From 204e5b2fcf46f7a9d801a863e26edc2f1121f026 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 17:41:32 +0000 Subject: [PATCH 1/4] Main-red hotfix: drop stale roster reference to witness moved by #7060 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #7060 moved scanner_clean_tree_meta_exec_holds_on_rostered_corpus from scanner/planted_leak_test.dag to test/claim/long/meta_exec_confinement_clean_tree_test.dag (excluded from per-PR discovery by dir grain, per its long-lane note), and deleted the fn from the old file — but the explicit CommitWitnessClaim roster row in gunbc.commit_workflow still enrolled it against the old entry on the GithubActionsCiJob surface. Every main ci run since #7060 merged (16:33Z) fails: 'runtime error: no main function found' on that witness (e.g. run 29940402396), and the 17:23Z affected-set-falsifier red is the same root. Fix: the roster row keeps only the fixture-scan witness that still lives in the entry file (scanner_planted_meta_exec_leak_detected_holds), completing #7060's stated fast-lane/long-lane split. No other roster row references a moved fn (layering long-lane test checked clean). Co-Authored-By: Claude Fable 5 --- dag/gunbc/commit_workflow.dag | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/dag/gunbc/commit_workflow.dag b/dag/gunbc/commit_workflow.dag index 05363dc237d..b908fe11bea 100644 --- a/dag/gunbc/commit_workflow.dag +++ b/dag/gunbc/commit_workflow.dag @@ -402,10 +402,7 @@ data commit_gate_roster: List = [ CommitCheckEnrollment { check: CommitWitnessClaim { entry: "src/v2/test/claim/meta_exec_confinement/scanner/planted_leak_test.dag", - check_fns: [ - "scanner_planted_meta_exec_leak_detected_holds", - "scanner_clean_tree_meta_exec_holds_on_rostered_corpus" - ], + check_fns: ["scanner_planted_meta_exec_leak_detected_holds"], kind: CorpusWitnessKind, span: SpanUndeclared }, From 5f73530d3fd90ae99f29c8012d9bb97ff2781531 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 18:01:03 +0000 Subject: [PATCH 2/4] Second latent main-red: re-ground memory-cap verify read on typed ShowProperty (#7064 deleted its script module) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #7079's own ci run exposed the second latent break: #7000 (merged 15:59Z) added host_runner_memory_cap_verify consuming fleet_runner_unit_memory_props_read_script; #7064 (16:33Z, branch predating #7000) deleted that script module without seeing the new consumer. Main pushes skip the compile-clean gate ('no touched paths in diff observation'), so the unresolved import is latent on main and reds any PR whose affected shard closure reaches this file — including this hotfix (run 29943428156: 'module gunbc.fleet_show_effective_read_script not found'). Fix follows #7064's own dissolution: the three memory-prop reads route through gunbc.systemctl_show_read.systemctl_show_property_read_local (MemoryMax / MemorySwapMax / MemoryHigh, slice1 precedent — LocalShell on-host semantics preserved), constructing RunnerUnitLiveReadRow directly and typing via runner_unit_live_read_typed — mirror of fleet_runner_unit_memory_live_read with the local transport (one shape, N transports). Absent reads still fold to none → the existing typed Refused arm. Verified by execution: the entry closure compiles with zero unresolved-import hard diagnostics (the class the gate reds on). Co-Authored-By: Claude Fable 5 --- dag/gunbc/host_runner_memory_cap_verify.dag | 44 ++++++++++++++------- 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/dag/gunbc/host_runner_memory_cap_verify.dag b/dag/gunbc/host_runner_memory_cap_verify.dag index 04ae57cb806..7221e2d1fd9 100644 --- a/dag/gunbc/host_runner_memory_cap_verify.dag +++ b/dag/gunbc/host_runner_memory_cap_verify.dag @@ -19,18 +19,18 @@ import gunbc.host_runner_memory_provision { runner_memory_knobs_from, runner_memory_cap_readback_verdict, } -import gunbc.fleet_show_effective_read { - runner_unit_memory_live_read_from_stdout, +import extdeps.os.systemd { MemoryMax, MemorySwapMax, MemoryHigh } +import gunbc.systemctl_show_read { systemctl_show_property_read_local } +import gunbc.runner_unit_live_read { + RunnerUnitMemoryLiveRead, + RunnerUnitLiveReadRow, + runner_unit_live_read_typed, } -import gunbc.fleet_show_effective_read_script { - fleet_runner_unit_memory_props_read_script, -} -import gunbc.runner_unit_live_read { RunnerUnitMemoryLiveRead } data runner_memory_cap_verify_probe_unit_assumption: String = "Path (b) verify read-back samples one representative unit (actions-runner@-01.service; precedent: host_converge_slice1_probe_unit) while apply knobs target runner_instance_glob actions-runner@-*.service (5 slots/host per gunbc.runner_slot_allocation). ASSUMPTION glob-uniform: systemd drop-ins apply the same MemoryMax/MemoryHigh/MemorySwapMax to every slot instance, so the knob tally receipt from -01 is the host-level verdict. Drift confined to -02..