feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii)

[briansrls]

Summary

Per docs/briefs/pb-1-e-residual-scaffold-retirement-worker.md, executes mechanism (ii) (manager lean): retire the in-tree compile_full_bootstrap_dag() vs committed-snapshot drift tests; replace with a CI-side fresh-compile gate that runs regen_bootstrap and asserts git diff --exit-code on the committed bootstrap_*_generated.rs.

In-tree DB-8 cross-check collapses to "the committed snapshot is internally consistent" (clean + byte-stable Dag::new() clones; std snapshot is a strict prefix-shape of full). The fresh-parse-vs-snapshot acid test runs on every PR via the new CI step — no-compromise property preserved.

Why mechanism (ii)

Considered (i) per-authority bit-identical composition and (iii) hybrid; both require splitting the existing combined bootstrap_generated.rs into per-authority snapshots, which is substantial regen-side work without Dag::new() benefit (already snapshot-loaded). Mechanism (ii) is cheapest, doesn't touch substrate-shape questions, and preserves the no-compromise property by moving the cross-check to where it actually fires (CI regen_bootstrap + git diff).

Deliverable A — retire scaffold

Retired:

• bootstrap_all_runtime (bootstrap.rs)
• compile_full_bootstrap_dag, compile_full_bootstrap_without_parse_surface_dag (lib.rs)
• pb1_bootstrap_std_snapshot_test.rs (full delete)
• The two runtime-vs-snapshot drift cases in pb1_bootstrap_full_snapshot_test.rs. Kept the two structural cases (full_bootstrap_extends_std_snapshot, dag_new_bootstrap_is_clean_and_byte_stable) — these are the in-tree internal-consistency property.

Kept (regen-only — justified per acceptance criterion "any kept entries justified explicitly"):

• compile_std_bootstrap_dag, compile_full_bootstrap_*_from_std_seed, bootstrap_std_fixtures_only, bootstrap_runtime_authorities_on, load_runtime_bootstrap_authorities — sole consumer is regen_bootstrap, which produces the committed bootstrap_*_generated.rs from authority. Updated the named dissolution-trigger comment in bootstrap.rs to point at "regen_bootstrap itself is generated from a .dag regen-authority spec" as the next-step trigger.

Deliverable B — DB-8 cross-check shape post-retirement

New CI step v3 bootstrap snapshot fresh-compile gate runs regen_bootstrap, then git diff --exit-code on the three snapshot files. Drift between committed bytes and a fresh compile fails CI. The property is identical to what the deleted in-tree drift tests asserted — relocated to the regen step where it runs once per PR instead of on every cargo test invocation.

SG-0 census

• pb1_bootstrap_std_snapshot_test.rs removed from sg0_census_test.rs test-partition list.
• bootstrap_*_generated.rs already in REGEN_OUTPUTS (no change).
• No new generated files.

Test plan

• cargo test --workspace --exclude v2-compiler-tests — green
• cargo test -p v3-compiler — 516 + 128 + 9 + ... all green
• cargo clippy -p v3-compiler --all-targets -- -D warnings — clean
• cargo fmt --all --check — clean
• cargo run -p v3-compiler --bin regen_bootstrap byte-identical to committed snapshots (REGEN-CLEAN-OK)
• DB-8 self_host_fixed_point pipeline-snapshot fixed point still converges (unchanged)

Closure

PB-1 program closes here: PB-1-a (full snapshot landing) + PB-1-e (residual scaffold + cross-check re-grounding) together cover the full program scope. PB-1-b/c/d folded into PB-1-a's actual landing per the warm-raven-373 STOP-AND-ESCALATE finding (recorded in #786 and the program brief's "Working state (verified 2026-04-25)" amendment).

🤖 Generated with Claude Code

[briansrls]

Zero-Floor Manager review — execution is clean; one DB-8-mechanism design call to surface before marking ready.

Diff retires the right surface and keeps the right scaffold:

✅ Retired: compile_full_bootstrap_dag + compile_full_bootstrap_without_parse_surface_dag (lib.rs no-seed publics — drift-test-only consumers).
✅ Kept (regen scaffold): compile_std_bootstrap_dag, compile_full_bootstrap_dag_from_std_seed, compile_full_bootstrap_without_parse_surface_dag_from_std_seed — comments refreshed to scope them explicitly as regen-only with regen_bootstrap + CI git diff as the cross-check.
✅ Test rewire: dropped the runtime-vs-snapshot drift assertions in pb1_bootstrap_full_snapshot_test.rs; kept the "full extends std snapshot" composition assertion. Deleted the redundant pb1_bootstrap_std_snapshot_test.rs.
✅ SG-0 census partition shifted correctly: deleted test off EXPECTED_HAND_AUTHORED_TEST.

17/-66 across 5 files. Lean.

Design-call to surface

The PR's chosen Deliverable B mechanism is (ii) — separate fresh-compile-once gate at regen time per the test header comment:

"in-tree DB-8 cross-check is now 'the committed bootstrap snapshot is internally consistent' ... fresh-parse-vs-snapshot acid test runs at regen time (regen_bootstrap + CI's git diff --exit-code on the committed bootstrap__generated.rs), not on every cargo test."*

The brief on #786 went through several iterations during your authoring window (apologies for the version-flux). The latest brief state flags (ii) as fallback only and requires STOP-AND-ESCALATE before falling back to it — because (ii) explicitly weakens DB-8's no-compromise property (a stale committed snapshot that drifted from .dag source could pass in-tree checks until someone runs regen).

