Bundle selected logic witnesses into one native process

[briansrls]

Summary

• Model SelectedWitnessPlan, content-addressed bundle identity, stable shard policy, counted interpreter-frontier rows, typed receipts, and fail-closed admission in .dag.
• Realize the selected meet/join/complement population as one generated native artifact whose main makes three direct calls in one process.
• Keep the interpreter as the cutover oracle: admission requires member verdict equivalence and live planted-RED evidence; stale compiler or plan identity, roster drift, missing native realization, warm-artifact miss, divergence, and invalid process counts refuse explicitly.

This is the first executable selected-entry slice. It does not change floor scheduling; the production selector can consume this execution kind in the follow-up cutover.

Bundle receipts

• Complete 20-witness entry: 20/20 passed. Correct and wrong-body artifacts each logged compile_skipped=false followed by compile_skipped=true across two host processes.
• Correct bundle cold plus warm host witness: 993 ms. Wrong-body cold plus warm RED: 977 ms.
• Already-built native bundle, direct execution of all three calls: 3 ms wall. Existing warm cargo run --quiet development transport: 457 ms with zero compile. Three interpreter controls: 20 ms total.
• Latest-head critical rerun after current-main integration: 5/5 passed, including cold/warm reuse, member-drift refusal, interpreter green, primary rows, and discriminating planted RED.

Current-main integration receipt

• Integrated the REST repair series through main dbc87b21e0; latest main b951e724c2 adds unrelated compiler/roadmap work, and GitHub reports the branch mergeable with no conflict.
• Adapted bundle identities to the grounded Fnv1a64Structural ContentHash family and kept exact member equality structural rather than hash-equality-based.
• Rebuilt claim_batch after the seed change and executed REST replay 9/9.
• RestAuthenticated.digest and RestBoundOperationInvocation.input_digest now share the modeled Fnv1a64Structural record mint. The authenticated mint seam is execution-proven by rest_authenticated_identity_matches_dag_constructed_value: seed identity equals the .dag-authored FNV identity, with a secret-inequality control. The end-to-end authenticated replay path remains explicitly deferred in rest_authenticated_digest_witness_note until the service-input limb migrates from host value_hash to the modeled FNV primitives.
• The exact formerly-red extdeps_scope_placement_gate_passes witness now passes locally in its wet profile after consuming main's OCI enrollment repair.

Test plan

• CTRL_BUILD_MODE=local cargo build -p v1-compiler --bin claim_batch
• claim_batch over all 20 functions in native_selected_witness_bundle_test.dag with --claim-run --wet — 20/20 passed.
• Latest-head focused native bundle rerun — 5/5 passed.
• Latest-head rest_exchange_replay_test.dag rerun — 9/9 passed.
• cargo test -p v1-compiler-tests rest_authenticated_identity_matches_dag_constructed_value -- --nocapture — 1/1 passed.
• claim_batch --wet --source-root dag --source-root src/v2 --entry dag/tools/floor_effect_gate_witness.dag --function extdeps_scope_placement_gate_passes — passed.
• cargo fmt --all -- --check
• git diff --check origin/main...HEAD
• Exact-head CI run 30731615199 is green: build 3m39s, heal 2m13s, regen 9m33s, and full floor plus merge admission 43m08s.

Primitive-surface authorized delta

The modeled observed_monotonic_nanos realization adds exactly one derived interpreter free-call row, one distinct arm identity, and one authored spelling. Executed census output reads derived=184, distinct identities=175, and authored spellings=162, versus the prior 183/174/161. observed_monotonic_nanos_arm_is_one_derived_free_call attributes the complete +1/+1/+1 delta to free_call.observed_monotonic_nanos; no second arm is absorbed into the expected bump.

Worker attestation

• The title and body describe the change and its boundary.
• Tests and executed receipts are listed above.
• This closes an internal dashboard work item, not a GitHub issue.
• No secrets, credentials, or large binaries are staged.

[gunbai-bot]

Addressed review 46399 in 6fabafc: NativeWitnessBundleExecutionReceipt now carries both walls as NanosecondDuration (Measure<Time, Nano, Nat>), with raw Int conversion confined to the monotonic observation boundary. Focused typed-admission, correct cold/warm equivalence, and wrong-body divergence witnesses all pass.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed review 46457 in 4c27584:

• execution admission now takes the selected plan and current compiler identity, refuses empty native plans, stale compilers, plan drift, frontier-count drift, and any incomplete/reordered/extra executed-member roster;
• verdict comparison now uses the canonical equality surface instead of a hand-written coproduct predicate;
• the monotonic observation seed arm now has an explicit v1-hand-queue-drain deferral tied to ROADMAP’s zero-hand-Rust row and v1_deletion_plan authority.

The expanded executable bundle suite passes 25/25 locally, including the new fail-closed refusal controls; formatting and diff checks are clean. — sent from cool-wren-804

[gunbai-bot]

Addressed review 46478 in 2f9e780:

• the bundle’s single host-only fn main/stdout wrapper now carries an explicit bounded SCAFFOLD disposition, named feature:rust-target-host-entrypoint-grammar, and a concrete dissolve-on deletion trigger into the canonical Rust TargetModel grammar-row inverse;
• native and interpreted wall observations now become NanosecondDuration at their observation boundaries and remain typed through receipt construction.

Branch-local executable validation passed for both the correct cold/warm equivalence witness and the planted wrong-body RED witness; each resolved the 119-source closure, logged cold then compile_skipped=true, and returned true. Current-head CI build is also green; regen/heal are running. — sent from cool-wren-804

[gunbai-bot]

CI failure at 2f9e780 was three witnesses. The two primitive-surface failures were the known main regression and are repaired by #7614, now merged into this branch. The third was inert_carrier_no_unrostered_or_stale: the live lens identified CompileDiagnosticCensus, a model-first carrier from #7575 whose current guarantee-probe consumer is witness-only. Commit 0085f7e adds the counted frontier row (dissolving when the production probe-admission reader lands) and explicit imports needed for a scoped check. The exact failing witness now executes as true; git diff --check and formatting are clean. — sent from cool-wren-804

[gunbai-bot]

Review 46547’s temporary debug_current_inert_carrier_names test was removed in c1478e7 before the current head. The current tree contains neither the test nor its eprintln!; only the resulting typed frontier fix remains. — sent from cool-wren-804

[gunbai-bot]

CI run 30714914288 failed only the primitive-surface exact-count receipt. Executed census output on the branch reads 184 derived rows, 175 distinct identities, and 162 authored spellings: exactly +1/+1/+1 from the prior 183/174/161. Commits 10adba0 and 29f4a43 update the exact receipt and add observed_monotonic_nanos_arm_is_one_derived_free_call, which proves the sole delta is free_call.observed_monotonic_nanos on DerivedFromDispatch through eval_builtin_inner. Both formerly failing witnesses and the new attribution witness pass locally; formatting and diff checks are clean. Fresh CI run 30717947188 is queued. — sent from cool-wren-804