From d157d75496b5d040fd5d19a3baa5899671e64149 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 2 Aug 2026 03:55:10 +0000 Subject: [PATCH 1/9] WIP: pure business 8/1 --- dag/gunbc/design_document.dag | 2 +- dag/gunbc/roadmap_authority.dag | 6 +++--- docs/plans/five-minute-ci-gate-design.md | 13 ++++++++++--- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/dag/gunbc/design_document.dag b/dag/gunbc/design_document.dag index bd2e191d808..3bbbd484248 100644 --- a/dag/gunbc/design_document.dag +++ b/dag/gunbc/design_document.dag @@ -162,7 +162,7 @@ fn open_threads_blocks() -> List { li(text: "**§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites)."), li(text: "the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.)"), li(text: "floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. That is the only surviving candidate, and it is NOT established here: the successor slice must measure per-entry typecheck attribution against a shared env and report repeated typecheck compute / total typecheck compute, which nobody has measured, so the duplication factor must not be quoted as a multiplier on typecheck time; implementation stays gated on that receipt plus fleet memory. Whole-corpus floor runs OOM-killed twice on the measuring host (exit 137, at 1,513 and 1,046 entries, including under GUNBC_MEMORY_BUDGET_BYTES=44GiB which governs realization admission rather than resolve-pool retention), so a floor-representative partition from the `claim_executor` discovery path still has not been run. Receipt, with the retractions recorded rather than silently dropped: [entry-graph-union slice 1 measurement](docs/plans/entry-graph-union-slice1-measurement.md). **CLOSED (slice 2, #7533 candidate head):** three disjoint N≤50 windows + reorder control — decision_ratio = 0 repeated typecheck misses; no union construction; redirect to five-minute-ci-gate `per-entry-assembly-decomposition`. Retention **PARKED** unless M2-aware floor shows pressure (#7581: 842-entry batch 1, peak 6.27 GiB, schedule_evictions=2094, PASS width 1). M2 RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md)"), - li(text: "**five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01).** Product contract: an ordinary source edit reaches a required CI verdict in five minutes without recomputing any semantic fact whose inputs did not change. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`"), + li(text: "**five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`"), li(text: "**#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md)"), li(text: "**v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md)"), li(text: "**emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md)"), diff --git a/dag/gunbc/roadmap_authority.dag b/dag/gunbc/roadmap_authority.dag index cd10a291671..1657a2e6382 100644 --- a/dag/gunbc/roadmap_authority.dag +++ b/dag/gunbc/roadmap_authority.dag @@ -78,7 +78,7 @@ fn signed(by: String, works: RedControlEvidence, scope_equivalent: HandbackEvide data namespace_kernel_authority_amendment_note: String = "THE KERNEL BAR AS FIRST WRITTEN DEADLOCKED ITS OWN SUCCESSOR, and this amendment is the fix (operator ruling, 2026-08-01). The recut landed namespace-binding-kernel with a red_control ending 'no second place in the compiler makes that same decision' and a handback demanding 'evidence that nothing else decides the same question'. That bar cannot be met while the bootstrap seed keeps its own hand-written none/one/many mirror inside the v1 adapter, and that mirror cannot be deleted until generic emission carries the canonical carrier with its required bounds. But namespace-reference-derived-closure DEPENDS on the kernel. So on the day the recut merged, the next step was already unstartable for a reason that had nothing to do with what the next step needs: deriving candidate populations does not require the seed mirror to be gone, it requires the canonical decision to EXIST and be callable.\n\nTHE CUT IS AUTHORITY VERSUS RETIREMENT. Owning the canonical decision and removing every rival implementation of it are separate achievements with separate evidence, and fusing them made an acceptance bar that no amount of correct kernel work could satisfy. The kernel now owns being the one canonical authority; namespace-legacy-choice-retirement owns deleting the older mechanisms, and the seed mirror is named there as one of its rows. A new node was deliberately NOT minted: that node already reads 'delete every other way of deciding what a name means' and already inventories every remaining place that decides, so the mirror is a row it should always have carried, and minting a sibling would have been a second home for one concept.\n\nTHE ADAPTER IS NOT THEREBY BLESSED. It remains a declared scaffold with its dissolution trigger on its own carrier, counted and visible; moving WHERE its retirement is tracked does not lower what is owed. What changes is only that a temporary bootstrap realization no longer gates work that does not depend on it.\n\nTWO ACCEPTANCE SENTENCES WERE ALSO WRONG AND ARE CORRECTED HERE. The red_control said 'a malformed name refuses', but this boundary accepts occurrence identities and derives no name spelling at all, so it named a check no implementation executes — it now reads malformed occurrence TRANSPORT. And the bar now states the two refusals that distinguish a malformed supplied population from a real verdict: a candidate handed in the wrong role refuses distinctly from one that is absent, and the same declaration supplied twice refuses as malformed rather than counting as two. Only two DISTINCT declaration identities are ambiguity. Collapsing either of those into an ordinary verdict would let a defective candidate producer read as a legitimate naming answer, which is the state-space conflation this whole lane exists to remove." -data five_minute_ci_gate_program_note: String = "PROGRAM BOUNDARY, NOT A SINGLE PR (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01). Product contract, verbatim: an ordinary source edit reaches a required CI verdict in five minutes without recomputing any semantic fact whose inputs did not change. Six sub-lanes plus an explicit operator sequence — (1) finish #7522 warm-merge-admission with net wall receipt; (2) merge #7599 native bundle slice; (3) immediately cut over bounded production witness population to native execution kind (#7599 owner); (4) continue #7534 as materialization substrate under module-grain (hierarchy: module parse/type/interface → resolved entry → native bundle; no default CI savings until ordinary invocations consume it); (5) union CLOSED per #7533 → per-entry-assembly narrow lane; (6) this parent registration. Native-at-small-scale is SETTLED at branch head 2f9e780e6 (#7599 in-flight executing slice, dispositive at small scale per witness receipts; banking trigger = #7599 merge); open question is operational migration rate with equivalence/fallback/identity/memory fail-closed. Staged expectations (not flat 30–35min): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction in docs/plans/five-minute-ci-gate-design.md holds. Dispositions: entry-graph-union CLOSED; retention PARKED (#7581). See docs/plans/five-minute-ci-gate-design.md." +data five_minute_ci_gate_program_note: String = "PROGRAM BOUNDARY, NOT A SINGLE PR (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02). Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract — it is the distress ceiling ('this is hard / not working well'), retained only as the Stage C checkpoint bound. Six sub-lanes plus an explicit operator sequence — (1) finish #7522 warm-merge-admission with net wall receipt; (2) merge #7599 native bundle slice; (3) immediately cut over bounded production witness population to native execution kind (#7599 owner); (4) continue #7534 as materialization substrate under module-grain (hierarchy: module parse/type/interface → resolved entry → native bundle; no default CI savings until ordinary invocations consume it); (5) union CLOSED per #7533 → per-entry-assembly narrow lane; (6) this parent registration. Native-at-small-scale is SETTLED at branch head 2f9e780e6 (#7599 in-flight executing slice, dispositive at small scale per witness receipts; banking trigger = #7599 merge); open question is operational migration rate with equivalence/fallback/identity/memory fail-closed. Staged expectations (not flat 30–35min): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction in docs/plans/five-minute-ci-gate-design.md holds. Dispositions: entry-graph-union CLOSED; retention PARKED (#7581). See docs/plans/five-minute-ci-gate-design.md." data namespace_node_recut_note: String = "THE BROAD NAMESPACE NODE WAS TOO COARSE TO CLOSE HONESTLY, and the recut is the fix (operator ruling, 2026-07-31). namespace-canonical-binding previously combined two separable things in one boundary: working out which declarations a name can see, and calling one decision function on them. A check proving only the none/one/many decision could therefore have marked the whole node accepted while candidate derivation, reference-derived dependency closure, and the production changeover all remained unbuilt — an acceptance hazard, and the exact shape of rung inflation DESIGN 4b forbids, where a carrier named for the top rung occupies the bottom one.\\n\\nThree prerequisites now stand in front of it. namespace-binding-kernel owns the decision alone, on a candidate population SUPPLIED to it. namespace-reference-derived-closure owns structural exposure, authored order, the candidate index, exact reference-to-declaration binding, and the derived dependency edges. namespace-ambiguity-discharge settles the genuinely-many cases from real compilation. namespace-canonical-binding KEEPS ITS DURABLE IDENTITY and is now the final production changeover only, so historical links resolve and no identity is reused.\\n\\nWhy the split falls exactly there: dependency edges are a PROJECTION OF THE BINDING, not a second authored statement. A program that instead authored the missing edges by hand reached 400 of 771 files at roughly one import per CI floor before it was stopped; the unresolved population was evidence that binding and module discovery are coupled at the wrong boundary, not a backlog to grind down.\\n\\nTHE CHANGEOVER AND ITS SUCCESSOR ARE DISJOINT, and an earlier revision of this recut broke that (review 45649). It retitled namespace-canonical-binding as 'switch the whole compiler over' with a boundary reading 'every place that resolves a name', which swallowed namespace-bound-only-consumers underneath it — that node's own boundary is type checking, call lookup, and argument-count checks reading the decided answer. Overlapping boundaries are the §2 redundancy this document exists to remove, and they are worse on a roadmap than in code: completing the parent would already entail most of the child, so either the child can never be honestly accepted or the parent was silently read narrower than it was written. The cut is PRODUCER versus READER. The changeover node owns the sites that WORK OUT what a name refers to, and the deletion of the search-everything fallback behind them. Its successor owns the READERS of that answer and their obligation to stop on unresolved or ambiguous. Neither entails the other, and each can be accepted on its own evidence.\\n\\nONE EDGE WAS DELIBERATELY NOT CHANGED. pderive-source-slot-binding still depends on namespace-canonical-binding, which now means it waits for the whole production changeover. It plausibly needs only occurrence transport plus the binding kernel, but that is unproven: the dependency moves only once the focused P-derive consumer demonstrates it can operate on an exact supplied candidate population. Loosening it on the strength of the argument alone would be asserting a fact nobody has measured." @@ -852,8 +852,8 @@ fn declared_roadmap_nodes() -> List { owner: "ci-cost", path: "docs/plans/five-minute-ci-gate-design.md", t: fields( - headline: "Reach a required CI verdict in five minutes without redundant semantic work", - boundary: "An ordinary source edit reaches a required CI verdict in five minutes without recomputing any semantic fact whose inputs did not change. Six sub-lanes plus operator sequence: (1) #7522 warm-merge-admission net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly lane; (6) this registration. Native-at-small-scale settled (#7599); open question is operational migration rate. Staged expectations A/B/C in design note — five-minute gate is Stage C conjunction, not today's wall clock.", + headline: "Serve every required CI operation with the bare minimum computation; five minutes is the distress ceiling, not the contract", + boundary: "Every required operation performs the bare minimum computation needed to serve it — an ordinary source edit's verdict recomputes no semantic fact whose inputs did not change (contract re-anchored by operator ruling 2026-08-02: five minutes is a distress ceiling retained as the Stage C checkpoint bound, not the contract). Six sub-lanes plus operator sequence: (1) #7522 warm-merge-admission net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly lane; (6) this registration. Native-at-small-scale settled (#7599); open question is operational migration rate. Staged expectations A/B/C in design note — five-minute gate is Stage C conjunction, not today's wall clock.", displaced_cost: "Today witness bodies are still interpreted and materialization is recomputed across phases — confidence is bought with time the product boundary forbids.", first_slice: "Register sequence, staged expectations, and #7599 in-flight disposition in authority; land no implementation under the parent id.", red_control: "A sub-lane that widens to whole-corpus work, silently falls through from an incomplete materialization artifact to cold recompute, or claims the five-minute envelope without Stage C fleet receipts refuses rather than greens.", diff --git a/docs/plans/five-minute-ci-gate-design.md b/docs/plans/five-minute-ci-gate-design.md index 676168b8fb8..b43071b3c5b 100644 --- a/docs/plans/five-minute-ci-gate-design.md +++ b/docs/plans/five-minute-ci-gate-design.md @@ -5,9 +5,16 @@ operator-signed product boundary, six sub-lanes, and the **dependency sequence** in `gunbc.roadmap_authority` so dispatch, witnesses, and receipts share one program identity. -**Product boundary (verbatim):** an ordinary source edit reaches a required CI -verdict in five minutes without recomputing any semantic fact whose inputs did -not change. +**Product boundary (re-anchored by operator ruling 2026-08-02):** every required +operation performs the bare minimum computation needed to serve it — an ordinary +source edit's verdict recomputes no semantic fact whose inputs did not change, +and its cost is the touched closure's delta, not the corpus. **Five minutes is +not the contract** — the operator's words: the earlier sentence presenting it as +the contract was a mistake; five minutes is the distress ceiling ("holy crap +this is hard / not working well"), retained only as the Stage C checkpoint +bound. Reaching 5:00 does not complete the program while redundant computation +remains on a required path; the bar is scoped by the realization/materialization +goals, and wall-clock falls out of them. **This is a program, not a PR.