CI onto v2: routing frontier + parity gate + consumption (P4/P2/R1/R2)

.github/workflows/ci.yml

@@ -33,8 +33,9 @@ jobs:
           echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
           echo "MAKEFLAGS=" >> "$GITHUB_ENV"
           echo "CARGO_BUILD_JOBS=4" >> "$GITHUB_ENV"
-          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native"
-          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native" >> "$GITHUB_ENV"
+          GUNBC_TOOLCHAIN_SEG=$(rustc -V 2>/dev/null | tr ' ' '-'); if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then GUNBC_TOOLCHAIN_SEG=toolchain-unresolved; fi
+          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG"
+          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV"
           if sccache --show-stats >/dev/null 2>&1; then
             echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
             echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"

.github/workflows/falsifier.yml

@@ -27,8 +27,9 @@ jobs:
           echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
           echo "MAKEFLAGS=" >> "$GITHUB_ENV"
           echo "CARGO_BUILD_JOBS=4" >> "$GITHUB_ENV"
-          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native"
-          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native" >> "$GITHUB_ENV"
+          GUNBC_TOOLCHAIN_SEG=$(rustc -V 2>/dev/null | tr ' ' '-'); if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then GUNBC_TOOLCHAIN_SEG=toolchain-unresolved; fi
+          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG"
+          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV"
           if sccache --show-stats >/dev/null 2>&1; then
             echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
             echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"

dag/std/computation_identity.dag

@@ -0,0 +1,34 @@
+module std.computation_identity
+
+import std.types { String, Bool }
+
+data computation_identity_note: String = "The computation-identity lattice (census R1, landed 2026-07-22; formerly prose in docs/plans/duplicate-work-graph-lens-design.md section 4, cited by v2.std.materialize, std.interface_summary, gunbc.design_document, and the cross-entry memo sketch as the authority they defer to). One vocabulary for what 'identical computation' means, at every grain: StructurallyIdentical (equal content hash over canonicalized structure — the corner v2.std.materialize implements), NormalizedIdentical (equal after a NAMED normalizer), ExtensionallyIdentical (equal observable behavior within a declared bound), IdentityUnknown (a typed, located debt — never permanent, never treated as identical or as distinct-by-default; the cause names the missing work). Mirrors DescentEvidence: evidence-graded, fail-closed at the bottom."
+
+type IdentityUnknownCause
+  = MissingConcept { detail: String }
+  | MissingEnforcement { detail: String }
+  | BoundUnmodeled { detail: String }
+
+type ComputationIdentity
+  = StructurallyIdentical
+  | NormalizedIdentical { normalizer: String }
+  | ExtensionallyIdentical { bound: String }
+  | IdentityUnknown { cause: IdentityUnknownCause }
+
+fn identity_grade_is_known(ci: ComputationIdentity) -> Bool {
+  match ci {
+    StructurallyIdentical => true
+    NormalizedIdentical { normalizer: _ } => true
+    ExtensionallyIdentical { bound: _ } => true
+    IdentityUnknown { cause: _ } => false
+  }
+}
+
+fn identity_permits_share(ci: ComputationIdentity) -> Bool {
+  match ci {
+    StructurallyIdentical => true
+    NormalizedIdentical { normalizer: _ } => true
+    ExtensionallyIdentical { bound: _ } => true
+    IdentityUnknown { cause: _ } => false
+  }
+}

src/v1/stage0/src/v1_interpreter.rs

@@ -7490,6 +7490,39 @@ fn eval_emit_host_run_transport_cached_builtin(
     )
 }
 
+/// Host-tool program resolution for the emit-host transports (fleet incident
+/// 2026-07-22: srv2 runner env has no `cargo` on PATH — the repo-checkout build
+/// steps get it via the CI prelude, but the transport spawns from an emitted
+/// workspace with only the process env). Resolution order: bare name if it
+/// resolves on PATH; else $CARGO_HOME/bin/<name>; else $HOME/.cargo/bin/<name>;
+/// else the bare name (spawn then fails with the existing typed error — refuse,
+/// never fabricate).
+fn resolve_host_tool_program(name: &str) -> String {
+    if name.contains('/') {
+        return name.to_string();
+    }
+    if let Ok(path_var) = std::env::var("PATH") {
+        for dir in path_var.split(':') {
+            if !dir.is_empty() && std::path::Path::new(dir).join(name).is_file() {
+                return name.to_string();
+            }
+        }
+    }
+    if let Ok(cargo_home) = std::env::var("CARGO_HOME") {
+        let candidate = std::path::Path::new(&cargo_home).join("bin").join(name);
+        if candidate.is_file() {
+            return candidate.to_string_lossy().into_owned();
+        }
+    }
+    if let Ok(home) = std::env::var("HOME") {
+        let candidate = std::path::Path::new(&home).join(".cargo/bin").join(name);
+        if candidate.is_file() {
+            return candidate.to_string_lossy().into_owned();
+        }
+    }
+    name.to_string()
+}
+
 fn emit_host_run_transport_cached_in_workspace(
     workspace: &std::path::Path,
     files: &[(String, String)],
@@ -7560,7 +7593,7 @@ fn emit_host_run_transport_cached_in_workspace(
 