-05 alone is invisible until multi-unit fold lands (dissolve-on trigger for path (b) verify close)." data runner_memory_cap_verify_scope_disposition: Disposition = Terminal { - reason: "Path (b) verify-only close for runner memory caps (operator mandate 2026-07-21): read-back ONLY over a runner unit on the host's instance glob via fleet_show_effective_read transport + per_slot_memory_cap_verdict_from_unit_read. Emits a counted tally (converged/drifted/absent knob counts, no apply claim). Does NOT call host_effect_apply, interpret_converge_knob, or SshShell ConvergePlan — the host_converge_realize lane stays untouched. Shell realization is scaffold-marked medium-as-string (host_runner_memory_cap_verify_transport_script_scaffold) until host_effect orchestration emit binds grammar rows — read scripts delegate to fleet_show_effective_read; probed_at uses slice-local date -Iseconds. Interim shell.Exec.Run is also rostered on meta_exec_confinement_exception_roster (precedent: host_converge_slice1) until typed host_effect_apply read transport lands. One-unit proxy read (slot -01) under glob-uniform assumption — see runner_memory_cap_verify_probe_unit_assumption." + reason: "Path (b) verify-only close for runner memory caps (operator mandate 2026-07-21): read-back ONLY over a runner unit on the host's instance glob via fleet_show_effective_read transport + per_slot_memory_cap_verdict_from_unit_read. Emits a counted tally (converged/drifted/absent knob counts, no apply claim). Does NOT call host_effect_apply, interpret_converge_knob, or SshShell ConvergePlan — the host_converge_realize lane stays untouched. Shell realization is scaffold-marked medium-as-string (host_runner_memory_cap_verify_transport_script_scaffold) until host_effect orchestration emit binds grammar rows — memory-prop reads route through gunbc.systemctl_show_read typed ShowProperty local reads (slice1 precedent; re-grounded here after #7064 deleted the concat script module this verify path consumed); probed_at uses slice-local date -Iseconds. Interim shell.Exec.Run is also rostered on meta_exec_confinement_exception_roster (precedent: host_converge_slice1) until typed host_effect_apply read transport lands. One-unit proxy read (slot -01) under glob-uniform assumption — see runner_memory_cap_verify_probe_unit_assumption." } data host_runner_memory_cap_verify_transport_script_scaffold: Disposition = Scaffold { @@ -158,13 +158,29 @@ fn runner_memory_cap_live_read(host: HostIdentity) -> RunnerUnitMemoryLiveRead? let unit = runner_memory_cap_probe_unit(host: host) match runner_memory_cap_verify_probed_at() { Present { value: probed_at } => - let result = shell.Exec.Run( - script: transport_script_from_body(body: fleet_runner_unit_memory_props_read_script(unit: unit)) - ) - if result.success { - runner_unit_memory_live_read_from_stdout(unit: unit, stdout: result.stdout, probed_at: probed_at) - } else { - none + match systemctl_show_property_read_local(unit: unit, property: MemoryMax) { + Present { value: memory_max_raw } => + match systemctl_show_property_read_local(unit: unit, property: MemorySwapMax) { + Present { value: memory_swap_max_raw } => + match systemctl_show_property_read_local(unit: unit, property: MemoryHigh) { + Present { value: memory_high_raw } => + Present { + value: runner_unit_live_read_typed( + row: RunnerUnitLiveReadRow { + unit: unit, + memory_max_raw: memory_max_raw, + memory_swap_max_raw: memory_swap_max_raw, + memory_high_raw: memory_high_raw, + memory_current_raw: "", + probed_at: probed_at, + } + ) + } + Absent => none + } + Absent => none + } + Absent => none } Absent => none } From 5c7633096a7867e13f485b5c80114c5d7cbbaa83 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 18:56:01 +0000 Subject: [PATCH 3/4] Regen stale generated artifacts (drift latent behind the batch-2 main-red) generated_artifact_drift_gate_passes has not executed on main since #7060 merged (every floor died at batch 2 on the phantom witness before batch 4), letting two stale artifacts through: - ROADMAP.md: #7071 hand-added an in-flight lane snapshot paragraph directly to the generated file; it exists in no authority carrier (roadmap_authority/ roadmap_document grep: 0 hits), so regen drops it. If the snapshot is wanted, it re-lands as an authority-side row (silent-ibex-417 notified). - ci.yml: trailing blank line vs regenerated output (the known trailing-newline drift class). Both files are byte-identical to generated_artifact_gate main_wet output on this head, run locally by execution (ExitSuccess, receipts above). Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 1 - ROADMAP.md | 2 -- 2 files changed, 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f0f512dfac2..12e739595af 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -251,4 +251,3 @@ jobs: run: | ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd) "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/live_deploy/apply.dag --function live_deploy_apply_srv1_wet - diff --git a/ROADMAP.md b/ROADMAP.md index f4d4554808c..806aaf2d23a 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -20,8 +20,6 @@ The two pillars — §1 get off v1, §2 own the compute fabric — stand as the **⑤ Everything linear / efficient / minimal — dev UX** *(un-shelved from §4)*. The authoring experience is minimal and non-redundant: **fold-ergonomics** (inert-abstraction lens, non-fold-residue audit, ban source comments), **namespace-only resolution** (minimal naming, delete `import`, no ambiguity — operator-signed 2026-07-06, its two rules *are* the §2/§4 minimality + no-ambiguity walls; gated on the `SymbolIndex` substrate; [design](docs/plans/namespace-resolution-design.md)), and local iteration speed. Detail: §4 *fold-ergonomics lane* (promoted); the namespace-only lane. -**In-flight lane snapshot (2026-07-22, silent-ibex-417 — effect-grants):** dissolving the forked `Hermetic | Wet | Record` bit into the (frame × verb × subtree) grant model (DESIGN open thread; not a pillar item). P-A/P-B landed; **P-C slice 1 MERGED (#6987)** (derived axes + presets), **P-C slice 2 in review (#7071)** (per-grant `HandlerBinding` selection — 2 approvals, mergeable, CI running). Remaining: `LiveTreeDisposition` stamp-retire (blocked on an operator path-A/B decision), `Hermetic|Wet|Record` enum deletion (gated on slice 2 + stamp-retire), hermetic-native run + network isolation (deferred behind a target-env trigger). Full PR ledger + blockers: [effect-namespace-grants §4](docs/plans/effect-namespace-grants.md). - ## 1. Get off v1 — v2 self-hosts (TERMINAL: `src/v1` deleted) Anchor (do not flip-flop): `.dag` = truth; v2 emits its own seed (no stage0 hand-edits); the trust chain is discharged by execution; then the hand-written seed is deleted. Terminal is **hand-written compiler logic → 0**, not zero bytes of Rust: a pinned v2-emitted bootstrap kernel (~8–15k LOC — `claim_executor`, evaluator host-physics, the regen oracle) survives as the content-addressed seed. → [plan](docs/plans/v2-self-hosting.md) · [de-fork audit](docs/plans/dag-v2-defork-audit.md) · [seed census](docs/plans/seed-shrink-census.md) From a697685fbd04c7119abb1bb16ef611ce21fc3d30 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Wed, 22 Jul 2026 19:03:02 +0000 Subject: [PATCH 4/4] layering gate: explicit v2.std.layer import so the scoped transport closure resolves MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate transport (run_clean_tree_gate, 13-source scoped run over witness_layer_roots) red with 'unresolved type LayerPrefix' — layering_imports.dag referenced LayerPrefix and its variants bare, and nothing in the scoped closure pulls v2.std.layer (the whole-tree pool masks this everywhere else). Explicit import completes the closure by construction; the gate now executes. NOTE: the gate then returns false on 7 violations that are all FALSE EDGES from the #7060 reference-derived producer (import-less std files' prelude bare names — List/fold/concat/Present class — misattributed to extdeps.color.srgb / extdeps.gitignore / v2.compiler.discovery_enumeration; zero textual imports in any flagged file). That defect is routed separately; it is main-side, not introduced by this PR. Co-Authored-By: Claude Fable 5 --- src/v2/lens/layering_imports.dag | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/v2/lens/layering_imports.dag b/src/v2/lens/layering_imports.dag index 22c92c0eceb..53260c2d1d2 100644 --- a/src/v2/lens/layering_imports.dag +++ b/src/v2/lens/layering_imports.dag @@ -2,6 +2,13 @@ module v2.lens.layering_imports import v2.lens.common.construction_justification { ConstructionJustification, WallAfterGrounding } import std.disposition { SingleAuthority } +import v2.std.layer { + LayerPrefix, + LayerPrefixStd, + LayerPrefixExtdeps, + LayerPrefixCompiler, + LayerPrefixWorkflow, +} type LayerImportFact { layer: LayerPrefix