD transport fix is also §2 live work)
  • opensession dashboard + roadmap-as-spawner — the automatic spawn bridge stays fail-closed paused; §1–§3 sized nodes are the only dispatch surface (§3 audit items are deliberately dispatchable — the operator's audit lanes). The operator-clicked dispatch actuator slice is un-shelved into §2 (2026-07-03) plan
  • opengunbhub (own the Git/CI engine, closes G6) · internal repo model · compute fabric as a sellable piece
  • openprivacy / isolation model for the compute fabric — trust boundaries, tenant isolation, what the fabric may observe about a workload; was compute-fabric downstream work pre-reset, parked here so it is not lost (trust_class on RunShape is its active §2 seam). Includes committed-secret references (operator 2026-07-02, not urgent): a typed SecretRef — GCP Secret Manager resource name + version/content-hash — so sensitive facts (router serial, WAN MAC, public prefixes, credentials) commit as model-legible references while values stay in Secret Manager; redaction by construction (public shapes carry no raw-value field); first consumer: the network-identity observation fixtures.
  • openstructural correctness walls (standing, not active) — generated-output gate · coproduct exhaustiveness · cross-representation equality · oracle-method map; they keep gating, no expansion work dispatches from here
  • opendesign sketches without an active lane orchestration-as-intent model-grounding extract node-minimal representation func-env sigs resolved-graph minimization emit-host batch isolation accelerator roundtrip commit workflow input envelope seed-debt bundle 2 resolver collision wall regime-2 shared emission
`, contentType: 'text/html; charset=utf-8', status: 200 }]; const server = require('http').createServer((req, res) => { const method = req.method || 'GET'; const rawUrl = req.url || '/'; const path = rawUrl.split('?')[0] || '/'; diff --git a/dag/gunbc/roadmap_page.dag b/dag/gunbc/roadmap_page.dag index ab1a83497ed..2a7cd65bcf7 100644 --- a/dag/gunbc/roadmap_page.dag +++ b/dag/gunbc/roadmap_page.dag @@ -21,6 +21,7 @@ import gunbc.v1_deletion_plan { v1_deletion_gates, v1_deletion_milestones, PlanGateSpec, PlanMilestone, PlanGate, GateEmitterFixedPoint, GateHonestFrontier, GateLedgerGreen, GateDeletion, BrickState, Placed, InFlight, Gated, + BrickRole, BarBrick, SeedShrink, } fn roadmap_page_max_depth() -> Int { 8 } @@ -68,8 +69,15 @@ fn tg_brick_state_label(bs: BrickState) -> String { } } +fn tg_is_bar_brick(m: PlanMilestone) -> Bool { + match m.role { + BarBrick => true + SeedShrink => false + } +} + fn tg_gate_bricks(g: PlanGate) -> List { - filter(v1_deletion_milestones, m => tg_gate_eq(a: m.gate, b: g)) + filter(v1_deletion_milestones, m => tg_gate_eq(a: m.gate, b: g) && tg_is_bar_brick(m: m)) } fn tg_gate_total(g: PlanGate) -> Int { count(tg_gate_bricks(g: g)) } diff --git a/dag/gunbc/v1_deletion_plan.dag b/dag/gunbc/v1_deletion_plan.dag index e1f63ec7be3..a12d53a4f0a 100644 --- a/dag/gunbc/v1_deletion_plan.dag +++ b/dag/gunbc/v1_deletion_plan.dag @@ -11,6 +11,8 @@ type PlanGate = GateEmitterFixedPoint | GateHonestFrontier | GateLedgerGreen | G type BrickState = Placed | InFlight | Gated +type BrickRole = BarBrick | SeedShrink + type ConfidenceBasis { basis: String, risk: String, @@ -28,6 +30,7 @@ type PlanMilestone { title: String, gate: PlanGate, brick_state: BrickState, + role: BrickRole, parallelism: PlanParallelism, fan_width: Int, days_low: Int, @@ -49,29 +52,29 @@ data v1_deletion_gates: List = [ ] data v1_deletion_milestones: List = [ - PlanMilestone { id: ^wrap_decision_predicate, title: "ONE structural Rc wrap-decision predicate in the emitter (ownership-fact derived, never a name roster) — the gate on every Rc-heavy deep module", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 7, lane_state: "LANDED #6776 (wrap_decision_gate, fail-closed Rc ownership wrapping) + UseSiteVerdict catalog #6877; verified by execution 2026-07-20 (valiant-dove-723: claim_batch wrap_decision_predicate_witness_holds 7 sub-witnesses + gate smoke green on main; 06_translate routes type_shell and value_expression through the gate, WrapGateInapplicable passes through unchanged — no silent Rc default)", confidence: ConfidenceBasis { basis: "By execution — 7 sub-witnesses green on main plus the gate smoke; the predicate is ownership-fact-derived so the bad Rc wrap is UNWRITABLE (construction), not flagged after the fact", risk: "A use-site whose ownership the derivation mis-classifies silently falls to a wrap default", antagonize: "wrap_decision_predicate_witness_holds runs over the corpus; a mis-wrap reds it — the RED control is the discriminating fixture" } }, - PlanMilestone { id: ^std_dup_assembly_fix, title: "One harness fix: cssl std-seed-link closure assembly collides dag/std with the seed std (E0255) — single root; post-discharge census 2026-07-19 puts ~13 modules on this fix (3 Gate-A + 10 tail); the 6 formerly-unresolved modules cleared emit via KeySource but stay on a separate cargo UNRESOLVED bucket", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "LANDED+CAPTURED 2026-07-19 (#6876)", confidence: ConfidenceBasis { basis: "Single root (cssl closure assembly collided dag/std with seed std, E0255); the post-discharge census placed ~13 modules on the one fix", risk: "A module the census missed carries a second assembly collision not on this root", antagonize: "the cssl closure-assembly probe over the flip candidate set surfaces a residual collision" } }, - PlanMilestone { id: ^emit_import_closure_root, title: "ONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "SINGLE CHAIN-A GATE (operator 2026-07-20: root-cause the closure into ONE derivation, do NOT peel face-by-face; cargo-green + witness-green at ALL times, no mid-peel merges). #6919 (neat-swift-795) pivoted to the comprehensive derivation; DRAFT until representative cargo-green (>=1 nested-struct module + materialization_carriers) AND witness-green (regen --verify divergence 0, witness families stay green). #6906 landed FreeMonoid + std_measure + partial nested-struct (mid-peel; main green, no module flipped)", confidence: ConfidenceBasis { basis: "The closure is a mechanical transitive walk over names the emitted constructs already reference; the representative bar is by-execution on real modules, not first_error", risk: "A residual reference class the walk misses — rustc masks downstream layers behind first_error, so a new layer can surface AFTER the representative bar (FreeMonoid was one layer, falsified as the whole gate)", antagonize: "neat-swift ships the FULL residual rustc histogram (every E-code + count on 02_parse + materialization_carriers) on each layer-clear push, not just first_error; the confidence-probe throwaway branch peels AHEAD past the closure to force-expose layer N+1 before we commit" } }, - PlanMilestone { id: ^generic_t_rendering, title: "Generic-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading", gate: GateEmitterFixedPoint, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "IN FLIGHT (quiet-bee-205, Pole A-2). E0425 unbound T in 04_infer. Scoped SEPARATELY from emit_import_closure_root (operator 2026-07-20: distinct root). Root located; fix = thread the generic param names into the fold acc-type + refuse an unbound TypeVariable in render_rust_type (construction, never a string-scan of the emitted text)", confidence: ConfidenceBasis { basis: "Root located to the fold acc-type fallback plus render_rust_type; the threading shape is the same as the already-landed #6881 fn_generic_param_names", risk: "Generic-T interleaves with import-closure on the same modules (a fix-order coupling), or is deeper than the 04_infer surface it first showed on", antagonize: "quiet-bee ships the full residual histogram on clear; the peel-ahead branch stacks generic-T ON TOP of the import closure to expose interaction before either commits" } }, - PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", gate: GateEmitterFixedPoint, brick_state: Placed, parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE + PARTIAL FIX LANDED 2026-07-20 (#6906): all 6 emit 0-diagnostics; FreeMonoid + std_measure module-manifest + partial nested-struct import closure merged (mid-peel). The remaining import-closure layers are absorbed into emit_import_closure_root — this milestone's DIAGNOSIS deliverable is done; the fix continues under that gate", confidence: ConfidenceBasis { basis: "All 6 modules emit 0-diagnostics; the diagnosis deliverable is complete and the residual work is folded into emit_import_closure_root", risk: "0-diagnostics emit is NOT evidence of correct call-shape — a runtime call-shape defect can hide behind a clean compile (compile-clean is arity-blind)", antagonize: "require an EXECUTING-consumer receipt on signature changes, never the 0-diagnostics count alone" } }, - PlanMilestone { id: ^emit_representation_mismatch, title: "Emit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "EXPOSED then SIZED 2026-07-20 by the confidence-probe antagonizing (quiet-bee #6924). EXPOSED: E0308 dominates the residual (~4400/deep module, uniform across all three) and was MASKED behind rustc first_error until import-closure + generic-T peeled it open. SIZED (type-pair histogram, n=4261, 206 distinct pairs): TOP 5 pairs = 82 percent — Symbol/String ~2100 sites (ONE fork: v2.std.text String vs host String), FreeMonoid-rope/String ~1038, Vector/FreeMonoid ~150, Optional/Option ~150. TRACTABLE: 3-4 construction walls at the authority, NOT 206 one-offs. Owner TBD; couples to the numeric-tower grounding (#5428) generalized to the remaining primitives", confidence: ConfidenceBasis { basis: "SIZED by execution — 206 pairs but heavily skewed, TOP 5 = 82 percent, and the dominant Symbol/String (~2100 sites) is ONE known section-3 fork (v2.std.text vs host String); so it is a few construction walls times many sites, not many independent roots", risk: "Each wall (Symbol/String, Vector/FreeMonoid, Optional/Option grounding) touches a load-bearing std authority, so it is real grounding work not a one-liner; the ~740 tail sites (18 percent) may hide a few more roots", antagonize: "verified by the same residual histogram dropping toward 0 as each wall lands — Symbol/String first (the 82 percent lever); a stalled count reveals an unmodeled root" } }, - PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_representation_mismatch (which is itself gated on emit_import_closure_root + generic_t_rendering) (wrap_decision #6776 + std_dup #6876 already cleared). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green", confidence: ConfidenceBasis { basis: "All 8 deep modules already emit 0-diagnostics and refuse on the SAME root as the flip wave (TSVs #6916), so the root fix is expected to clear them wholesale, not one-by-one", risk: "A deep module (especially 04_infer, the generic-heavy one) hits a THIRD layer past import-closure + generic-T", antagonize: "the confidence-probe peel-ahead hacks past both known roots on a throwaway branch to surface layer 3 BEFORE the lanes commit" } }, - PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)", gate: GateEmitterFixedPoint, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on deep_module_lanes. Byte-fixpoint is an explicit NON-goal (it would force v2 to reproduce the seed's warts); the bar is behavioral equivalence on a discriminating corpus", confidence: ConfidenceBasis { basis: "Behavioral equivalence on a discriminating corpus is the operator-set bar; the emit machinery is already proven on the shallow modules that self-emit today", risk: "The emitted emitter diverges from the seed on a discriminating input the corpus does not cover", antagonize: "regen_stage0 --emit-fresh + --verify divergence 0 plus a discriminating RED that goes red when the re-emit is wrong" } }, - PlanMilestone { id: ^typed_frontier, title: "The self-host frontier is a typed row per module: SelfEmitted | SeedRetained(reason, migration_trigger) — no silent escape hatch (the DecodeFidelity/Lossless boundary)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED (src/v2/compiler/self_host/frontier.dag). Each compiler module is a FrontierQualifiedModuleBinding with a disposition; SeedRetained carries reason + migration_trigger, so a seed-retained module is countable and prioritizable, never a silent hole", confidence: ConfidenceBasis { basis: "frontier.dag exists and every module is a typed row with a disposition; the Lossless boundary is modeled", risk: "The disposition enum admits a state that reads honest but is not (SelfEmitted with a dead receipt, or a stale SeedRetained reason)", antagonize: "the no_frontier_lies wall plus the frontier audit (confidence-probe Phase 2) attack exactly that gap" } }, - PlanMilestone { id: ^frontier_dispositioned, title: "All 27 compiler modules dispositioned: 6 SelfEmitted (03_body_producer, 03_normalize, 07_target_carriers, discovery_enumeration, parse_engine_hooks, use_site_verdict) + 21 SeedRetained, each with a reason + trigger. The bar is NOT 27/27 SelfEmitted — some stay SeedRetained by necessity", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — 27/27 rows present in frontier.dag (count SelfEmitted vs SeedRetained there for the live number). The host-effect kernel, bootstrap, and self_host.dag itself stay SeedRetained by necessity; the flip wave (probe_flip_fanout) grows the SelfEmitted count but is seed-shrink beyond the minimum, not a bar-brick", confidence: ConfidenceBasis { basis: "27 rows counted in frontier.dag; the 6 SelfEmitted are verified by execution", risk: "A SeedRetained reason is stale (the module could self-emit now, so the frontier UNDERSTATES progress) or a SelfEmitted receipt is orphaned (OVERSTATES it)", antagonize: "the frontier audit samples SeedRetained rows for false-retention AND verifies every one of the 6 SelfEmitted receipts actually executes" } }, - PlanMilestone { id: ^no_frontier_lies, title: "No orphaned enrollment: every frontier receipt names an EXECUTING consumer; an enrolled-but-never-run receipt itself reds (the #6856 coverage-by-illusion class)", gate: GateHonestFrontier, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — the admission invariant (module-identity-storage-binding Phase 0): SelfEmitted receipts run on the falsifier wet cadence; quarantined known-red rows run on a probe cadence EXPECTING red so greening is a counted un-quarantine event. 'Enrolled, zero executions' reds", confidence: ConfidenceBasis { basis: "The wall is executable and runs over the corpus, not a grep", risk: "The wall itself goes inert (coverage-by-illusion one level up — a lens that exists but nothing gates on)", antagonize: "the executable hygiene backstop keeps every lens wired-or-deleted; the frontier audit confirms the wall actually fires" } }, - PlanMilestone { id: ^trigger_renegotiation, title: "DECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope", gate: GateHonestFrontier, brick_state: InFlight, parallelism: DecisionGate, fan_width: 1, days_low: 0, days_high: 0, lane_state: "RESOLVED 2026-07-20 (operator): do NOT wait on the namespace terminal — it is dragging. Renegotiate 03_resolve/03_name_resolve + body-producer tail triggers to emit under the current design with a declared later re-emit; the frontier-row renegotiation rides the flip-wave refresh", confidence: ConfidenceBasis { basis: "Operator-decided; the decision is made, only the mechanical frontier-row update remains", risk: "The row update lags and leaves a stale trigger on the frontier", antagonize: "the flip-wave refresh updates the rows and the no_frontier_lies wall catches a stale trigger" } }, - PlanMilestone { id: ^probe_flip_fanout, title: "Probe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum", gate: GateHonestFrontier, brick_state: Gated, parallelism: FanOutWide, fan_width: 13, days_low: 2, days_high: 5, lane_state: "GATED on emit_import_closure_root (+ generic_t_rendering for the generic-heavy candidates). The emitter fixed point (Gate 1) only needs the emitter modules to self-emit, so the flip wave GROWS the SelfEmitted count but is not itself a bar-brick. 2026-07-19 re-probe (TSVs #6891) read 18 of 19 candidates as import-closure-only. Fans out IN PARALLEL with deep_module_lanes on root-fix cargo-green. Flip PR #6881 HELD DRAFT; the flip set refreshes to the actual green set on root-fix merge", confidence: ConfidenceBasis { basis: "18 of 19 candidates read as import-closure-only after the re-probe; each flip is an independent lane once the root clears", risk: "The re-probe read only first_error, so a candidate may hide a second layer past import-closure", antagonize: "the full residual histogram per candidate on clear; each flip lands by-execution (cargo-green + witness-green), never on a probe prediction" } }, - PlanMilestone { id: ^witness_realization_kernel, title: "v2 execution path kernel: emit a witness to native code + run harness + scheduler (the piece that replaces the v1 interpreter for CI) — serial kernel, then families fan out", gate: GateLedgerGreen, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 5, lane_state: "LANDED 2026-07-19 #6879 (da0e7c3d) at full bar; kernel handoff (partition, seams, traps) and the six-family diagnosis table durable as comments on the PR; stern-lark-430 closed out clean", confidence: ConfidenceBasis { basis: "Landed at full bar by execution; the kernel runs a family end-to-end", risk: "The kernel's partition/seams do not generalize to a family the diagnosis table did not cover", antagonize: "the 9 family lanes all exercised it and all went green — the generalization is proven, not assumed" } }, - PlanMilestone { id: ^witness_family_fanout, title: "Per-witness-family realization lanes (claim families, wet receipts, lens gates) once the kernel runs one family end-to-end", gate: GateLedgerGreen, brick_state: Placed, parallelism: FanOutWide, fan_width: 5, days_low: 4, days_high: 8, lane_state: "DONE 2026-07-20 — all 9 witness families GREEN with trustworthy controls. #6912 (eval-repair consolidation) + #6917 (fold closure-arg: structural RuntimeClosure at edge grain, both oracle legs real, un-quarantine receipt) + #6918 (field_access RED-control fail-open fix — the wrong-fixture control could not go red when behavior was wrong; section-5 coverage-by-illusion, now discriminating). Emitter was CLEAN across all 9; every fix was eval/harness-side (the side v1-deletion removes)", confidence: ConfidenceBasis { basis: "All 9 families green by execution WITH