Repository navigation
F0: restore falsifier dark controls (always() prerequisites) - #7812
Merged
Merged
Conversation
The falsifier_run_control witness used invalid `..` record-rest syntax that blocked corpus parse during regen; regenerate ci.yml and falsifier.yml from the .dag authorities and update the ci backstop witness for the containment step. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot
Bot
changed the title
Derive prerequisite if-conditions from step-id constants instead of duplicating release_build/release_bins literals; wire ci_workflow step ids through the same authority; add ci containment ordering witnesses. Co-authored-by: Cursor <cursoragent@cursor.com>
Operator correction (msg_f71d6501): measured receipts show step 11 completes with witness redness, not infrastructure failure; per-PR compile-clean containment was quarantining a healthy control. Keep F0 dark-control fix (always() prerequisites on falsifier cold controls) and revert ci job backstop/containment step. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot
Bot
changed the title
Heal job reported AuthorCommitRequired drift: ci_release_bins_unpack_verify_step projects id: release_bins on every job using the shared step constructor, not only the ci job. Co-authored-by: Cursor <cursoragent@cursor.com>
Operator ruling requires a discriminating fixture proving cold controls still execute when the affected-set floor fails: assert step order plus prerequisite if that does not gate on steps.floor, with a RED control rejecting floor-success gating. Document honest runner/job-loss bound. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 5, 2026
Mark §4 bisect as WIP handoff to wise-ram-22 (not merge criterion); §5 remains the mergeable infra slice. Note rebase after #7812. Co-authored-by: Cursor <cursoragent@cursor.com>
briansrls
added a commit
that referenced
this pull request
Aug 5, 2026
* WIP: F2: Falsifier memory root-cause investigation * F2: split falsifier into build/floor jobs to recover cgroup headroom Measured root cause: ~9.5 GiB pre-floor carry-in from release build + selection control in the same job cgroup pins falsifier at memory.high (width=1, not plural-worker). Split mirrors ci build→ci handoff; width check and bisect evidence recorded in diagnosis doc. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix falsifier workflow witness arithmetic and RED control (review 48258) Backstop witness now sums three artifact and four aux terms (350 min). Order discriminates within each job (build before control; peak before floor), not cross-job indices. Diagnosis doc retracts memory-event premise; separates Class A (BudgetExceeded, host-sensitive) from Class B (WitnessRed, deterministic). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: F2: Falsifier memory root-cause investigation * Record 76ef121 bisect: fn_wf and closing_contract already red Fresh claim_batch at last BudgetExceeded head shows Class B witnesses predate the seven-commit window; bisect must search earlier. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: F2: Falsifier memory root-cause investigation * Scope diagnosis doc to 7813A/7813B split per operator ruling. Mark §4 bisect as WIP handoff to wise-ram-22 (not merge criterion); §5 remains the mergeable infra slice. Note rebase after #7812. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 5, 2026
…required path) The heal job cannot push .github/workflows paths (the App lacks workflows:write), so the regenerated artifact has to land as an author commit. The one-line change comes from main's generator (#7812/#7813), not from this branch: regen was clean at the pre-merge head and produces this diff only once main's newer generator is present. 94/94 census witnesses still green by execution after the merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 5, 2026
Merged
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 5, 2026
Run regen_stage0 so v1_compiler_infer_method.rs carries observe_declared_import_closure_symbol_binding_row_note from 04_method.dag, then main_wet to settle falsifier.yml at the fixed point. Follows merge of main (#7812 falsifier dark controls) into the branch. Co-authored-by: Cursor <cursoragent@cursor.com>
2 tasks done
briansrls
pushed a commit
that referenced
this pull request
Aug 5, 2026