** Each sub-lane is independently dispatchable; the parent carries the end-to-end contract and the ordered sequence below. From bb5eefce2c3c56077ed9c00c3a2b84f3a0572607 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 2 Aug 2026 03:59:51 +0000 Subject: [PATCH 2/9] Regenerate DESIGN.md from the re-anchored five-minute row Co-Authored-By: Claude Fable 5 --- DESIGN.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DESIGN.md b/DESIGN.md index 1f5b9432e6d..c8115f0aa97 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -127,7 +127,7 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/` - **§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites). - the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.) - floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. That is the only surviving candidate, and it is NOT established here: the successor slice must measure per-entry typecheck attribution against a shared env and report repeated typecheck compute / total typecheck compute, which nobody has measured, so the duplication factor must not be quoted as a multiplier on typecheck time; implementation stays gated on that receipt plus fleet memory. Whole-corpus floor runs OOM-killed twice on the measuring host (exit 137, at 1,513 and 1,046 entries, including under GUNBC_MEMORY_BUDGET_BYTES=44GiB which governs realization admission rather than resolve-pool retention), so a floor-representative partition from the `claim_executor` discovery path still has not been run. Receipt, with the retractions recorded rather than silently dropped: [entry-graph-union slice 1 measurement](docs/plans/entry-graph-union-slice1-measurement.md). **CLOSED (slice 2, #7533 candidate head):** three disjoint N≤50 windows + reorder control — decision_ratio = 0 repeated typecheck misses; no union construction; redirect to five-minute-ci-gate `per-entry-assembly-decomposition`. Retention **PARKED** unless M2-aware floor shows pressure (#7581: 842-entry batch 1, peak 6.27 GiB, schedule_evictions=2094, PASS width 1). M2 RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md) -- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01).** Product contract: an ordinary source edit reaches a required CI verdict in five minutes without recomputing any semantic fact whose inputs did not change. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` +- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` - **#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md) - **v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md) - **emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md) From 750a1e0f705958178f985e2a03679d7b1f493fe8 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 2 Aug 2026 16:06:03 +0000 Subject: [PATCH 3/9] Regenerate DESIGN.md after merge (auto-sweep committed the conflicted file) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The mid-merge auto-commit captured DESIGN.md with conflict markers. DESIGN.md is a registered generated artifact — regeneration from the resolved design_document.dag via main_wet is the authoritative merge resolution. Co-Authored-By: Claude Fable 5 --- DESIGN.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/DESIGN.md b/DESIGN.md index ffa3bb7df2b..d8150d6e84b 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -126,13 +126,8 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/` - the model↔realization fork is systemic, and where unfinished it fails open: every primitive is modeled as a coproduct and realized as a native `Value`, reconciled by per-site bridges, so coverage is accidental and non-compositional. `match` bridges `Int→Zero/Succ` but `Value::eq` has no `Int↔Variant` arm, so `nat_add(85, 32) == 117` silently compared `false` at its `_ => false` chokepoint — a §5 fail-open, not the §2/§7 redundancy the 🟡 dissolve-on markers track. **Landed:** the *numeric tower* fork now fails closed — `eval_binop`'s `BinOp::Eq`/`Ne` raises `InterpError::CrossRepresentationEquality` when a `false` result is *explained* by a native `Int`/`Float` vs `Nat`-coproduct straddle (recursive: catches `nat_add == nat_add` and `[nat_add(1,1)] == [2]`), with `Value::eq` left infallible so it stays the single `CanonKey` map-key authority. The discriminating witness is `cross_representation_equality_test` (forks → typed error; reconciled/native → `true`; genuine diffs `1 == 2`/`Succ{..} == Zero` → `false`, not error). **Remaining:** (a) the same straddle for `Bool True|False` over `Value::Bool` (no `==` site in the corpus today) and `Optional/Witness` over `Value::Null` — the latter resists a blanket guard because `Value::Null` is the overloaded `None`/`Absent`/miss sentinel and `present == None` (131 sites) is a *legitimate* `false`, so it needs grounding, not an error arm; (b) the root fix (§1/§2/§7) — ground each primitive into its realization. **Numeric tower: GROUNDED** (#5428, 2026-06-21) — Nat construction-side grounded (`Zero → Int(0)`, `Succ{prev:Int(k)} → Int(k+1)`); native form == modeled form; `eval_binop` `CrossRepresentationEquality` guard is dead-in-corpus for numerics, kept as fail-closed backstop until the `Value::Null` split lands (guard removal bundled with that work, fenced out of this window). **Remaining:** `Value::Null` split — Optional/Witness/miss into own carriers (~131 sites; the deeper root, its own runway). Phase A (plan + witnesses, #7261); carrier split not landed. → [value-null split plan](docs/plans/value-null-split.md) (operator: `==` fail-closed, 2026-06-20) · **Next layer (PR #7197, open, not yet merged):** `dag/std/algebra.dag:38`'s `GroupCompletion` is hollow (bodyless — no fields at all), forked a second time by `src/v2/std/integer.dag`'s independent redeclaration — the emitted-Rust operator-trait surface #5428 left uncovered renders it as `PhantomData`. PR #7197 grounds `GroupCompletion` as the Grothendieck pair construction (`{pos: M, neg: M}`) at its single authority, deletes the v2 duplicate in favor of importing it (§2/§3), collapses a native-`Int`-fielded pair construction in `eval_record_lit` (mirrors #5428's `Succ{prev}` collapse), and swaps the emitter's zero-param alias-decl branch to the single-authority `rust_scalar_checkpoint_render_base` so the `Int → i64` checkpoint fires under both corpus representations. Content-reviewed clean; CI in progress. → [GroupCompletion pair-construction design](docs/plans/groupcompletion-pair-construction-design.md) - **§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites). - the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.) -<<<<<<< HEAD -- floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. That is the only surviving candidate, and it is NOT established here: the successor slice must measure per-entry typecheck attribution against a shared env and report repeated typecheck compute / total typecheck compute, which nobody has measured, so the duplication factor must not be quoted as a multiplier on typecheck time; implementation stays gated on that receipt plus fleet memory. Whole-corpus floor runs OOM-killed twice on the measuring host (exit 137, at 1,513 and 1,046 entries, including under GUNBC_MEMORY_BUDGET_BYTES=44GiB which governs realization admission rather than resolve-pool retention), so a floor-representative partition from the `claim_executor` discovery path still has not been run. Receipt, with the retractions recorded rather than silently dropped: [entry-graph-union slice 1 measurement](docs/plans/entry-graph-union-slice1-measurement.md). **CLOSED (slice 2, #7533 candidate head):** three disjoint N≤50 windows + reorder control — decision_ratio = 0 repeated typecheck misses; no union construction; redirect to five-minute-ci-gate `per-entry-assembly-decomposition`. Retention **PARKED** unless M2-aware floor shows pressure (#7581: 842-entry batch 1, peak 6.27 GiB, schedule_evictions=2094, PASS width 1). M2 RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md) -- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` -======= - floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. Slice 2 CLOSED that candidate as a no-go: three disjoint N<=50 windows and the post-merge representative/reorder receipt found zero repeated typecheck misses and an order-stable distinct-computation set inside one shared typed-cache authority. The durable law remains once-per-content-key; the one-shot ratio instrument was deleted after the merged-SHA provenance receipt. No union construction and no larger-host confirmation run follow from this hypothesis. The separate #7597 successor measures assembly on a new denominator: its exclusive, refusal-based split reproduces symbol-index merge, root symbol-index composition, import-string rewiring, closure symbol-index construction, root variant-base construction, emit-info, pool fill, and services as the priced terms, with the derived other row at 0.32% in both runs. Receipts: [slice 2 closeout](docs/plans/entry-graph-union-slice2-typecheck-attribution.md) and [per-entry assembly decomposition](docs/plans/per-entry-assembly-decomposition-measurement.md). M2: RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md) -- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01).** Product contract: an ordinary source edit reaches a required CI verdict in five minutes without recomputing any semantic fact whose inputs did not change. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` ->>>>>>> origin/main +- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` - **#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md) - **v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md) - **emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md) From 4bf1e8b4ea87716496afa04d79a53d5dd6269ec1 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 2 Aug 2026 16:17:37 +0000 Subject: [PATCH 4/9] Reword program step 6 off the superseded five-minute objective (review 47439) Step 6 still called five minutes 'the objective'; it now names the bare-minimum-computation contract as the objective, with five minutes as the Stage C distress checkpoint bound only. Co-Authored-By: Claude Fable 5 --- docs/plans/five-minute-ci-gate-design.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/five-minute-ci-gate-design.md b/docs/plans/five-minute-ci-gate-design.md index b43071b3c5b..4b52d05f2b4 100644 --- a/docs/plans/five-minute-ci-gate-design.md +++ b/docs/plans/five-minute-ci-gate-design.md @@ -55,7 +55,7 @@ Registered as roadmap edges where noted; order is binding for dispatch. | 3 | **Immediately** cut over a bounded production witness population to the native execution kind | **NEXT** — #7599 owner; first major CI slice after merge | | 4 | Continue **#7534** as shared materialization substrate — no default CI savings credited until ordinary invocations consume it | **NEXT** under `module-grain-materialization` | | 5 | Union program **closed** per #7533; remaining assembly observation → `per-entry-assembly-decomposition` (narrow measured lane) | **CLOSED** / **NEXT** | -| 6 | This program (`five-minute-ci-gate`) makes the five-minute objective and this graph explicit | this registration | +| 6 | This program (`five-minute-ci-gate`) makes the bare-minimum-computation contract and this graph explicit; five minutes stays the distress checkpoint (Stage C bound), never the completion criterion | this registration | **Materialization hierarchy** (step 4 feeds step 3, not a parallel fork): From 659271e48635ddbf2230a55bf5d9ecf01749357e Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 2 Aug 2026 17:02:23 +0000 Subject: [PATCH 5/9] WIP: pure business 8/1 --- dag/gunbc/roadmap_authority.