     let target_dir = workspace.join("target");
     let run_command = |argv: &[String]| -> InterpResult<std::process::Output> {
-        std::process::Command::new(&argv[0])
+        std::process::Command::new(resolve_host_tool_program(&argv[0]))
             .args(&argv[1..])
             .current_dir(workspace)
             .env("CARGO_TARGET_DIR", &target_dir)
@@ -7688,7 +7721,7 @@ fn emit_host_run_transport_in_workspace(
 
     let target_dir = workspace.join("target");
     let run_command = |argv: &[String]| -> InterpResult<std::process::Output> {
-        std::process::Command::new(&argv[0])
+        std::process::Command::new(resolve_host_tool_program(&argv[0]))
             .args(&argv[1..])
             .current_dir(workspace)
             .env("CARGO_TARGET_DIR", &target_dir)

src/v2/compiler/self_host/native_routing_frontier.dag

@@ -0,0 +1,137 @@
+module v2.compiler.self_host.native_routing_frontier
+
+import v2.std.collection { List }
+import v2.std.logic { Bool }
+import v2.std.text { String }
+import v2.std.algebra { length }
+
+data native_routing_frontier_note: String = "Per-family execution-routing frontier (P6 cutover mechanism, planned 2026-07-22): each enrolled emit-on-demand witness family is EXACTLY one of NativeRouted (its equals_eval agreement legs run native in the per-PR floor via gunbc_pr_native_batch, warm against GUNBC_NATIVE_CACHE_ROOT) or InterpretedRetained (a declared row with reason + dissolve_on — countable, prioritizable, never a silent default; the self-host-frontier pattern applied to execution routing). The flip NativeRouted is DATA gated by the parity window (v2.compiler.self_host.parity_window): N consecutive green falsifier cadence windows (agreement + warm compile_skipped=true) are required evidence; a refusal or divergence resets the window. One authority decides both sides of the floor: the per-PR native batch enrolls NativeRouted families and interpreted discovery drops exactly those — no dual representation. All 9 families start InterpretedRetained with reason parity_window_open at landing; the PR ships the machine, receipts flip it."
+
+type NativeRoutingDisposition
+  = NativeRouted
+  | InterpretedRetained { reason: String, dissolve_on: String }
+
+type NativeRoutingFrontierRow {
+  family: String
+  agreement_entry: String
+  agreement_function: String
+  disposition: NativeRoutingDisposition
+}
+
+fn retained_parity_open(family: String, entry: String, f: String) -> NativeRoutingFrontierRow {
+  NativeRoutingFrontierRow {
+    family: family,
+    agreement_entry: entry,
+    agreement_function: f,
+    disposition: InterpretedRetained {
+      reason: "no_cached_no_evict_carrier",
+      dissolve_on: "a no-evict cached agreement leg exists for this family (the family_crate pr_native pattern) AND its parity window is green per v2.compiler.self_host.parity_window; the equals_eval legs are UNCACHED (srv1 sweep receipt 2026-07-22: empty native-cache fields) so routing them would build every PR run"
+    }
+  }
+}
+
+fn routed_via_family_crate(family: String) -> NativeRoutingFrontierRow {
+  NativeRoutingFrontierRow {
+    family: family,
+    agreement_entry: "src/v2/test/claim/execution/emit_on_demand_family_crate_witness_test.dag",
+    agreement_function: "emit_on_demand_family_crate_pr_native_agreement_holds",
+    disposition: NativeRouted
+  }
+}
+
+data native_routing_frontier_roster: List<NativeRoutingFrontierRow> = [
+  retained_parity_open(
+    family: "add",
+    entry: "src/v2/test/claim/execution/emit_host_add_equals_eval_test.dag",
+    f: "emit_host_add_equals_eval_holds"
+  ),
+  retained_parity_open(
+    family: "field_access",
+    entry: "src/v2/test/claim/execution/emit_host_field_access_equals_eval_test.dag",
+    f: "emit_host_field_access_equals_eval_holds"
+  ),
+  routed_via_family_crate(family: "complement"),
+  retained_parity_open(
+    family: "match",
+    entry: "src/v2/test/claim/execution/emit_host_match_equals_eval_test.dag",
+    f: "emit_host_match_equals_eval_holds"
+  ),
+  retained_parity_open(
+    family: "loop",
+    entry: "src/v2/test/claim/execution/emit_host_loop_equals_eval_test.dag",
+    f: "emit_host_loop_equals_eval_holds"
+  ),
+  retained_parity_open(
+    family: "fold_closure",
+    entry: "src/v2/test/claim/execution/emit_host_fold_closure_equals_eval_test.dag",
+    f: "emit_host_fold_closure_equals_eval_holds"
+  ),
+  routed_via_family_crate(family: "meet_join"),
+  retained_parity_open(
+    family: "variant_construct",
+    entry: "src/v2/test/claim/execution/emit_host_variant_construct_equals_eval_test.dag",
+    f: "emit_host_variant_construct_equals_eval_holds"
+  ),
+  retained_parity_open(
+    family: "classical_not_ingested",
+    entry: "src/v2/test/claim/execution/emit_host_classical_not_ingested_equals_eval_test.dag",
+    f: "emit_host_classical_not_ingested_equals_eval_holds"
+  )
+]
+
+data native_routing_frontier_family_count_expected: Int = 9
+
+fn routing_row_is_native(row: NativeRoutingFrontierRow) -> Bool {
+  match row.disposition {
+    NativeRouted => true
+    InterpretedRetained { reason: _, dissolve_on: _ } => false
+  }
+}
+
+fn native_routed_rows() -> List<NativeRoutingFrontierRow> {
+  fold(
+    native_routing_frontier_roster,
+    init: [],
+    f: fn(acc, row) {
+      if routing_row_is_native(row: row) {
+        concat(acc, [row])
+      } else {
+        acc
+      }
+    }
+  )
+}
+
+fn interpreted_retained_rows() -> List<NativeRoutingFrontierRow> {
+  fold(
+    native_routing_frontier_roster,
+    init: [],
+    f: fn(acc, row) {
+      if routing_row_is_native(row: row) {
+        acc
+      } else {
+        concat(acc, [row])
+      }
+    }
+  )
+}
+
+fn routing_frontier_row_for_family(family: String) -> List<NativeRoutingFrontierRow> {
+  fold(
+    native_routing_frontier_roster,
+    init: [],
+    f: fn(acc, row) {
+      if row.family == family {
+        concat(acc, [row])
+      } else {
+        acc
+      }
+    }
+  )
+}
+
+fn routing_frontier_total_holds() -> Bool {
+  let split_total = length(xs: native_routed_rows()) + length(xs: interpreted_retained_rows())
+  length(xs: native_routing_frontier_roster) == native_routing_frontier_family_count_expected
+    && split_total == native_routing_frontier_family_count_expected
+}

