Lane 1: exact-head frontier survey (provenance scaffolding — authoritative run on hold)

[briansrls]

Summary

Exact-head closeout scaffolding for all 27 compiler frontier modules — last in chain. Vocabulary split landed in #7776 (merged). #7762 merged (1ef330f4b). This PR lands provenance infrastructure; the authoritative 27/27 run remains on operator hold (escalating release).

Models survey pinning as FrontierSurveySubject + FrontierSurveyManifest (typed CommitSha, GitObjectId tree, Sha256Digest executable, Fnv1a64Structural source-roots digest, ContentHash probe-policy revision). Totality witnesses consume the manifest subject — empty metadata no longer passes.

Provenance — three lists (not one table of caveats):

Closed (mechanism landed, witness-backed):

• Hole 1 — commit↔tree binding: resolve_survey_subject refuses dirty worktree before survey; frontier_survey_commit_tree_binding_holds proves source_tree == tree(source_commit) via git.Inspect.ShowTree.
• Hole 2 — local build provenance: build.rs embeds BUILD_COMMIT, BUILD_TREE, and BUILD_DIRTY (git status --porcelain; git failure → unwrap_or(true) assumes dirty). verify_build_provenance refuses missing/empty stamps, commit/tree mismatch, and dirty-worktree builds.
• Hole 3 — no mixed-head relabel on seed TSV path: all five subject fields per row including probe_policy_revision; subjects_equal compares all five; load_probe_rows_from_tsv refuses SurveySubjectMismatch; manifest emits measured revision literal (not frontier_probe_policy_revision() relabel).

Residual (closed at current grain; named next trigger):

• Hole 2: cross-machine binary provenance — local build only; a binary built elsewhere is not proven by the embedded stamp.
• Hole 3: per-row subject equality is enforced by the seed bin loader only — FrontierProbeReceipt has no subject field; honest next trigger is subject-on-receipt (frontier_survey_subject_grounding_note).

Still open (not closed by this PR):

• Cross-machine binary provenance (hole 2 residual above).
• Structural per-row subject on FrontierProbeReceipt (hole 3 residual above).

frontier_probe_survey refuses on dirty tree, failed git observation, build-provenance skew, or dirty-build stamp.

Chain (last of four): #7776 (merged) → #7762 (merged) → #7767 diagnostic detail (open, preferred before authoritative run) → one authoritative 27/27 here.

Hold — do not run the definitive 27/27. Operator hold on the authoritative run (escalating release). #7767 is preferred in sequence before the run but is not a hard dependency to execute the survey. Provenance scaffolding is landable without the run.

CI enrollment: seven long/ witnesses are not in per-PR discovery (witness_discovery_scan_dirs omits src/v2/test/claim/long/; OfflineLocalRecipe exclusion). Stub manifest (receipts: Empty) REDs only on the offline local recipe — not a CI failure shape.

Definitive run contract (only after operator releases hold):

• Clean detached worktree; build receipt binding commit, tree, compiler sources, probe executable digest, source-root set, and probe-policy revision.
• Every shard carries complete subject on the TSV wire; all 27 subjects compare exactly equal before aggregation (subjects_equal on all five components).
• No partial or mixed-head receipts in the definitive manifest. Not reconciled, not adjusted, not carried forward with a note. If a shard fails or a predecessor lands mid-run, affected receipts are discarded and re-run at the new exact subject. Do not hand-reconcile around SurveySubjectMismatch — the value is ONE authoritative run at ONE subject; a manifest assembled from two heads looks authoritative and is not.
• Identity join (not tally): roster_matches_survey + length equality + frontier_probe_survey_roster_bidirectional_totality_holds; offline recipe names all seven functions in claim_batch.

Seven long/ witnesses — TERMINATING one-shot (admitted, identity-frozen). src/v2/test/claim/long/compiler_frontier_per_module_probe_test.dag carries seven witnesses behind a file-grain WitnessExclusionRow. Under #7804 they are ADMITTED (byte-identical to freeze) and refuse nothing. No cadence enrollment — terminating one-shot has no later. Gate carrier: permanent regression → scheduled consumer; terminating one-shot → none; no discriminating red → deletion. These seven are the live TERMINATING specimen (dissolve_on in compiler_frontier_per_module_probe_exclusion_note / gunbc.ci_layer_roots exclusion row).

Identity constraint: admission by exact function identity. Rename or add in that file → new identity refuses. Definitive 27/27 does not add functions. If closing needs a new witness function there, stop and escalate first.

Test plan

• cargo build --release -p v1-compiler --bin frontier_probe_survey
• CI green on provenance + nfr roster
• Merged current main (incl. Fix frontier probe resolve_module_not_found for large import closures #7762, Refuse named arguments on function-value calls (compiler P0) #7834 named-argument wall)
• After operator hold release: clean detached head, run all 27, offline claim_batch per compiler_frontier_per_module_probe_exclusion_note — not started; on operator hold

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

review 48889 (REQUEST_CHANGES): fixed in 61cafcaa8.

Finding 1 — policy-revision well-formed check: Valid. frontier_survey_probe_policy_revision_holds was copy-pasted onto frontier_survey_source_roots_digest_holds (16-digit hex shape only). Now compares revision against frontier_probe_policy_revision() via compare_content_hash → ContentHashEqual, so hand-authored arbitrary structural hashes no longer pass the .dag consumer path.

Finding 2 — transport vs shell source roots: Valid. survey_manifest_emit_args now passes --source-root src/v2 and --source-root dag, matching docs/probes/run_frontier_probe_survey_per_module.sh and the manifest aggregation path (same source_roots_digest contract).

— sent from sleek-pike-668