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/roadmap_authority.dag b/dag/gunbc/roadmap_authority.dag index 5f7e4810d66..4d97de6a8b4 100644 --- a/dag/gunbc/roadmap_authority.dag +++ b/dag/gunbc/roadmap_authority.dag @@ -880,7 +880,7 @@ fn declared_roadmap_nodes() -> List { path: "docs/plans/five-minute-ci-gate-design.md", t: fields( headline: "Serve every required CI operation with the bare minimum computation; five minutes is the distress ceiling, not the contract", - boundary: "Every required operation performs the bare minimum computation needed to serve it — an ordinary source edit's verdict recomputes no semantic fact whose inputs did not change (contract re-anchored by operator ruling 2026-08-02: five minutes is a distress ceiling retained as the Stage C checkpoint bound, not the contract). Six sub-lanes plus operator sequence: (1) #7522 warm-merge-admission net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly lane; (6) this registration. Native-at-small-scale settled (#7599); open question is operational migration rate. Staged expectations A/B/C in design note — five-minute gate is Stage C conjunction, not today's wall clock.", + boundary: "Every required operation performs only the computation its inputs require — no semantic fact recomputed whose inputs did not change (re-anchored by operator ruling 2026-08-02: five minutes is the distress ceiling — the Stage C checkpoint bound, not the contract). Six sub-lanes plus operator sequence: (1) #7522 warm-merge-admission net receipt; (2) #7599 native bundle slice; (3) bounded production cutover to native execution; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly lane; (6) this registration. Native-at-small-scale settled (#7599); open: operational migration rate. Staged expectations A/B/C in design note; the gate is the Stage C conjunction.", displaced_cost: "Today witness bodies are still interpreted and materialization is recomputed across phases — confidence is bought with time the product boundary forbids.", first_slice: "Register sequence, staged expectations, and #7599 in-flight disposition in authority; land no implementation under the parent id.", red_control: "A sub-lane that widens to whole-corpus work, silently falls through from an incomplete materialization artifact to cold recompute, or claims the five-minute envelope without Stage C fleet receipts refuses rather than greens.", From cd0d1475dec33795d7ea8d22f11f7647288d0381 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 2 Aug 2026 22:42:48 +0000 Subject: [PATCH 6/9] =?UTF-8?q?Refresh=20the=20#7599=20observation=20in=20?= =?UTF-8?q?the=20five-minute-gate=20rows:=20in-flight=20=E2=86=92=20merged?= =?UTF-8?q?,=20banking=20trigger=20fired?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The program note (gunbc.roadmap_authority five_minute_ci_gate_program_note) and the DESIGN row still described #7599 as an in-flight executing slice with its banking trigger pending. #7599 merged 2026-08-02 (merge 1ebff27f1e), so the trigger those rows named has fired. Both sentences now state the dated merged fact; the registered operator sequence and the first_slice record of what the registration slice registered are untouched. DESIGN.md regenerated same-commit via the generated-artifact gate (main_wet), executed green. Co-Authored-By: Claude Fable 5 --- DESIGN.md | 2 +- dag/gunbc/design_document.dag | 2 +- dag/gunbc/roadmap_authority.dag | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/DESIGN.md b/DESIGN.md index 8b0be68d4f3..7ea2f6abbd7 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -127,7 +127,7 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/` - **§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites). - the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.) - floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. Slice 2 CLOSED that candidate as a no-go: three disjoint N<=50 windows and the post-merge representative/reorder receipt found zero repeated typecheck misses and an order-stable distinct-computation set inside one shared typed-cache authority. The durable law remains once-per-content-key; the one-shot ratio instrument was deleted after the merged-SHA provenance receipt. No union construction and no larger-host confirmation run follow from this hypothesis. The separate #7597 successor measures assembly on a new denominator: its exclusive, refusal-based split reproduces symbol-index merge, root symbol-index composition, import-string rewiring, closure symbol-index construction, root variant-base construction, emit-info, pool fill, and services as the priced terms, with the derived other row at 0.32% in both runs. Receipts: [slice 2 closeout](docs/plans/entry-graph-union-slice2-typecheck-attribution.md) and [per-entry assembly decomposition](docs/plans/per-entry-assembly-decomposition-measurement.md). M2: RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md) -- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` +- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled and banked** — #7599 merged 2026-08-02 (merge `1ebff27f1e`; 25/25 witness PASS executed 2026-08-01 at pre-merge head `2f9e780e6`); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` - **#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md) - **v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md) - **emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md) diff --git a/dag/gunbc/design_document.dag b/dag/gunbc/design_document.dag index 8f2833a5c57..a0ad81fe63f 100644 --- a/dag/gunbc/design_document.dag +++ b/dag/gunbc/design_document.dag @@ -162,7 +162,7 @@ fn open_threads_blocks() -> List { li(text: "**§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites)."), li(text: "the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.)"), li(text: "floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. Slice 2 CLOSED that candidate as a no-go: three disjoint N<=50 windows and the post-merge representative/reorder receipt found zero repeated typecheck misses and an order-stable distinct-computation set inside one shared typed-cache authority. The durable law remains once-per-content-key; the one-shot ratio instrument was deleted after the merged-SHA provenance receipt. No union construction and no larger-host confirmation run follow from this hypothesis. The separate #7597 successor measures assembly on a new denominator: its exclusive, refusal-based split reproduces symbol-index merge, root symbol-index composition, import-string rewiring, closure symbol-index construction, root variant-base construction, emit-info, pool fill, and services as the priced terms, with the derived other row at 0.32% in both runs. Receipts: [slice 2 closeout](docs/plans/entry-graph-union-slice2-typecheck-attribution.md) and [per-entry assembly decomposition](docs/plans/per-entry-assembly-decomposition-measurement.md). M2: RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md)"), - li(text: "**five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled** at #7599 branch head `2f9e780e6` (in-flight executing slice, 25/25 witness PASS executed 2026-08-01; banking trigger = #7599 merge); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`"), + li(text: "**five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled and banked** — #7599 merged 2026-08-02 (merge `1ebff27f1e`; 25/25 witness PASS executed 2026-08-01 at pre-merge head `2f9e780e6`); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`"), li(text: "**#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md)"), li(text: "**v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md)"), li(text: "**emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md)"), diff --git a/dag/gunbc/roadmap_authority.dag b/dag/gunbc/roadmap_authority.dag index 64eed1017a6..b897b6d7bf6 100644 --- a/dag/gunbc/roadmap_authority.dag +++ b/dag/gunbc/roadmap_authority.dag @@ -78,7 +78,7 @@ fn signed(by: String, works: RedControlEvidence, scope_equivalent: HandbackEvide data namespace_kernel_authority_amendment_note: String = "THE KERNEL BAR AS FIRST WRITTEN DEADLOCKED ITS OWN SUCCESSOR, and this amendment is the fix (operator ruling, 2026-08-01). The recut landed namespace-binding-kernel with a red_control ending 'no second place in the compiler makes that same decision' and a handback demanding 'evidence that nothing else decides the same question'. That bar cannot be met while the bootstrap seed keeps its own hand-written none/one/many mirror inside the v1 adapter, and that mirror cannot be deleted until generic emission carries the canonical carrier with its required bounds. But namespace-reference-derived-closure DEPENDS on the kernel. So on the day the recut merged, the next step was already unstartable for a reason that had nothing to do with what the next step needs: deriving candidate populations does not require the seed mirror to be gone, it requires the canonical decision to EXIST and be callable.\n\nTHE CUT IS AUTHORITY VERSUS RETIREMENT. Owning the canonical decision and removing every rival implementation of it are separate achievements with separate evidence, and fusing them made an acceptance bar that no amount of correct kernel work could satisfy. The kernel now owns being the one canonical authority; namespace-legacy-choice-retirement owns deleting the older mechanisms, and the seed mirror is named there as one of its rows. A new node was deliberately NOT minted: that node already reads 'delete every other way of deciding what a name means' and already inventories every remaining place that decides, so the mirror is a row it should always have carried, and minting a sibling would have been a second home for one concept.\n\nTHE ADAPTER IS NOT THEREBY BLESSED. It remains a declared scaffold with its dissolution trigger on its own carrier, counted and visible; moving WHERE its retirement is tracked does not lower what is owed. What changes is only that a temporary bootstrap realization no longer gates work that does not depend on it.\n\nTWO ACCEPTANCE SENTENCES WERE ALSO WRONG AND ARE CORRECTED HERE. The red_control said 'a malformed name refuses', but this boundary accepts occurrence identities and derives no name spelling at all, so it named a check no implementation executes — it now reads malformed occurrence TRANSPORT. And the bar now states the two refusals that distinguish a malformed supplied population from a real verdict: a candidate handed in the wrong role refuses distinctly from one that is absent, and the same declaration supplied twice refuses as malformed rather than counting as two. Only two DISTINCT declaration identities are ambiguity. Collapsing either of those into an ordinary verdict would let a defective candidate producer read as a legitimate naming answer, which is the state-space conflation this whole lane exists to remove." -data five_minute_ci_gate_program_note: String = "PROGRAM BOUNDARY, NOT A SINGLE PR (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02). Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract — it is the distress ceiling ('this is hard / not working well'), retained only as the Stage C checkpoint bound. Six sub-lanes plus an explicit operator sequence — (1) finish #7522 warm-merge-admission with net wall receipt; (2) merge #7599 native bundle slice; (3) immediately cut over bounded production witness population to native execution kind (#7599 owner); (4) continue #7534 as materialization substrate under module-grain (hierarchy: module parse/type/interface → resolved entry → native bundle; no default CI savings until ordinary invocations consume it); (5) union CLOSED per #7533 → per-entry-assembly narrow lane; (6) this parent registration. Native-at-small-scale is SETTLED at branch head 2f9e780e6 (#7599 in-flight executing slice, dispositive at small scale per witness receipts; banking trigger = #7599 merge); open question is operational migration rate with equivalence/fallback/identity/memory fail-closed. Staged expectations (not flat 30–35min): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction in docs/plans/five-minute-ci-gate-design.md holds. Dispositions: entry-graph-union CLOSED; retention PARKED (#7581). See docs/plans/five-minute-ci-gate-design.md." +data five_minute_ci_gate_program_note: String = "PROGRAM BOUNDARY, NOT A SINGLE PR (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02). Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract — it is the distress ceiling ('this is hard / not working well'), retained only as the Stage C checkpoint bound. Six sub-lanes plus an explicit operator sequence — (1) finish #7522 warm-merge-admission with net wall receipt; (2) merge #7599 native bundle slice; (3) immediately cut over bounded production witness population to native execution kind (#7599 owner); (4) continue #7534 as materialization substrate under module-grain (hierarchy: module parse/type/interface → resolved entry → native bundle; no default CI savings until ordinary invocations consume it); (5) union CLOSED per #7533 → per-entry-assembly narrow lane; (6) this parent registration. Native-at-small-scale is SETTLED and BANKED — #7599 merged 2026-08-02 (merge 1ebff27f1e; 25/25 witness receipts executed at pre-merge head 2f9e780e6, dispositive at small scale; the banking trigger was #7599 merge, now fired); open question is operational migration rate with equivalence/fallback/identity/memory fail-closed. Staged expectations (not flat 30–35min): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction in docs/plans/five-minute-ci-gate-design.md holds. Dispositions: entry-graph-union CLOSED; retention PARKED (#7581). See docs/plans/five-minute-ci-gate-design.md." data namespace_node_recut_note: String = "THE BROAD NAMESPACE NODE WAS TOO COARSE TO CLOSE HONESTLY, and the recut is the fix (operator ruling, 2026-07-31). namespace-canonical-binding previously combined two separable things in one boundary: working out which declarations a name can see, and calling one decision function on them. A check proving only the none/one/many decision could therefore have marked the whole node accepted while candidate derivation, reference-derived dependency closure, and the production changeover all remained unbuilt — an acceptance hazard, and the exact shape of rung inflation DESIGN 4b forbids, where a carrier named for the top rung occupies the bottom one.\\n\\nThree prerequisites now stand in front of it. namespace-binding-kernel owns the decision alone, on a candidate population SUPPLIED to it. namespace-reference-derived-closure owns structural exposure, authored order, the candidate index, exact reference-to-declaration binding, and the derived dependency edges. namespace-ambiguity-discharge settles the genuinely-many cases from real compilation. namespace-canonical-binding KEEPS ITS DURABLE IDENTITY and is now the final production changeover only, so historical links resolve and no identity is reused.