src/v2/compiler/self_host/parity_receipts_local.dag

@@ -0,0 +1,32 @@
+module v2.compiler.self_host.parity_receipts_local
+
+import v2.compiler.self_host.parity_window { ParityWindowReceipt }
+import v2.std.collection { List }
+import v2.std.text { String }
+
+data parity_receipts_local_note: String = "Operator-sourced parity receipts (ruling 2026-07-22: verify locally, then flip — the receipt SOURCE is relaxed from falsifier nightlies to observed local runs; the window law itself is unchanged). Observations: srv1 hermetic 4-run probe of emit_on_demand_family_crate_pr_native_agreement_holds against a durable root (GUNBC_NATIVE_CACHE_ROOT), key 8f21f541808ddb22 — run 1 cold-built then warmed, runs 2..4 fully warm, all 4 PASS (interpreted == native per member: meet, join, complement). Runs 2..4 are the three consecutive green windows for the two families whose native execution the logic family crate carries. When falsifier-authored receipts land, they supersede this module (dissolve-on: parity rows derived from falsifier run observations)."
+
+fn local_green(family: String, window: String) -> ParityWindowReceipt {
+  ParityWindowReceipt {
+    family: family,
+    cadence_window_id: window,
+    agreement_green: true,
+    warm_compile_skipped: true
+  }
+}
+
+fn local_receipts_for(family: String) -> List<ParityWindowReceipt> {
+  [
+    local_green(family: family, window: "srv1-probe-run2"),
+    local_green(family: family, window: "srv1-probe-run3"),
+    local_green(family: family, window: "srv1-probe-run4")
+  ]
+}
+
+fn meet_join_local_receipts() -> List<ParityWindowReceipt> {
+  local_receipts_for(family: "meet_join")
+}
+
+fn complement_local_receipts() -> List<ParityWindowReceipt> {
+  local_receipts_for(family: "complement")
+}

