Repository navigation
Ground exact Playwright Chromium navigation-failure specimens - #7556
Merged
Merged
Conversation
gunbai-bot
Bot
changed the title
gunbai-bot
Bot
changed the title
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 1, 2026
…t + ExternalModelScope carrier/gate (operator verdict on #7556) - design_document.dag §3: verbatim 'External upstream decomposition' subsection; DESIGN.md regenerated - gunbc.plans.extdeps_modeling_preflight: 8 typed preflight rows (single authority), registered Plan renders the table from them - extdeps.external_authority: ExternalSubjectRef/ExternalRevision/ExternalModelScope (citations nonempty by construction), FactAuthorityOverride.fact -> DeclarationRef; admit_external_model_scope gate with ForeignSubjectRow/ConsumerCoverageInUpstream refusals - gunbc.extdeps_scope_frontier: staged fail-closed enrollment — 2 carriers + 17 machinery-exempt + 397 counted frontier rows over all 416 dag/extdeps files; live-tree cover witness refuses unrostered or stale rows - extdeps.vendor.{microsoft,atlassian} adopt extdeps_model_scope (admitted by execution) - extdeps.browser: loud non-precedent disposition note naming the eventual split - dag/test/claim/external_model_scope_witness_test.dag: 12 claims incl. operator RED (generic browser + Chromium scope + Chrome|Firefox|Safari rows -> refused) and GREEN (shared shape + separate modules + downstream roster -> admitted); stage0 seed + ci.yml + plan doc regenerated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
6 tasks done
briansrls
marked this pull request as ready for review
August 1, 2026 17:13
briansrls
added a commit
that referenced
this pull request
Aug 1, 2026
…ng preflight + ExternalModelScope carrier (operator verdict on #7556) (#7571) * WIP: DESIGN §3 external-upstream-decomposition subsection + extdeps modeling * chore: regenerate drifted generated artifacts (ci auto-heal) * DESIGN §3 external-upstream-decomposition + extdeps modeling preflight + ExternalModelScope carrier/gate (operator verdict on #7556) - design_document.dag §3: verbatim 'External upstream decomposition' subsection; DESIGN.md regenerated - gunbc.plans.extdeps_modeling_preflight: 8 typed preflight rows (single authority), registered Plan renders the table from them - extdeps.external_authority: ExternalSubjectRef/ExternalRevision/ExternalModelScope (citations nonempty by construction), FactAuthorityOverride.fact -> DeclarationRef; admit_external_model_scope gate with ForeignSubjectRow/ConsumerCoverageInUpstream refusals - gunbc.extdeps_scope_frontier: staged fail-closed enrollment — 2 carriers + 17 machinery-exempt + 397 counted frontier rows over all 416 dag/extdeps files; live-tree cover witness refuses unrostered or stale rows - extdeps.vendor.{microsoft,atlassian} adopt extdeps_model_scope (admitted by execution) - extdeps.browser: loud non-precedent disposition note naming the eventual split - dag/test/claim/external_model_scope_witness_test.dag: 12 claims incl. operator RED (generic browser + Chromium scope + Chrome|Firefox|Safari rows -> refused) and GREEN (shared shape + separate modules + downstream roster -> admitted); stage0 seed + ci.yml + plan doc regenerated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Consume the module's own anchor in extdeps_model_scope (review 46077), qualified against silent same-name capture cursor review 46077: first_citation re-minted the anchor URI — parallel representation. Fixing it by BARE sibling reference was proven WRONG by execution: atlassian's bare extdeps_external_authority_anchor reference silently captured microsoft's same-named decl (first-occurrence-wins pooling; the duplicate-toplevel-decl fail-open, now witnessed on data decls). The landed spelling is the module-QUALIFIED reference (extdeps.vendor.<m>.extdeps_external_authority_anchor), single authority with no capture; the adopter witness now discriminates per-module citation locators so a future capture regression reds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regenerate ci.yml on merged tree (extdeps-modeling-preflight rows on top of main) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roster the two extdeps modules main added mid-flight (review 46111): git/inspect + github/workflows, frontier count 397 -> 399 The live cover witness red exactly as designed on the merged tree; frontier claims re-run green (418 files = 2 carriers + 17 machinery-exempt + 399 frontier). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Rework carrier/enforcement per operator handback on #7571 (also codex review 46118) (1) ExternalSubjectRef carries a DeclarationRef (symbolic subject identity; vendor scopes point at their existing microsoft/atlassian declarations, no restated legal names). (2) module-grain revision removed — revisions belong on build/release/fact rows. (3) the synthetic function is no longer presented as an admission gate: renamed to the external_model_scope_decision KERNEL over DeclaredScopeFacts with a loud honesty boundary; the mechanical wall today is scope PRESENCE; subject-content-derived enforcement is the named frontier feature:extdeps-subject-content-derived (dissolves when a Node-tree projection derives DeclaredScopeFacts from the real module and feeds the same kernel). (4) the 399-row legacy population moved out of the semantic module into the frozen manifest dag/gunbc/legacy_extdeps_scope_frontier.tsv (one path per line, remove-only, count DERIVED by parse_frontier_manifest, exact bidirectional live diff enforced by the cover witness). (5) consumer coverage identity is DeclarationRef, not free text. 12/12 witness claims green by execution incl. the live 418-file cover against the manifest; stage0 seed regenerated; drift gates PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: DESIGN §3 external-upstream-decomposition subsection + extdeps modeling * Consume std.roster_frontier's declaration_ref_eq instead of re-minting it (review 46136); register std_roster_frontier.rs in the seed roster Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: DESIGN §3 external-upstream-decomposition subsection + extdeps modeling * Merge main; enroll publication grants for this PR's 6 added paths + 11 ungranted main-side additions (publication_placement_gate green) The new Stage-0 publication wall (P-B) requires a PublicFilePublishGrant row for every path added after the cutover commit. This PR's six additions are enrolled, plus the eleven paths merged to main since cutover without rows (heal_revalidation, source_integration_proof_kernel, workflow-dispatch, github/workflows lanes) — main's own floor is red on the gate without them, and the roster is one shared carrier. publication_placement_gate_passes PASS locally by wet execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Make the presence wall mechanical (codex review 46215): carrier rows content-verified, manifest frozen against a git anchor Half 1: scope_carrier_paths membership was path-asserted; the cover witness now filesystem_reads every carrier file and refuses one whose bytes lack the extdeps_model_scope declaration (declared text-scan scaffold, corpus_scan precedent, dissolves with the storage-grain frontier). Half 2: the manifest's remove-only lifecycle was review discipline; every manifest row must now name a file that existed at the pinned legacy_manifest_freeze_sha — the witness diffs freeze..HEAD via git.Core.DiffNameStatus (the publication-gate pattern) and refuses any manifest row in the added/copied/renamed set, with diff failure and parse truncation typed as refusals (PostFreezeObservation coproduct), never skips. 17/17 claims green by execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: DESIGN §3 external-upstream-decomposition subsection + extdeps modeling * Split the wet live observations out of hermetic discovery (d4bef96 floor red) Hermetic discovery executed the three wet-only fns (Filesystem.List walk, git.Core.DiffNameStatus freeze diff) against the mock corpus, where those operations are unpublished — ReadsLiveTree does not exclude fns from discovery. Structural fix, not a widened mock: - pure decision fns (scope_cover_holds, carrier_content_declares_scope, PostFreezeObservation, manifest_freeze_holds) move to their single authority gunbc.extdeps_scope_frontier; the hermetic witness imports them (also discharges cursor review 46245 both findings) - new dag/test/claim/external_model_scope_live_cover_witness_test.dag (ReadsLiveTree) holds the live walk + freeze diff; discovery-excluded via witness_exclusion_frontier (OfflineLocalRecipe, substantiated reason + dissolve-on + local recipe, artifact_store precedent) and granted in publication_grant - hermetic file keeps all RED controls, kernel controls, manifest accounting, and the filesystem_read carrier-content check per-PR Verified by execution: 14/14 hermetic PASS, 3/3 wet PASS, publication_placement_gate_passes PASS, generated-artifact gate PASS, fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix the mainline scm_compatibility homonym capture blocking CI (5 floor reds on origin/main d552ff4) Top-level fn names are not module-scoped in the assembled closure, so native_scm_interaction_scenario_fixture's parametered fixture_projection collided with the zero-arg fixture_projection homonyms in pijul/mercurial_upstream_model_witness_test once #7563 linked their closures — native_scm_receipt_for's internal call then dispatched to a zero-arg winner: 'call contract mismatch: no parameter named scenario'. Fix: rename the parametered helper to the unique prefixed native_scm_scenario_fixture_projection (both references are file-internal; no external caller exists, verified by corpus grep). Verified by execution: all 5 previously failing witnesses PASS, plus 63 witnesses across every other importer of the fixture module (native_scm_interaction_contract 14/14, mercurial compat 6/6, git compat 7/7, roadmap_validation_oracle 36/36). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * State the enforcement grain honestly and gate the roster-to-disk direction per-PR (codex review 46258) Finding 1: the preflight doc and frontier law claimed the population cover as 'the mechanical wall today' while the cover runs only on the discovery-excluded wet lane — grain inflation. Fixed both ways: - new per-PR hermetic test roster_paths_resolve_on_disk: every rostered path across all three rosters (2 carriers + 17 machinery + 399 manifest rows) must resolve in the checkout via the filesystem_read carve-out (22ms for 418 reads); a stale or fabricated roster row reds per-PR via the interpreter's typed hermetic Read refusal (verified by execution on a nonexistent probe path) - law note + preflight bullets now state the grain explicitly: per-PR merge-gated = roster-to-disk resolution, roster disjointness, carrier byte-content, RED controls; wet-lane = live enumeration (disk-to- roster new-file detection) and the freeze diff, with per-PR gating of that direction arriving at the mandatory_tag region promotion the frontier dissolves into 15/15 hermetic witnesses PASS; plan doc regenerated same commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Dedupe the publication roster after merging main (gate-red duplication on main itself) origin/main 06d7aea lists the eleven pre-wall repair paths TWICE: once from #7565's branch-side enrollment block and once from #7580's repair block — the same enrollment race #7580's own note describes, re-entered by the next concurrent pair. The placement gate refuses repeated grants, so main is currently gate-red and every PR merge ref inherits it. This branch resolves the merge by keeping #7580's repair block (with its note) as the single occurrence and re-adding only this PR's own seven paths; publication_placement_gate_passes PASS by execution on the merged tree (42 unique rows, zero duplicates). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Land the per-PR merge-gated ExtdepsScopePlacementGate (codex review 46281) Diff-grain sibling of tools.publication_placement_gate: refuses any freeze..HEAD-added dag/extdeps .dag file outside carriers-union- machinery (scope_placement_refused_paths, pure kernel on gunbc.extdeps_scope_frontier with hermetic RED/GREEN controls) and any frozen-manifest row naming a post-freeze-added file; diff failure and parse truncation refuse, never skip. Enrolled as a cheap-floor wet gate (roster 49->50, gates 10->11, cheap membership 4->5). One recorded freeze re-anchor to the gate-landing base (0ec3c10), admitting lean/overflow.dag which merged inside the wall-less interim (#7550); documented in legacy_manifest_freeze_sha_note. Live-cover witness dedupes its diff observation onto the gate module. Law note and preflight bullet updated to state both directions per-PR. RED proven by execution: a committed unrostered dag/extdeps probe file turns extdeps_scope_placement_gate_passes red; removing it greens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Expose std_roster_frontier in the derived stage0 crate partition (codex review 46329) extdeps_external_authority.rs imports crate::std_roster_frontier, but the partition source authority (v2.workflow.rust_crate_partition) never rostered the new module, so the partitioned crates could not resolve it. Fix at the authority: std_roster_frontier joins the std-core primitive roster with its module-dag edges (extdeps_external_authority -> std_roster_frontier -> std_decl_ref); partition artifacts and the stage0 seed regenerated to fixed point (two regen generations — the renderer bakes the partition rows at its own build time), and stage0_core/src/lib.rs (tracked but outside every regen path — the lifecycle scaffold's open partition contradiction) gains the matching declaration directly. Disclosed, not fixed here: v1-stage0-std-core has four OTHER unresolved modules (std_occurrence_identity, extdeps_units_{dimensionless, iec_80000_13,iso8601}) byte-identical on origin/main — pre-existing partition rot from other lanes (the #7109 class; no CI job compiles these crates). Rostering them correctly requires re-cutting the std/extdeps crate boundary (extdeps_uri + extdeps_external_authority would move below std_measure, emptying v1-stage0-extdeps-base) — the deferred emitted-crate-partition lane's re-cut, not a one-line roster fix; attempted and reverted here after it surfaced that knot. Verified: cargo check -p v1-stage0-std-core no longer reports std_roster_frontier (remaining errors = the four pre-existing, same as main); generated-artifact gate PASS; fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Reconcile freeze anchor with merged main 5669d42 (cpm_pert joined the interim manifest) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Make the manifest's remove-only lifecycle mechanical at line grain (codex review 46378) manifest_freeze_holds judges file CREATION dates, so a pre-freeze file migrated out of the manifest could later be re-added (scope decl deleted, carrier row dropped, manifest row restored) and the freeze check would pass — the escape hatch re-opened after migration. Closed: tools.extdeps_scope_placement_gate now also observes git.Core.DiffUnified0(origin/main...HEAD) and