\\n\\nWhy the split falls exactly there: dependency edges are a PROJECTION OF THE BINDING, not a second authored statement. A program that instead authored the missing edges by hand reached 400 of 771 files at roughly one import per CI floor before it was stopped; the unresolved population was evidence that binding and module discovery are coupled at the wrong boundary, not a backlog to grind down.\\n\\nTHE CHANGEOVER AND ITS SUCCESSOR ARE DISJOINT, and an earlier revision of this recut broke that (review 45649). It retitled namespace-canonical-binding as 'switch the whole compiler over' with a boundary reading 'every place that resolves a name', which swallowed namespace-bound-only-consumers underneath it — that node's own boundary is type checking, call lookup, and argument-count checks reading the decided answer. Overlapping boundaries are the §2 redundancy this document exists to remove, and they are worse on a roadmap than in code: completing the parent would already entail most of the child, so either the child can never be honestly accepted or the parent was silently read narrower than it was written. The cut is PRODUCER versus READER. The changeover node owns the sites that WORK OUT what a name refers to, and the deletion of the search-everything fallback behind them. Its successor owns the READERS of that answer and their obligation to stop on unresolved or ambiguous. Neither entails the other, and each can be accepted on its own evidence.\\n\\nONE EDGE WAS DELIBERATELY NOT CHANGED. pderive-source-slot-binding still depends on namespace-canonical-binding, which now means it waits for the whole production changeover. It plausibly needs only occurrence transport plus the binding kernel, but that is unproven: the dependency moves only once the focused P-derive consumer demonstrates it can operate on an exact supplied candidate population. Loosening it on the strength of the argument alone would be asserting a fact nobody has measured." From 701f4435e472b5a265aa3b27ae2726d1c1eb43db Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 3 Aug 2026 01:20:13 +0000 Subject: [PATCH 7/9] WIP: pure business 8/1 --- .../native_witness_transition_receipt.dag | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 dag/gunbc/native_witness_transition_receipt.dag diff --git a/dag/gunbc/native_witness_transition_receipt.dag b/dag/gunbc/native_witness_transition_receipt.dag new file mode 100644 index 00000000000..c54331ea634 --- /dev/null +++ b/dag/gunbc/native_witness_transition_receipt.dag @@ -0,0 +1,52 @@ +module gunbc.native_witness_transition_receipt + +import std.decl_ref { DeclarationRef, decl_ref } +import std.types { CommitSha, Int, String } +import gunbc.roadmap_model { RoadmapNodeIdentity } + +data native_witness_transition_receipt_note: String = "ONE HOME FOR A MUTABLE PROGRAM STATUS, SO NO DOCUMENT HAS TO HOLD IT TWICE (operator ruling on gunbc#7710, 2026-08-02). That PR wrote the same changing observation -- native-at-small-scale evidence landed, with its pull request, merge commit, evaluated head and pass count -- independently into gunbc.roadmap_authority five_minute_ci_gate_program_note AND into gunbc.design_document, and therefore into generated DESIGN.md. Two hand-maintained copies of one advancing status is the DESIGN section 3 dual representation: someone updates one, the other silently goes stale, and both read as authoritative. The operator's split is the model here -- the DURABLE DESIGN FACT is two clauses (native-at-small-scale evidence has landed; operational migration rate remains open) and belongs in the design criteria; the pull request, merge commit, evaluated head and executed witness are EXECUTION EVIDENCE and belong in exactly one typed receipt that both documents cite.\n\nWHAT IS DELIBERATELY NOT STORED, and why the exclusion is the point. No pass count. gunbc#7710 recorded 25 of 25 witness receipts; that module declared 31 test functions less than a day later, so a transcribed count is stale before the ink dries and no oracle in this repository could have caught it. The per-member verdicts already have a single authority in std.selected_witness_bundle NativeWitnessBundleExecutionReceipt member_equivalence, produced by the run itself; a hand-typed integer beside it would be a second representation of that list. executed_evidence therefore cites the witness SYMBOL, per the DESIGN section 3 rule that a citation names the module and declaration rather than a position or a snapshot. No rendered status string either: standing is DERIVED below, never stored, so a transcribed standing is unrepresentable rather than lens-caught.\n\nTHIS IS NOT AN ACCEPTANCE AND MUST NOT BE READ AS ONE. gunbc.roadmap_model RoadmapAcceptanceReceipt remains the only fact node_accepted consults, and it requires the node's criteria digest plus executed red-control and delivered handback evidence. This receipt records that ONE piece of evidence landed under a node that is still OPEN -- for the native-selected-witness-bundle node, operational migration rate, fallback counting, artifact identity and fail-closed memory all remain open. A receipt here moves nothing on the roadmap graph.\n\nGENERALIZATION TRIGGER, named rather than pre-built (DESIGN section 6, model just-in-time): partial evidence landing under an open node is not native-witness-specific, but it has exactly one inhabitant today. On the SECOND subject needing this shape, the node identity plus landed change plus evaluated head plus cited evidence generalize into one carrier and this module becomes an instantiation; minting the general shape now would be uninhabited generality." + +type NativeSelectedWitnessTransitionReceipt { + node: RoadmapNodeIdentity + landed_pull_request: Int + landed_merge_commit: CommitSha + evaluated_head: CommitSha + executed_evidence: DeclarationRef +} + +data transition_evidence_standing_note: String = "THE HEAD THE WITNESSES RAN AT IS NOT THE COMMIT THAT LANDED THEM, AND THE DIFFERENCE IS THE WHOLE HONESTY CONTENT. gunbc#7710 carried this distinction in prose -- receipts executed at the pre-merge head, not at the merge -- which is exactly the kind of true sentence that survives only as long as its author is watching. gunbc.roadmap_verification_receipt already states the underlying law for the verification case: head A and head B are different subjects, so evidence gathered at one cannot silently impersonate evidence about the other. Deriving the standing from the two commits the receipt already carries turns that sentence into structure: a reader cannot quote an evidence run as verified-at-the-merged-tree unless the two commits actually agree, because the arm naming both commits is what the fold returns when they do not.\n\nBOTH ARMS ARE ADMISSIBLE EVIDENCE. EvidenceExecutedBeforeLanding is not a refusal and not a defect -- pre-merge execution is the normal shape of a controls-clear-then-merge sequence. It is a NAMED standing, so that the weaker claim cannot be reported as the stronger one." + +type TransitionEvidenceStanding + = EvidenceExecutedAtLandedCommit + | EvidenceExecutedBeforeLanding { + evaluated_head: CommitSha, + landed_merge_commit: CommitSha, + } + +fn transition_evidence_standing( + receipt: NativeSelectedWitnessTransitionReceipt, +) -> TransitionEvidenceStanding { + if receipt.evaluated_head == receipt.landed_merge_commit { + EvidenceExecutedAtLandedCommit + } else { + EvidenceExecutedBeforeLanding { + evaluated_head: receipt.evaluated_head, + landed_merge_commit: receipt.landed_merge_commit, + } + } +} + +data native_at_small_scale_receipt_note: String = "THE ONE INHABITANT. Subject is the durable roadmap node identity rn_2I5K7M9O1Q3R6T8V0W2X4Y7Z9A1C, the native-selected-witness-bundle node, rather than its editable slug -- the same choice gunbc.roadmap_verification_receipt VerificationSubject makes, and it matters here because a slug rename must not orphan the evidence. The landed change is gunbc#7599, merge commit 1ebff27f1e538a06edbaf6a1871bff4c10887b39. The witnesses executed at 2f9e780e6d2130680c4d9fb49739bf0c6cc7c746, the pre-merge branch head, so this receipt's derived standing is EvidenceExecutedBeforeLanding and no consumer may report it as verified at the merged tree. The cited evidence is the cutover-evidence witness in v2.test.execution.native_selected_witness_bundle, which is where the equivalence between native and interpreted execution is actually established; the timing ratio against interpreted and warm-cargo paths remains claimed-not-verified per the design note, and nothing here asserts it." + +fn native_at_small_scale_transition_receipt() -> NativeSelectedWitnessTransitionReceipt { + NativeSelectedWitnessTransitionReceipt { + node: "rn_2I5K7M9O1Q3R6T8V0W2X4Y7Z9A1C" as RoadmapNodeIdentity, + landed_pull_request: 7599, + landed_merge_commit: "1ebff27f1e538a06edbaf6a1871bff4c10887b39", + evaluated_head: "2f9e780e6d2130680c4d9fb49739bf0c6cc7c746", + executed_evidence: decl_ref( + module_path: "v2.test.execution.native_selected_witness_bundle", + decl_name: "native_selected_witness_bundle_cutover_evidence_holds", + ), + } +} From 9b408b06ff1713cd42922d3882c49799522917fd Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Mon, 3 Aug 2026 01:29:18 +0000 Subject: [PATCH 8/9] chore: regenerate drifted generated artifacts (ci auto-heal) --- DESIGN.md | 1 + 1 file changed, 1 insertion(+) diff --git a/DESIGN.md b/DESIGN.md index 7ea2f6abbd7..6042cf58ade 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -142,6 +142,7 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/` - **publication and reference-admission capabilities — carrier retirement, replacement ontology unresolved.** **Removal record (operator ruling 2026-08-01):** the Stage-0 `Publish`/`Reference` effect-grant experiment retired after its sole live publication consumer, the placement gate, was deleted. `Reference` and `Publish` were removed from `std.effect_grant.Verb`, `AudienceScopeTree` was removed, and `std.visibility_grant` plus its carrier-only witnesses were deleted; generic authorization admission re-homed onto the `std.access` kernel. This retires those carriers, not the underlying capabilities. Publication remains required, but no replacement ontology has been selected and any redesign requires operator review before implementation. Reference-edge admission — whether an edge may form within one compiled program — is a separate deferred capability awaiting a concrete consumer; the publication rollback decides nothing about it. **Stage 0 per-file placement gate DELETED:** its constant `Publish World` rows duplicated Git's post-cutover path population, four same-day repair rounds raced identical reconstructions and repeatedly redded fleet CI, ordinary modifications were invisible, and a CI check after a public push could protect merge integrity but not confidentiality because the objects had already reached public storage. New public files require no stamp. Any future confidentiality boundary must act before unauthorized bytes enter public storage — for example by withholding public-write capability from ordinary sessions — but that constraint selects no replacement architecture. The locked extension remains a **publication capability product, not a ladder**: source/interface disclosure, artifact delivery, local/remote execution, integrity, reproducibility, existence/churn disclosure, revocation/erase, and placement/trust are independent policy axes. An emitted artifact is not source disclosure but remains inspectable; client-held key means plaintext access, distinct from remote/attested key custody. Locked blobs use AEAD with subject/interface/version/audience/policy context bound as associated data plus confidentiality-and-integrity-preserving per-audience key wraps; wrong key/context/authentication is typed refusal. Per-statement holes remain refused; interface/realization is the cut; size padding and `Secret`/`Pii`→`SecretRef` construction constraints remain. Commitments never promise zero leakage: length, timing, interface shape, wrap count, access pattern, low-entropy guessing, and churn stay in a named threat model. Remote execution and SCM diagnostics obey information-flow/noninterference + explicit declassification; metering prices an oracle but does not secure it, and unauthorized audiences receive only a non-leaking diagnostic projection. Cryptographic erase is conditional on every key/wrap/backup/cache/derivative/recovery path being sanitized and the result validated, never “delete one key.” → [retired node/subtree carrier experiment](docs/plans/node-subtree-visibility-grants.md) - **effect grants over namespaces — dissolve `Hermetic | Wet` into (frame × verb × subtree).** The 2-valued `Hermetic | Wet` enum conflates four axes (input closure / replayability, output reach / interference, handler binding, selection eligibility) — a §3 state-space conflation with proto-envelopes already forked (the hand-rolled `workspace_root` containment gate, `std.resources.ResourceHandle`, `AuthScope`, `LiveTreeDisposition`). End shape (§3, cited not minted): an effect target is a position in a containment tree that already exists — filesystem paths, URIs, `/proc`, service-operation paths, and the unifying case **code names themselves** (the containment tree the namespace-resolution lane makes the single naming authority); permission is a grant of (verb × subtree) attached to a `Frame`; admissibility is the namespace prefix relation — the same `⊑` the resolver walks, content-addressing hashes, and termination reads, so effects become the **fourth consumer** of the one containment structure. Dispatch projects an `EffectRequest` through `std.access.AccessPolicy` fail-closed (`Deny` carries the typed/located/counted refusal, never a silent widen — §5); *replayable* / *isolated* / `LiveTreeDisposition` become **derived** projections, and `Hermetic | Wet | Record` survive only as named envelope presets, deleted at the end. Frame-containment is graded on the §5 construction/validation axis (`LifecycleByConstruction` vs `LifecycleByConvention`). No code lands from the design doc; the FLAG-A interim is the only near-term consumer. → [effect-namespace-grants design](docs/plans/effect-namespace-grants.md) - **shell → intent: the intent layer is language-blind (operator-aligned 2026-07-17; census/routing consolidated onto sibling authorities 2026-07-19).