discriminating RED controls (the #6918 fix made the field_access control able to go red on a wrong fixture)", risk: "A family's green rests on a non-discriminating control (the exact #6918 class recurring elsewhere)", antagonize: "each control was checked to go red on a wrong fixture; ledger_projection (Pole B) re-derives the dispositions from the probe_red carrier so a silent regression reds" } }, - PlanMilestone { id: ^ledger_modeled, title: "The proactive verification ledger is modeled: 3 spine receipts (cold parity, compile-clean, regen fixed point) + 9 family receipts, typed dispositions, no fabricated green", gate: GateLedgerGreen, brick_state: Placed, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "LANDED #6915 (proactive_verification_ledger.dag). Typed dispositions; no soak — every receipt is a deliberate executed run, not an elapsed-time claim", confidence: ConfidenceBasis { basis: "proactive_verification_ledger.dag exists with typed receipt rows for the 3 spine + 9 family checks", risk: "A disposition is a hand-declared literal that goes stale — exactly the Pole B defect: 5 family dispositions were hand-literals, lying after the eval PRs greened them", antagonize: "ledger_projection (Pole B #6923) projects dispositions from the probe_red carrier so they self-update; until it lands, the hand-literals ARE the attack surface" } }, - PlanMilestone { id: ^ledger_projection, title: "The ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)", gate: GateLedgerGreen, brick_state: InFlight, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "IN FLIGHT (gentle-bee, Pole B #6923). The genuinely-ORTHOGONAL Gate-3 lane runnable NOW (no Gate-1 dependency). Fixes the section-3 defect: 5 KnownRedPendingUnquarantine literals stale/lying after #6912/#6917/#6918 greened them", confidence: ConfidenceBasis { basis: "Root located — the probe_red carrier already holds the truth; the fix projects from it (single authority) rather than re-declaring the dispositions", risk: "The carrier does not cover every family, leaving a residue still hand-declared", antagonize: "gentle-bee executes the projection over all 9 families; a coverage gap reds it" } }, - PlanMilestone { id: ^cold_parity_receipt, title: "Spine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on emitter_fixed_point (no v2 emission = no cold parity to run). The falsifier cadence already carries the deterministic whole-tree cold control (GUNBC_CI_COMPILE_CLEAN_COLD_CONTROL); this brick is the deliberate v1-vs-v2 comparison over it", confidence: ConfidenceBasis { basis: "The cold-control mechanism already exists in the falsifier cadence; this receipt is a comparison, not new machinery", risk: "Cannot execute until Gate 1 lands — the deepest cross-gate dependency, so a divergence would surface late", antagonize: "run it the moment the emitter fixed point lands, counted per-family, with no elapsed-time substitute permitted" } }, - PlanMilestone { id: ^compile_clean_parity_receipt, title: "Spine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. Compile-clean is already the CI gate for v1; the receipt runs it on the v2 path", confidence: ConfidenceBasis { basis: "Compile-clean is already the v1 CI gate; the receipt just runs it on the v2-emitted path", risk: "0-diagnostics compile is arity-blind — clean does not imply behaviorally equal", antagonize: "paired with cold_parity_receipt (the behavioral leg), never standing alone as the equality claim" } }, - PlanMilestone { id: ^regen_fixed_point_receipt, title: "Spine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter", gate: GateLedgerGreen, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. The self-host fixed-point step executed as a ledger receipt, scoped at its own closure (regen skip authority)", confidence: ConfidenceBasis { basis: "regen_stage0 --emit-fresh + --verify is the existing self-host proof harness", risk: "The fixed point holds for the emitter but a downstream module regresses", antagonize: "--verify divergence 0 over the FULL regen input set, never a sampled subset" } }, - PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on emitter_fixed_point + probe_flip_fanout (the v2-emitted-execution half) + the ledger receipts. witness_family_fanout DONE. This is the cutover ACTION: CI stops using the v1 interpreter and runs the v2-emitted path", confidence: ConfidenceBasis { basis: "The ledger bricks supply the parity evidence; the cutover is the switch once they are green", risk: "The cutover exposes a CI-only path the per-family receipts did not cover", antagonize: "cold_parity_receipt runs the FULL corpus cold, not just the enrolled families" } }, - PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point (Gate 1) + ci_floor_cutover (itself gated on Gate 3 — ledger_projection + the 3 spine receipts) + unresolved_error_diagnosis + trigger_renegotiation (Gate 2). So all three gates read done before quarantine, Gate 3 reached transitively through the cutover — the DAG has no path to quarantine that skips the ledger", confidence: ConfidenceBasis { basis: "Quarantine is a build-path change (freeze the seed crates, ensure nothing depends on them) once all three gates read done", risk: "A product or CI step still references a seed crate", antagonize: "the products-can-build check — verify nothing in CI or products depends on src/v1 before flipping" } }, - PlanMilestone { id: ^v1_delete, title: "Delete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim", gate: GateDeletion, brick_state: Gated, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 1, lane_state: "blocked on v1_quarantine, which transitively requires the executed verification ledger: Gate 3 (ledger_projection + cold parity + compile-clean + regen fixed point) gates the ci_floor_cutover that gates quarantine, so no DAG path reaches delete without the ledger green by execution (per-family receipts included). No calendar soak", confidence: ConfidenceBasis { basis: "A mechanical removal once quarantine holds and the ledger is green BY EXECUTION", risk: "Deleting too early on a soak-substituted green (the operator's explicit worry)", antagonize: "gate on the enumerated executed receipts, never elapsed time — the ledger is the wall" } } + PlanMilestone { id: ^wrap_decision_predicate, title: "ONE structural Rc wrap-decision predicate in the emitter (ownership-fact derived, never a name roster) — the gate on every Rc-heavy deep module", gate: GateEmitterFixedPoint, brick_state: Placed, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 7, lane_state: "LANDED #6776 (wrap_decision_gate, fail-closed Rc ownership wrapping) + UseSiteVerdict catalog #6877; verified by execution 2026-07-20 (valiant-dove-723: claim_batch wrap_decision_predicate_witness_holds 7 sub-witnesses + gate smoke green on main; 06_translate routes type_shell and value_expression through the gate, WrapGateInapplicable passes through unchanged — no silent Rc default)", confidence: ConfidenceBasis { basis: "By execution — 7 sub-witnesses green on main plus the gate smoke; the predicate is ownership-fact-derived so the bad Rc wrap is UNWRITABLE (construction), not flagged after the fact", risk: "A use-site whose ownership the derivation mis-classifies silently falls to a wrap default", antagonize: "wrap_decision_predicate_witness_holds runs over the corpus; a mis-wrap reds it — the RED control is the discriminating fixture" } }, + PlanMilestone { id: ^std_dup_assembly_fix, title: "One harness fix: cssl std-seed-link closure assembly collides dag/std with the seed std (E0255) — single root; post-discharge census 2026-07-19 puts ~13 modules on this fix (3 Gate-A + 10 tail); the 6 formerly-unresolved modules cleared emit via KeySource but stay on a separate cargo UNRESOLVED bucket", gate: GateEmitterFixedPoint, brick_state: Placed, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "LANDED+CAPTURED 2026-07-19 (#6876)", confidence: ConfidenceBasis { basis: "Single root (cssl closure assembly collided dag/std with seed std, E0255); the post-discharge census placed ~13 modules on the one fix", risk: "A module the census missed carries a second assembly collision not on this root", antagonize: "the cssl closure-assembly probe over the flip candidate set surfaces a residual collision" } }, + PlanMilestone { id: ^emit_import_closure_root, title: "ONE comprehensive emit import-closure derivation: the emitted module import set = the transitive closure of every type/module name any emitted construct references (params, body, inferred, nested-record struct literals AND their sibling-module field types, carrier types, referenced modules). Replaces the per-face gates (faithful-carrier, struct-field StructRepr-only, module-manifest). FreeMonoid was ONE layer of this, not the whole gate", gate: GateEmitterFixedPoint, brick_state: InFlight, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "SINGLE CHAIN-A GATE (operator 2026-07-20: root-cause the closure into ONE derivation, do NOT peel face-by-face; cargo-green + witness-green at ALL times, no mid-peel merges). #6919 (neat-swift-795) pivoted to the comprehensive derivation; DRAFT until representative cargo-green (>=1 nested-struct module + materialization_carriers) AND witness-green (regen --verify divergence 