Repository navigation
Sole modeled publisher (model + shadow): policy-derived projection, publisher authority, shadow replay - #7594
Merged
Merged
Conversation
gunbai-bot
Bot
changed the title
Contributor
Author
|
Addressed both findings from review 46354 in 1. Digest tautology ( 2. Deletion blind spot ( Re-ran affected witnesses green locally; CI re-running on the fix commit. — sent from snappy-lark-489 |
gunbai-bot
Bot
force-pushed
the
session/snappy-lark-489-publisher-b
branch
2 times, most recently
from
August 1, 2026 17:13
413c438 to
8315505
Compare
Contributor
Author
|
Addressed review 46429 in
— sent from snappy-lark-489 |
Contributor
Author
|
Addressed review 46459 in
All 17 witnesses green locally; CI running. — sent from snappy-lark-489 |
Contributor
Author
|
Addressed review 46476 in latest push:
21/21 witnesses green locally. — sent from snappy-lark-489 |
gunbai-bot
Bot
force-pushed
the
session/snappy-lark-489-publisher-b
branch
5 times, most recently
from
August 2, 2026 02:53
2f6587d to
c771f09
Compare
Replay only PR-B carriers onto current main — no #7591 deletion content (placement gate/roster removal stays on vivid-newt-418 until that PR merges). Includes review 46354 digest/deletion-delta fixes and 13 witness tests. Co-authored-by: Cursor <cursoragent@cursor.com>
…urface. Remove unreachable AmbiguousSubtreeRule; argv authority stays only on PublicationTransport service rows. Document slice-1 validation vs live unforgeable-construction acceptance bar. Co-authored-by: Cursor <cursoragent@cursor.com>
…gates. Split RecordEmptyCommit so allow_empty maps to argv; prune unreachable ProjectionDeltaClass arms for slice-1; wire decision-receipt and push-head checks in admit_public_write with witnesses for both refusal classes. Co-authored-by: Cursor <cursoragent@cursor.com>
Close the empty-pushed_refs vacuous-pass fail-open before live-slice binding; witness sole_publisher_refuses_empty_pushed_refs. Co-authored-by: Cursor <cursoragent@cursor.com>
…tly. derive_public_projection_plan requires construction-admitted policy so conflicting/unknown-root policies cannot reach the derived path; dissolve publication_disposition_is_public in favor of coproduct match. Witness publication_policy_refuses_conflicting_prefix_rules. Co-authored-by: Cursor <cursoragent@cursor.com>
publication_decision_authorizes_newly_public checks policy_version, authority, and universal audience; invalid receipts refuse with DecisionReceiptNotAuthorizing. Replace posture Bool predicate with session_publication_posture_fold. Co-authored-by: Cursor <cursoragent@cursor.com>
Main moved ContentHash off std.types and renamed content_hash_combine to content_hash_combine_structural; update publication projection, witnesses, and publisher refusal strings to the family-grounded API. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot
Bot
force-pushed
the
session/snappy-lark-489-publisher-b
branch
from
August 3, 2026 13:42
3a64ce6 to
aaec5a2
Compare
briansrls
marked this pull request as ready for review
August 3, 2026 17:05
briansrls
added a commit
that referenced
this pull request
Aug 3, 2026
…en (#7697) * WIP: Lane E: self-host frontier 27-row exact-head closeout, totality wall gre * WIP: Lane E: self-host frontier 27-row exact-head closeout, totality wall gre * WIP audit: push interim exact-head frontier probe census (17/27 at HEAD). Land execution-measured TSV + audit note for 17 surveyed compiler modules: dominant RealizationGap(parse_grammar_choice_overlap_residue) at ProbeStageAssemble, minority NameResolutionGap(resolve_module_not_found) on three modules. This is an interim survey receipt, not roster acceptance or totality-wall closeout. Move per-module survey driver from scripts/ (does not exist on main) to docs/probes/ as a declared scaffold with dissolution trigger on frontier transport. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP audit: hand-authored 17 frontier rows from survey; add compare oracle. Document 12 pre-closeout declared-vs-survey mismatches in audit md (not silently reconciled). Update measured_probe on 17 surveyed modules by hand using TSV evidence; migration triggers remain authored claims. Add diff_frontier_declared_vs_survey.sh (refuses on mismatch; does not write rows). Do not land row-writer script — measurement is not declaration. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix CI: doc-graph bind for probe audit md; reorder sweep for rank monotonicity. Hand-updating roster rows to RealizationGap raised tractability ranks above interleaved NameResolutionGap modules and broke compiler_frontier_sweep_order rank nondecreasing. Reorder sweep by blocker band. Register the interim survey receipt in doc_graph_roots so doc_reachability does not orphan it. Co-authored-by: Cursor <cursoragent@cursor.com> * Align per-module survey scaffold order with frontier sweep_order. Keeps the hand-Rust probe driver consistent with compiler_frontier_sweep_order after the tractability-rank reorder fix. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane E: self-host frontier 27-row exact-head closeout, totality wall gre * Fix invalid enum accessor impl after stage0 regen. Regen with a stale emitter seed duplicated `<N: Clone>` onto the impl target (`OccurrenceBindingFoldState<N: Clone>`), which rustc rejects (E0229). Restore `OccurrenceBindingFoldState<N>`; regen --verify green. Co-authored-by: Cursor <cursoragent@cursor.com> * Name offline consumer for frontier per-module probe witness. Per-PR CI excludes test/claim/long/ at dir grain but never ran this probe; add a file-grain exclusion row and exclusion note with the full local claim_batch recipe so survey evidence is not implied by green CI. Co-authored-by: Cursor <cursoragent@cursor.com> * Document survey stale-head drift and spot-check at current main. State 9f978aa is 44 commits behind 19cc776 with five emitter-path commits in between; record four-module spot-check where verdicts held. Co-authored-by: Cursor <cursoragent@cursor.com> * P2: selection degradation receipts (selected/total + reason) (#7722) * WIP: P2: selection degradation receipts (selected/total + reason) * P2: emit selection degradation receipts on every floor discovery run. Every discovery completion now prints selection_state, selected/total entry groups, ratio, and fallback_reason so whole-corpus affected runs are counted degradations, not quiet success. Co-authored-by: Cursor <cursoragent@cursor.com> * P2: wire selection degradation into every floor receipt path. Publish selection_state, counts, ratio, and fallback_reason on the measurement tail, resolve receipt, floor-component JSON, and dedicated receipt file so carrier-only emission cannot satisfy the P2 bar. Co-authored-by: Cursor <cursoragent@cursor.com> * P2: drop stale prep-tax doc; prove executed-only selected count. Remove docs/plans/floor-prep-tax-program.md (owned by #7721). Add a discriminating test that skip-before-resolve rows do not inflate selected_entry_groups toward total. Co-authored-by: Cursor <cursoragent@cursor.com> * P2: drop duplicate selection-degradation stderr emission. run_discovery_corpus_with_options already emits via emit_selection_degradation_receipt; remove the second DAG eval in run_discovery_batch_node (review 47735). Co-authored-by: Cursor <cursoragent@cursor.com> * P2: thread walk source_roots into resolve receipt writer. Fix E0425: claim_executor bin cannot call pub(crate) default_source_roots; pass the walk's source_roots through write_resolve_receipt_at like the selection-degradation receipt path already does. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: P2: selection degradation receipts (selected/total + reason) * P2: add SELECTION_DEGRADATION_CENSUS_MARKER to cli_run seed. Roster bidirectional hygiene: observation_emit_census cites cli_run.rs for [selection-degradation]; mirror other frontier sites with a const the witness grep can find (review 47746). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: P2: selection degradation receipts (selected/total + reason) * P2: rustfmt selection_degradation_interp_ctx map_err closure. Co-authored-by: Cursor <cursoragent@cursor.com> * Merge origin/main; restore v1_generic_params_needing_clone_bound arity. Main merge regressed emit_rust to the 6-arg call site; trait_derive_emit requires ret/bounds/type_decl_items (E0061 on CI merge commit). Co-authored-by: Cursor <cursoragent@cursor.com> * P2: witness unknown-tag SelectionUnavailable path (review 47814). Document that Unavailable is fail-closed for unknown mode tags only; categorization_unavailable stays on Applied/Superset fallback_reason. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: P2: selection degradation receipts (selected/total + reason) --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Discharge namespace occurrence identity receipts (#7559) * WIP: Namespace occurrence debt receipts * WIP: Namespace occurrence debt receipts * Restore generated occurrence allocator * Enroll occurrence debt receipts in Cargo CI * Track parser receipt CI enrollment debt * WIP: Namespace occurrence debt receipts * Track split rebuild receipt enrollment * WIP: Namespace occurrence debt receipts * Keep parser receipts outside compile-clean roots * Prepare governed parser receipt enrollment * Keep occurrence debts live until roster enrollment * Import receipt newline index in generated projection * WIP: Namespace occurrence debt receipts * Derive occurrence acceptance closure from receipts * Bind occurrence closure to its law authority * Clarify occurrence denominator tripwire * WIP: Namespace occurrence debt receipts * Complete occurrence acceptance workflow relocation * WIP: debt receipts * Register std.occurrence_binding{,_resolve} seed modules; regen PR #7559's build job fails because the generated witness v1_tests_claim_occurrence_identity_debt_receipt_test.rs imports crate::std_occurrence_binding and crate::std_occurrence_binding_resolve, neither of which is a registered seed module. This registers both in gunbc.stage0_emit_model generated_stage0_files and stage0 lib.rs and regenerates. Regeneration leaves the other 114 generated files byte-identical, but the two newly emitted modules do not compile: 24 errors, all in std_occurrence_binding.rs. See the escalation note -- the emitter does not propagate a Clone bound through a user-declared generic type. * chore: regenerate drifted generated artifacts (ci auto-heal) * WIP: Finish PR 7559 adoption: main is repaired (19cc776), so the inherited * Roster occurrence_identity_closing_complete for non-fold residue gate PR #7559's acceptance-closure carrier introduces a wildcard match arm that must be enrolled in gunbc.non_fold_residue before the always-on corpus witness can pass. Companion to the regenerated ci.yml heal exclude for the new stage0 projection file. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Finish PR 7559 adoption: main is repaired (19cc776), so the inherited * Fix main-merge regen: restore keyed stage0 modules and total receipt_passed Merge resolution dropped main's std_keyed_roster/row from the generated emit plan and lib.rs; regen_stage0 from the merged tree restores both alongside the debt-receipt module. Total occurrence_identity_receipt_passed over the closed OccurrenceIdentityReceiptExecution coproduct instead of rostering a non-fold residue row (closing_complete remains total from 806a0d8). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Finish PR 7559 adoption: main is repaired (19cc776), so the inherited --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Root-cause disk-tier repeat-resolve memory growth (>8GiB OOM on second resolve through v1 disk cache seam) (#7728) * WIP: Root-cause disk-tier repeat-resolve memory growth (>8GiB OOM on second r * WIP: Root-cause disk-tier repeat-resolve memory growth (>8GiB OOM on second r * Remove debug RSS instrumentation swept in by auto-WIP Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Coordinator replay: wet witness per-row outcomes visible in CI job log (#7702) * Coordinator replay for wet witness row outcomes in claim_executor. Ordinary floor worker writes target/floor-wet-witness-row-outcome-receipt.tsv with passed | failed | selection-skipped per row; coordinator replays into job log on worker exit and spawn-failure paths. Unit tests discriminate the three outcomes (claim_executor binary, not claim_batch). Co-authored-by: Cursor <cursoragent@cursor.com> * Fix wet witness outcome TSV parsing for empty detail columns. Rust tab-split drops trailing empty fields; accept 4- or 5-column rows so passed rows with no detail replay correctly. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: falsifier is flakey on budget - please investigate (#7738) Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * P1 retention vs drain cohort receipt (authoritative) (#7725) * WIP: P1 retention vs drain cohort receipt (authoritative) * P1 retention vs drain cohort receipt: REJECT — eviction is not the tax source Fixed 50-entry cohort run through the real floor path (run_discovery_corpus_with_options, Adaptive width) in two modes: A (production eviction on) and B (GUNBC_SCHEDULE_RETENTION_EVICT=0, retain-all pole). Entries 2..34 (Mode B OOM-killed at 34/50 after unbounded RSS growth, honestly reported and not backfilled) show statistically indistinguishable wall/resolve times between modes — disabling schedule-retention eviction does not collapse the ~1-2s per-entry tax. Verdict: REJECT the retention hypothesis; redirect to assembly/materialization reuse, per the parent's stated criterion. Also fixes the cargo fmt violation from the prior P1 instrumentation commit that was failing CI on this PR. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * WIP: P1 retention vs drain cohort receipt (authoritative) * P1 receipt: fix cited SHA, rename mislabeled field, align scaffold wording Per review 47754 (cursor/composer-2.5, REQUEST_CHANGES), three fixes: 1. Receipt cited b53aec1 (this PR's initial WIP commit) as the reproduction SHA, but p1_cohort_probe.rs doesn't exist in that commit's tree. Corrected to dddc795, where the probe first lands in git history. 