Rich PDF citation anchors

[briansrls]

Summary

CIT-1 — RFC 8118 PDF open-parameter citation anchors on main after CIT-0 (#7775).

New modules

• extdeps.standards.rfc_8118 — RFC 8118 §3 vocabulary, wire serialization (map + join, no concat fold), project_navigable_uri, pdf_open_fragment_selector
• gunbc.citation.pdf_safe_profile — gunbc admission policy (page / nameddest / structelem only)
• extdeps.runtime.abi.sysv_amd64 — upstream x86_64 ABI PDF document identity, edition, authoritative page constant, register/syscall calling-convention facts
• gunbc.citation.x86_64_abi_pdf_consumer — product-layer citation consumer: safe-profile admission, navigable URI projection, pin/selector receipts, syscall-claim evidence (imports sysv_amd64 + pdf_safe_profile downward; no gunbc imports in extdeps)

Design points

• No duplicate authored SHA-256 hex literals — digest reconciliation is not claimed without independent retrieval; pin reports IndependentExpectedPinUnavailable, citation stays below the digest-matched rung
• Syscall convention selector at physical page 125 with page-28 RED controls; malformed local receipt hex refuses as WetReceiptHexMalformed
• Selector/URI pipeline and percent-encode refusal propagation unchanged
• Witness split across citation_cit1_witness_test and citation_cit1_consumer_witness_test

Why five consumer declarations are fn, not data

Cross-module data-to-data references are module-init-order-dependent: a data row is evaluated when its module initializes, so a consumer data row that reads another module's data row can observe an uninitialized or wrong value if import/init order shifts — without any expression changing. The extdeps→gunbc consumer split moved that boundary; three consumer witnesses failed at c06a4969ac because module-level navigable-URI and fragment-selector rows initialized before extdeps.runtime.abi.sysv_amd64 authority facts were ready. The fix is fn …() -> T { … } (call-time evaluation), not weaker assertions: x86_64_abi_pdf_version_cover_sequence, x86_64_abi_pdf_syscall_convention_sequence, x86_64_abi_pdf_syscall_fragment_selector, x86_64_abi_pdf_version_navigable_uri_projection, x86_64_abi_pdf_syscall_navigable_uri_projection. Do not convert these back to data without a construction wall that makes cross-module init order irrelevant.

Test plan

• citation_cit1_witness_test — RFC/safe-profile/URI, wire join control, page controls
• citation_cit1_consumer_witness_test — IndependentExpectedPinUnavailable, below-rung RED controls, page-125 URI/selector, malformed-hex local refusal, conforms_to authority binding

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Temporary close to re-trigger pull_request reopened event after cancelled superseded run.

[gunbai-bot]

Read review 49635 (/api/reviews/49635/artifacts/stdout.log) against HEAD 98198c6c9f05.

Pure APPROVE on the current diff — descriptive affirmations only (RFC 8118 as extdeps upstream authority, safe-profile consumer decomposition, construction-time refusal, honest IndependentExpectedPinUnavailable → BelowDigestMatchedRung dispositions, string_contains fragment check carries an explicit dissolve-on note, unit-modeling gate clean). No Findings block and nothing that warrants a follow-up commit; holding frozen while workflow_dispatch cold run 31127279442 concludes.

— sent from smart-cat-178

[gunbai-bot]

Addressing review 49636 (REQUEST_CHANGES):

Both findings — valid. pdf_fragment_selector_conforms_to_rfc_8118_not_web_annotation and pdf_fragment_selector_red_wrong_conforms_to_web_annotation had regressed to wire-value-only comparison. Fixed in 1f20ec1968:

• Positive witness now asserts got.conforms_to.uri.locator matches want and witness_fragment_spec_authority, and differs from web_annotation_authority.
• RED witness now asserts the fixture's conforms_to is Web Annotation (web_annotation_authority.uri.locator) and not RFC 8118 — so retargeting witness_false_web_annotation_fragment_selector to the RFC authority fails even when the wire string matches.

— sent from smart-cat-178

[gunbai-bot]

Read review 49643 against HEAD 1f20ec1968.

Pure APPROVE — affirmations only (extdeps/gunbc split, honest BelowDigestMatchedRung posture, bounded BaseLocatorAlreadyCarriesFragment scaffold, unit-modeling gate clean, sequence order preserved). No Findings block; nothing to change.

— sent from smart-cat-178

[gunbai-bot]

Addressing review 49644 (REQUEST_CHANGES):

Finding — valid. x86_64_abi_syscall_citation_selector_conforms_to_rfc_8118 only compared s.value. Fixed in c945fe2253: asserts s.conforms_to.uri.locator == extdeps_external_authority_anchor.uri.locator (RFC 8118 §3) and != x86_64_abi_pdf_authority.uri.locator (the cited PDF document — negative discriminator inline, same pattern as cit0 567-578).

— sent from smart-cat-178

[gunbai-bot]

Addressing review 49655 (REQUEST_CHANGES):

Both findings — valid per DESIGN §3. Citation receipts and gunbc imports did not belong in extdeps.runtime.abi.sysv_amd64. Fixed in c06a4969ac:

• New gunbc.citation.x86_64_abi_pdf_consumer — pin/selector/navigable-URI construction, citation facts, evidence links, wet-receipt observations, syscall-claim witnesses; imports sysv_amd64 + pdf_safe_profile + readback_independence downward.
• Slimmed extdeps.runtime.abi.sysv_amd64 — PDF authority/identity/edition, authoritative page constant, register inhabitants, and sysv_amd64_linux_syscall_convention only; zero gunbc imports.
• citation_cit1_consumer_witness_test imports split across the two modules.

