Generated-artifact drift: one typed observation per artifact; pure leaf/group expectations; delete the per-artifact live perturb loop

[briansrls]

Worker attestation

• Title describes the change (not the session id or branch).
• PR body summarises what and why.
• Tests run: named below.
• No commits on this branch are surprises.
• No secrets / credentials / large binaries staged.

Summary

Fixes the redundant-producer defect the operator flagged in
dag/tools/generated_artifact_gate.dag: the healthy path performed 4
artifact_generate calls and 2 committed-file reads per artifact, and
the fast witness (dag/test/claim/generated_artifact_drift_test.dag)
independently called artifact_generate 3 more times per artifact via a
live perturb loop that only reproved generic string inequality (DESIGN
§6), never an artifact-specific fact.

Adds dag/gunbc/generated_artifact_observation.dag, a single typed
GeneratedArtifactObservation model with three layers:

• live producer (observe_generated_artifact / _population) — one
  Filesystem.Read, one artifact_generate, one artifact_extra_valid
  per artifact, captured once as a retained receipt;
• pure leaf (assess_generated_artifact_observation) — clean iff
  generation succeeded, the read succeeded, generated == committed, and
  extra validation holds; reads only the retained receipt fields;
• pure group (assess_generated_artifact_population) — an identity
  join (via the existing artifact_eq, not count equality) asserting
  every expected artifact identity is observed exactly once, no
  unknown/duplicate observation, and every leaf receipt passes;
• pure diagnostic projections (first_failing_observation_path,
  first_failing_diagnostic_path) that fold the same retained
  population to name the first leaf failure, falling back to a missing-
  or unknown-identity path so a group-only failure never surfaces as an
  empty diagnostic string.

dag/tools/generated_artifact_gate.dag's run_generated_artifact_drift_gate_body
now calls the live producer exactly once per gate run; the pass/fail
verdict and the failure diagnostic both read that one retained
population — no re-invocation of the producer, no rerun-as-remediation.

dag/test/claim/generated_artifact_drift_test.dag drops the live
perturb loop (perturb/artifact_drifted/artifact_red_receipt/
witness_per_artifact_red_receipts) and replaces it with sub-millisecond
constructed-fixture witnesses against the new pure leaf/group/diagnostic
functions, covering: clean, one-byte-perturbed drift, generation
refusal, committed-read refusal, extra-validation refusal, and group
missing/duplicate/unknown identity — no Filesystem/artifact_generate
calls in any of the new tests.

Out of scope (per the operator's brief): #7810, #7772, #7770, #7791,
#7816, #7817 are untouched; the long-lane fixed-point witness
(dag/test/claim/long/generated_artifact_drift_fixed_point_witness_test.dag)
is untouched.

Test plan

• claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/generated_artifact_drift_test.dag --functions <all 20> —
  all 20 witnesses PASS; every new pure leaf/group/diagnostic witness
  reports 0ms subject=... eval_self=0.000ms.
• gunbc run --source-root dag --source-root src/v2 --entry dag/tools/generated_artifact_gate.dag --function run_generated_artifact_drift_gate_body --dry-run —
  compiles with 0 problems and returns ExitSuccess against the current
  committed tree (the production gate call site).
• cargo build --release --bin claim_batch --bin gunbc — green.

Module split (loyal-ram-550 review, module-grain purity)

gunbc.generated_artifact_observation (the live producer) and
gunbc.generated_artifact_assessment (the pure type + leaf/group/
diagnostic predicates) are now two modules, not one. The assessment
module imports gunbc.generated_artifact only — Filesystem and
gunbc.generated_artifact_emit's artifact_generate/artifact_extra_valid
appear nowhere in it. The observation module imports the assessment
module (never the reverse), so the dependency edge runs producer →
pure, one direction only.

Honest rung, corrected in-file: the assessment module's note
originally claimed a bare artifact_generate reference written inside
it (no import added) "fails to compile." That overstates what the
substrate currently guarantees. DESIGN §4b Class B (open thread, #6985)
means a bare cross-module reference can still resolve by
pool-membership coincidence when an unrelated import elsewhere in the
same compiled closure has already dragged the target module into the
pool — and here gunbc.generated_artifact_observation imports both the
assessment module and the generator, so that coincidence is close to
guaranteed in every real closure. The note has been reworded: today's
guarantee is mechanically-preventable-by-convention (no import path
exists; any future import is immediately visible to review), not
structurally-impossible; it dissolves into the stronger claim once
the namespace lane's closure-independent binding fix lands. This is
the correct rung per DESIGN §4b rather than an inflated one.

Cost: producer is an integration operation, not an ordinary witness

observe_generated_artifact_population (9 Filesystem.Read + 9
artifact_generate + 9 artifact_extra_valid calls, one per committed
artifact) was measured directly, in isolation, via a disposable
scratch witness that called it exactly once (not committed; deleted
after measurement). Executed wall-clock for evaluating that single
call: 6709ms. That is well above the ordinary 500ms
mandatory-migration threshold, and that is expected and fine: it
executes exactly once per run_generated_artifact_drift_gate_body
call (the gate/regen path), not per witness and not per artifact. None
of the 13 new pure witnesses in
dag/test/claim/generated_artifact_drift_test.dag call
observe_generated_artifact_population or
assess_generated_artifact_live_population — every one of them is
fixture-only, constructing GeneratedArtifactObservation values by
hand and driving the pure leaf/group/diagnostic functions directly, at
eval_self=0.000ms. The higher-order pure checks consume the
producer's one retained population; nothing re-invokes it. This is the
operator's prescribed routing for an over-500ms producer — an
integration operation living in the gate/regen path — not a violation,
and nothing here is being moved to long/.

Separate, unowned, out-of-scope finding

witness_extra_validation_wired in
dag/test/claim/generated_artifact_drift_test.dag is a pre-existing
witness, unmodified by this PR, that reads the live tree and measures
~1971ms — roughly 4x the 500ms threshold. It is not covered by this
PR's module split or migration and is not being routed here;
flagging it explicitly so it is not laundered as "the file is clean
now." loyal-ram-550 has been notified and will route ownership/a fix
separately.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.