refuses any line the change itself ADDS to the manifest (manifest_line_observation / manifest_remove_only_holds on gunbc.extdeps_scope_frontier). The one admitted arm is ManifestIntroduced — the file absent at the merge base (the unified diff's /dev/null old side), exactly the PR that first lands the manifest, unforgeable once it exists on main (a delete-and- rewrite inside a branch still diffs as modification). Unreadable diff text and failed diffs refuse, never skip; removals stay free, so the manifest is monotonically shrinking by construction at the merge gate. Hermetic controls: red_manifest_remove_only_refuses_added_row, green_manifest_remove_only_admits_removal_and_unrelated_edits, green_manifest_introduction_admitted_once, red_manifest_unreadable_refuses. Verified by execution: 21/21 hermetic witnesses PASS, both placement gates PASS wet on this tree (the introduction arm exercising the live path), fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Reach the unreadable arm from the parser and collapse the verdict to one surface (codex review 46387) Finding 1: manifest_line_observation never constructed ManifestDiffUnreadable — malformed or truncated diff text fell through to ManifestUntouched, which the gate accepts (fail-open), and the RED control bypassed the parser by constructing the variant directly. Closed: the fold tracks whether any line MENTIONS the manifest path and whether its recognized new-side header was ever ENTERED; mention without entry yields ManifestDiffUnreadable — covering truncation mid- header AND making a manifest deletion refuse conservatively (old-side header mentions the path, no new-side header follows; the promotion PR that legitimately deletes the manifest deletes this gate in the same change). New REDs go THROUGH the parser: a truncated header diff and a whole-file deletion diff both yield ManifestDiffUnreadable. Finding 2: manifest_remove_only_holds hand-matched the same coproduct the gate matched into ProcessExit — two verdict authorities. The Bool predicate is deleted; the ONE surface is the pure manifest_remove_only_exit(observation) -> ProcessExit on the gate module, consumed by both the wet gate wrapper and every hermetic control (which assert on its ExitSuccess/failure arms). Verified by execution: 22/22 hermetic witnesses PASS (incl. the two new parser-reaching REDs), extdeps_scope_placement_gate_passes PASS wet, fmt clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Disambiguate decl_ref in the #7549 witness (floor red on 2a04481: ambiguous across std.primitive_identity and std.roster_frontier) Both modules declare an identical top-level decl_ref helper on main; the ambiguity is latent there and fired in this PR's closure, which is the first to link them (extdeps.external_authority imports std.roster_frontier). Minimal fix at the red site only: the six call sites in dag/test/claim/primitive_identity_join_witness_test.dag are module-qualified to std.primitive_identity.decl_ref and the named import row is dropped. 15/15 witnesses in the file PASS by execution. The root defect is a DESIGN section-3 fork: std.primitive_identity re-mints the decl_ref constructor std.roster_frontier already owns (the same re-mint cursor review 46136 removed from this PR's own carrier). Deduplicating it belongs to the primitive-identity lane on main; this commit only unblocks the floor at the site that reds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Post-merge reconcile: fix stale sibling citations after #7591 deleted the publication gate Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
6 tasks
This was referenced Aug 2, 2026
…35-takeover # Conflicts: # dag/gunbc/extdeps_scope_frontier.dag
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Ground the exact navigation-presentation experiment executed with Playwright 1.62.1 and its managed Chromium 151.0.7922.34 binary in a Debian 12 container on Linux arm64.
This revision deliberately does not claim Google Chrome, Firefox, Safari, Opera, a product-wide empty/nonempty-body rule, a Tailscale Serve production response, an achieved continuity guarantee, or a roadmap implementation mechanism.
Model
extdeps.browser.chromiumowns Chromium build/error/internal-document vocabulary. The tested source revision remains typedUnobserved; the pinned Chromium revision grounds vocabulary only.extdeps.automation.playwrightseparately owns the Playwright build and managed-binary provenance.extdeps.os.debianseparately grounds the observed Debian 12 Bookworm container-userland identity.Evidence
wcbyte-count verification preserves typed matches, differs, and unavailable arms through one canonical extdeps fold.Local validation
claim_batch --claim-runclaim_batch --claim-run --wetclaim_batch --claim-run --wetcargo fmt --all --checkLanding dependency
This PR remains draft until the corrected #7571 external-upstream scope carrier/enrollment wall lands. It will then rebase and enroll the new Playwright, Chromium, Debian, and wc modules under that carrier before final CI/review.