Lane C: native host-effect transport for emitted crates

[briansrls]

Auto-opened by session-dashboard for session neat-carp-312.
Pushing to session/neat-carp-312 advances this PR.

Summary

Lane C of the XL dispatch wave: adds two native (emitted-Rust) host-effect witness families — filesystem_read and shell_exec_run — to the emit-host execution path, each proven equal to the interpreter by execution on the same workspace, plus a construction-time confinement wall gating which families may ever build a real HostTransportDescriptor for an emitted binary.

What changed

• filesystem_read and shell_exec_run native families (src/v2/extdeps/languages/rust_test.dag): each family's emitted Rust argv/handler is derived from the same extdeps op rows the interpreter reads (shell_materialize_argv_for_operation against dag/extdeps/shell/exec.dag for shell.Exec.Run — no hand-typed second dispatch).
• Agreement witnesses (src/v2/test/claim/execution/emit_host_filesystem_read_equals_eval_test.dag, emit_host_shell_exec_run_equals_eval_test.dag): both legs (interpreted eval + native emitted binary) run against the same workspace and are proven byte-identical by execution.
• Confinement wall (src/v2/lens/emitted_binary_effect_confinement.dag): a construction-time gate (WallNow{SingleAuthority}) at the .dag-level call site that builds a HostTransportDescriptor for an emitted binary. Only rostered families (filesystem_read_family, shell_exec_run_family) admit; anything else returns HostRuntimeRowAbsent (reuses the existing TargetEmitHostRuntimeRow refusal carrier, no new parallel refusal type). RED control (src/v2/test/claim/emitted_binary_effect_confinement_red_control_test.dag) proves a synthetic unrostered family name refuses via the real gated call site.
• native_routing_frontier roster: added both new families as InterpretedRetained{reason: "no_cached_no_evict_carrier"} (conservative — not falsely marked NativeRouted); bumped native_routing_frontier_family_count_expected 9→11. No existing row's family/disposition touched.
• Lens registry enrollment: v2.lens.emitted_binary_effect_confinement added as a new LensIdV0 (EmittedBinaryEffectConfinement) to v2.lens.registry and its exhaustive dispatch in v2.lens.enforcement.lens_module_gate, satisfying the corpus-wide lens_registry_completeness_holds_live gate.

Exit receipts (per parent mandate)

• (a) both native witnesses green by execution, same workspace:
  • PASS emit_host_filesystem_read_equals_eval_all_holds (188ms)
  • PASS emit_host_shell_exec_run_equals_eval_all_holds (188ms)
• (b) confinement roster + RED control green:
  • PASS emitted_family_effect_admitted_refuses_unrostered_family
  • PASS emitted_family_runtime_row_gated_refuses_unrostered_family (synthetic unrostered family → HostRuntimeRowAbsent via the real emitted_family_runtime_row_gated call site)
  • PASS emitted_family_runtime_row_gated_admits_rostered_filesystem_read_family
• (c) derivation receipt: shell_exec_run_witness_argv() calls shell_materialize_argv_for_operation("dag/extdeps/shell/exec.dag", "shell.Exec", "Run", ...) — the emitted argv is read from the same .dag op row the interpreter's dispatch_shell reads, not a duplicated literal.

Test plan

• claim_batch --hermetic --entry src/v2/lens/registry/completeness_test.dag --function lens_registry_completeness_holds_live → PASS
• claim_batch --hermetic --entry src/v2/test/claim/self_host/native_routing_frontier_test.dag --function native_routing_frontier_witnesses → PASS
• claim_batch --hermetic --entry src/v2/test/claim/emitted_binary_effect_confinement_red_control_test.dag --functions ... (3 witnesses) → all PASS
• claim_batch --wet --entry .../emit_host_filesystem_read_equals_eval_test.dag --function emit_host_filesystem_read_equals_eval_all_holds → PASS
• claim_batch --wet --entry .../emit_host_shell_exec_run_equals_eval_test.dag --function emit_host_shell_exec_run_equals_eval_all_holds → PASS
• CI ci GitHub Action check: in progress on latest push (merged origin/main to pick up CI fail-fast: cheap-gate early batch (SIMPLE declared membership + dissolution trigger) + event-scoped stop policy #7088).

Re-verified at current head (319f445, 2026-07-23, fresh local claim_batch build)

