Repository navigation
Design: emission admission + stage-aware pipeline (declared-change vs regression) - #7681
Merged
Merged
Conversation
Rewrite the plan around existing emitter_producer_provenance machinery, declare the two new pieces (declared-change vs regression and generation lineage), register the doc graph bind, and drop premature carrier code. Co-authored-by: Cursor <cursoragent@cursor.com>
Expand beyond declared-change/lineage to requirement revision identity, candidate/promoted lifecycle, recovery anchor, bridge-generation, and successor-capability fix-forward proof. Replace rollback-only de-risk with explicit temporal graph. Record resolved Q1–Q5 decisions. Co-authored-by: Cursor <cursoragent@cursor.com>
This was referenced Aug 2, 2026
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 2, 2026
Operator ruling: #7681 merged before design review completed. Not reverted -- it is document-only and no promoted generation depends on it -- but its non-authoritative status is made explicit rather than left to be inferred. The banner states what the document does NOT authorize (promotion, warm reuse, recovery-anchor release, deletion of a prior generation) and lists the nine outstanding corrections, three blocking. The sign-off bar is retained rather than deleted, as the record of what it asked for, and annotated with why it did not catch this: every item it names is satisfiable while the highest-stakes concepts stay undefined. A bar that checks whether cited symbols resolve and whether sections exist cannot detect that FixForwardProof and StageStamp are names without models. Full amendment is G0 (proud-fox-809). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 2, 2026
Scope change mid-lane: G0 is the design amendment, not model code. The carrier authored earlier in this session (dag/gunbc/emission_admission.dag plus its witness) is withdrawn — carriers land at stages 1-8, separately. #7681 merged before its review completed, so revision one is a merged rough draft. Not reverted (document-only, nothing depends on it); this revision applies the corrections and §12 records what each supersedes. The central one: a candidate does NOT carry a FixForwardProof. The actual DeclaredTransition derives exact transition exercises, whose stage and behavior receipts establish successor capability, under an explicit BootstrapGenesis and a retained anchor with a named NoTrustedFixForwardPath failure state. 1. FixForwardProof deleted as a free-standing concept. RequirementDelta + TransitionExercise derived from the transition's own deltas; the complete receipt is the proof; five admission conditions. The anchor need NOT fail to build the exercise — an anchor failure is never by itself positive evidence of candidate capability. 2. Generation zero gets a structurally distinct constructor. BootstrapGenesis with a GenesisAdmissionReceipt; the candidate-promotion constructor cannot produce one. The v1 committed-Rust compiler is the genesis as the explicit trust root, not because it proves itself clean. 3. GenerationContinuityVerdict, five arms, ending in the fail-closed NoTrustedFixForwardPath with enumerated permitted actions and no use-the-candidate-anyway arm. 4. StageStamp becomes the content identity of a total StageExecutionReceipt (Accepted | Refused | FallbackUsed); extend gunbc.guarantee_measurement rather than minting a parallel receipt. 5. RequirementRevision split from ValidationRevision — enrolling a witness is validation-only and needs no bridge; weakening one needs an explicit validation transition. 6. RecoveryAnchor immutable, never referencing the future; RecoveryAnchorState Retained | ReleaseEligible | Released, with release a separate transition. 7. Byte-only admission proved by reachability, never authored. Unknown reachability requires semantic validation. Two corpus facts recorded that block a shortcut: artifact_commit_policy files emitted stage0 Rust and .gitignore both under GitProtocol, and nothing derives which module emitted a given .rs path. 8. Stages reordered 0-10; stage 2 narrowed to within-revision with no promotion authority, which resolves the ordering contradiction. 9. Witness table rewritten with the fourth column that makes a row evidence: the mutation that must change the verdict. Nine rows. Also removed: the sign-off bar and every merge-readiness reading, replaced by an explicit statement that this document confers no merge readiness, no promotion authority, and no roadmap acceptance. Kept: the §2 DFS reuse inventory, candidate-cannot-promote-itself, the lineage graph, rollback-is-not-fix-forward, declared change as distinct from behavioral equivalence, and probes flipping to permanent regression controls. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
briansrls
pushed a commit
that referenced
this pull request
Aug 3, 2026
