From c4ce8c9e4f9d00fe68acad89e1c2bee06bdd9dde Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Sun, 2 Aug 2026 14:44:23 +0000 Subject: [PATCH] Restore the rung-honesty correction and hand-Rust receipt to rest_authenticated_digest_witness_note PR #7599 absorbed #7648's REST content from a pre-correction head: the carriers, mint, and pin landed intact, but the note regressed to the version claiming 'the mint seam is mechanically prevented by the executed pin'. Commit 85a5ac443f on #7648 had retracted exactly that sentence, verified against ci.yml and gunbc.ci_layer_roots witness_layer_roots: CI's only contact with v1-compiler-tests is a compile gate (no test execution) and floor discovery excludes src/v1/tests, so the pin executes in no admission path. DESIGN 4b defines mechanically preventable as a mechanism that reliably exposes AND blocks; reporting the class at that rung is rung inflation, which 4b names worse than sitting low because an inflated class never ranks for climbing. The absorption also dropped the review 47065 hand-Rust receipt: the v1-hand-queue-drain lane (dag/gunbc/v1_deletion_plan.dag) owns the interim seed bridge in rest_auth_identity_value, fnv1a64_structural_value, and rest_authenticated_identity_for_witness, with deletion of those three symbols while the discriminating witness stays enrolled as the checkable dissolution receipt; and the NOT-NEW-DEBT pointer to content_hash_cross_family_eq_v1_seed_bridge_note recording that the whole seed-bridge control family shares the enrollment gap. One data-row string edit, spliced verbatim from the final #7648 head 45e5875140c0 whose floor ran green on this exact text. Regression: 9/9 rest_exchange_replay_test witnesses green by execution against the edit. Co-Authored-By: Claude Fable 5 --- dag/extdeps/transports/rest.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/extdeps/transports/rest.dag b/dag/extdeps/transports/rest.dag index f7c88ca203e..960a0c00d81 100644 --- a/dag/extdeps/transports/rest.dag +++ b/dag/extdeps/transports/rest.dag @@ -80,7 +80,7 @@ type RestAuthSensitiveIdentity = RestUnauthenticated | RestAuthenticated { scheme: NonEmptyStr, digest: Fnv1a64Structural } -data rest_authenticated_digest_witness_note: String = "AUTHENTICATED ARM: EXECUTED PIN, REPLAY-PATH DEFERRAL TYPED (review 47041, gunbc#7648). RestAuthenticated.digest is Fnv1a64Structural and the seed mint rest_auth_identity_value produces it via atom_identity_hash over '\\0' - the SAME fnv1a64 primitive std.content_hash.content_hash_atom realizes, so an authored fixture reproduces the digest through the modeled surface (content_hash_atom(value: \"\\0\")); an earlier spelling hashed with the host DefaultHasher, a value from outside the family this carrier names, which no dag fixture could ever author. EXECUTED EVIDENCE: rest_authenticated_identity_matches_dag_constructed_value (src/v1/tests/src/cross_representation_equality_test.rs) pins the seed mint ==-equal to the dag-authored identity - RED under a bare-text digest, RED under a non-fnv1a64 digest - plus a secret-inequality control. WHAT REMAINS DEFERRED, AND WHY, TYPED: a full replay-path authenticated witness (fixture matched against a seed-produced invocation through the service dispatch) additionally requires the invocation input_digest, whose per-param limbs content_hash_service_inputs still derives via the host value_hash - not reproducible from .dag - so authoring the matching fixture is blocked on that limb pipeline migrating to the fnv1a64 primitives; that migration also moves the recorded-fixture store keys, so it is its own lane, not a fixture edit here. RUNG: the mint seam is mechanically prevented by the executed pin; the end-to-end authenticated replay path remains unexecuted and must not be reported above that. DISSOLVE-ON: the limb migration lands and an authenticated replay witness executes against a seed-produced invocation; this row then deletes." +data rest_authenticated_digest_witness_note: String = "AUTHENTICATED ARM: EXECUTED PIN, REPLAY-PATH DEFERRAL TYPED (review 