0, witness families stay green). #6906 landed FreeMonoid + std_measure + partial nested-struct (mid-peel; main green, no module flipped)", confidence: ConfidenceBasis { basis: "The closure is a mechanical transitive walk over names the emitted constructs already reference; the representative bar is by-execution on real modules, not first_error", risk: "A residual reference class the walk misses — rustc masks downstream layers behind first_error, so a new layer can surface AFTER the representative bar (FreeMonoid was one layer, falsified as the whole gate)", antagonize: "neat-swift ships the FULL residual rustc histogram (every E-code + count on 02_parse + materialization_carriers) on each layer-clear push, not just first_error; the confidence-probe throwaway branch peels AHEAD past the closure to force-expose layer N+1 before we commit" } }, + PlanMilestone { id: ^generic_t_rendering, title: "Generic-type rendering fix: an unbound TypeVariable in an applied type must REFUSE, not render — root is the fold acc-type fallback path (emit_rust_fold_method_call -> lambda_acc_type_str/lambda_param_type_strs with fold_acc_uses_fallback) plus render_rust_type not refusing an unbound T inside an applied type. A DISTINCT class from import-closure (generic rendering, not a missing import); blocks 04_infer/06_translate/05_emit; same family as #6881 fn_generic_param_names threading", gate: GateEmitterFixedPoint, brick_state: InFlight, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 3, lane_state: "IN FLIGHT (quiet-bee-205, Pole A-2). E0425 unbound T in 04_infer. Scoped SEPARATELY from emit_import_closure_root (operator 2026-07-20: distinct root). Root located; fix = thread the generic param names into the fold acc-type + refuse an unbound TypeVariable in render_rust_type (construction, never a string-scan of the emitted text)", confidence: ConfidenceBasis { basis: "Root located to the fold acc-type fallback plus render_rust_type; the threading shape is the same as the already-landed #6881 fn_generic_param_names", risk: "Generic-T interleaves with import-closure on the same modules (a fix-order coupling), or is deeper than the 04_infer surface it first showed on", antagonize: "quiet-bee ships the full residual histogram on clear; the peel-ahead branch stacks generic-T ON TOP of the import closure to expose interaction before either commits" } }, + PlanMilestone { id: ^unresolved_error_diagnosis, title: "Diagnose-then-fix the 6 unresolved_compiler_error modules (00_compile, materialization_carriers, program_assembly, source_authority, 02_parse, 03_ingest) from the census probe output", gate: GateEmitterFixedPoint, brick_state: Placed, role: BarBrick, parallelism: FanOutWide, fan_width: 3, days_low: 0, days_high: 1, lane_state: "DIAGNOSIS COMPLETE + PARTIAL FIX LANDED 2026-07-20 (#6906): all 6 emit 0-diagnostics; FreeMonoid + std_measure module-manifest + partial nested-struct import closure merged (mid-peel). The remaining import-closure layers are absorbed into emit_import_closure_root — this milestone's DIAGNOSIS deliverable is done; the fix continues under that gate", confidence: ConfidenceBasis { basis: "All 6 modules emit 0-diagnostics; the diagnosis deliverable is complete and the residual work is folded into emit_import_closure_root", risk: "0-diagnostics emit is NOT evidence of correct call-shape — a runtime call-shape defect can hide behind a clean compile (compile-clean is arity-blind)", antagonize: "require an EXECUTING-consumer receipt on signature changes, never the 0-diagnostics count alone" } }, + PlanMilestone { id: ^emit_representation_mismatch, title: "Emit representation-mismatch layer: after import-closure + generic-T clear, each deep module still shows ~4400 E0308 type mismatches (04_infer E0308x4261; 06_translate + 05_emit E0308x4422) — the model-vs-realization fork surfacing in emit (modeled coproduct types where native Rust/Value types are expected, and vice versa)", gate: GateEmitterFixedPoint, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 5, lane_state: "EXPOSED then SIZED 2026-07-20 by the confidence-probe antagonizing (quiet-bee #6924). EXPOSED: E0308 dominates the residual (~4400/deep module, uniform across all three) and was MASKED behind rustc first_error until import-closure + generic-T peeled it open. SIZED (type-pair histogram, n=4261, 206 distinct pairs): TOP 5 pairs = 82 percent — Symbol/String ~2100 sites (ONE fork: v2.std.text String vs host String), FreeMonoid-rope/String ~1038, Vector/FreeMonoid ~150, Optional/Option ~150. TRACTABLE: 3-4 construction walls at the authority, NOT 206 one-offs. Owner TBD; couples to the numeric-tower grounding (#5428) generalized to the remaining primitives", confidence: ConfidenceBasis { basis: "SIZED by execution — 206 pairs but heavily skewed, TOP 5 = 82 percent, and the dominant Symbol/String (~2100 sites) is ONE known section-3 fork (v2.std.text vs host String); so it is a few construction walls times many sites, not many independent roots", risk: "Each wall (Symbol/String, Vector/FreeMonoid, Optional/Option grounding) touches a load-bearing std authority, so it is real grounding work not a one-liner; the ~740 tail sites (18 percent) may hide a few more roots", antagonize: "verified by the same residual histogram dropping toward 0 as each wall lands — Symbol/String first (the 82 percent lever); a stalled count reveals an unmodeled root" } }, + PlanMilestone { id: ^deep_module_lanes, title: "Self-emit lanes for the Rc-heavy core: 04_infer, 06_translate, the 05_emit family — fan out in parallel with the flip wave once import-closure + generic-T + representation-mismatch reach cargo-green", gate: GateEmitterFixedPoint, brick_state: Gated, role: BarBrick, parallelism: FanOutWide, fan_width: 4, days_low: 3, days_high: 6, lane_state: "GATED on emit_representation_mismatch (which is itself gated on emit_import_closure_root + generic_t_rendering) (wrap_decision #6776 + std_dup #6876 already cleared). Baseline TSVs #6916 (sharp-ferret-568): all 8 deep modules (04_infer, 06_translate, whole 05_emit family) emit clean + cargo-refuse on the SAME import-closure root as the flip wave. Fans out IN PARALLEL with probe_flip_fanout on root-fix cargo-green", confidence: ConfidenceBasis { basis: "All 8 deep modules already emit 0-diagnostics and refuse on the SAME root as the flip wave (TSVs #6916), so the root fix is expected to clear them wholesale, not one-by-one", risk: "A deep module (especially 04_infer, the generic-heavy one) hits a THIRD layer past import-closure + generic-T", antagonize: "the confidence-probe peel-ahead hacks past both known roots on a throwaway branch to surface layer 3 BEFORE the lanes commit" } }, + PlanMilestone { id: ^emitter_fixed_point, title: "The emitted emitter re-emits itself: behavioral 2-generation fixed point on the v2 side (not byte identity)", gate: GateEmitterFixedPoint, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on deep_module_lanes. Byte-fixpoint is an explicit NON-goal (it would force v2 to reproduce the seed's warts); the bar is behavioral equivalence on a discriminating corpus", confidence: ConfidenceBasis { basis: "Behavioral equivalence on a discriminating corpus is the operator-set bar; the emit machinery is already proven on the shallow modules that self-emit today", risk: "The emitted emitter diverges from the seed on a discriminating input the corpus does not cover", antagonize: "regen_stage0 --emit-fresh + --verify divergence 0 plus a discriminating RED that goes red when the re-emit is wrong" } }, + PlanMilestone { id: ^typed_frontier, title: "The self-host frontier is a typed row per module: SelfEmitted | SeedRetained(reason, migration_trigger) — no silent escape hatch (the DecodeFidelity/Lossless boundary)", gate: GateHonestFrontier, brick_state: Placed, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED (src/v2/compiler/self_host/frontier.dag). Each compiler module is a FrontierQualifiedModuleBinding with a disposition; SeedRetained carries reason + migration_trigger, so a seed-retained module is countable and prioritizable, never a silent hole", confidence: ConfidenceBasis { basis: "frontier.dag exists and every module is a typed row with a disposition; the Lossless boundary is modeled", risk: "The disposition enum admits a state that reads honest but is not (SelfEmitted with a dead receipt, or a stale SeedRetained reason)", antagonize: "the no_frontier_lies wall plus the frontier audit (confidence-probe Phase 2) attack exactly that gap" } }, + PlanMilestone { id: ^frontier_dispositioned, title: "All 27 compiler modules dispositioned: 6 SelfEmitted (03_body_producer, 03_normalize, 07_target_carriers, discovery_enumeration, parse_engine_hooks, use_site_verdict) + 21 SeedRetained, each with a reason + trigger. The bar is NOT 27/27 SelfEmitted — some stay SeedRetained by necessity", gate: GateHonestFrontier, brick_state: Placed, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — 27/27 rows present in frontier.dag (count SelfEmitted vs SeedRetained there for the live number). The host-effect kernel, bootstrap, and self_host.dag itself stay SeedRetained by necessity; the flip wave (probe_flip_fanout) grows the SelfEmitted count but is seed-shrink beyond the minimum, not a bar-brick", confidence: ConfidenceBasis { basis: "27 rows counted in frontier.dag; the 6 SelfEmitted are verified by execution", risk: "A SeedRetained reason is stale (the module could self-emit now, so the frontier UNDERSTATES progress) or a SelfEmitted receipt is orphaned (OVERSTATES it)", antagonize: "the frontier audit samples SeedRetained rows for false-retention AND verifies every one of the 6 SelfEmitted receipts actually executes" } }, + PlanMilestone { id: ^no_frontier_lies, title: "No orphaned enrollment: every frontier receipt names an EXECUTING consumer; an enrolled-but-never-run receipt itself reds (the #6856 coverage-by-illusion class)", gate: GateHonestFrontier, brick_state: Placed, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 0, days_high: 0, lane_state: "LANDED — the admission invariant (module-identity-storage-binding Phase 0): SelfEmitted receipts run on the falsifier wet cadence; quarantined known-red rows run on a probe cadence EXPECTING red so greening is a counted un-quarantine event. 