…#7704) * WIP: G-lane: generation admission model (G0 model / G1 emit binding / G2 prom * G0: correct the emission-admission design (nine operator corrections) Scope change mid-lane: G0 is the design amendment, not model code. The carrier authored earlier in this session (dag/gunbc/emission_admission.dag plus its witness) is withdrawn — carriers land at stages 1-8, separately. #7681 merged before its review completed, so revision one is a merged rough draft. Not reverted (document-only, nothing depends on it); this revision applies the corrections and §12 records what each supersedes. The central one: a candidate does NOT carry a FixForwardProof. The actual DeclaredTransition derives exact transition exercises, whose stage and behavior receipts establish successor capability, under an explicit BootstrapGenesis and a retained anchor with a named NoTrustedFixForwardPath failure state. 1. FixForwardProof deleted as a free-standing concept. RequirementDelta + TransitionExercise derived from the transition's own deltas; the complete receipt is the proof; five admission conditions. The anchor need NOT fail to build the exercise — an anchor failure is never by itself positive evidence of candidate capability. 2. Generation zero gets a structurally distinct constructor. BootstrapGenesis with a GenesisAdmissionReceipt; the candidate-promotion constructor cannot produce one. The v1 committed-Rust compiler is the genesis as the explicit trust root, not because it proves itself clean. 3. GenerationContinuityVerdict, five arms, ending in the fail-closed NoTrustedFixForwardPath with enumerated permitted actions and no use-the-candidate-anyway arm. 4. StageStamp becomes the content identity of a total StageExecutionReceipt (Accepted | Refused | FallbackUsed); extend gunbc.guarantee_measurement rather than minting a parallel receipt. 5. RequirementRevision split from ValidationRevision — enrolling a witness is validation-only and needs no bridge; weakening one needs an explicit validation transition. 6. RecoveryAnchor immutable, never referencing the future; RecoveryAnchorState Retained | ReleaseEligible | Released, with release a separate transition. 7. Byte-only admission proved by reachability, never authored. Unknown reachability requires semantic validation. Two corpus facts recorded that block a shortcut: artifact_commit_policy files emitted stage0 Rust and .gitignore both under GitProtocol, and nothing derives which module emitted a given .rs path. 8. Stages reordered 0-10; stage 2 narrowed to within-revision with no promotion authority, which resolves the ordering contradiction. 9. Witness table rewritten with the fourth column that makes a row evidence: the mutation that must change the verdict. Nine rows. Also removed: the sign-off bar and every merge-readiness reading, replaced by an explicit statement that this document confers no merge readiness, no promotion authority, and no roadmap acceptance. Kept: the §2 DFS reuse inventory, candidate-cannot-promote-itself, the lineage graph, rollback-is-not-fix-forward, declared change as distinct from behavioral equivalence, and probes flipping to permanent regression controls. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Split the two causes RefusedRegression was carrying The within-revision verdict table let RefusedRegression mean both "moved without a declaration" and "moved with one but the witness failed", while RefusedUndeclaredDelta sat next to it meaning the first of those. Two causes with different remedies sharing an arm is the state-space conflation DESIGN §5 names; the table now says which is which. Also re-points the admitted row at stage-execution receipts rather than the stamp correction 4 dissolved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Replace the rough-draft banner; retain the sign-off bar as an annotated record Three things the parent lane verified or asked for after the amendment: Banner replaced, not deleted. The corrections are no longer outstanding, so "rough draft with nine open corrections" is no longer true — but the document is also not signed. Status becomes amended-and-awaiting-sign-off, and the clause that must survive until the operator signs is carried verbatim: this document does not authorize promotion, warm reuse, recovery-anchor release, or deletion of a prior compiler generation. Section 11 keeps the original sign-off bar as a record with the parent's annotation, because the durable lesson is not that the bar was incomplete but how it failed: every item it named is satisfiable while the highest-stakes concepts stay undefined. All eight items were met by a draft in which FixForwardProof had no structure, StageStamp was never typed, and there was no generation zero. That is the reason §8's table now asks which mutation must change each verdict — a bar phrased as presence is satisfiable by presence. §3.11 prerequisite (a) reframed after the parent re-verified it against the carrier. It is not a missing axis but a wrong one: the consumer of a generated .rs file is rustc, and git is how the file is stored. Filing it under GitProtocol conflates storage with consumption, and does so for all four Stage0 rows. That makes the prerequisite "correct a fact already carried" rather than "invent a new fact". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Drop the authorization clause duplicated between the banner and the revision note The banner now carries it; restating it two paragraphs later was a second representation of one fact. * Record the three consequences found while applying the nine corrections A cross-correction consequence that is fixed but unrecorded reads, to the next author, as though it was never there: the bridge trigger list changed because correction 5 moved the witness roster, the RefusedRegression arm split because it was carrying two causes, and the first revision's stage 9 folded away because it was a second measurement receipt beside gunbc.guarantee_measurement. None is one of the nine. * Retire the stamp wording §3.9 dissolved (review 47612) The phase diagram and the prelude-duplication metric still said stamps after correction 4 made StageStamp only the content identity of a stage execution receipt. Terminological drift, but it is the drift that lets a retired concept keep circulating. The remaining uses are deliberate: the stamping RUN is a real referent, and the dissolution trigger names the untyped stage stamp precisely because that is what it retires. --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Aug 3, 2026
…loor_batches citations (#7688) * WIP: v1 deletion * Correct the DDC description in the seed-honesty rationale * Flip the seed-honesty expect-red probe to a permanent control; file the acceptance receipt The verdict greened v1_seed_honesty_decision_closing_contract_holds, which left seed_honesty_undecided_keeps_closing_contract_red asserting a state that no longer exists -- it could only go red or be deleted, and DESIGN 4b(4) forbids deleting the evidence with the machinery. The conjunction is now a function of the decision, applied to the live constant by the contract and to SeedHonestyUndecided by a permanent control. Receipt digest 1717cfe258d9afe1 derived by execution via node_criteria_digest; the probe reproduced f1c76111c83a0a60 for v2-emitter-producer-provenance, byte-matching the receipt already stored for that node, and returned three distinct values for three nodes. Green by execution under claim_batch on this tree: all three of v1_seed_honesty_decision_closing_contract_holds, seed_honesty_undecided_would_keep_closing_contract_red and seed_honesty_check_four_poles_hold_before_decision PASS. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: regenerate drifted generated artifacts (ci auto-heal) * Sweep the stale gunbc_ci_floor_batches citations, including two typed DeclarationRefs The function was renamed to gunbc_ci_floor_plan. One note recorded the rename; the references were never swept. Found by execution -- running DESIGN's own documented CI command refuses: no such function gunbc_ci_floor_batches. Repaired: - DESIGN.md + gunbc.design_document -- the documented claim_executor command did not run. ci.yml passes gunbc_ci_floor_plan, which is what the seven-hit sweep confirms is live. - gunbc.doc_graph_roots -- TWO typed DeclarationRef rows naming a declaration that does not exist. These are the sharpest instances: structured citations, in the carrier built to hold machine-checkable references, resolving to nothing, with no gate reporting it. - gunbc.ci_spec clamp note and gunbc.roster_registry -- live index-alignment and membership claims. NOT substituted blindly: the clamp rows align to the batch list gunbc_ci_floor_ordinary_batches, not to the plan function, per witness_scoped_batch_is_singleton_and_outside_positional_clamps. Substituting the plan function would have replaced one false citation with another. Deliberately NOT changed: gunbc_ci_floor_batch_wall_budget_note, which says 'named gunbc_ci_floor_batches through the static era this note records'. That is a correctly framed historical mention and the only place the rename was recorded. DESIGN.md is generated; the documented regen (generated_artifact_gate main_wet) refuses locally at stage0_emission_source_identities_host, and that refusal reproduces on pristine origin/main, so it is not introduced here. The DESIGN.md edit is the character-identical substitution the generator would produce from the corrected carrier, verified by comparing the rendered line to the carrier literal; the drift gate is the independent check on that claim. This is the class DESIGN 3 predicts and has not walled -- feature:cited-symbol-resolution would have caught all seven. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Mark #7681 a merged rough draft; it authorizes no promotion Operator ruling: #7681 merged before design review completed. Not reverted -- it is document-only and no promoted generation depends on it -- but its non-authoritative status is made explicit rather than left to be inferred. The banner states what the document does NOT authorize (promotion, warm reuse, recovery-anchor release, deletion of a prior generation) and lists the nine outstanding corrections, three blocking. The sign-off bar is retained rather than deleted, as the record of what it asked for, and annotated with why it did not catch this: every item it names is satisfiable while the highest-stakes concepts stay undefined. A bar that checks whether cited symbols resolve and whether sections exist cannot detect that FixForwardProof and StageStamp are names without models. Full amendment is G0 (proud-fox-809). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * WIP: v1 deletion * Move the seed-honesty witnesses into a home CI actually scans (review 47620) The review is correct and this was a real defect in my own change. Deleting the seed-honesty QuarantineProbeExpectRed enrollment removed the only thing scheduling the file. It sat in src/v2/test/claim/execution/, which carries a DIRECTORY-grain OfflineLocalRecipe exclusion (stated reason: the emit-vs-eval execution corpus home) and is not in witness_discovery_scan_dirs at all. So both the closing contract AND the permanent DESIGN 4b(4) control were left executing nowhere on the merge-gating path -- a one-time RedControlExecuted receipt backing a regression wall that never runs again. That is specification-without-execution for the exact wall the change claims to keep, and the PR body asserted the opposite: that this run would be the claim_executor verification. It would not have been. These witnesses are hermetic -- constructed DiverseCompilationRun fixtures, no host read -- so they never belonged in an emit-vs-eval execution home. Moving them is the construction fix; an explicit witness_entries row would have been a second exception layered on a wrong classification. Verified on BOTH halves, which is the part that matters: dag/test/claim IS a discovery scan dir (positive membership), and NO exclusion pattern matches the new path. Checking only the exclusion roster is how a sibling lane produced a false zero the same day. Green by execution under claim_batch from the new location: all three of v1_seed_honesty_decision_closing_contract_holds, seed_honesty_undecided_would_keep_closing_contract_red and seed_honesty_check_four_poles_hold_before_decision PASS. Receipt witness_module and both handback/entry paths repointed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct this PR's own justification: discovery is a source-root walk, not scan_dirs Read claim_executor rather than trusting the roster name. invoke_floor_discovery_ producer_over_corpus uses scan_dirs ONLY for the discover_owned_data_decls loop; the witness producer discover_floor_corpus_rows_from_host_facts receives source_roots and exclude_substrings and never sees scan_dirs. So witness discovery is a source-root walk for *_test.dag minus exclusions, and witness_discovery_scan_ dirs is the owned-data-decl scope, not the witness scope. Consequence for this PR: the file move is STILL the correct repair, but not for the reason given. The old location was already reachable by the walk; what excluded it was the exclusion substring test/claim/execution/, which the walk does honor. The operative repair is leaving an excluded path. The scan-dir half of the previous justification named a mechanism that does not govern witnesses at all. Fix unchanged, reason corrected. Credit to deep-swift-442, who read the executor and refuted both their model and mine. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: regenerate drifted generated artifacts (ci auto-heal) * chore: regenerate drifted generated artifacts (ci auto-heal) --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Design-only — no implementation code. Stage-aware emission admission: declared change vs regression, candidate/promoted lifecycle, fix-forward validation (not rollback-only de-risk). Downstream: #7683 builds on this note.
Existing machinery (reuse — doc §2)
v2.compiler.self_host.emitter_producer_provenance:EmitterProducer×EmissionQualification,mint_producer_emission_receipt,emitter_producer_mint_admission,emitter_produced_baseline = 0v2.compiler.self_host.canonical_emitted_bytes_digesttools.floor_effect_gate_witness.regen_verify_gate_passes/gunbc.ci_spec.RegenVerifyGatev2.workflow.self_host_realized_comparison_gategunbc.bootstrap.CompilerStageNew obligations (doc §3 — operator revision)
Beyond declared-change vs regression and generation lineage:
Fix-forward de-risk (doc §4)
Rollback via
git checkoutis real but insufficient: a defective generation may rebuild old source while unable to compile the new requirement revision. Design retains anchor + bridge + successor-capability gates.Temporal graph (doc §5)
AcceptedGeneration N→RequirementTransition+RecoveryAnchor N→Candidate N+1→ stage validation → behavior validation → bootstrap/fix-forward validation →PromotedGeneration N+1.Candidate generation through the direct Rust door is not blocked; only promotion and authoritative admission are gated.
Operator decisions (resolved — doc §9)
BehavioralEquivalent.SurfaceUnknownrefuses promotion and warm reuse; FrontierAccepted only in non-authoritative candidate/audit state.Test plan
.dagcarrier implementationdag/gunbc/doc_graph_roots.dag