• PASS emit_host_filesystem_read_equals_eval_holds (173ms)
• PASS emit_host_shell_exec_run_equals_eval_holds (127ms)
• PASS emitted_family_runtime_row_gated_refuses_unrostered_family (RED control)
• PASS emitted_family_runtime_row_gated_admits_rostered_filesystem_read_family
• PASS native_routing_frontier_witnesses
• PASS lens_registry_completeness_holds_live
• Single-authority confirmed by inspection: both rust_test.dag's emitted-argv construction and the eval-side witness call shell_materialize_argv_for_operation against dag/extdeps/shell/exec.dag's shell.Exec.Run row — one derivation, not a hand-typed second dispatch.
• Confinement ordering confirmed: the roster rows (filesystem_read_family, shell_exec_run_family) and the emitted_binary_effect_confinement wall land in this same PR, before either family's emitted binary can build a real HostTransportDescriptor — construction wall, not a follow-up.
• lens_module_gate gated-file edit confirmed complete: EmittedBinaryEffectConfinement is enrolled in v2.lens.registry (+11 lines) and has an exhaustive dispatch arm in lens_module_gate.dag; lens_registry_completeness_holds_live passes.
• GitHub ci check: in progress (self-hosted runner queue contention from the parallel XL-dispatch-wave lanes; multiple re-merges of an advancing main have restarted it several times — each restart's diff confirmed clean, only this PR's 9 files vs origin/main). build check (compile-clean) passes.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed review 41854 (DESIGN.md §3 layer inversion): moved emitted_effect_family_roster, list_contains_str, emitted_family_effect_admitted, and emitted_family_runtime_row_gated from v2.lens.emitted_binary_effect_confinement down to v2.std.host_transport (commit c7f8000), which already houses the sibling EmitHostRuntimeRow/TargetEmitHostRuntimeRow carriers these functions build on. The lens module now only carries the construction-justification doc row and its WallNow{SingleAuthority} metadata, whose DeclarationRef.module_path now points at v2.std.host_transport.

src/v2/extdeps/languages/rust_test.dag's two call sites (lines 4033/4133) needed no edit — they were already bare (zero-import) references, and the corpus's bare-reference resolution is name-uniqueness-based, so they now resolve to the std-tier definition automatically. emitted_binary_effect_confinement_red_control_test.dag's explicit import was updated to pull the two functions from v2.std.host_transport instead of the lens module.

Re-verified green by execution at the new head:

• PASS emitted_family_effect_admitted_refuses_unrostered_family
• PASS emitted_family_runtime_row_gated_refuses_unrostered_family (RED control)
• PASS emitted_family_runtime_row_gated_admits_rostered_filesystem_read_family
• PASS emit_host_filesystem_read_equals_eval_holds
• PASS emit_host_shell_exec_run_equals_eval_holds
• PASS native_routing_frontier_witnesses
• PASS lens_registry_completeness_holds_live

Confirmed the fix: grep -rn "v2\.lens\." src/v2/extdeps dag/extdeps now returns zero matches, same as before the finding — extdeps no longer references the lens tier at all.

— sent from neat-carp-312

[gunbai-bot]

Addressed review 41864 finding #1 (hand-rolled family: String sum instead of a real closed type).

Replaced emitted_effect_family_roster: List<String> + emitted_family_effect_admitted(family: String) -> Bool in v2.std.host_transport with a genuine closed sum:

type EmittedEffectFamily
  = FilesystemReadFamily
  | ShellExecRunFamily

emitted_family_runtime_row_gated now takes family: EmittedEffectFamily and dispatches via an exhaustive match over both variants — an unrostered family name is unrepresentable, not merely rejected by a runtime membership check, and a future third variant fails to compile at this call site until named (DESIGN.md §5 construction over validation). Call sites in rust_test.dag updated to the enum constructors. The RED-control test file (emitted_binary_effect_confinement_red_control_test.dag) was reworked accordingly: the two "refuses an unrostered family" tests are gone (there's no longer a value to construct that would exercise them — that's the point of the fix), and the two "admits a rostered family" tests now cover both FilesystemReadFamily and ShellExecRunFamily directly. The ConstructionJustification/LensContract DeclarationRef authority pointers in emitted_binary_effect_confinement.dag and enforcement/contract.dag were updated from the deleted emitted_effect_family_roster to the new EmittedEffectFamily type declaration, and the LensContract's bound consumer witness function was repointed to a still-existing test (emitted_binary_effect_confinement_authority_points_at_host_transport) since its prior target was one of the deleted tests. The commit-gate roster enrollment in dag/gunbc/commit_workflow.dag was updated to match the renamed/removed test functions.

Verified green-by-execution (claim_batch --wet) on the current head:

• emitted_family_runtime_row_gated_admits_rostered_filesystem_read_family
• emitted_family_runtime_row_gated_admits_rostered_shell_exec_run_family
• emitted_binary_effect_confinement_authority_points_at_host_transport
• emit_host_filesystem_read_equals_eval_all_holds (real host-effect execution equivalence, unaffected by the type change — proves the call sites still resolve/compile)
• emit_host_shell_exec_run_equals_eval_all_holds (same)
• enforcement_consistency_gate_holds (the LensContract liveness check, confirming the repointed authority + consumer witness are internally consistent)

This also means review 41873's approval (which praised the now-superseded roster/predicate design) is stale against the current head — a fresh review will need to run against this commit.

— sent from neat-carp-312

[gunbai-bot]

Addressed review 41880 (coverage-by-illusion on the two new parity witnesses).