…every PR (#7839) falsifier.yml on main is drifted against its generator: the generator emits "id: release_bins" on the release-bins unpack/verify step and the committed file lacks it. Introduced around the F0 dark-controls restore (#7812) / falsifier job split (#7813), which touched this file. Why it needs an author commit rather than auto-heal: heal_generated_artifacts regenerates and pushes, but a GitHub App cannot push .github/workflows/* without workflows:write. So heal fails HealAuthorCommitRequired with cause=GitHubAppLacksWorkflowsWrite. Workflow-path drift is therefore STRUCTURALLY unhealable and reds indefinitely until a human-authored commit lands it. Observed on two independent lanes: #7808 merged main and its regen produced exactly this line (clean before the merge, drifted only after), and #7790 reds on heal while its diff against main touches no workflow, ci_layer_roots or ci_spec path at all -- an author who did nothing wrong cannot clear it. Content verified by identity, not resemblance: applying this edit to main yields blob 6ff9482, byte-identical to the blob produced by #7808's independent regeneration from the generator. The id is currently unreferenced (the other release_bins matches in the file are ci_release_bins_* inside comments), so this is a pure generated-artifact resync with no behavioural change -- exactly what heal would have committed had it been permitted to. Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 5, 2026
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 5, 2026
falsifier_job_steps requires job_id; the cold-control order witness intended falsifier_floor_job_steps after the build/floor job split. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot Bot
added a commit
that referenced
this pull request
Aug 5, 2026
…-base event data, enforce exact append-only prefix, hash every field (#7791) * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Close receipt-continuity bypass with JSONL carrier and merge-base parse. Move acceptance events to dag/gunbc/roadmap_acceptance_event_history.jsonl, parse HEAD and merge-base carrier revisions independently (no overlay .dag eval), delete authored seal count/digest, and extend hermetic RED controls for prefix law without seal co-edit and digest-field mutation. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Close receipt-continuity bypass with carrier bootstrap and typed load refusal. Migrate acceptance history to JSONL with merge-base carrier parse, authority projection bootstrap when the carrier is absent at base, and RoadmapAcceptanceReceiptsProjection so LoadRefused never masquerades as an empty receipt list. Move the JSONL parser under cli_run/ for regen copy. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Propagate typed refusal through accepted-node projections. Add AcceptedRoadmapNodesProjection and AcceptedRoadmapNodeIdsProjection so carrier load refusal no longer masquerades as an empty accepted set (active frontier, startable checks, and roadmap page now match on Refused). Co-authored-by: Cursor <cursoragent@cursor.com> * Plant empty-prior bypass discriminant for receipt-continuity requirement 1. The hermetic witness proves the old authority-changed path admitted deletion with prior_history = [] while observed non-empty prior refuses, closing the third operator RED control alongside prefix-law and digest-field mutation. Co-authored-by: Cursor <cursoragent@cursor.com> * Delete list accessors that collapsed acceptance projection refusal to []. Callers now use accepted_roadmap_node_ids_projection directly; tests fail closed on ProjectionRefused instead of treating refusal as zero acceptances. Co-authored-by: Cursor <cursoragent@cursor.com> * Digest revocation disposition structurally; clean bootstrap overlay on failure. acceptance_revocation_disposition_digest recurses over the disposition variant so future additions cannot collide, and the authority projection scaffold removes its temp directory when overlay staging fails. Co-authored-by: Cursor <cursoragent@cursor.com> * Parse committed HEAD carrier as prior when merge-base identity matches. The unchanged-carrier branch no longer aliases prior_history to the working-tree load, so dirty local JSONL edits refuse against the git-observed committed prior instead of self-matching. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Fix compile-clean variant collision and dedupe healthz authority projection. Rename ForecastRefusal's authority arm to ForecastRoadmapAuthorityRefused so it no longer collides with RoadmapAuthorityProjectionRefused, and evaluate roadmap_site_healthz_body from one projection pass to avoid repeated carrier reads. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Delete orphaned healthz well-formed helpers moved to surface bundle witnesses. The batch witness in roadmap_site_surface_expect now owns those predicates; leaving the plain fn helpers in roadmap_static_site_witness_test.dag tripped witness naming hygiene and blocked regen/CI. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Fix compile-clean: import aliases are not valid in .dag import lists. Drop the invalid `as expect_healthz_surface_is_current` rename and the shadowing 1-arg wrapper; keep the bundle delegate and expose the materializing entry as roadmap_site_healthz_surface_is_current_from_observed_body. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Fix dispatch generated rs after main merge: restore bridge lookups and keep roadmap parser arms. The merge dropped main's v1_interpreter_dispatch_generated bridge lookup tables while retaining new interpreter bridge calls, breaking the rustc compile gate. Restore origin/main's generated file and re-add only this PR's two roadmap JSONL/authority-text builtin arms. Co-authored-by: Cursor <cursoragent@cursor.com> * Address review feedback: projection narrow bypass, P0 identities, sealed-compat scaffold. Route active roadmap rendering through roadmap_authority_projection; remove narrow active_* wrappers; separate subject/producer/bundle identities; add sealed-compat dissolution trigger and prior-prefix mismatch index; serde-tag revocation disposition. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Propagate typed refusal for closing-contract task projections. Replace empty-list collapse on AcceptedRoadmapNodeIdsProjectionRefused with ClosingContractTaskPairsProjection and ClosingContractTaskEdgesProjection; route spawner sanctioning and page family members through accepted or fail-closed. Co-authored-by: Cursor <cursoragent@cursor.com> * Regenerate falsifier.yml after main merge (release_bins step id). Heal job requires author-commit for workflow paths; run main_wet before push when stage0 roster or falsifier authority changes. Co-authored-by: Cursor <cursoragent@cursor.com> * Reject unknown JSONL fields at parse boundary (review 48588). Add serde deny_unknown_fields on carrier decode structs so new JSONL columns refuse instead of silently dropping through the seed parser. Co-authored-by: Cursor <cursoragent@cursor.com> * Add deny_unknown_fields to revocation disposition enum (review 48607). Complete uniform strict JSONL parse boundary across all carrier serde types. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Delete sealed-prefix compat wrapper with zero callers (review 48633). The 6-arg acceptance_history_integrity_holds_from_prior_observation shim silently dropped sealed_event_count and sealed_chain_digest; every caller already routes through _with_prior. Document the git stderr substring as interim until extdeps.git gains a typed path-absent disposition. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix falsifier cold-control witness: pass floor job steps (#7812 typo). falsifier_job_steps requires job_id; the cold-control order witness intended falsifier_floor_job_steps after the build/floor job split. Co-authored-by: Cursor <cursoragent@cursor.com> * Document HEAD transitive-closure limit on authority bootstrap (review 48679). The projection seed overlay swaps only roadmap_authority.dag from merge-base text; other source roots stay on the worktree HEAD. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Fix rustfmt drift and admit failure-receipt witness on wet batch. Add bin_wet row for live_roadmap_acceptance_history_integrity_failure_receipt alongside the renamed holds witness so Phase 0(b) witness admission stops refusing the new companion function. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Close the remaining receipt-continuity production bypass: parse merge-ba * Return None instead of panicking when failure_receipt companion lookup fails. Authority delegation to gunbc.test_module_hygiene now logs resolve/call refusals and degrades to no companion so claim_executor cannot abort on hygiene load failure; documents that the JSONL seed bridge bypasses the digest refinement at Value construction. Co-authored-by: Cursor <cursoragent@cursor.com> * Distinguish failure-receipt companion lookup refusal from not-declared. failure_receipt_companion_from_authority returns a three-valued FailureReceiptCompanionLookup so hygiene resolve/call failures surface as failure_receipt_companion_refused in witness receipts instead of silently masquerading as no companion (review 48762). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>
briansrls
pushed a commit
that referenced
this pull request
Aug 5, 2026