47041, gunbc#7648). RestAuthenticated.digest is Fnv1a64Structural and the seed mint rest_auth_identity_value produces it via atom_identity_hash over '\\0' - the SAME fnv1a64 primitive std.content_hash.content_hash_atom realizes, so an authored fixture reproduces the digest through the modeled surface (content_hash_atom(value: \"\\0\")); an earlier spelling hashed with the host DefaultHasher, a value from outside the family this carrier names, which no dag fixture could ever author. EXECUTED EVIDENCE: rest_authenticated_identity_matches_dag_constructed_value (src/v1/tests/src/cross_representation_equality_test.rs) pins the seed mint ==-equal to the dag-authored identity - RED under a bare-text digest, RED under a non-fnv1a64 digest - plus a secret-inequality control. WHAT REMAINS DEFERRED, AND WHY, TYPED: a full replay-path authenticated witness (fixture matched against a seed-produced invocation through the service dispatch) additionally requires the invocation input_digest, whose per-param limbs content_hash_service_inputs still derives via the host value_hash - not reproducible from .dag - so authoring the matching fixture is blocked on that limb pipeline migrating to the fnv1a64 primitives; that migration also moves the recorded-fixture store keys, so it is its own lane, not a fixture edit here. RUNG, CORRECTED FOR CI ENROLLMENT (calm-badger-682, verified against .github/workflows/ci.yml and gunbc.ci_layer_roots witness_layer_roots): the pin executes LOCALLY and is enrolled in NO executing CI path, so it is evidence a human can run rather than a mechanism that blocks. CI's only contact with that crate is the step named 'cargo check -p v1-compiler-tests --tests (compile gate; no test execution)', and witness_layer_roots is dag plus src/v2, so floor discovery never reaches src/v1/tests either; measured, the pin passes locally in 1.66s and reds nothing anywhere. DESIGN 4b defines mechanically preventable as a mechanism that reliably exposes AND blocks, with safety depending on it executing and staying enrolled - so the mint seam sits BELOW that rung, and calling it mechanically prevented is rung inflation, which 4b names as worse than sitting low because an inflated class never ranks for climbing. Deleting the seam guard would leave this control present, compiling, and mute. NOT NEW DEBT FROM THIS PR: content_hash_cross_family_eq_v1_seed_bridge_note cites the same unexecuted crate for the cross-family backstop, so the whole family of seed-bridge controls shares this gap and it is recorded here rather than fixed. The end-to-end authenticated replay path remains unexecuted and must not be reported above either. HAND-RUST RECEIPT (review 47065): the ROADMAP row 'Work through the remaining hand-written files the products need' (authority dag/gunbc/v1_deletion_plan.dag, v1-hand-queue-drain lane) owns the interim seed bridge in rest_auth_identity_value, fnv1a64_structural_value, and rest_authenticated_identity_for_witness. DISSOLVE-ON: that row migrates REST invocation construction out of v1_interpreter; the checkable receipt is deletion of those three hand-Rust symbols while this discriminating equality/inequality witness remains enrolled against the replacement realization. Independently, the input-digest limb migration lands and an authenticated replay witness executes against a seed-produced invocation; this note then deletes." data rest_bound_invocation_note: String = "REST needs a specialization of v2.std.operation_argv.BoundOperationInvocation rather than pretending its shell-only binding list is enough. OperationRef remains the declaration identity authority. The specialization adds the HTTP method, fully realized URI target, the digest of every declared input, and an auth-sensitive digest whose preimage never enters the fixture. Together those facts make a replay exact: a fixture for another operation, path/query/body input, method, target, or credential identity cannot satisfy this invocation. Query and body values are already in the declared-input digest; constants are fixed by OperationRef."