** §3/§4 restated for the shell case: the `.dag` intent may not name a target language — a workflow is an ordinary dependency graph over modeled operations (§4: a program is `Node`+`Edge`); *the intent IS the `.dag` graph* (operator), and `src/v2/std/orchestration.dag` `Pipeline` is optional sugar, never the authority. Two distinct downstream layers, not to be conflated: **emit** (§4 — `emit(intent, Bash)`, one grammar read backward, target as a *parameter*) and **realization** (§2 — pure-spec → host-effect, N transports `LocalShell`/`SshShell`, `dag/gunbc/host_effect_realize.dag`). **Routing (the load-bearing correction, operator review 2026-07-19): most sites do NOT emit bash.** Runtime-present sites (a gunbc runtime / typed transport is on the path) realize as typed service ops / typed transports / binary-interpreted effect-plan via `host_effect_apply` — no bash emitted (precedent already in tree: `floor_diff_observe` calls `git.Core.DiffUnified0` directly; `host_identity_converge` funnels through `host_effect_apply`); only foreign executors (GHA `run:`, cron, git hooks) and pre-runtime bootstrap windows render through the bounded v2 bash grammar rows. The authority for that routing is `authorize_shell_emission` (provisioning-window lane); the per-site residual census + arc-completion scoping is `shell-to-dag-residual-census-and-arc-completion.md` (witty-ibex-317) — DESIGN carries no parallel copy of either. **Invariant (enforceable):** the intent imports no language-construction vocab — emit-internal; `src/v2/lens/realization_vocabulary_containment.dag` confines it (LANDED #6854). The lens confines by MODULE, and naming what it actually reads is the whole point of §3's cite-the-symbol rule: `target_ast_vocab_module_prefixes` = `v2.extdeps.languages.bash`, `v2.workflow.bash`, plus `target_ast_vocab_modules` = `extdeps.languages.typescript.program`. The bash vocabulary is `v2.extdeps.languages.bash_build`'s `bash_build_*` constructors and the `v2.workflow.bash_command_fold_serialize` backend. *(Corrected 2026-07-31: this sentence previously listed the confined vocab as ``bash_build``, ``bash_command_fold_serialize``, ``the ShellStmt/ShellWord/ShellProgram coproduct``, ``serialize_bash``. The first two are real modules; the last two NAME NOTHING — the bash AST is built as generic `Node` (every `bash_build_*` fn returns `Node`), there is no ShellStmt/ShellWord/ShellProgram coproduct, and no `serialize_bash` is defined anywhere in the tree. Both were dissolved by the typed-WitnessBin migration (Phase D, 2026-07-14), which the `dag/tools/*` transport notes record and this row did not follow. The WALL WAS NEVER AFFECTED — the lens confines module prefixes, not these names, so nothing was unguarded; what rotted was the description of it, in the sentence declaring the invariant. That is the §3 positional/symbolic citation class exactly: a name-level claim in the canonical authority that a grep would have decided, sitting false while the mechanism it describes stayed correct. Found by a corpus citation sweep, not by anyone touching this row.)* Meta-exec confinement is **PARTIAL**: Wave A1 (#6900) module-isolated `shell.Exec.Run/.Check` and the import wall now has an empty exception roster; the still-open construction half is symbol/reference-level visibility that prevents allowed realization-edge modules from forming arbitrary transport values. *(Corrected 2026-07-26: this read "`host_language_transport_script` lens inert, `fail_closed_lockdown.dag`". That lens is **LIVE** — activated by #7184 as a per-PR `ReadsLiveTree` consumer that reds a new raw literal at an enrolled `Run` position — and the transport-script hole it was cited for is **closed by construction on the `ShellOnHost` route only**: `ShellOnHost.script` is the `RetainedShellScript` record and the free minter is deleted — while `shell.Exec.Run` itself still declares a transparent `TransportScript` brand over `String`, so a direct `as TransportScript` cast stays writable from any module and that sink is lens-guarded, not construction-walled (corrected 2026-07-27, `review 43600`; closing it is the meta-exec confinement milestone). The lens stays deliberately green on `ComputedApplication`, so it backstops literal blobs rather than being the wall. What remains open is the construction confinement named above, not the already-landed module-import wall.)* **Carriers → `Do{effect}` (never a command string, host-effect-orchestration.md):** the anemic `String` leaves are `host_effect.ShellCommand{script}`, `std.orchestration.Run.command`, and `host_effect.BootstrapFragment.script` — add-replacement → migrate all consumers → delete at arc close (§5 construction; `host_effect.dag` is load-bearing, the delete escalated). **Phases:** 0 sidecar delete LANDED (#6831) → 1 agnostic `While`/`BoundedPoll`/`Retry` emit PARTIAL (#6832; corrected 2026-07-26, verified against main — `While` framing has exactly one production consumer, `ci_floor_peak_emit`, whose cond and body are still raw shell strings; `BoundedPoll` has zero production construction sites, test-only; #7303 makes Retry refuse multi-step bodies, present redirect/capture, changed template log sources, and three-or-more (N-level) escalation shapes; #7318 additionally refuses every nonempty source `Run.env` while preserving empty-env emission bytes, proven by executing nonempty-refusal and empty-env accepted controls. Phase 1 remains PARTIAL only because the live `While` consumer has two raw command leaves, `BoundedPoll` is test-only, and the modeled scope still needs need-driven adoption or explicit narrowing) → 2 model runtime-present sites as typed effects on `host_effect_apply` + emit the foreign-executor/bootstrap residue → 3 wall green (bash-AST containment + meta-exec confinement). → [shell → intent design](docs/plans/shell-intent-emit-realization-design.md) +- **language and medium support completion — profiles, registry, exact frontier (DRAFT for operator review, 2026-08-02).** Every claimed target is complete for an explicit support profile or visibly partial/parked — never mostly-supported (operator: language support repeatedly reaches 80% and stops; the live specimen is `roadmap_component` carrying 2,025 hand-authored `ts_*` target-AST call sites at the product layer). Grounding receipt, executed 2026-08-02: the live-corpus containment witness `realization_vocab_live_corpus_receipt_holds` FAILS on main with three unexempted importers (`roadmap_component`, `design/theme_transition`, `effect_plan_bash_materialize`) while excluded from CI discovery AND the falsifier — the §6 coverage-by-illusion tier, executing. Program (design-note-first, no code from the note): typed registry extending `gunbc.plans.language_target_self_host_frontier`'s three-bar rows and folding in `gunbc.plans.typescript_gap_census` · exact residue census at path-and-declaration identity · no-new-debt gate (enroll the live receipt, freeze the three leaks as dissolution-triggered rows, new leak refuses) · common executed toolchain receipt generalizing `emit_host_gate` · derived status projection. Then per-profile closures: P0 typescript product-browser + web medium (site/dashboard lanes are the consumers; Rust stays under the self-host lanes, referenced never duplicated), P1 spice/verilog/python/c-accelerator, P2/P3 as registry rows. Three operator decisions surfaced: ecmascript authority, cpp profile, TsProgram terminal role. → [language-support-completion design](docs/plans/language-support-completion-design.md) - **srvN build-cache provisioning on host-standup subsumption spine.** Legacy `ctrl-sccache.service` is misconfigured; `ci_release_build_script()` absorbing fallback (`CARGO_BUILD_JOBS=1` then `-u RUSTC_WRAPPER`) masks the deficit (§5). Design anchor: provision sccache as a host-effect ensure on the assimilation spine (P1b after `RunnerDeploySlot`), generalizing srv3's `WorkflowEnsureActuatorToolchain` to srvN; `ProvisionBuildCache { catalog_id }` routes through `host_effect_apply`; verdict fold is `ProvisionConverged | ProvisionRefused` only. **PLACEMENT IS A VERDICT AXIS (landed):** sccache executes cache-miss compiles as *children of the server*, so the server's cgroup is the cgroup every compile on the host runs in — a responsive daemon proves nothing about where it runs, and collapsing the two into one `DaemonStatsOk` arm is the §5 state-space conflation that let a lazily auto-spawned server (kept alive by `SCCACHE_IDLE_TIMEOUT=0`) strand itself in a dead slot's cgroup and bound all five live slots' compiles at one slot's cap. `BuildCacheServerPlacement = ServerManagedUnitOwned | ServerRunnerOwned{slot,lifecycle} | ServerUnsupervised | ServerPlacementAbsent | ServerPlacementUnknown` gates `ProvisionConverged`; unknown placement refuses rather than assuming owned, and BOTH runner lifecycles refuse (an active slot means birth ordering failed; a retired slot means birth ordering AND retirement both failed). It is derived from an endpoint-owner observation homed with the deployed-instance model in `gunbc.build_cache_instance` (`BuildCacheInstance` = host x consumer class x instance name, distinct from the CATALOG identity `sccache_local_id`), because process name plus cgroup cannot tell a server from the transient clients every compile spawns — the owner is the process holding the LISTEN on the configured endpoint. **LIVE RECEIPT 2026-08-01 (read-only, srv1/srv2/srv3):** NO host has a unit-owned CI cache; the birth defect is fleet-wide. srv1's owner is pid 3975946, 31.2 days old, in RETIRED slot `srv1-10` (inactive+disabled) with `max 229780` / `oom_kill 12` and a live runner's `rustc` resident beside it; srv2's and srv3's owners sit in ACTIVE slots and so self-limit only because ephemeral runners recycle them. srv4 was unreachable and is carried as typed `ReachRefused`, never as absent. A measured correction landed with it: `--show-stats` does NOT auto-start a server (private-endpoint controls, both UDS and TCP, 0 to 0 listeners) — it answers plausibly with NO server in existence, so stats may only ever be supplemental data read after ownership is grounded; a real COMPILE is what spawns a server, inheriting the invoking cgroup. The budget consequence is a first-class `compile_pool` child of the host allocation tree sized by the cited jobserver authority (`jobserver_build_pool_bytes`) — a per-slot memory cap does *not* bound compile RSS — with `CompilePoolPlacement` making the pool's size derive from the declared topology rather than a fudge. STEP 2 (fallback removal) operator-sequenced after T4 live read-back. → [srvN build-cache provisioning design](docs/plans/srvn-buildcache-provisioning-design.md) · [placement step-1 live receipt](docs/plans/build-cache-placement-receipt.md) - **srv4 fleet subsumption — manual-gap receipts (2026-07-22).** srv4 was installed and subsumed through the modeled BMC virtual-media path (PR #7027: 5 runners live, rootless Docker + sccache, seeded-media boot-fidelity fixes root-caused live); every step still performed by hand is typed as a modeling gap in the registered plan `gunbc.plans.fleet_subsumption_manual_gaps` (A1 MaterializedSecret lifecycle, A2 reach-secrets ADC, A3 SecretRef liveness, B1 runner-slot provisioning, B2 runner user, B3 fresh-host prereqs, B4 install actuator), each with an acceptance bar and RED; the plan dissolves item-by-item and fully retires when srv5 subsumes with zero hand-run shell. The BMC credential-rotation gap analysis that seeded the lane: → [srv4 BMC onboarding gap](docs/plans/srv4-bmc-onboarding-gap.md) - **gunb.ai site subsumption — hosting + frontend emitted from `.dag` (operator-directed 2026-07-20).