… inference ceiling (#7808) * WIP: CENSUS-0 observation carrier * CENSUS-0: neutral revision-scoped observation carrier Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CENSUS-0: rename witness fixture row helpers to avoid tree-wide bare-name collision Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * review 48109: include unmet_because in the coverage content address Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * WIP: CENSUS-0 observation carrier * Revert autosave capture of a mutation probe: restore the Sampled floor arm The autosave commit 1b52fee captured a deliberately-broken line from an in-flight discriminating-RED probe and pushed it as the PR head. The Sampled arm must derive SemanticPopulationFloor; ExhaustiveSemanticPopulation there would let a sampled census support a whole-corpus absence claim, which is the exact law this carrier exists to enforce. Content restored to b5a1dde, the reviewed and witness-green state. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CENSUS-0A recut: repository census observation fact with executed-method identity Operator ruling: the first cut left the strongest conclusion SELECTED by authored labels (nullary CompleteForDeclaredPopulation plus a DeclarationRef that names a spelling, not an execution), so the carrier built to prevent unsupported numbers demonstrated that class. Recut to the fact only. - gunbc, not std: a neutral substrate module cannot import gunbc vocabulary - method is a CensusMethodExecutionReceipt (classifier + classifier_revision + invocation_identity + output_identity), never a bare reference - row identity is INTRINSIC, stamped at mint from subject AND value; the read-time row_key callback is deleted - identities built by tagged structural combination field by field; the pipe/comma/tilde/at wire grammar inside the content hash is deleted - coverage, inference ceiling and the evidence link move to CENSUS-0B Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * WIP: CENSUS-0 observation carrier * Close both identity forks: run identity replaces execution receipt, rows carry an opaque fact identity Fork A: output_identity was a parallel representation of the rows -- a caller could state the classifier produced output X and attach rows Y, and hashing both gives the contradiction a stable name rather than resolving it. Deleted; the observation constructor derives rows_identity from the rows it stores. CensusMethodExecutionReceipt renamed CensusMethodRunIdentity: the type admitted it could not establish execution while its name claimed a receipt, which is the class this carrier was recut for. Fork B: value plus value_rendering were two representations of one measured fact with nothing forcing agreement. The row now carries subject plus one opaque domain-fact identity, chosen with the real consumer in hand -- the language-residue census derives its fact identity structurally from declaration references rather than rendering anything to text. Dropping the type parameter also moves sole_constructor off the generic case (unverified per DESIGN 4b) onto the audited plain-record case. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CENSUS-0B: exact coverage receipt, method capability, derived inference ceiling, first real domain claim * Split the self-join witnesses from receipt existence so each probe lands on its own red * CENSUS-0B recut: one coherent evidence package, joined on exact identity * Declare the untyped ceiling-refusal arm as a frontier with its dissolution trigger * WIP: CENSUS-0 observation carrier * Remove the scratch cost probe the autosave swept in; its receipt is durable elsewhere The probe was a throwaway measurement harness for the keyed_roster_build cost shape, never intended for the corpus. Its numbers are recorded in the escalation rather than as an enrolled witness, because a timing harness is not a structural cost witness and enrolling one would be a change detector. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fire the ceiling frontier: a typed located refusal replaces the silent none The declared frontier said census_inference_ceiling answered an Optional and that none is not a typed located refusal. It now returns a coproduct: CensusCeilingDerived, or CensusCeilingRefusedRunMismatch carrying the classification run the coverage established and the method run the capability receipt claims. A second cause can no longer join the first silently, because adding one means adding a variant every reader must handle -- the compiler enforces what the note previously asked of the next author. The frontier note is deleted, replaced by the refusal note. The ceiling is also now constructed only on the joined arm. The previous body built the value and discarded it on failure, computing a strength for a package not yet shown to be one package. The domain consumer keeps the cause rather than re-absorbing it: confinement_surface_ceiling returns a three-arm outcome separating a receipt that never existed from a receipt naming a different run. A producer that refuses by name into a consumer that answers none would have made the refusal countable at the producer and invisible one line later. Three discriminating witnesses: the mismatch refuses by name, carries both identities and they differ, and the identity it names is the one the coverage actually established. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Recut the coverage reconciliation onto a keyed index: linear, not quadratic The reconciliation appended to a growing list while collecting distinct keys, rescanned the whole list once per distinct key to count occurrences, and rescanned again for every missing and unexpected subject. Each is a linear scan per element, so the join was quadratic in the subject count. The 24-subject consumer does not expose it, which is why it survived review; DESIGN section 6 fixes a proven cost-shape defect regardless of the realized n. Membership and duplicate detection now go through one Map keyed on the subject spelling, built in a single pass that also yields the distinct and duplicated lists -- the std.occurrence_binding_candidates pattern (map_get/map_insert with typed duplicate evidence), not a new authority. Authored order is preserved in lists beside the map and no map_keys or map_values call is introduced, so nothing depends on host traversal order. It deliberately does NOT call std.keyed_roster. keyed_roster_build is itself quadratic -- a linear keyed_row_find plus a growing concat per element -- and the cause is its signature, not its body: key_eq is an arbitrary caller-supplied predicate and an arbitrary predicate cannot be indexed. Measured on that function at 256/512/1024 keys: 85ms, 318ms, 1273ms, so 3.74x then 4.00x per doubling against quadratic 4.00. The dissolution trigger names the std regrounding that would let this module consume it directly; that regrounding is its own work item because it changes a std interface with six production consumers. 85/85 witnesses green by execution across all three suites, run with a compiler built from this tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * WIP: CENSUS-0 observation carrier * Do not land the structural cost witness: the lens cannot see this defect class The cost lens was the right instrument to reach for instead of a timing harness, and it cannot be pointed at this subject today. Measured, not assumed: dag/gunbc/repository_census_coverage.dag ingest REJECTED by the v2 frontend, so it yields no function rows at all. dag/std/keyed_roster.dag ingests clean and yields ZERO function rows, so the lens returns no class for the one file in the tree independently proven quadratic (4.00x per doubling). That is the general-body-producer frontier: real ingested fn bodies do not become substrate behaviors yet, so cost_coverage_file_receipt has nothing to classify. The demonstration that this must not ship: the headline assertion, no census coverage function is superlinear by shape, PASSED -- over zero rows -- while the assertion that any class was derived at all FAILED. Written the natural way, with only the headline, this witness would have been green and would have proved nothing. An inert check is a lie (DESIGN section 6), so it is removed rather than enrolled with a caveat. The quadratic fix in the preceding commit stands on its own: it is proven by the 85 executing witnesses and by the measurement on the real std function, not by this witness. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * WIP: CENSUS-0 observation carrier * Close the conformance construction hole; kill the growing-prefix copy; name the independence arm honestly THREE OPERATOR FINDINGS. 1. Conformance was author-supplied. census_conformance_observation took discriminating_input_refused and positive_control_accepted as Bools, so any caller could pass true/true and obtain a value that raised a semantic ceiling. The domain consumer computed them honestly by running the controls -- which is what hid the defect, since the generic carrier never required it. The carrier now consumes a CensusControlPair of two real CensusCoverageOutcome values and DERIVES the verdict: the discriminating control must be CoverageRefused, the positive CoverageEstablished, both outcomes must carry the declared control run's identity, and the control must be the same classifier at the same revision under a different invocation. Only that join yields CensusMethodConformanceReceipt, which is sole_constructor. The receipt records the method run it was derived against and the capability receipt re-joins on it, so conformance earned against run A cannot be attached to an observation from run B -- a hole the old fixtures were relying on, which is why they had to change. 2. The recut removed the quadratic lookup and left a quadratic write: append(acc, [key]) per fold step copies the accumulated prefix. Now prepend-then-reverse, the idiom std.change and std.realization already use. Authored order is unchanged. 