'Enrolled, zero executions' reds", confidence: ConfidenceBasis { basis: "The wall is executable and runs over the corpus, not a grep", risk: "The wall itself goes inert (coverage-by-illusion one level up — a lens that exists but nothing gates on)", antagonize: "the executable hygiene backstop keeps every lens wired-or-deleted; the frontier audit confirms the wall actually fires" } }, + PlanMilestone { id: ^trigger_renegotiation, title: "DECISION: namespace-gated modules (03_resolve, 03_name_resolve) + body-producer tail — renegotiate migration triggers to emit under the current design (accept a later re-emit), or exclude from the 2-week scope", gate: GateHonestFrontier, brick_state: InFlight, role: BarBrick, parallelism: DecisionGate, fan_width: 1, days_low: 0, days_high: 0, lane_state: "RESOLVED 2026-07-20 (operator): do NOT wait on the namespace terminal — it is dragging. Renegotiate 03_resolve/03_name_resolve + body-producer tail triggers to emit under the current design with a declared later re-emit; the frontier-row renegotiation rides the flip-wave refresh", confidence: ConfidenceBasis { basis: "Operator-decided; the decision is made, only the mechanical frontier-row update remains", risk: "The row update lags and leaves a stale trigger on the frontier", antagonize: "the flip-wave refresh updates the rows and the no_frontier_lies wall catches a stale trigger" } }, + PlanMilestone { id: ^probe_flip_fanout, title: "Probe + flip the std_dup-gated modules (~13 at cargo stage after the 2026-07-19 re-probe); each probe/flip is an independent lane once the import-closure root reaches cargo-green. Seed-shrink beyond the fixed-point minimum", gate: GateHonestFrontier, brick_state: Gated, role: SeedShrink, parallelism: FanOutWide, fan_width: 13, days_low: 2, days_high: 5, lane_state: "GATED on emit_import_closure_root (+ generic_t_rendering for the generic-heavy candidates). The emitter fixed point (Gate 1) only needs the emitter modules to self-emit, so the flip wave GROWS the SelfEmitted count but is not itself a bar-brick. 2026-07-19 re-probe (TSVs #6891) read 18 of 19 candidates as import-closure-only. Fans out IN PARALLEL with deep_module_lanes on root-fix cargo-green. Flip PR #6881 HELD DRAFT; the flip set refreshes to the actual green set on root-fix merge", confidence: ConfidenceBasis { basis: "18 of 19 candidates read as import-closure-only after the re-probe; each flip is an independent lane once the root clears", risk: "The re-probe read only first_error, so a candidate may hide a second layer past import-closure", antagonize: "the full residual histogram per candidate on clear; each flip lands by-execution (cargo-green + witness-green), never on a probe prediction" } }, + PlanMilestone { id: ^witness_realization_kernel, title: "v2 execution path kernel: emit a witness to native code + run harness + scheduler (the piece that replaces the v1 interpreter for CI) — serial kernel, then families fan out", gate: GateLedgerGreen, brick_state: Placed, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 3, days_high: 5, lane_state: "LANDED 2026-07-19 #6879 (da0e7c3d) at full bar; kernel handoff (partition, seams, traps) and the six-family diagnosis table durable as comments on the PR; stern-lark-430 closed out clean", confidence: ConfidenceBasis { basis: "Landed at full bar by execution; the kernel runs a family end-to-end", risk: "The kernel's partition/seams do not generalize to a family the diagnosis table did not cover", antagonize: "the 9 family lanes all exercised it and all went green — the generalization is proven, not assumed" } }, + PlanMilestone { id: ^witness_family_fanout, title: "Per-witness-family realization lanes (claim families, wet receipts, lens gates) once the kernel runs one family end-to-end", gate: GateLedgerGreen, brick_state: Placed, role: BarBrick, parallelism: FanOutWide, fan_width: 5, days_low: 4, days_high: 8, lane_state: "DONE 2026-07-20 — all 9 witness families GREEN with trustworthy controls. #6912 (eval-repair consolidation) + #6917 (fold closure-arg: structural RuntimeClosure at edge grain, both oracle legs real, un-quarantine receipt) + #6918 (field_access RED-control fail-open fix — the wrong-fixture control could not go red when behavior was wrong; section-5 coverage-by-illusion, now discriminating). Emitter was CLEAN across all 9; every fix was eval/harness-side (the side v1-deletion removes)", confidence: ConfidenceBasis { basis: "All 9 families green by execution WITH discriminating RED controls (the #6918 fix made the field_access control able to go red on a wrong fixture)", risk: "A family's green rests on a non-discriminating control (the exact #6918 class recurring elsewhere)", antagonize: "each control was checked to go red on a wrong fixture; ledger_projection (Pole B) re-derives the dispositions from the probe_red carrier so a silent regression reds" } }, + PlanMilestone { id: ^ledger_modeled, title: "The proactive verification ledger is modeled: 3 spine receipts (cold parity, compile-clean, regen fixed point) + 9 family receipts, typed dispositions, no fabricated green", gate: GateLedgerGreen, brick_state: Placed, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "LANDED #6915 (proactive_verification_ledger.dag). Typed dispositions; no soak — every receipt is a deliberate executed run, not an elapsed-time claim", confidence: ConfidenceBasis { basis: "proactive_verification_ledger.dag exists with typed receipt rows for the 3 spine + 9 family checks", risk: "A disposition is a hand-declared literal that goes stale — exactly the Pole B defect: 5 family dispositions were hand-literals, lying after the eval PRs greened them", antagonize: "ledger_projection (Pole B #6923) projects dispositions from the probe_red carrier so they self-update; until it lands, the hand-literals ARE the attack surface" } }, + PlanMilestone { id: ^ledger_projection, title: "The ledger self-updates: project family dispositions from the ci_layer_roots.dag probe_red carrier instead of hand-declared literals (DESIGN section 3 single authority)", gate: GateLedgerGreen, brick_state: InFlight, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "IN FLIGHT (gentle-bee, Pole B #6923). The genuinely-ORTHOGONAL Gate-3 lane runnable NOW (no Gate-1 dependency). Fixes the section-3 defect: 5 KnownRedPendingUnquarantine literals stale/lying after #6912/#6917/#6918 greened them", confidence: ConfidenceBasis { basis: "Root located — the probe_red carrier already holds the truth; the fix projects from it (single authority) rather than re-declaring the dispositions", risk: "The carrier does not cover every family, leaving a residue still hand-declared", antagonize: "gentle-bee executes the projection over all 9 families; a coverage gap reds it" } }, + PlanMilestone { id: ^cold_parity_receipt, title: "Spine receipt: whole-corpus COLD v1-vs-v2 witness parity with zero unexplained divergence — a deliberate executed run, not a soak", gate: GateLedgerGreen, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on emitter_fixed_point (no v2 emission = no cold parity to run). The falsifier cadence already carries the deterministic whole-tree cold control (GUNBC_CI_COMPILE_CLEAN_COLD_CONTROL); this brick is the deliberate v1-vs-v2 comparison over it", confidence: ConfidenceBasis { basis: "The cold-control mechanism already exists in the falsifier cadence; this receipt is a comparison, not new machinery", risk: "Cannot execute until Gate 1 lands — the deepest cross-gate dependency, so a divergence would surface late", antagonize: "run it the moment the emitter fixed point lands, counted per-family, with no elapsed-time substitute permitted" } }, + PlanMilestone { id: ^compile_clean_parity_receipt, title: "Spine receipt: compile-clean parity — the v2-emitted path compiles the corpus clean, matching v1", gate: GateLedgerGreen, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. Compile-clean is already the CI gate for v1; the receipt runs it on the v2 path", confidence: ConfidenceBasis { basis: "Compile-clean is already the v1 CI gate; the receipt just runs it on the v2-emitted path", risk: "0-diagnostics compile is arity-blind — clean does not imply behaviorally equal", antagonize: "paired