** Subsume `gunb-ai/frontend`: the public site's HTML/CSS/JS become emitted, drift-gated artifacts in this repo, published to GitHub Pages at `gunb.ai` (DNS already points at Pages IPs; cutover is Pages-config-only; the frontend repo archives). Register thesis, developed across nine operator passes and carried as a signable checklist + behavioral-intricacy law: *quiet at arm's length; responsive up close; every response true* — simplicity is a D0/D1 property, intricacy a D2/D3 property of BEHAVIOR (coverage × consistency × timing, the Discord re-read), and every intricate thing shown or answered derives from a real repo fact. Phase-0 slices LANDED under `dag/gunbc/site/` (principles → tokens → interaction → mark → constellation → moodboard → theme_transition → starlight/accent_study), proven by execution with RED controls: themes as total role→material assignments (night = warm starlight on indigo, day = indigo ink on paper, one model, two projections; totality/area/contrast witnessed), the glare envelope (bright OR chromatic, never both — the operator-rejected gamer cyan is the negative control and provably absent from emissions), still-until-touched by construction (MotionTrigger has no ambient variant), the universal theme reframe derived from the same BuildRule rows (role-routed colors cross-fade for free on one token clock; an unthemed color is a counted census row; the data-theme watcher pins the flip so the fade cannot race the UA restyle — measured, snap → 12–16-frame blend), and the accent decision grounded in `extdeps.astronomy.stellar_classification` (cited MK/Harvard table; no green stars exist so green enters only as verdigris material; M self-prunes at the envelope; candidates O/A/G/K rendered from identical fact rows). Remaining: checklist row-by-row sign-off, primitives.html at every depth, mark candidates B–D, craft-floor scales, generated-artifact registration, Pages workflow + cutover receipt (discharges the `2-stateless-frontend` milestone-A shape on the public domain). → [site subsumption design](docs/plans/gunb-ai-site-subsumption-design.md) From 724d27ad292f697a03b86cbe833c3bf48a8e582b Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Mon, 3 Aug 2026 01:45:01 +0000 Subject: [PATCH 9/9] Record the native-at-small-scale status once, in one typed receipt Operator ruling on #7710: that PR wrote the same advancing observation -- native-at-small-scale evidence landed, with its pull request, merge commit, evaluated head and pass count -- independently into gunbc.roadmap_authority five_minute_ci_gate_program_note AND into gunbc.design_document (and so into generated DESIGN.md). Two hand-maintained copies of one mutable status is the DESIGN section 3 dual representation: someone updates one, the other goes stale silently, and both read as authoritative. The split this lands is the operator's. The DURABLE DESIGN FACT is two clauses -- native-at-small-scale evidence has landed; operational migration rate remains open -- and stays in the design criteria. The pull request, merge commit, evaluated head and executing witness are EXECUTION EVIDENCE and now live in exactly one typed carrier, gunbc.native_witness_transition_receipt, which both documents cite by symbol rather than restate. No pass count is stored anywhere. #7710 recorded 25 of 25 witness receipts; that module declares 31 test functions today, so the transcribed count was stale within a day and no oracle here could have caught it. The per-member verdicts already have one authority in std.selected_witness_bundle NativeWitnessBundleExecutionReceipt member_equivalence. The receipt's standing is DERIVED, never stored: the head the witnesses ran at and the commit that landed them are different commits, so transition_evidence_standing returns EvidenceExecutedBeforeLanding naming both rather than letting pre-merge evidence be quoted as verified-at-the-merged-tree. That honesty was prose in #7710; it is structure now. This is not an acceptance. RoadmapAcceptanceReceipt remains the only fact node_accepted consults; the native-selected-witness-bundle node stays open. Co-Authored-By: Claude Opus 5 (1M context) --- DESIGN.md | 3 +- dag/gunbc/design_document.dag | 2 +- dag/gunbc/doc_graph_roots.dag | 5 +- dag/gunbc/roadmap_authority.dag | 2 +- ...itness_transition_receipt_witness_test.dag | 91 +++++++++++++++++++ 5 files changed, 99 insertions(+), 4 deletions(-) create mode 100644 dag/test/claim/native_witness_transition_receipt_witness_test.dag diff --git a/DESIGN.md b/DESIGN.md index 7ea2f6abbd7..09e0df7a276 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -127,7 +127,7 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/` - **§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites). - the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.) - floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. Slice 2 CLOSED that candidate as a no-go: three disjoint N<=50 windows and the post-merge representative/reorder receipt found zero repeated typecheck misses and an order-stable distinct-computation set inside one shared typed-cache authority. The durable law remains once-per-content-key; the one-shot ratio instrument was deleted after the merged-SHA provenance receipt. No union construction and no larger-host confirmation run follow from this hypothesis. The separate #7597 successor measures assembly on a new denominator: its exclusive, refusal-based split reproduces symbol-index merge, root symbol-index composition, import-string rewiring, closure symbol-index construction, root variant-base construction, emit-info, pool fill, and services as the priced terms, with the derived other row at 0.32% in both runs. Receipts: [slice 2 closeout](docs/plans/entry-graph-union-slice2-typecheck-attribution.md) and [per-entry assembly decomposition](docs/plans/per-entry-assembly-decomposition-measurement.md). M2: RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md) -- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled and banked** — #7599 merged 2026-08-02 (merge `1ebff27f1e`; 25/25 witness PASS executed 2026-08-01 at pre-merge head `2f9e780e6`); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` +- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale evidence has landed; operational migration rate remains open.** Which change landed it, at which merge commit, at which evaluated head, and under which executing witness are *execution evidence*, carried in one typed receipt (`gunbc.native_witness_transition_receipt` `native_at_small_scale_transition_receipt`) that this document cites rather than restates — a design criterion embedding a SHA or a pass count has to be edited every time the world moves, and a second hand-maintained copy of one advancing status goes stale silently (operator ruling on #7710, 2026-08-02). Timing ratio remains claimed-not-verified per the design note. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag` - **#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md) - **v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md) - **emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md) @@ -142,6 +142,7 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/` - **publication and reference-admission capabilities — carrier retirement, replacement ontology unresolved.** **Removal record (operator ruling 2026-08-01):** the Stage-0 `Publish`/`Reference` effect-grant experiment retired after its sole live publication consumer, the placement gate, was deleted. `Reference` and `Publish` were removed from `std.effect_grant.Verb`, `AudienceScopeTree` was removed, and `std.visibility_grant` plus its carrier-only witnesses were deleted; generic authorization admission re-homed onto the `std.access` kernel. This retires those carriers, not the underlying capabilities. Publication remains required, but no replacement ontology has been selected and any redesign requires operator review before implementation. Reference-edge admission — whether an edge may form within one compiled program — is a separate deferred capability awaiting a concrete consumer; the publication rollback decides nothing about it. **Stage 0 per-file placement gate DELETED:** its constant `Publish World` rows duplicated Git's post-cutover path population, four same-day repair rounds raced identical reconstructions and repeatedly redded fleet CI, ordinary modifications were invisible, and a CI check after a public push could protect merge integrity but not confidentiality because the objects had already reached public storage. New public files require no stamp. Any future confidentiality boundary must act before unauthorized bytes enter public storage — for example by withholding public-write capability from ordinary sessions — but that constraint selects no replacement architecture. The locked extension remains a **publication capability product, not a ladder**: source/interface disclosure, artifact delivery, local/remote execution, integrity, reproducibility, existence/churn disclosure, revocation/erase, and placement/trust are independent policy axes. An emitted artifact is not source disclosure but remains inspectable; client-held key means plaintext access, distinct from remote/attested key custody. Locked blobs use AEAD with subject/interface/version/audience/policy context bound as associated data plus confidentiality-and-integrity-preserving per-audience key wraps; wrong key/context/authentication is typed refusal. Per-statement holes remain refused; interface/realization is the cut; size padding and `Secret`/`Pii`→`SecretRef` construction constraints remain. Commitments never promise zero leakage: length, timing, interface shape, wrap count, access pattern, low-entropy guessing, and churn stay in a named threat model. Remote execution and SCM diagnostics obey information-flow/noninterference + explicit declassification; metering prices an oracle but does not secure it, and unauthorized audiences receive only a non-leaking diagnostic projection. Cryptographic erase is conditional on every key/wrap/backup/cache/derivative/recovery path being sanitized and the result validated, never “delete one key.” → [retired node/subtree carrier experiment](docs/plans/node-subtree-visibility-grants.md) - **effect grants over namespaces — dissolve `Hermetic | Wet` into (frame × verb × subtree).** The 2-valued `Hermetic | Wet` enum conflates four axes (input closure / replayability, output reach / interference, handler binding, selection eligibility) — a §3 state-space conflation with proto-envelopes already forked (the hand-rolled `workspace_root` containment gate, `std.resources.ResourceHandle`, `AuthScope`, `LiveTreeDisposition`). End shape (§3, cited not minted): an effect target is a position in a containment tree that already exists — filesystem paths, URIs, `/proc`, service-operation paths, and the unifying case **code names themselves** (the containment tree the namespace-resolution lane makes the single naming authority); permission is a grant of (verb × subtree) attached to a `Frame`; admissibility is the namespace prefix relation — the same `⊑` the resolver walks, content-addressing hashes, and termination reads, so effects become the **fourth consumer** of the one containment structure. Dispatch projects an `EffectRequest` through `std.access.AccessPolicy` fail-closed (`Deny` carries the typed/located/counted refusal, never a silent widen — §5); *replayable* / *isolated* / `LiveTreeDisposition` become **derived** projections, and `Hermetic | Wet | Record` survive only as named envelope presets, deleted at the end. Frame-containment is graded on the §5 construction/validation axis (`LifecycleByConstruction` vs `LifecycleByConvention`). No code lands from the design doc; the FLAG-A interim is the only near-term consumer. → [effect-namespace-grants design](docs/plans/effect-namespace-grants.md) - **shell → intent: the intent layer is language-blind (operator-aligned 2026-07-17; census/routing consolidated onto sibling authorities 2026-07-19).** §3/§4 restated for the shell case: the `.dag` intent may not name a target language — a workflow is an ordinary dependency graph over modeled operations (§4: a program is `Node`+`Edge`); *the intent IS the `.dag` graph* (operator), and `src/v2/std/orchestration.dag` `Pipeline` is optional sugar, never the authority. Two distinct downstream layers, not to be conflated: **emit** (§4 — `emit(intent, Bash)`, one grammar read backward, target as a *parameter*) and **realization** (§2 — pure-spec → host-effect, N transports `LocalShell`/`SshShell`, `dag/gunbc/host_effect_realize.dag`). **Routing (the load-bearing correction, operator review 2026-07-19): most sites do NOT emit bash.** Runtime-present sites (a gunbc runtime / typed transport is on the path) realize as typed service ops / typed transports / binary-interpreted effect-plan via `host_effect_apply` — no bash emitted (precedent already in tree: `floor_diff_observe` calls `git.Core.DiffUnified0` directly; `host_identity_converge` funnels through `host_effect_apply`); only foreign executors (GHA `run:`, cron, git hooks) and pre-runtime bootstrap windows render through the bounded v2 bash grammar rows. The authority for that routing is `authorize_shell_emission` (provisioning-window lane); the per-site residual census + arc-completion scoping is `shell-to-dag-residual-census-and-arc-completion.md` (witty-ibex-317) — DESIGN carries no parallel copy of either. **Invariant (enforceable):** the intent imports no language-construction vocab — emit-internal; `src/v2/lens/realization_vocabulary_containment.dag` confines it (LANDED #6854). The lens confines by MODULE, and naming what it actually reads is the whole point of §3's cite-the-symbol rule: `target_ast_vocab_module_prefixes` = `v2.extdeps.languages.bash`, `v2.workflow.bash`, plus `target_ast_vocab_modules` = `extdeps.languages.typescript.program`. The bash vocabulary is `v2.extdeps.languages.bash_build`'s `bash_build_*` constructors and the `v2.workflow.bash_command_fold_serialize` backend. *(Corrected 2026-07-31: this sentence previously listed the confined vocab as ``bash_build``, ``bash_command_fold_serialize``, ``the ShellStmt/ShellWord/ShellProgram coproduct``, ``serialize_bash``. The first two are real modules; the last two NAME NOTHING — the bash AST is built as generic `Node` (every `bash_build_*` fn returns `Node`), there is no ShellStmt/ShellWord/ShellProgram coproduct, and no `serialize_bash` is defined anywhere in the tree. Both were dissolved by the typed-WitnessBin migration (Phase D, 2026-07-14), which the `dag/tools/*` transport notes record and this row did not follow. The WALL WAS NEVER AFFECTED — the lens confines module prefixes, not these names, so nothing was unguarded; what rotted was the description of it, in the sentence declaring the invariant. That is the §3 positional/symbolic citation class exactly: a name-level claim in the canonical authority that a grep would have decided, sitting false while the mechanism it describes stayed correct. Found by a corpus citation sweep, not by anyone touching this row.)