Valid finding. emit_host_filesystem_read_equals_eval_all_holds and emit_host_shell_exec_run_equals_eval_all_holds were added under test/claim/execution/ (excluded from discovery by the dir-grain WitnessExclusionRow in ci_layer_roots.dag) and enrolled in native_routing_frontier_roster, but native_routing_frontier only proves the routing frontier's disposition/count facts — it does not run the parity witness itself. The only thing actually enrolled to run them was wet_receipt_enrollment_witness_test.dag's own self-consistency check, not the nightly falsifier. So the two witnesses that prove Lane C's core deliverable (emit->build->run parity for the new families) had no executing CI consumer — exactly the DESIGN §5/§6 gap called out.

Fixed by adding both to falsifier_native_cache_cold_entries in src/v2/compiler/self_host/wet_receipt_enrollment.dag, alongside the existing 9 standalone emit_host_<family>_equals_eval_test.dag witnesses (same shape: no compile_skipped assertion, so COLD-VALID under the nightly GUNBC_CI_NATIVE_CACHE_COLD_CONTROL falsifier). Updated the stale "9 standalone" count in falsifier_native_cache_cold_roster_note to 11 and appended a dated note explaining the extension.

Verified green-by-execution on the current head:

• wet_receipt_enrollment_witnesses (the roster's own self-consistency witness)
• ci_floor_plan_witnesses (the CI plan that consumes falsifier_native_cache_cold_roster())
• emit_host_filesystem_read_equals_eval_all_holds / emit_host_shell_exec_run_equals_eval_all_holds still pass directly (unaffected by the enrollment change, confirming the roster addition is additive, not a rewrite of the witnesses themselves)

— sent from neat-carp-312

[gunbai-bot]

Investigated the CI failure on head 3c5ed5d. Not a code defect — infra-level timeout under shared-runner memory contention:

The gunbc ci floor job entered its adaptive discovery corpus (batch 4: 2228 witnesses across 670 entries) at 14:22:14Z. Within a minute the memory governor hit memory.current over its declared high-water mark and dropped target_width from 2 to 1 ([governor] creep back-off / hard back-off), and stayed pinned at width 1 for the rest of the run — effectively serializing the whole corpus. It never OOM-killed (oom_kill +0 throughout), it just ran too slowly at width 1 to finish inside the 55-minute job timeout (##[error]The action 'gunbc ci (.dag witnesses + gates)' has timed out after 55 minutes).

Checking concurrent runner load at that time: 4 other ci/affected-set-falsifier workflow runs were in_progress on this shared infra during the same window (gentle-raven-495, keen-ibex-888, a claude/ci-compilation-caching branch, and main's affected-set-falsifier), consistent with cross-job memory pressure driving the governor's width throttle. My diff's own footprint here is negligible (3 new witness functions, ~30 lines, plus 2 roster-enrollment lines) — nowhere near enough to explain a 2228-witness corpus dropping to serial width. This matches a known pattern in this repo (adaptive-width floor going Amdahl-negative under memory pressure: serial ~12min vs contended 47min+).

No code change is warranted for a transient resource-contention timeout — retrying is the correct remedy here (DESIGN §5: don't fabricate a fix for a class of failure this isn't). Reran the failed job (gh run rerun 30014081173 --failed); a fresh ci run is now queued on this same head.

— sent from neat-carp-312

[gunbai-bot]

Second consecutive CI timeout on this head, identical signature to the first: memory governor pinned at target_width 1→1 (hard back-off, oom_kill +0 throughout — never an actual OOM), 55-minute job timeout. Confirmed still not a code defect — reran and it failed the exact same way (job 89245733076, completed 16:00:25Z).

Runner contention has gotten worse, not better: 7 other ci/affected-set-falsifier workflow runs are in_progress right now across main and several session branches, vs. 4 concurrent runs during the first failure. This is consistent with the shared floor infra being saturated at the moment, independent of this PR's diff.

Reran once more (job 89261323658, queued 16:02:28Z on the same head). If this third attempt also times out with the identical governor-throttle signature, that's a signal worth the operator's attention as a standing infra issue (the floor's adaptive-width governor going Amdahl-negative under contention — matches the known "Floor width is Amdahl-NEGATIVE" pattern), rather than something further reruns from this session can fix.

— sent from neat-carp-312

[gunbai-bot]

CI failure on head 0db06e6 is NOT a Lane C regression: batch-1 generated_artifact_drift_gate_passes fails because the committed .github/workflows/ci.yml still lists .github/fleet-converge.sh in its heal-step git add, a path deleted by #7121 (ac89afbe6) without a corresponding ci.yml regen landing on main. Confirmed this is breaking main's own CI too (heal_generated_artifacts job exit-128s with fatal: pathspec '.github/fleet-converge.sh' did not match any files on recent main pushes) — a pre-existing main-red, not something introduced by this branch's merge.

PR #7126 ("CI: regen upstream of ci (build→regen→ci→deploy) + heal auto-fixes drift on PRs") already fixes this exact incident (its description explicitly names the #7121 fleet-converge case) and is currently running (regen/heal in progress). Rather than duplicate that fix here, this PR will rerun/rebase once #7126 merges to main.

— sent from neat-carp-312