with cold_parity_receipt (the behavioral leg), never standing alone as the equality claim" } }, + PlanMilestone { id: ^regen_fixed_point_receipt, title: "Spine receipt: regen behavioral fixed point — regen_stage0 on the v2-emitted sources reproduces a behaviorally-equivalent emitter", gate: GateLedgerGreen, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "GATED on emitter_fixed_point. The self-host fixed-point step executed as a ledger receipt, scoped at its own closure (regen skip authority)", confidence: ConfidenceBasis { basis: "regen_stage0 --emit-fresh + --verify is the existing self-host proof harness", risk: "The fixed point holds for the emitter but a downstream module regresses", antagonize: "--verify divergence 0 over the FULL regen input set, never a sampled subset" } }, + PlanMilestone { id: ^ci_floor_cutover, title: "CI floor runs on v2-emitted execution; PROACTIVE falsifier parity against the v1 path — deliberately executed cold v1-vs-v2 runs with counted divergence (operator 2026-07-20: no passive soak; verify by execution, not elapsed time)", gate: GateDeletion, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 2, days_high: 4, lane_state: "GATED on emitter_fixed_point + probe_flip_fanout (the v2-emitted-execution half) + the ledger receipts. witness_family_fanout DONE. This is the cutover ACTION: CI stops using the v1 interpreter and runs the v2-emitted path", confidence: ConfidenceBasis { basis: "The ledger bricks supply the parity evidence; the cutover is the switch once they are green", risk: "The cutover exposes a CI-only path the per-family receipts did not cover", antagonize: "cold_parity_receipt runs the FULL corpus cold, not just the enrolled families" } }, + PlanMilestone { id: ^v1_quarantine, title: "v1 off the build path: seed crates frozen as a bootstrap artifact, nothing in CI or products depends on them — the products-can-build milestone", gate: GateDeletion, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 2, lane_state: "blocked on emitter_fixed_point (Gate 1) + ci_floor_cutover (itself gated on Gate 3 — ledger_projection + the 3 spine receipts) + unresolved_error_diagnosis + trigger_renegotiation (Gate 2). So all three gates read done before quarantine, Gate 3 reached transitively through the cutover — the DAG has no path to quarantine that skips the ledger", confidence: ConfidenceBasis { basis: "Quarantine is a build-path change (freeze the seed crates, ensure nothing depends on them) once all three gates read done", risk: "A product or CI step still references a seed crate", antagonize: "the products-can-build check — verify nothing in CI or products depends on src/v1 before flipping" } }, + PlanMilestone { id: ^v1_delete, title: "Delete src/v1 + stage0 when the PROACTIVE VERIFICATION LEDGER is green by execution — no calendar soak (operator 2026-07-20: suspicious of soaking; test/verify proactively). Ledger = enumerated executed receipts, each a deliberate run, none an elapsed-time claim", gate: GateDeletion, brick_state: Gated, role: BarBrick, parallelism: ForciblySerial, fan_width: 1, days_low: 1, days_high: 1, lane_state: "blocked on v1_quarantine, which transitively requires the executed verification ledger: Gate 3 (ledger_projection + cold parity + compile-clean + regen fixed point) gates the ci_floor_cutover that gates quarantine, so no DAG path reaches delete without the ledger green by execution (per-family receipts included). No calendar soak", confidence: ConfidenceBasis { basis: "A mechanical removal once quarantine holds and the ledger is green BY EXECUTION", risk: "Deleting too early on a soak-substituted green (the operator's explicit worry)", antagonize: "gate on the enumerated executed receipts, never elapsed time — the ledger is the wall" } } ] data v1_deletion_dependencies: List = [ diff --git a/dag/test/claim/roadmap_page_witness_test.dag b/dag/test/claim/roadmap_page_witness_test.dag index 84320c6d005..f07b1581278 100644 --- a/dag/test/claim/roadmap_page_witness_test.dag +++ b/dag/test/claim/roadmap_page_witness_test.dag @@ -46,6 +46,7 @@ fn witness_authority_shows_three_gate_progress() -> Bool { && string_contains(s: authority, pattern: "Gate 1 — the emitter re-emits itself") && string_contains(s: authority, pattern: "Gate 3 — verification ledger green by execution") && !string_contains(s: authority, pattern: "Cutover and delete") + && !string_contains(s: authority, pattern: "std_dup-gated modules") } fn depth_chain_html(fuel: Int) -> String { From 1d63288736168e85ec45446a7ef4cfdebfa0bed7 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 23:41:16 +0000 Subject: [PATCH 23/32] WIP: Weak Self Host -> Strong Self Host (Wave 1 -> 4, on 1 exit) --- dag/test/fixture/m4_universal_governed_corpus.dag | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dag/test/fixture/m4_universal_governed_corpus.dag b/dag/test/fixture/m4_universal_governed_corpus.dag index 5441dddabb7..0e0608842b4 100644 --- a/dag/test/fixture/m4_universal_governed_corpus.dag +++ b/dag/test/fixture/m4_universal_governed_corpus.dag @@ -1,5 +1,7 @@ module test.fixture.m4_universal_governed_corpus +import std.hermetic_replay { PublishedMockCase } + data m4_universal_probe_case_allowed: PublishedMockCase = PublishedMockCase { operation_key: "GovernedUniversalProbe.Allowed", From 3340a20f4cd49ae49cb7f823349232ae380a0ae4 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 20 Jul 2026 23:46:08 +0000 Subject: [PATCH 24/32] Fix host_standup witness stale after #6947 nbd_proxy typed-effect migration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit declared_gap_steps_carry_interim_realization_authority required every DeclaredGap's interim_realization to cite `ctrl:` OR (`extdeps.` AND `gunbc.`). #6947 (Wave C3, merged to main) correctly migrated the os-install-actuated gap's nbd_proxy realization from the extdeps shell transport (`extdeps.bmc.webui.nbd_proxy_serve ShellProgram`) to a gunbc typed host-effect (`gunbc.host_effect_nbd_proxy_serve`), a more-grounded authority that no longer routes through an extdeps dep. The now-purely- gunbc realization made the `(extdeps. AND gunbc.)` conjunction fail, so the fold returned Bool(false) — a main-inherited CI red (owner session crisp-bat-221 archived; no fix in flight). Relax the over-specific conjunction to the invariant's actual intent: a DeclaredGap must cite >=1 grounded authority — `ctrl:` OR `extdeps.` OR `gunbc.`. Fail-closed property preserved: a gap citing NONE still reds; ModeledCompose arm unchanged. RED proven by CI execution on 36442263c2 (returned Bool(false)); this greens it. Also restores dag/test/fixture/m4_universal_governed_corpus.dag to origin/main (a phantom auto-WIP edit had crept in during local repro). Co-Authored-By: Claude Fable 5 --- dag/test/claim/host_standup_spine_witness_test.dag | 4 ++-- dag/test/fixture/m4_universal_governed_corpus.dag | 2 -- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/dag/test/claim/host_standup_spine_witness_test.dag b/dag/test/claim/host_standup_spine_witness_test.dag index c32753a4260..136a6aa08e2 100644 --- a/dag/test/claim/host_standup_spine_witness_test.dag +++ b/dag/test/claim/host_standup_spine_witness_test.dag @@ -181,8 +181,8 @@ test fn declared_gap_steps_carry_interim_realization_authority() -> Bool { DeclaredGap { interim_realization: path, refusal: r } => string_contains(s: r, pattern: "host_standup:") && (string_contains(s: path, pattern: "ctrl:") - || (string_contains(s: path, pattern: "extdeps.") - && string_contains(s: path, pattern: "gunbc."))) + || string_contains(s: path, pattern: "extdeps.") + || string_contains(s: path, pattern: "gunbc.")) ModeledCompose { authorities: refs } => refs.length() > 0 } ) diff --git a/dag/test/fixture/m4_universal_governed_corpus.dag b/dag/test/fixture/m4_universal_governed_corpus.dag index 0e0608842b4..5441dddabb7 100644 --- a/dag/test/fixture/m4_universal_governed_corpus.dag +++ b/dag/test/fixture/m4_universal_governed_corpus.dag @@ -1,7 +1,5 @@ module test.fixture.m4_universal_governed_corpus -import std.hermetic_replay { PublishedMockCase } - data m4_universal_probe_case_allowed: PublishedMockCase = PublishedMockCase { operation_key: "GovernedUniversalProbe.Allowed", From cb8e6ad47e95d4df29ce12e7958e27a6e7ecaf5e Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:14:30 +0000 Subject: [PATCH 25/32] WIP: Weak Self Host -> Strong Self Host (Gates 1-3, i guess) --- docs/probes/curated_cargo_frontier_probe_sweep.tsv | 4 +++- src/v2/compiler/self_host/frontier.dag | 13 +++++++++---- src/v2/compiler/self_host/frontier_probe_types.dag | 3 +++ 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index 50f751c85fb..9d573dbaab1 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -1,3 +1,5 @@ # classifier_stamp: rule1-first-error-dup-harness-unknown-unresolved-v2 module emit cargo first_error mapped_gate verdict -src/v2/compiler/02_parse.dag 73 files emitted, 55 diagnostics refuse error: expected `,`, or `}`, found `.` UNKNOWN UNKNOWN-error:_expected_`,`,_or_`}`,_found_`.` +src/v2/compiler/02_parse.dag 74 files emitted, 55 diagnostics refuse error: expected `,`, or `}`, found `.` UNKNOWN UNKNOWN-error:_expected_`,`,_or_`}`,_found_`.