2. emit_p1_cohort_entry_line's `schedule_cache_hit` field actually logged typecheck_compute_count() movement (a typecheck-memo hit/miss), not schedule-retention cache occupancy -- mislabeled instrumentation on a measurement-only PR. Renamed to `typecheck_cache_hit` everywhere (code, doc comment, receipt); raw checked-in logs left unedited as captured evidence, with a note explaining the field rename maps onto the same underlying signal. 3. Receipt said the probe was "kept in tree; reusable for future retention receipts", contradicting the in-code scaffold/dissolve-on framing now that P1's REJECT verdict is recorded. Reworded to match: probe-only scaffolding, deletes per its named trigger. No measurement data or verdict changed -- only citation accuracy and field/wording honesty. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * WIP: P1 retention vs drain cohort receipt (authoritative) * chore: retrigger CI now that main's E0061 (v1_generic_params_needing_clone_bound arity) is fixed by #7733 No content change on this branch — forces GitHub to recompute the PR merge-ref against main's current (fixed) tip, since a rerun of the prior failed run reused a stale merge-ref captured before #7733 landed. * P1 scaffold: gate per-group timing/subject-tracking behind p1_cohort_receipt_enabled() Per review 47844: the Instant/typecheck_compute_count() timing pair and the resolved_graph_hit subject-set scan ran on every width-1 inline discovery-drain group regardless of GUNBC_P1_COHORT_RECEIPT — only the eprintln emission was gated. Wraps the bookkeeping in the same p1_cohort_detail check as its emission, so the default production floor path (env unset) pays none of this scaffold's cost, matching the env-gated discipline the receipt doc already claims. --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * Sole modeled publisher (model + shadow): policy-derived projection, publisher authority, shadow replay (#7594) * Sole modeled publisher (model + shadow): rebase PR-B onto main. Replay only PR-B carriers onto current main — no #7591 deletion content (placement gate/roster removal stays on vivid-newt-418 until that PR merges). Includes review 46354 digest/deletion-delta fixes and 13 witness tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Address review 46417: prune dead variant and dissolve parallel argv surface. Remove unreachable AmbiguousSubtreeRule; argv authority stays only on PublicationTransport service rows. Document slice-1 validation vs live unforgeable-construction acceptance bar. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Sole modeled publisher: ordinary sessions lose public-write capability; * Address review 46429: align transport, delta taxonomy, and publisher gates. Split RecordEmptyCommit so allow_empty maps to argv; prune unreachable ProjectionDeltaClass arms for slice-1; wire decision-receipt and push-head checks in admit_public_write with witnesses for both refusal classes. Co-authored-by: Cursor <cursoragent@cursor.com> * Refuse sole-publisher admission when no pushed refs are presented. Close the empty-pushed_refs vacuous-pass fail-open before live-slice binding; witness sole_publisher_refuses_empty_pushed_refs. Co-authored-by: Cursor <cursoragent@cursor.com> * Gate projection on AdmittedPublicationPolicy; match disposition directly. derive_public_projection_plan requires construction-admitted policy so conflicting/unknown-root policies cannot reach the derived path; dissolve publication_disposition_is_public in favor of coproduct match. Witness publication_policy_refuses_conflicting_prefix_rules. Co-authored-by: Cursor <cursoragent@cursor.com> * Address review 46476: full receipt auth and posture fold. publication_decision_authorizes_newly_public checks policy_version, authority, and universal audience; invalid receipts refuse with DecisionReceiptNotAuthorizing. Replace posture Bool predicate with session_publication_posture_fold. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Sole modeled publisher: ordinary sessions lose public-write capability; * Route publication ContentHash through std.content_hash. Main moved ContentHash off std.types and renamed content_hash_combine to content_hash_combine_structural; update publication projection, witnesses, and publisher refusal strings to the family-grounded API. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Sole modeled publisher: ordinary sessions lose public-write capability; --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Lane A: R1 invert interpreter dispatch authority (roster becomes the authority) (#7682) * fix(r1-dispatch): restore regen fixed-point and enroll dispatch generated module Regen was failing because type_ref_hit_ne_bind_measure_active was accidentally dropped from the builtin registry, and v1_interpreter_dispatch_generated was not enrolled in the stage0 crate layout (lib.rs drift). Register the scaffold in frontier, sync crate-layout projections, and land R1 roster authority on main. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane A: R1 invert interpreter dispatch authority (roster becomes the aut * docs(r1-dispatch): refresh authority notes for roster inversion Update v1_interpreter_primitive_surface authority prose and handler macro comments to describe the post-R1 model: authored roster in .dag, generated lookup routing, and compile-time handler alignment — not the pre-inversion macro-token derivation story review 47740 flagged. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(r1-dispatch): refuse emit when roster row maps to unknown site Close review 47777 fail-open: expected_v1_interpreter_dispatch_generated_rs now refuses when any authored row's roster_site_key falls outside known_dispatch_emit_site_keys instead of silently omitting it from generated lookup. Witnesses cover live-roster success and bare eval_call site-key RED control. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane A: R1 invert interpreter dispatch authority (roster becomes the aut * fix(r1-dispatch): restore clone-bound call after main merge Merge main (#7709) regressed v1_generic_params_needing_clone_bound to a 6-arg call site against the 9-arg signature; restore ret/bounds/type_decl arguments so the build job compiles. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: regenerate drifted generated artifacts (ci auto-heal) * fix(r1-dispatch): honest exhaustiveness note and ci heal paths Tighten closing-contract prose per review 47801: single-family dispatch sites get compile-time enum exhaustiveness; bridge/native-intercept multi-family sites honestly disclose the wildcard/unreachable! backstop. Propagate V1InterpreterDispatchGenerationRefused.reason through artifact emit. Add v1_interpreter_dispatch_generated.rs to ci.yml heal staging. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane A: R1 invert interpreter dispatch authority (roster becomes the aut * fix(r1-dispatch): repair invalid OccurrenceBindingFoldState impl emit Revert the regen typo that emitted `OccurrenceBindingFoldState<N: Clone>` (E0229). With emit_bare_type_params already in the seed, the correct application form is `OccurrenceBindingFoldState<N>`; regen --verify passes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(r1-dispatch): regen ci.yml and dispatch artifact to clear drift gate HealAuthorCommitRequired was failing because hand-edited ci.yml skew-guard exclude ordering did not match expected_ci_yml(). Regenerated via main_wet. Fixed v1_interpreter_dispatch_emit to emit fully-qualified enum paths in identity arm macros and #![rustfmt::skip] so pre-commit fmt does not fight the generated-artifact fixed point. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane A: R1 invert interpreter dispatch authority (roster becomes the aut * fix(r1-dispatch): use item-level rustfmt::skip in dispatch emit Co-authored-by: Cursor <cursoragent@cursor.com> #![rustfmt::skip] is unstable in submodule files (E0658 on CI). Emit #[rustfmt::skip] on each generated enum, lookup fn, and arm macro instead. * fix(r1-dispatch): module-scope arm macros, not macro_export macro_export arm macros cannot be invoked via $crate:: from another macro (macro_expanded_macro_exports_accessed_by_absolute_paths). Drop #[macro_export] from dispatch emit and call through v1_interpreter_dispatch_generated:: in handler macro expansions. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(r1-dispatch): hoist arm macros via macro_use for nested handler expansion macro_export arm macros cannot be invoked from nested macro_rules! via $crate:: (macro_expanded_macro_exports_accessed_by_absolute_paths) and non-exported module-path invocation does not resolve. Import generated arm macros with #[macro_use] on v1_interpreter_dispatch_generated before v1_interpreter and call them by bare name in handler expansions. Align roadmap node v1-interpreter-primitive-dispatch-authority with the site-scoped exhaustiveness contract (review 47830): compile-time refusal on single-family sites, unreachable! backstop on bridge/native-intercept. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane A: R1 invert interpreter dispatch authority (roster becomes the aut * chore: regenerate drifted generated artifacts (ci auto-heal) * fix(r1-dispatch): make lib.rs macro_use survive regen fixed-point Hand-editing lib.rs for #[macro_use] was overwritten by regen_stage0. Teach emit_lib_rs_from_files to emit macro_use on v1_interpreter_dispatch_generated and order it before v1_interpreter in the file-derived mod list; sync gunbc_stage0_crate_layout_generated.rs with the frontier hand-maintained block. regen_stage0 --verify now passes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(r1-dispatch): resolve main merge — lib.rs modules and ci.yml drift Merge main (#7606 keyed-roster) left lib.rs missing std_keyed_roster and std_keyed_row module declarations. Regenerated ci.yml and .gitattributes via main_wet so heal skew-guard excludes match expected_ci_yml() after the merge. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(r1-dispatch): narrow authority note to site-scoped exhaustiveness Review 47840: v1_interpreter_primitive_surface_authority_note claimed all roster/handler mismatches fail at compile time; align with the honest site-scoped bar already in roadmap_authority and the acceptance contract (single-family sites compile-time; bridge/native-intercept unreachable! until per-family enum split). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane A: R1 invert interpreter dispatch authority (roster becomes the aut * fix(r1-dispatch): repair dispatch emit dag parse for collision RED v1_interpreter_dispatch_emit.dag failed v1 parse (expected expression, found EqEq) when == started a continuation line in rust_variant_collision_synthetic_red_control. Single-line the equality and use negated == for identity inequality. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Fix audit scaffold fail-open and rename inflated closeout note. Probe survey script now refuses on per-module failure instead of || true stale-row widening; rename frontier_probe_exact_head_interim_audit_note to match 17/27 interim state and empty manifest stub. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: regenerate drifted generated artifacts (ci auto-heal) * Align probe note and survey md with interim audit framing. Rename closeout wording in wave2 sizing note; document that 17 frontier.dag rows were hand-authored in this PR and oracle diff greens for surveyed slice. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Lane E: self-host frontier 27-row exact-head closeout, totality wall gre * Regen stage0 lib.rs for regen_verify gate. Adds v1_tests_claim_occurrence_identity_debt_receipt_test mod export so regen_verify_gate_passes matches fresh self-compile. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft status (intentional — not forgotten)
Held in draft by operator design freeze (
clever-ferret-451msg_1049df00, 2026-08-01): no replacement publication ontology is approved yet; do not undraft or merge until the operator explicitly approves a publication design artifact.This PR is model + shadow only — typed carriers and a read-only shadow witness; no activation (no credential removal, no transport rebinding, no CI enrollment as enforcement, no load-bearing publication routing). That scope matches the freeze's allowed exploration lane, not the blocked merge lane.
Prior draft hold on #7591 stacking is discharged (#7591 merged 2026-08-01); the remaining gate is design review, not sequencing.
Design artifact for review:
docs/plans/sole-modeled-publisher-design.md(registered ingunbc.doc_graph_roots).Summary
Slice-1 model + shadow only for the sole modeled publisher lane (priority-assessment directive §8), rebased on post-#7591
main(placement gate/roster deletion landed).Ordinary dashboard sessions do not yet lose public-write capability — credentials and push machinery are unchanged. This PR lands the typed carriers and shadow witness that size the live enforcement slice.
New authorities (exploratory — ontology not operator-selected):
PublicationPolicy— subtree prefix → disposition; defaultWithholdPrivate; most-specific rule winsPublicProjectionPlan— derived from policy over authored subjects (never a pathname census)PublicationDecisionReceipt— binds content identity, not pathnamesArtifacts:
extdeps.git.publication_transport,tools.publication_publisher,tools.publication_push_shadow, design doc + doc-graph bind.Supersedes closed #7577 (recut per operator verdict). Authorization kernel: #7586 (merged).
Test plan
All 11 witness tests green by execution (2026-08-01):
ordinary_session_lacks_public_write_authority_holdssole_publisher_posture_is_uniquegit_push_shape_is_modeled_not_raw_argvpublication_policy_refuses_unknown_top_level_rootpublication_policy_most_specific_rule_winspublic_projection_plan_derives_from_policy_not_pathname_censuschange_local_admission_classifies_newly_public_deltapublication_decision_binds_content_identity_not_pathnameordinary_session_reds_before_projection_checksole_publisher_admits_change_local_projectionshadow_replay_counts_ordinary_session_refusals