3. IndependentDenominatorEstablished renamed DistinctProcedureDenominatorEstablished. The old name claimed independence where the evidence establishes only that two different declarations ran. EXECUTION RECEIPT, 24 vs 240 subjects. Operation counters are incremented by the production fold itself, not by a mirror of it, so they cannot drift from the code they measure. They count map lookups, map inserts, key prepends and order reversals; they deliberately do NOT claim the interpreter's internal copy volume, which is the substrate's per-operation cost. Assertions are on the RATIO, never on an absolute count copied from a current run. The RED control performs the old pairwise scan and is asserted to BREACH the same band: at n=24 it visits 576 pairs, 24 matched and 552 passed over, against the linear path. 94/94 witnesses green by execution on a compiler built from this tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Merge main; commit the regenerated falsifier workflow (author-commit-required path) The heal job cannot push .github/workflows paths (the App lacks workflows:write), so the regenerated artifact has to land as an author commit. The one-line change comes from main's generator (#7812/#7813), not from this branch: regen was clean at the pre-merge head and produces this diff only once main's newer generator is present. 94/94 census witnesses still green by execution after the merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Class sweep: the independence overclaim survived one identifier away Renaming DistinctProcedureDenominatorEstablished fixed the instance and left the class. Its mirror, the ceiling limit DenominatorNotIndependent, asserted non-independence in general when the join decides only that two procedures were not shown to be distinct declarations. A negative inherits the evidence bound of the positive it negates: if structure cannot establish independence it cannot establish its absence either. Renamed DenominatorProcedureNotDistinct. Found by sweeping the name class, not by a failing test -- no witness distinguishes the two names, which is exactly why the sweep was needed. 94/94 green by execution. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Brian Searls <searlsbrian@gmail.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 6, 2026
…ix falsifier.yml cross-job gate hole
capability_retirement_trigger_naming_note in v1_complexity_capability_census.dag
still described stage0_rust_lifecycle_totality's axis as a bare
RetirementTrigger after this branch's own rename to
LifecycleTotalityRetirementTriggerUnmodeled — a stale symbol citation
per DESIGN.md §3. Corrected the note to name the one live collision
(stage0_rust_honest_frontier_projection's RetirementTrigger variant)
and to state explicitly that this census does not discharge
lifecycle_totality_retirement_trigger_dissolve_on.
Also root-caused and fixed an independent, currently-active CI gate
hole: falsifier_control_prerequisite_if cited
falsifier_release_build_step_id ("release_build"), a step id belonging
to falsifier_build_job(), from falsifier_floor_job()'s cold-control
steps. GitHub Actions' steps.<id> context is job-scoped, so the
cross-job reference resolved to null and both cold controls
(compile-clean whole-tree, native-cache) were unconditionally skipped
from commit 491ee01 (2026-08-05, #7812) through 2026-08-06. Repointed
to the correct same-job step id (release_bins) and regenerated
falsifier.yml via generated_artifact_gate main_wet. Added a witness
asserting the if-condition cites the same-job step and no longer
contains the wrong job's step id.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
6 tasks done
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 6, 2026
…ect falsifier control dark-window claim; add execution-proof honesty note CI failure on #7894 (run 31069215347): maintenance_census_report_positive_control_derives_from_current_head reaches git.Inspect.HeadCommit unmocked, refusing under the hermetic discovery envelope and failing the whole 7298-row batch. Split it into stage0_rust_maintenance_census_report_live_witness_test.dag (offline-local recipe, mirrors stage0_rust_host_observation_live_witness_test.dag) and registered the exclusion row in ci_layer_roots.dag. Per parent session still-bat-561 (msg_7ae919df): corrected falsifier_control_prerequisite_note — the dark window predates #7812 (default success() gate already skipped cold controls whenever the floor reddened, and the floor was red on every checked run); #7812 was itself a repair that introduced the cross-job steps.release_build.outcome bug, making the skip unconditional; #7894 is the third fix. Corpus damage this control failed to catch traces to the namespace-6848 change merged 2026-07-20, 19 diagnostics cleared separately by #7908. Added falsifier_control_prerequisite_execution_proof_note: the two prior repairs shipped with shape-based witnesses while the control stayed dark on real runs, so this fix is not entitled to be declared done at merge — the acceptance gate is the first real scheduled falsifier run showing both cold-control steps concluding success/failure, never skipped. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Aug 6, 2026