` +src/v2/compiler/03_ingest.dag 147 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/06_translate.dag 74 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE diff --git a/src/v2/compiler/self_host/frontier.dag b/src/v2/compiler/self_host/frontier.dag index b7b7c27bbfc..769126944e9 100644 --- a/src/v2/compiler/self_host/frontier.dag +++ b/src/v2/compiler/self_host/frontier.dag @@ -20,6 +20,7 @@ import v2.compiler.self_host.frontier_probe_types { curated_cargo_probe_namespace_qualified_rust_emit_reason, curated_cargo_probe_import_closure_cargo_refuse_reason, curated_cargo_probe_emit_assemble_refuse_reason, + curated_cargo_probe_generic_type_render_reason, frontier_blocker_class_matches, frontier_probe_blocker_rank } @@ -286,11 +287,13 @@ data compiler_frontier_row_03_ingest: CompilerModuleFrontierRow = execution_meas migration_trigger: ^migrate_when_closure_self_emits_cargo_green ) -data compiler_frontier_row_03_name_resolve: CompilerModuleFrontierRow = knowledge_attributed_blocker_class_seed_retained_row( +data compiler_frontier_row_03_name_resolve: CompilerModuleFrontierRow = execution_measured_seed_retained_row( module_path: "src/v2/compiler/03_name_resolve.dag", closure_reads: 44, measured_blocker: EmitSurfaceGap, - migration_trigger: ^migrate_when_namespace_only_resolution_lands + located_stage: ProbeStageAssemble, + located_reason: curated_cargo_probe_emit_assemble_refuse_reason, + migration_trigger: ^migrate_when_closure_self_emits_cargo_green ) data compiler_frontier_row_03_normalize: CompilerModuleFrontierRow = execution_measured_self_emitted_row( @@ -305,11 +308,13 @@ data compiler_frontier_row_03_normalize: CompilerModuleFrontierRow = execution_m tractability_rank: self_emitted_tractability_rank_at_flip(closure_reads: 37, pre_flip_blocker: EmitSurfaceGap) ) -data compiler_frontier_row_03_resolve: CompilerModuleFrontierRow = knowledge_attributed_blocker_class_seed_retained_row( +data compiler_frontier_row_03_resolve: CompilerModuleFrontierRow = execution_measured_seed_retained_row( module_path: "src/v2/compiler/03_resolve.dag", closure_reads: 39, measured_blocker: EmitSurfaceGap, - migration_trigger: ^migrate_when_namespace_only_resolution_lands + located_stage: ProbeStageEmit, + located_reason: curated_cargo_probe_generic_type_render_reason, + migration_trigger: ^migrate_when_closure_self_emits_cargo_green ) data compiler_frontier_row_04_infer: CompilerModuleFrontierRow = execution_measured_seed_retained_row( diff --git a/src/v2/compiler/self_host/frontier_probe_types.dag b/src/v2/compiler/self_host/frontier_probe_types.dag index f5cec8e15e9..c572c863d14 100644 --- a/src/v2/compiler/self_host/frontier_probe_types.dag +++ b/src/v2/compiler/self_host/frontier_probe_types.dag @@ -83,9 +83,12 @@ data curated_cargo_probe_import_closure_cargo_refuse_reason: Symbol = ^curated_c data curated_cargo_probe_emit_assemble_refuse_reason: Symbol = ^curated_cargo_probe_emit_assemble_refuse +data curated_cargo_probe_generic_type_render_reason: Symbol = ^curated_cargo_probe_generic_type_render + data honest_frontier_refresh_probe_note: String = "Honest frontier refresh 2026-07-20 (neat-swift-795 @ d904abdeae): reverted premature Gate-A flip-wave 6 from SelfEmitted→SeedRetained after CSSL_STD_SEED_LINK=1 curated_cargo_probe_one.sh execution showed 0/6 cargo-green and 0/6 emit-clean post-#6848 merge. Current buckets by probe: curated_cargo_probe_namespace_qualified_rust_emit (emit+cargo dotted-path rustc refuse on 00_compile/02_parse/03_ingest/source_authority); curated_cargo_probe_import_closure_cargo_refuse (E0422 namespace on materialization_carriers + prior std_dup cargo residue on 01_tokenize/04_infer/program_partition); curated_cargo_probe_emit_assemble_refuse (program_assembly EMIT_REFUSE). Baseline 6 SelfEmitted (body_producer, normalize, target_carriers, discovery_enumeration, parse_engine_hooks, use_site_verdict). #6881 stays DRAFT until emit regression fixed and >=1 module cargo-green by execution." data gate_a_flip_probe_wave_note: String = "SUPERSEDED by honest_frontier_refresh_probe_note (2026-07-20): Jul-19 flip-wave claim retracted — never cargo-green by execution on current HEAD." +data honest_frontier_refresh_2026_07_22_note: String = "Honest frontier refresh 2026-07-22 (sharp-bee-290, operator-directed: disentangle dependencies — a blocker edge without a named MEASURED reason is removed). The two resolver rows (03_resolve, 03_name_resolve) were the only knowledge_attributed rows carrying migration_trigger migrate_when_namespace_only_resolution_lands; probed by execution (CSSL_STD_SEED_LINK=1 curated_cargo_probe_one.sh, empty shim per sr transport contract, gunbc rebuilt at the probe head) and the namespace-terminal trigger is REFUTED on both: (1) 03_resolve emits clean (45 files, 0 diagnostics) and cargo-refuses on E0425 cannot-find-type-T — the generic-T fold-lambda render class (crisp-fox-839 site map: emit_typed_fold_lambda -> lambda_param_type_strs -> render_rust_type), a DISTINCT class from import-closure, new reason row curated_cargo_probe_generic_type_render; re-probe after the generic-T guard lands. (2) 03_name_resolve refuses at ASSEMBLE: cssl_assemble unroutable closure dependency gunbc_plans_md_helpers — its reference closure is contaminated by a gunbc.plans reach (suspect edge: src/v2/compiler/self_host/frontier_probe_survey.dag imports gunbc.plans, a layer inversion per DESIGN section 3 strict layer DAG; own separate fix). Both rows re-declared execution_measured with trigger migrate_when_closure_self_emits_cargo_green (the 04_infer pattern). The pre-existing contradiction is itself a receipt: self_host_03_resolve_behavioral_transport.dag (Wave-2 flip machinery, already built) names its dependency as post-#6775 Rc/Optional emit surface greens — never the namespace terminal. The namespace-only-resolution terminal no longer appears anywhere in the v1-delete dependency graph." data honest_frontier_refresh_2026_07_21_note: String = "Honest frontier refresh 2026-07-21 (warm-lark-815), re-probed on fresh main AFTER the Gate-1 import-closure root (PR 6960) merged. Method: CSSL_STD_SEED_LINK=1 curated_cargo_probe_one.sh per module, first rustc error only. FLIPS: ZERO — the flip wave produced no SelfEmitted transition, and that negative result is the receipt. From 30c1252fd079e61ba835b10b28b4fd1738aed95f Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:26:31 +0000 Subject: [PATCH 26/32] WIP: Weak Self Host -> Strong Self Host (Gates 1-3, i guess) --- docs/probes/curated_cargo_frontier_probe_sweep.tsv | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index 9d573dbaab1..012b4faabf8 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -3,3 +3,15 @@ module emit cargo first_error mapped_gate verdict src/v2/compiler/02_parse.dag 74 files emitted, 55 diagnostics refuse error: expected `,`, or `}`, found `.` UNKNOWN UNKNOWN-error:_expected_`,`,_or_`}`,_found_`.` src/v2/compiler/03_ingest.dag 147 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/06_translate.dag 74 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/05_eval.dag 57 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/materialization_carriers.dag 41 files emitted, 46 diagnostics refuse error[E0425]: cannot find value `extdeps` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/05_emit.dag 75 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/materialization_carriers.dag 41 files emitted, 46 diagnostics refuse error[E0425]: cannot find value `extdeps` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/05_emit_orchestration.dag 81 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/05_emit_orchestration.dag 81 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_module.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_module.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_produced.dag 85 files emitted, 97 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_produced.dag 85 files emitted, 97 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE From 1cff68a8725e57134b5717d1cb14bf05e885e66a Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:28:01 +0000 Subject: [PATCH 27/32] WIP: Weak Self Host -> Strong Self Host (Gates 1-3, i guess) --- docs/probes/curated_cargo_frontier_probe_sweep.tsv | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index 012b4faabf8..7fcb6223314 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -15,3 +15,5 @@ src/v2/compiler/emit_produced.dag 85 files emitted, 97 diagnostics harness_refus src/v2/compiler/emit_produced.dag 85 files emitted, 97 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_host.dag 88 files emitted, 76 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_host.dag 88 files emitted, 76 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE From 25791124096d58a9d0be77209418f17096368453 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:32:31 +0000 Subject: [PATCH 28/32] WIP: Weak Self Host -> Strong Self Host (Gates 1-3, i guess) --- docs/probes/curated_cargo_frontier_probe_sweep.tsv | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index 7fcb6223314..c7ec37da984 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -17,3 +17,7 @@ src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_ src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/emit_host.dag 88 files emitted, 76 