— sent from smart-cat-178

[gunbai-bot]

Read review 49661 against HEAD c06a4969ac.

Pure APPROVE — affirmations only (refusal-driven consumer, typed carriers, extdeps/gunbc §3 split, observed_at: 0 acceptable in hex-only test path). No Findings block; nothing to change.

— sent from smart-cat-178

[gunbai-bot]

Read review 49663 against HEAD c06a4969ac.

Pure APPROVE — affirmations only (rfc_8118 / pdf_safe_profile / x86_64_abi_pdf_consumer layering, fail-closed refusal paths, witness coverage). No Findings block; nothing to change.

— sent from smart-cat-178

[gunbai-bot]

Converted back to draft. This is a state correction, not a verdict on the work.

The dashboard gate currently reads 2/2 approvals, no REQUEST_CHANGES, mergeable MERGEABLE, and only "checks: failing" outstanding. That tally is easy to read as merge-ready at a glance, and it is not.

Three things established by reading and by run history, none of which the approvals cover:

1. Three witnesses fail at head 818cbb8, the same three that failed at c06a496, so the last fix did not move them: x86_64_abi_syscall_citation_selector_conforms_to_rfc_8118, x86_64_abi_syscall_convention_uri_uses_physical_page_125, x86_64_abi_version_cover_uri_uses_page_one.

2. This branch has never been green on its current history. Of the last 40 runs there are exactly two ci successes, both on 2026-08-04, and neither commit is an ancestor of the current head - the branch was rebased and both greens sit on a line that was force-pushed away.

3. The failure is a genuine code regression, not a bad new assertion. x86_64_abi_version_cover_uri_uses_page_one is byte-identical between the last green tree and the current head, and the commit that produced that green touched both the witness file and the module under test, so it was in its own affected set and actually executed rather than selection-skipped.

Because batch 3 stops every later batch, no run on this branch has reached batch 4, so the drift-test and annotation half of this PR remains unverified by execution. It will stay draft until one run at a pinned head concludes green.

• sent from loyal-ant-382

[gunbai-bot]

Converting to ready. The condition I set has been met and I verified it against the run logs rather than the report. Two caveats below that the merge gate does not surface, and the second one matters.

WHAT I VERIFIED BY EXECUTION at d1ae83f, run 31158901745, pull_request, conclusion success:

• every batch passes, 1 through 6, and batch 4 was REACHED. Prior heads all died at batch 1 or 3, so nothing after batch 3 on this PR had ever executed.
• compile_clean_shard_a_exemplar_compile_green shows outcome=passed, leg=InterpretedLeg, 60276ms. It genuinely EXECUTED - 345 other rows in that run report selection-skipped and this one is not among them. That is the first executed proof of the annotation and drift-test half anywhere, main included, where this same witness predict-skips.
• all 17 citation_cit1_consumer witnesses green, including the base-locator probe, which is being kept permanently as the regression control for the silent direction.

THE FOUR ORIGINAL BLOCKERS, re-checked against the tree rather than assumed from the PR body:

1. page 28 to 125 with a discriminating control - present, plus a RED control asserting page 28 does not match.
2. wet receipt as authored data - the pin emits IndependentExpectedPinUnavailable and the rung disposition is BelowDigestMatchedRung; no authored digest is presented as an observation.
3. malformed local hash impersonating an HTTP status - the only http_status in the consumer is 200 on the success arm. A malformed hex returns X86_64AbiPdfRetrievalDigestHexRefused carrying WetReceiptHexMalformed, a typed refusal, not a fabricated 400.
4. growing-prefix concat(wires, [wire]) - gone, replaced by list_push. I checked this is a real fix and not a rename: list_push clones an im::Vector, which is O(1) structural sharing plus a push_back, where the old form rebuilt the list each iteration.

CAVEAT 1, minor: the dashboard shows checks pending. There is exactly one run at this head and it concluded success. The gate is lagging, not reporting a real pending check.

CAVEAT 2, and please do not read the approval tally as coverage: the two approvals are both at 818cbb8 and are not flagged stale, but that head is six heads back. Everything that actually fixes this PR landed after it - the nickname deletion, the qualified-path disambiguation, and the probe witnesses. No reviewer has seen the fix. I am flipping to ready partly so fresh reviews fire against the real change. Treat 2/2 as covering an earlier version of this PR, not this one.

THE DEFECT, for the record, since the commit titles do not tell the story. Three witnesses were failing because extdeps_external_authority_anchor is declared once per extdeps module, roughly three hundred times, all typed ExternalAuthority, and a data reference to it bound a DIFFERENT module row without any diagnostic. Five probe witnesses measured it: the base locator was non-empty and wrong rather than missing, the page wire was correct all along, and the conforms conjunct failed with both sides holding the RFC locator. An explicit import naming the source module did NOT fix it - the failing head already had one. Only fully qualified paths did, including for sysv_amd64 reference to its own row. Related evidence is on #7990, where the same class in a FUNCTION reference refused loudly instead of binding silently.

• sent from loyal-ant-382