* Meta-exec confinement is **PARTIAL**: Wave A1 (#6900) module-isolated `shell.Exec.Run/.Check` and the import wall now has an empty exception roster; the still-open construction half is symbol/reference-level visibility that prevents allowed realization-edge modules from forming arbitrary transport values. *(Corrected 2026-07-26: this read "`host_language_transport_script` lens inert, `fail_closed_lockdown.dag`". That lens is **LIVE** — activated by #7184 as a per-PR `ReadsLiveTree` consumer that reds a new raw literal at an enrolled `Run` position — and the transport-script hole it was cited for is **closed by construction on the `ShellOnHost` route only**: `ShellOnHost.script` is the `RetainedShellScript` record and the free minter is deleted — while `shell.Exec.Run` itself still declares a transparent `TransportScript` brand over `String`, so a direct `as TransportScript` cast stays writable from any module and that sink is lens-guarded, not construction-walled (corrected 2026-07-27, `review 43600`; closing it is the meta-exec confinement milestone). The lens stays deliberately green on `ComputedApplication`, so it backstops literal blobs rather than being the wall. What remains open is the construction confinement named above, not the already-landed module-import wall.)* **Carriers → `Do{effect}` (never a command string, host-effect-orchestration.md):** the anemic `String` leaves are `host_effect.ShellCommand{script}`, `std.orchestration.Run.command`, and `host_effect.BootstrapFragment.script` — add-replacement → migrate all consumers → delete at arc close (§5 construction; `host_effect.dag` is load-bearing, the delete escalated). **Phases:** 0 sidecar delete LANDED (#6831) → 1 agnostic `While`/`BoundedPoll`/`Retry` emit PARTIAL (#6832; corrected 2026-07-26, verified against main — `While` framing has exactly one production consumer, `ci_floor_peak_emit`, whose cond and body are still raw shell strings; `BoundedPoll` has zero production construction sites, test-only; #7303 makes Retry refuse multi-step bodies, present redirect/capture, changed template log sources, and three-or-more (N-level) escalation shapes; #7318 additionally refuses every nonempty source `Run.env` while preserving empty-env emission bytes, proven by executing nonempty-refusal and empty-env accepted controls. Phase 1 remains PARTIAL only because the live `While` consumer has two raw command leaves, `BoundedPoll` is test-only, and the modeled scope still needs need-driven adoption or explicit narrowing) → 2 model runtime-present sites as typed effects on `host_effect_apply` + emit the foreign-executor/bootstrap residue → 3 wall green (bash-AST containment + meta-exec confinement). → [shell → intent design](docs/plans/shell-intent-emit-realization-design.md) +- **language and medium support completion — profiles, registry, exact frontier (DRAFT for operator review, 2026-08-02).** Every claimed target is complete for an explicit support profile or visibly partial/parked — never mostly-supported (operator: language support repeatedly reaches 80% and stops; the live specimen is `roadmap_component` carrying 2,025 hand-authored `ts_*` target-AST call sites at the product layer). Grounding receipt, executed 2026-08-02: the live-corpus containment witness `realization_vocab_live_corpus_receipt_holds` FAILS on main with three unexempted importers (`roadmap_component`, `design/theme_transition`, `effect_plan_bash_materialize`) while excluded from CI discovery AND the falsifier — the §6 coverage-by-illusion tier, executing. Program (design-note-first, no code from the note): typed registry extending `gunbc.plans.language_target_self_host_frontier`'s three-bar rows and folding in `gunbc.plans.typescript_gap_census` · exact residue census at path-and-declaration identity · no-new-debt gate (enroll the live receipt, freeze the three leaks as dissolution-triggered rows, new leak refuses) · common executed toolchain receipt generalizing `emit_host_gate` · derived status projection. Then per-profile closures: P0 typescript product-browser + web medium (site/dashboard lanes are the consumers; Rust stays under the self-host lanes, referenced never duplicated), P1 spice/verilog/python/c-accelerator, P2/P3 as registry rows. Three operator decisions surfaced: ecmascript authority, cpp profile, TsProgram terminal role. → [language-support-completion design](docs/plans/language-support-completion-design.md) - **srvN build-cache provisioning on host-standup subsumption spine.** Legacy `ctrl-sccache.service` is misconfigured; `ci_release_build_script()` absorbing fallback (`CARGO_BUILD_JOBS=1` then `-u RUSTC_WRAPPER`) masks the deficit (§5). Design anchor: provision sccache as a host-effect ensure on the assimilation spine (P1b after `RunnerDeploySlot`), generalizing srv3's `WorkflowEnsureActuatorToolchain` to srvN; `ProvisionBuildCache { catalog_id }` routes through `host_effect_apply`; verdict fold is `ProvisionConverged | ProvisionRefused` only. **PLACEMENT IS A VERDICT AXIS (landed):** sccache executes cache-miss compiles as *children of the server*, so the server's cgroup is the cgroup every compile on the host runs in — a responsive daemon proves nothing about where it runs, and collapsing the two into one `DaemonStatsOk` arm is the §5 state-space conflation that let a lazily auto-spawned server (kept alive by `SCCACHE_IDLE_TIMEOUT=0`) strand itself in a dead slot's cgroup and bound all five live slots' compiles at one slot's cap. `BuildCacheServerPlacement = ServerManagedUnitOwned | ServerRunnerOwned{slot,lifecycle} | ServerUnsupervised | ServerPlacementAbsent | ServerPlacementUnknown` gates `ProvisionConverged`; unknown placement refuses rather than assuming owned, and BOTH runner lifecycles refuse (an active slot means birth ordering failed; a retired slot means birth ordering AND retirement both failed). It is derived from an endpoint-owner observation homed with the deployed-instance model in `gunbc.build_cache_instance` (`BuildCacheInstance` = host x consumer class x instance name, distinct from the CATALOG identity `sccache_local_id`), because process name plus cgroup cannot tell a server from the transient clients every compile spawns — the owner is the process holding the LISTEN on the configured endpoint. **LIVE RECEIPT 2026-08-01 (read-only, srv1/srv2/srv3):** NO host has a unit-owned CI cache; the birth defect is fleet-wide. srv1's owner is pid 3975946, 31.2 days old, in RETIRED slot `srv1-10` (inactive+disabled) with `max 229780` / `oom_kill 12` and a live runner's `rustc` resident beside it; srv2's and srv3's owners sit in ACTIVE slots and so self-limit only because ephemeral runners recycle them. srv4 was unreachable and is carried as typed `ReachRefused`, never as absent. A measured correction landed with it: `--show-stats` does NOT auto-start a server (private-endpoint controls, both UDS and TCP, 0 to 0 listeners) — it answers plausibly with NO server in existence, so stats may only ever be supplemental data read after ownership is grounded; a real COMPILE is what spawns a server, inheriting the invoking cgroup. The budget consequence is a first-class `compile_pool` child of the host allocation tree sized by the cited jobserver authority (`jobserver_build_pool_bytes`) — a per-slot memory cap does *not* bound compile RSS — with `CompilePoolPlacement` making the pool's size derive from the declared topology rather than a fudge. STEP 2 (fallback removal) operator-sequenced after T4 live read-back. → [srvN build-cache provisioning design](docs/plans/srvn-buildcache-provisioning-design.md) · [placement step-1 live receipt](docs/plans/build-cache-placement-receipt.md) - **srv4 fleet subsumption — manual-gap receipts (2026-07-22).** srv4 was installed and subsumed through the modeled BMC virtual-media path (PR #7027: 5 runners live, rootless Docker + sccache, seeded-media boot-fidelity fixes root-caused live); every step still performed by hand is typed as a modeling gap in the registered plan `gunbc.plans.fleet_subsumption_manual_gaps` (A1 MaterializedSecret lifecycle, A2 reach-secrets ADC, A3 SecretRef liveness, B1 runner-slot provisioning, B2 runner user, B3 fresh-host prereqs, B4 install actuator), each with an acceptance bar and RED; the plan dissolves item-by-item and fully retires when srv5 subsumes with zero hand-run shell. The BMC credential-rotation gap analysis that seeded the lane: → [srv4 BMC onboarding gap](docs/plans/srv4-bmc-onboarding-gap.md) - **gunb.ai site subsumption — hosting + frontend emitted from `.dag` (operator-directed 2026-07-20).** Subsume `gunb-ai/frontend`: the public site's HTML/CSS/JS become emitted, drift-gated artifacts in this repo, published to GitHub Pages at `gunb.ai` (DNS already points at Pages IPs; cutover is Pages-config-only; the frontend repo archives). Register thesis, developed across nine operator passes and carried as a signable checklist + behavioral-intricacy law: *quiet at arm's length; responsive up close; every response true* — simplicity is a D0/D1 property, intricacy a D2/D3 property of BEHAVIOR (coverage × consistency × timing, the Discord re-read), and every intricate thing shown or answered derives from a real repo fact. Phase-0 slices LANDED under `dag/gunbc/site/` (principles → tokens → interaction → mark → constellation → moodboard → theme_transition → starlight/accent_study), proven by execution with RED controls: themes as total role→material assignments (night = warm starlight on indigo, day = indigo ink on paper, one model, two projections; totality/area/contrast witnessed), the glare envelope (bright OR chromatic, never both — the operator-rejected gamer cyan is the negative control and provably absent from emissions), still-until-touched by construction (MotionTrigger has no ambient variant), the universal theme reframe derived from the same BuildRule rows (role-routed colors cross-fade for free on one token clock; an unthemed color is a counted census row; the data-theme watcher pins the flip so the fade cannot race the UA restyle — measured, snap → 12–16-frame blend), and the accent decision grounded in `extdeps.astronomy.stellar_classification` (cited MK/Harvard table; no green stars exist so green enters only as verdigris material; M self-prunes at the envelope; candidates O/A/G/K rendered from identical fact rows). Remaining: checklist row-by-row sign-off, primitives.html at every depth, mark candidates B–D, craft-floor scales, generated-artifact registration, Pages workflow + cutover receipt (discharges the `2-stateless-frontend` milestone-A shape on the public domain). → [site subsumption design](docs/plans/gunb-ai-site-subsumption-design.md) diff --git a/dag/gunbc/design_document.dag b/dag/gunbc/design_document.dag index 88e61ebc7d1..854aaac567c 100644 --- a/dag/gunbc/design_document.dag +++ b/dag/gunbc/design_document.dag @@ -162,7 +162,7 @@ fn open_threads_blocks() -> List { li(text: "**§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites)."), li(text: "the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.)"), li(text: "floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. Slice 2 CLOSED that candidate as a no-go: three disjoint N<=50 windows and the post-merge representative/reorder receipt found zero repeated typecheck misses and an order-stable distinct-computation set inside one shared typed-cache authority. The durable law remains once-per-content-key; the one-shot ratio instrument was deleted after the merged-SHA provenance receipt. No union construction and no larger-host confirmation run follow from this hypothesis. The separate #7597 successor measures assembly on a new denominator: its exclusive, refusal-based split reproduces symbol-index merge, root symbol-index composition, import-string rewiring, closure symbol-index construction, root variant-base construction, emit-info, pool fill, and services as the priced terms, with the derived other row at 0.32% in both runs. Receipts: [slice 2 closeout](docs/plans/entry-graph-union-slice2-typecheck-attribution.md) and [per-entry assembly decomposition](docs/plans/per-entry-assembly-decomposition-measurement.md). M2: RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md)"), - li(text: "**five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled and banked** — #7599 merged 2026-08-02 (merge `1ebff27f1e`; 25/25 witness PASS executed 2026-08-01 at pre-merge head `2f9e780e6`); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`"), + li(text: "**five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale evidence has landed; operational migration rate remains open.** Which change landed it, at which merge commit, at which evaluated head, and under which executing witness are *execution evidence*, carried in one typed receipt (`gunbc.native_witness_transition_receipt` `native_at_small_scale_transition_receipt`) that this document cites rather than restates — a design criterion embedding a SHA or a pass count has to be edited every time the world moves, and a second hand-maintained copy of one advancing status goes stale silently (operator ruling on #7710, 2026-08-02). Timing ratio remains claimed-not-verified per the design note. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`"), li(text: "**#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md)"), li(text: "**v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md)"), li(text: "**emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md)"), diff --git a/dag/gunbc/doc_graph_roots.dag b/dag/gunbc/doc_graph_roots.dag index 124350e8328..08bdfd2d80b 100644 --- a/dag/gunbc/doc_graph_roots.dag +++ b/dag/gunbc/doc_graph_roots.dag @@ -95,7 +95,10 @@ data hand_authored_doc_binds: List = [ home: PlanDoc, slug: "five-minute-ci-gate-design", primary_work: DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "five_minute_ci_gate_program_note", field: WholeDeclaration }, - additional_works: [DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "roadmap_authority_for", field: WholeDeclaration }], + additional_works: [ + DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "roadmap_authority_for", field: WholeDeclaration }, + DeclarationRef { module_path: "gunbc.native_witness_transition_receipt", decl_name: "native_at_small_scale_transition_receipt", field: WholeDeclaration }, + ], dissolution: HasTrigger { text: "every sub-lane row is accepted or honestly retired and the program parent five-minute-ci-gate is accepted on fleet receipts showing a representative leaf .dag PR at ≤5 minutes wall with byte-identical verdicts vs a cold recompute control — or the operator recuts the program and this note is superseded by a registered plan row." }, }, HandAuthoredDocBind { diff --git a/dag/gunbc/roadmap_authority.dag b/dag/gunbc/roadmap_authority.dag index 2dfdb8f7af4..925e94a50ee 100644 --- a/dag/gunbc/roadmap_authority.dag +++ b/dag/gunbc/roadmap_authority.dag @@ -78,7 +78,7 @@ fn signed(by: String, works: RedControlEvidence, scope_equivalent: HandbackEvide data namespace_kernel_authority_amendment_note: String = "THE KERNEL BAR AS FIRST WRITTEN DEADLOCKED ITS OWN SUCCESSOR, and this amendment is the fix (operator ruling, 2026-08-01). The recut landed namespace-binding-kernel with a red_control ending 'no second place in the compiler makes that same decision' and a handback demanding 'evidence that nothing else decides the same question'. That bar cannot be met while the bootstrap seed keeps its own hand-written none/one/many mirror inside the v1 adapter, and that mirror cannot be deleted until generic emission carries the canonical carrier with its required bounds. But namespace-reference-derived-closure DEPENDS on the kernel. So on the day the recut merged, the next step was already unstartable for a reason that had nothing to do with what the next step needs: deriving candidate populations does not require the seed mirror to be gone, it requires the canonical decision to EXIST and be callable.\n\nTHE CUT IS AUTHORITY VERSUS RETIREMENT. Owning the canonical decision and removing every rival implementation of it are separate achievements with separate evidence, and fusing them made an acceptance bar that no amount of correct kernel work could satisfy. The kernel now owns being the one canonical authority; namespace-legacy-choice-retirement owns deleting the older mechanisms, and the seed mirror is named there as one of its rows. A new node was deliberately NOT minted: that node already reads 'delete every other way of deciding what a name means' and already inventories every remaining place that decides, so the mirror is a row it should always have carried, and minting a sibling would have been a second home for one concept.\n\nTHE ADAPTER IS NOT THEREBY BLESSED. It remains a declared scaffold with its dissolution trigger on its own carrier, counted and visible; moving WHERE its retirement is tracked does not lower what is owed. What changes is only that a temporary bootstrap realization no longer gates work that does not depend on it.\n\nTWO ACCEPTANCE SENTENCES WERE ALSO WRONG AND ARE CORRECTED HERE. The red_control said 'a malformed name refuses', but this boundary accepts occurrence identities and derives no name spelling at all, so it named a check no implementation executes — it now reads malformed occurrence TRANSPORT. And the bar now states the two refusals that distinguish a malformed supplied population from a real verdict: a candidate handed in the wrong role refuses distinctly from one that is absent, and the same declaration supplied twice refuses as malformed rather than counting as two. Only two DISTINCT declaration identities are ambiguity. Collapsing either of those into an ordinary verdict would let a defective candidate producer read as a legitimate naming answer, which is the state-space conflation this whole lane exists to remove." -data five_minute_ci_gate_program_note: String = "PROGRAM BOUNDARY, NOT A SINGLE PR (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02). Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract — it is the distress ceiling ('this is hard / not working well'), retained only as the Stage C checkpoint bound. Six sub-lanes plus an explicit operator sequence — (1) finish #7522 warm-merge-admission with net wall receipt; (2) merge #7599 native bundle slice; (3) immediately cut over bounded production witness population to native execution kind (#7599 owner); (4) continue #7534 as materialization substrate under module-grain (hierarchy: module parse/type/interface → resolved entry → native bundle; no default CI savings until ordinary invocations consume it); (5) union CLOSED per #7533 → per-entry-assembly narrow lane; (6) this parent registration. Native-at-small-scale is SETTLED and BANKED — #7599 merged 2026-08-02 (merge 1ebff27f1e; 25/25 witness receipts executed at pre-merge head 2f9e780e6, dispositive at small scale; the banking trigger was #7599 merge, now fired); open question is operational migration rate with equivalence/fallback/identity/memory fail-closed. Staged expectations (not flat 30–35min): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction in docs/plans/five-minute-ci-gate-design.md holds. Dispositions: entry-graph-union CLOSED; retention PARKED (#7581). See docs/plans/five-minute-ci-gate-design.md." +data five_minute_ci_gate_program_note: String = "PROGRAM BOUNDARY, NOT A SINGLE PR (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02). Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract — it is the distress ceiling ('this is hard / not working well'), retained only as the Stage C checkpoint bound. Six sub-lanes plus an explicit operator sequence — (1) finish #7522 warm-merge-admission with net wall receipt; (2) merge #7599 native bundle slice; (3) immediately cut over bounded production witness population to native execution kind (#7599 owner); (4) continue #7534 as materialization substrate under module-grain (hierarchy: module parse/type/interface → resolved entry → native bundle; no default CI savings until ordinary invocations consume it); (5) union CLOSED per #7533 → per-entry-assembly narrow lane; (6) this parent registration. Native-at-small-scale evidence has LANDED; operational migration rate remains OPEN with equivalence/fallback/identity/memory fail-closed. The landed change, its merge commit, the head the witnesses actually executed at, and the cited executing witness are execution evidence, not design criteria: they live in ONE typed receipt, gunbc.native_witness_transition_receipt native_at_small_scale_transition_receipt, and are restated neither here nor in gunbc.design_document (operator ruling on gunbc#7710, 2026-08-02 — this note and the design document previously carried independent hand-maintained copies of the same advancing status). Staged expectations (not flat 30–35min): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction in docs/plans/five-minute-ci-gate-design.md holds. Dispositions: entry-graph-union CLOSED; retention PARKED (#7581). See docs/plans/five-minute-ci-gate-design.md." data namespace_node_recut_note: String = "THE BROAD NAMESPACE NODE WAS TOO COARSE TO CLOSE HONESTLY, and the recut is the fix (operator ruling, 2026-07-31). namespace-canonical-binding previously combined two separable things in one boundary: working out which declarations a name can see, and calling one decision function on them. A check proving only the none/one/many decision could therefore have marked the whole node accepted while candidate derivation, reference-derived dependency closure, and the production changeover all remained unbuilt — an acceptance hazard, and the exact shape of rung inflation DESIGN 4b forbids, where a carrier named for the top rung occupies the bottom one.\\n\\nThree prerequisites now stand in front of it. namespace-binding-kernel owns the decision alone, on a candidate population SUPPLIED to it. namespace-reference-derived-closure owns structural exposure, authored order, the candidate index, exact reference-to-declaration binding, and the derived dependency edges. namespace-ambiguity-discharge settles the genuinely-many cases from real compilation. namespace-canonical-binding KEEPS ITS DURABLE IDENTITY and is now the final production changeover only, so historical links resolve and no identity is reused.\\n\\nWhy the split falls exactly there: dependency edges are a PROJECTION OF THE BINDING, not a second authored statement. A program that instead authored the missing edges by hand reached 400 of 771 files at roughly one import per CI floor before it was stopped; the unresolved population was evidence that binding and module discovery are coupled at the wrong boundary, not a backlog to grind down.\\n\\nTHE CHANGEOVER AND ITS SUCCESSOR ARE DISJOINT, and an earlier revision of this recut broke that (review 45649). It retitled namespace-canonical-binding as 'switch the whole compiler over' with a boundary reading 'every place that resolves a name', which swallowed namespace-bound-only-consumers underneath it — that node's own boundary is type checking, call lookup, and argument-count checks reading the decided answer. Overlapping boundaries are the §2 redundancy this document exists to remove, and they are worse on a roadmap than in code: completing the parent would already entail most of the child, so either the child can never be honestly accepted or the parent was silently read narrower than it was written. The cut is PRODUCER versus READER. The changeover node owns the sites that WORK OUT what a name refers to, and the deletion of the search-everything fallback behind them. Its successor owns the READERS of that answer and their obligation to stop on unresolved or ambiguous. Neither entails the other, and each can be accepted on its own evidence.\\n\\nONE EDGE WAS DELIBERATELY NOT CHANGED. pderive-source-slot-binding still depends on namespace-canonical-binding, which now means it waits for the whole production changeover. It plausibly needs only occurrence transport plus the binding kernel, but that is unproven: the dependency moves only once the focused P-derive consumer demonstrates it can operate on an exact supplied candidate population. Loosening it on the strength of the argument alone would be asserting a fact nobody has measured." diff --git a/dag/test/claim/native_witness_transition_receipt_witness_test.dag b/dag/test/claim/native_witness_transition_receipt_witness_test.dag new file mode 100644 index 00000000000..d30a1c26464 --- /dev/null +++ b/dag/test/claim/native_witness_transition_receipt_witness_test.dag @@ -0,0 +1,91 @@ +module test.claim.native_witness_transition_receipt_witness + +import std.decl_ref { decl_ref } +import std.types { Bool, Int, String } +import gunbc.roadmap_authority { declared_roadmap_nodes } +import gunbc.roadmap_model { RoadmapNodeIdentity } +import gunbc.native_witness_transition_receipt { + NativeSelectedWitnessTransitionReceipt, + TransitionEvidenceStanding, + EvidenceExecutedAtLandedCommit, + EvidenceExecutedBeforeLanding, + transition_evidence_standing, + native_at_small_scale_transition_receipt, +} + +data native_witness_transition_witness_note: String = "THE TWO STANDING ARMS ARE ASSERTED TOGETHER ON PURPOSE. Either arm alone would pass against a fold that ignored its inputs and returned a constant; asserting both means no constant implementation survives, which is what makes the pair discriminating rather than decorative. The subject join is the second independent question -- a receipt naming a node identity nothing declares is evidence about nobody -- and its RED plants a fabricated identity so the join is proven capable of returning zero. That control is not hypothetical: drafting this receipt first transcribed the node identity as rn_2I5K7M9O1Q3S5T8V0W2X4Y7Z9A1C, one character off the declared rn_2I5K7M9O1Q3R6T8V0W2X4Y7Z9A1C, and the join is what catches that class." + +fn planted_receipt( + identity: String, + merge_commit: String, + evaluated_head: String, +) -> NativeSelectedWitnessTransitionReceipt { + NativeSelectedWitnessTransitionReceipt { + node: identity as RoadmapNodeIdentity, + landed_pull_request: 1, + landed_merge_commit: merge_commit, + evaluated_head: evaluated_head, + executed_evidence: decl_ref( + module_path: "test.claim.native_witness_transition_receipt_witness", + decl_name: "planted_receipt", + ), + } +} + +fn standing_is_before_landing(standing: TransitionEvidenceStanding) -> Bool { + match standing { + EvidenceExecutedBeforeLanding { evaluated_head: _, landed_merge_commit: _ } => true + EvidenceExecutedAtLandedCommit => false + } +} + +fn standing_names_both_commits( + standing: TransitionEvidenceStanding, + expected_head: String, + expected_merge: String, +) -> Bool { + match standing { + EvidenceExecutedBeforeLanding { evaluated_head, landed_merge_commit } => + evaluated_head == expected_head && landed_merge_commit == expected_merge + EvidenceExecutedAtLandedCommit => false + } +} + +fn declared_nodes_carrying_identity(identity: String) -> Int { + declared_roadmap_nodes() + |> filter(n => (n.identity as String) == identity) + |> count +} + +test fn native_at_small_scale_evidence_stands_as_executed_before_landing() -> Bool { + let receipt = native_at_small_scale_transition_receipt() + let standing = transition_evidence_standing(receipt: receipt) + return standing_is_before_landing(standing: standing) + && standing_names_both_commits( + standing: standing, + expected_head: "2f9e780e6d2130680c4d9fb49739bf0c6cc7c746", + expected_merge: "1ebff27f1e538a06edbaf6a1871bff4c10887b39", + ) +} + +test fn evidence_executed_at_the_landed_commit_is_the_other_standing() -> Bool { + let receipt = planted_receipt( + identity: "rn_2I5K7M9O1Q3R6T8V0W2X4Y7Z9A1C", + merge_commit: "1ebff27f1e538a06edbaf6a1871bff4c10887b39", + evaluated_head: "1ebff27f1e538a06edbaf6a1871bff4c10887b39", + ) + return !standing_is_before_landing( + standing: transition_evidence_standing(receipt: receipt), + ) +} + +test fn receipt_subject_joins_exactly_one_declared_roadmap_node() -> Bool { + let receipt = native_at_small_scale_transition_receipt() + return declared_nodes_carrying_identity(identity: receipt.node as String) == 1 +} + +test fn a_fabricated_subject_identity_joins_no_declared_node() -> Bool { + return declared_nodes_carrying_identity( + identity: "rn_2I5K7M9O1Q3S5T8V0W2X4Y7Z9A1C", + ) == 0 +}