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/emit_host.dag 88 files emitted, 76 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/fold_lowering.dag 42 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/fold_lowering.dag 42 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for gunbc_plans_md_helpers: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for gunbc_plans_md_helpers: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE From 9e085fdbb1c9bb3e3b802a92121875234e20a580 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:37:02 +0000 Subject: [PATCH 29/32] WIP: Weak Self Host -> Strong Self Host (Gates 1-3, i guess) --- docs/probes/curated_cargo_frontier_probe_sweep.tsv | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index c7ec37da984..65cfe927702 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -21,3 +21,6 @@ src/v2/compiler/fold_lowering.dag 42 files emitted, 0 diagnostics refuse error[E src/v2/compiler/fold_lowering.dag 42 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for gunbc_plans_md_helpers: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for gunbc_plans_md_helpers: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE From f72d4c0e568e7ab08b0b0a9455c772c3f7f769d4 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:38:32 +0000 Subject: [PATCH 30/32] WIP: Weak Self Host -> Strong Self Host (Gates 1-3, i guess) --- docs/probes/curated_cargo_frontier_probe_sweep.tsv | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index 65cfe927702..215e941ebd1 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -24,3 +24,4 @@ src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_ref src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE From a26c440750a0360c1e317bb778ed4c11fa8d5292 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:41:33 +0000 Subject: [PATCH 31/32] WIP: Weak Self Host -> Strong Self Host (Gates 1-3, i guess) --- docs/probes/curated_cargo_frontier_probe_sweep.tsv | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index 215e941ebd1..a2e8423fdcb 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -25,3 +25,5 @@ src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E042 src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/01_tokenize.dag 23 files emitted, 0 diagnostics refuse error: struct literal body without path UNKNOWN UNKNOWN-error:_struct_literal_body_without_path +src/v2/compiler/01_tokenize.dag 23 files emitted, 0 diagnostics refuse error: struct literal body without path UNKNOWN UNKNOWN-error:_struct_literal_body_without_path From 653daedc8aeba2e66812b2878e52d5e54e540c8a Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 00:52:31 +0000 Subject: [PATCH 32/32] Honest frontier refresh 2026-07-22: namespace-terminal trigger refuted by execution; full 21-module probe sweep Operator-directed disentangle: a blocker edge without a named MEASURED reason is removed. - 03_resolve + 03_name_resolve re-declared knowledge_attributed -> execution_measured: 03_resolve = generic-T render class (E0425 cannot find type T; new reason row curated_cargo_probe_generic_type_render), 03_name_resolve = cssl_assemble refuse (unroutable gunbc_plans_md_helpers closure reach). Both triggers -> migrate_when_closure_self_emits_cargo_green (the 04_infer pattern); the migrate_when_namespace_only_resolution_lands trigger no longer appears anywhere. - Full-frontier sweep TSV (21/21 modules, deduped, provenance header): 4 generic-T (03_resolve, 04_infer, 05_eval, fold_lowering), 1 value-qualified (materialization_carriers), 2 render residues (02_parse dotted, 01_tokenize struct-literal-path), 13 HARNESS_REFUSE on ONE root (test_claim_materialization_ladder_witness pulled into compiler closures; + gunbc.plans on 03_name_resolve), 1 false-red (03_normalize, lane shim required). - Verified by execution: frontier compile differential clean (135 pre-existing on entry, 0 added), frontier_classify_unlisted_reason_refuses_holds green, 10/10 compiler_frontier_census witnesses green. Co-Authored-By: Claude Fable 5 --- .../curated_cargo_frontier_probe_sweep.tsv | 36 +++++++++---------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/docs/probes/curated_cargo_frontier_probe_sweep.tsv b/docs/probes/curated_cargo_frontier_probe_sweep.tsv index a2e8423fdcb..e85a25a5317 100644 --- a/docs/probes/curated_cargo_frontier_probe_sweep.tsv +++ b/docs/probes/curated_cargo_frontier_probe_sweep.tsv @@ -1,29 +1,27 @@ # classifier_stamp: rule1-first-error-dup-harness-unknown-unresolved-v2 +# Full-frontier re-sweep 2026-07-22 (sharp-bee-290, operator-directed disentangle-by-measurement). +# branch_head=a26c440750a0 CSSL_STD_SEED_LINK=1 shim=empty gunbc_sha256_prefix=488f4bbff36fb106 +# NOTE: two racing sweep invocations produced duplicate rows with IDENTICAL verdicts (accidental determinism receipt); deduped here. +# CAVEAT: 03_normalize row is a KNOWN FALSE-RED under empty shim (lane shim REQUIRED per probe contract); it is SelfEmitted with an executing receipt. module emit cargo first_error mapped_gate verdict +src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/01_tokenize.dag 23 files emitted, 0 diagnostics refuse error: struct literal body without path UNKNOWN UNKNOWN-error:_struct_literal_body_without_path src/v2/compiler/02_parse.dag 74 files emitted, 55 diagnostics refuse error: expected `,`, or `}`, found `.` UNKNOWN UNKNOWN-error:_expected_`,`,_or_`}`,_found_`.` src/v2/compiler/03_ingest.dag 147 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/06_translate.dag 74 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/05_eval.dag 57 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace -src/v2/compiler/materialization_carriers.dag 41 files emitted, 46 diagnostics refuse error[E0425]: cannot find value `extdeps` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for gunbc_plans_md_helpers: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/03_normalize.dag 50 files emitted, 29 diagnostics refuse error: expected one of `:`, `@`, or `|`, found `.` UNKNOWN_emit_shape UNKNOWN-error:_expected_one_of_`:`,_`@`,_or_`|`,_found_`.` +src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/04_infer.dag 50 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace src/v2/compiler/05_emit.dag 75 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/materialization_carriers.dag 41 files emitted, 46 diagnostics refuse error[E0425]: cannot find value `extdeps` in this scope namespace_resolution CONFIRMED-namespace -src/v2/compiler/05_emit_orchestration.dag 81 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/05_emit_orchestration.dag 81 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/05_eval.dag 57 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/06_translate.dag 74 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/emit_host.dag 88 files emitted, 76 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/emit_module.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/emit_module.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/emit_produced.dag 85 files emitted, 97 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/emit_produced.dag 85 files emitted, 97 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/emit_semantic_decl.dag 76 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/emit_host.dag 88 files emitted, 76 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/emit_host.dag 88 files emitted, 76 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/fold_lowering.dag 42 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace src/v2/compiler/fold_lowering.dag 42 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace -src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for gunbc_plans_md_helpers: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/03_name_resolve.dag 54 files emitted, 38 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for gunbc_plans_md_helpers: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace -src/v2/compiler/03_resolve.dag 45 files emitted, 0 diagnostics refuse error[E0425]: cannot find type `T` in this scope namespace_resolution CONFIRMED-namespace -src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/00_compile.dag 145 files emitted, 285 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE -src/v2/compiler/01_tokenize.dag 23 files emitted, 0 diagnostics refuse error: struct literal body without path UNKNOWN UNKNOWN-error:_struct_literal_body_without_path -src/v2/compiler/01_tokenize.dag 23 files emitted, 0 diagnostics refuse error: struct literal body without path UNKNOWN UNKNOWN-error:_struct_literal_body_without_path +src/v2/compiler/materialization_carriers.dag 41 files emitted, 46 diagnostics refuse error[E0425]: cannot find value `extdeps` in this scope namespace_resolution CONFIRMED-namespace +src/v2/compiler/program_assembly.dag 109 files emitted, 156 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/program_partition.dag 81 files emitted, 75 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE +src/v2/compiler/source_authority.dag 107 files emitted, 135 diagnostics harness_refuse CSSL_ASSEMBLE: REFUSED refused dep assembly for test_claim_materialization_ladder_witness: unroutable closure dependency (not entry/compiler/std-bridge/bootstrap/lens/peripheral) HARNESS_SEED_LINK HARNESS_REFUSE