…ger compile fix (#7894) * WIP: Current hand-Rust maintenance census and roadmap reconciliation * WIP: Current hand-Rust maintenance census and roadmap reconciliation * WIP: Current hand-Rust maintenance census and roadmap reconciliation * Reconcile stale RetirementTrigger citation flagged in review 49280; fix falsifier.yml cross-job gate hole capability_retirement_trigger_naming_note in v1_complexity_capability_census.dag still described stage0_rust_lifecycle_totality's axis as a bare RetirementTrigger after this branch's own rename to LifecycleTotalityRetirementTriggerUnmodeled — a stale symbol citation per DESIGN.md §3. Corrected the note to name the one live collision (stage0_rust_honest_frontier_projection's RetirementTrigger variant) and to state explicitly that this census does not discharge lifecycle_totality_retirement_trigger_dissolve_on. Also root-caused and fixed an independent, currently-active CI gate hole: falsifier_control_prerequisite_if cited falsifier_release_build_step_id ("release_build"), a step id belonging to falsifier_build_job(), from falsifier_floor_job()'s cold-control steps. GitHub Actions' steps.<id> context is job-scoped, so the cross-job reference resolved to null and both cold controls (compile-clean whole-tree, native-cache) were unconditionally skipped from commit 491ee01 (2026-08-05, #7812) through 2026-08-06. Repointed to the correct same-job step id (release_bins) and regenerated falsifier.yml via generated_artifact_gate main_wet. Added a witness asserting the if-condition cites the same-job step and no longer contains the wrong job's step id. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * WIP: Current hand-Rust maintenance census and roadmap reconciliation * Fix CI: split live-git census-report test to hermetic exclusion; correct falsifier control dark-window claim; add execution-proof honesty note CI failure on #7894 (run 31069215347): maintenance_census_report_positive_control_derives_from_current_head reaches git.Inspect.HeadCommit unmocked, refusing under the hermetic discovery envelope and failing the whole 7298-row batch. Split it into stage0_rust_maintenance_census_report_live_witness_test.dag (offline-local recipe, mirrors stage0_rust_host_observation_live_witness_test.dag) and registered the exclusion row in ci_layer_roots.dag. Per parent session still-bat-561 (msg_7ae919df): corrected falsifier_control_prerequisite_note — the dark window predates #7812 (default success() gate already skipped cold controls whenever the floor reddened, and the floor was red on every checked run); #7812 was itself a repair that introduced the cross-job steps.release_build.outcome bug, making the skip unconditional; #7894 is the third fix. Corpus damage this control failed to catch traces to the namespace-6848 change merged 2026-07-20, 19 diagnostics cleared separately by #7908. Added falsifier_control_prerequisite_execution_proof_note: the two prior repairs shipped with shape-based witnesses while the control stayed dark on real runs, so this fix is not entitled to be declared done at merge — the acceptance gate is the first real scheduled falsifier run showing both cold-control steps concluding success/failure, never skipped. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * WIP: Current hand-Rust maintenance census and roadmap reconciliation --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
P0: repairs the falsifier control-dependency defect — compile-clean and native-cache cold controls were skipped whenever the predict-only floor reddened because GitHub Actions' default
success()gate inherited from the prior step (verified run 30935833427).gunbc.falsifier_run_controlwithalways() && !cancelled() && steps.release_build.outcome == 'success'prerequisitesfalsifier.ymlwithrelease_buildstep id and prerequisiteifon both cold controlssteps.flooroutcome (RED control rejects floor-success gate)Honest bound: step-level
always()does not survive total runner/job loss. Follow-up (not a blocker): split controls into serially dependent jobs consuming the build artifact.Retracted (operator msg_f71d6501): per-PR compile-clean containment on the
cijob.F1 (routing + stale alert) and Class B witness root-cause are separate child sessions.
Test plan
falsifier_run_control_witness_test— closed role population, prerequisite if, YAML projectionfalsifier_workflow_witness_test— cold control ordering, red_floor_workflow_fixture_cold_controls_still_execute, RED control on floor-success gateci_workflow_witness_test— backstop step-sum