src/v2/compiler/self_host/parity_window.dag

@@ -0,0 +1,59 @@
+module v2.compiler.self_host.parity_window
+
+import v2.std.collection { List }
+import v2.std.logic { Bool }
+import v2.std.text { String }
+import v2.std.algebra { length }
+
+data parity_window_note: String = "Parity window (P6 routing flip gate, 2026-07-22): a family may flip to NativeRouted in the native-routing frontier ONLY on evidence — N consecutive green falsifier cadence windows, where green means the family's equals_eval agreement leg passed AND the warm leg observed compile_skipped=true on the durable root. Any red or divergence RESETS the streak (consecutive, not cumulative). The flip is thereby unwritable without receipts (DESIGN section 5 construction over validation): the frontier row edit that flips a family must cite the window verdict, and the witness test pins the law on synthetic sequences. Receipt rows are authored from falsifier run observations; required_consecutive_green_windows is the single authority for N."
+
+data required_consecutive_green_windows: Int = 3
+
+type ParityWindowReceipt {
+  family: String
+  cadence_window_id: String
+  agreement_green: Bool
+  warm_compile_skipped: Bool
+}
+
+type ParityVerdict
+  = ParityFlipPermitted { family: String, consecutive_green: Int }
+  | ParityFlipRefused { family: String, consecutive_green: Int, required: Int }
+
+fn receipt_is_green(r: ParityWindowReceipt) -> Bool {
+  r.agreement_green && r.warm_compile_skipped
+}
+
+fn trailing_consecutive_green(receipts: List<ParityWindowReceipt>) -> Int {
+  fold(
+    receipts,
+    init: 0,
+    f: fn(acc, r) {
+      if receipt_is_green(r: r) {
+        acc + 1
+      } else {
+        0
+      }
+    }
+  )
+}
+
+fn parity_verdict_for(family: String, receipts: List<ParityWindowReceipt>) -> ParityVerdict {
+  let streak = trailing_consecutive_green(receipts: receipts)
+  if streak >= required_consecutive_green_windows {
+    ParityFlipPermitted { family: family, consecutive_green: streak }
+  } else {
+    ParityFlipRefused {
+      family: family,
+      consecutive_green: streak,
+      required: required_consecutive_green_windows
+    }
+  }
+}
+
+fn parity_flip_permitted(family: String, receipts: List<ParityWindowReceipt>) -> Bool {
+  match parity_verdict_for(family: family, receipts: receipts) {
+    ParityFlipPermitted { family: _, consecutive_green: _ } => true
+    ParityFlipRefused { family: _, consecutive_green: _, required: _ } => false
+  }
+}

src/v2/extdeps/languages/rust.dag

@@ -1881,6 +1881,10 @@ fn rust_emit_host_runtime_primitive_type_node() -> Node {
   }
 }
 
+data rust_emit_host_toolchain_pin_note: String = "Toolchain pin materialized into every emitted cargo workspace (fleet incident 2026-07-22: runners with no rustup default refuse cargo builds in $RUNNER_TOOL_CACHE workspaces — the repo checkout builds only because rust-toolchain.toml is present there; srv1 masked this via a hand-set default). The channel literal mirrors the sole in-repo authority rust-toolchain.toml; dissolve-on: the emitter derives this row from that file instead of a mirrored literal."
+
+data rust_emit_host_toolchain_pin: String = "[toolchain]\nchannel = \"1.93.0\"\n"
+
 data rust_emit_host_cargo_manifest: String = "[package]\nname = \"gunbc_emit_host\"\nversion = \"0.0.0\"\nedition = \"2021\"\n\n[[bin]]\nname = \"emit_host\"\npath = \"src/main.rs\"\n"
 
 data rust_emit_host_main_suffix: String = "\n\nfn main() { let value = add(2, 3); let bytes = [0u8, (value & 0xff) as u8, ((value >> 8) & 0xff) as u8, ((value >> 16) & 0xff) as u8, ((value >> 24) & 0xff) as u8]; let _ = std::io::Write::write_all(&mut std::io::stdout(), &bytes); }\n"
@@ -1893,6 +1897,10 @@ fn rust_host_transport_descriptor() -> HostTransportDescriptor {
         path: "Cargo.toml",
         content: FixedText { text: rust_emit_host_cargo_manifest }
       },
+      WorkspaceFile {
+        path: "rust-toolchain.toml",
+        content: FixedText { text: rust_emit_host_toolchain_pin }
+      },
       WorkspaceFile {
         path: "src/main.rs",
         content: EmittedWithSuffix { suffix: rust_emit_host_main_suffix }