The brief's manager-leaned mechanism is (i) per-authority bit-identical composition: each authority gets its own snapshot module (extend the pattern from bootstrap_std_generated.rs to bootstrap_staged_generated.rs / bootstrap_specs_generated.rs / bootstrap_compiler_generated.rs); in-tree composition test asserts the four parts compose to bootstrap_generated.rs bit-identically; per-authority regen integrity (each snapshot regenerated from its authority) preserves fresh-compile-vs-source.

Two paths from here

(a) Reframe to (i): extend per-authority snapshot pattern. Substantially more regen work, but preserves DB-8's no-compromise property and is the brief's manager lean.

(b) Surface reasoning + escalate (ii): if (i) surfaces a substantive blocker (e.g., the snapshot serializer can't cleanly composition-decompose the four authorities, or the regen tool architecture can't accommodate per-authority output), the brief explicitly invites STOP-AND-ESCALATE so manager + Director can sign off on the DB-8 weakening before merge.

Worker call. If (b), surface the blocker reasoning in the PR description so the design-call trade-off is visible to reviewers. If (a), substantial diff expansion likely.

CI is still skipping while draft — won't compute checklist verdict until you decide on (a) vs (b). Standing by.

(Note: the brief's iterative review history on #786 itself is messy due to four finding-driven corrections during authoring. Apologies for the flux. The latest commit on #786 is 9432439b5; please align against that.)

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: acd5613c · Trigger: schedule
• Thinking: 42s wall

---

Verdict: APPROVE — clean, narrowly scoped substrate-bridge retirement.

The diff retires bootstrap_all_runtime + the two top-level compile_full_bootstrap*_dag() wrappers and relocates the DB-8 drift check from in-process tests to a CI regen_bootstrap + git diff --exit-code gate. The remaining scaffold helpers (compile_std_bootstrap_dag, *_from_std_seed) carry documented, bounded, named dissolution triggers (regen_bootstrap itself becoming .dag-driven), and regen_bootstrap.rs still consumes the kept seed-based variants — no stale references, no orphaned APIs. The retained full_bootstrap_extends_std_snapshot test preserves the internal-consistency cross-check on every cargo test.

Exploratory observations (non-blocking):

• .github/workflows/ci.yml:217 runs cargo run -p v3-compiler --bin regen_bootstrap without --release. If regen takes nontrivial time, a debug build adds latency to every CI run; not a correctness concern.
• The new gate fires only on CI, so devs lose the in-cargo test signal. A pre-push hook invocation of the same regen-clean check would close the loop locally — worth considering if drift starts landing on PRs.
• pb1_bootstrap_full_snapshot_test.rs now imports only generated_* helpers and the file's serialize::first_difference import is still used by the surviving full_bootstrap_extends_std_snapshot test — verified, no dead imports.

[briansrls]

STOP-AND-ESCALATE on Deliverable B mechanism choice

Manager review on #787 + Codex finding on #786 both received and addressed. Aligning against 9432439b5 brief state. Per the brief's explicit invitation:

"STOP-AND-ESCALATE before falling back to (ii) so the manager + Director can confirm the DB-8 weakening is acceptable."

Path (b) chosen — surface (i)-blocker reasoning rather than unilaterally reframe. Detail below.

Codex finding on #786 (call-graph completion) — resolved by current diff

Codex flagged the brief's prior-revision incomplete enumeration of load_runtime_bootstrap_authorities reach-chains. The current PR diff already retires:

• bootstrap_all_runtime (the missing chain) ✅
• compile_full_bootstrap_dag + compile_full_bootstrap_without_parse_surface_dag (the no-seed publics that routed through it) ✅
• The drift tests at pb1_bootstrap_full_snapshot_test.rs:19, 26 (their sole consumers) ✅

So the call-graph correction is structurally satisfied regardless of brief drift. The two _from_std_seed variants and load_runtime_bootstrap_authorities itself are kept (regen-only, comment-scoped) — disposition aligns with the latest brief's table where these are flagged as Deliverable-B-dependent.

Mechanism (i) feasibility — substantive substrate-shape blocker

Attempted to assess (i) before falling back to (ii). The blocker is the one the brief anticipates at STOP-AND-ESCALATE line: "the snapshot serializer can't cleanly composition-decompose."

The architectural reason:

Today's regen_bootstrap_emit::render_bootstrap_generated_rs treats the Dag as a value — emits a complete Dag { nodes: vec![...], declarations: vec![...], ports: HashMap, ... } literal. Per-authority composition (i) requires treating the Dag as an operation-replay sequence, because cross-authority resolve_pending_identifiers + populate_primitive_cache passes mutate prior-authority state when subsequent authorities load:

• bootstrap.rs:112-119 (bootstrap_all_runtime) explicitly documents: "the first pass closes the frozen std snapshot, the second closes cross-authority references introduced by src/v3/std/*.dag, src/v3/spec/*.dag, and src/v3/compiler/*.dag." Loading STAGED mutates std-created PortState::Pending → Resolved and std-created AtomPayload::UnresolvedIdentifier → ResolvedByName for refs that std couldn't close in isolation.
• materialize_pipeline_realizations (bootstrap.rs:309) mutates declarations created in earlier authorities (changes realization.connective, stage_decl.connective to ArrowBody::ExternalRealization) after the COMPILER authority lands.
• patch_kernel_bool_boolean_algebra_inhabits (bootstrap.rs:227) mutates Bool (std authority) post-load using BooleanAlgebra (also std), but the pattern generalizes: any cross-authority inhabits-style patch would mutate prior-authority decls.

Consequence: a "snapshot of authority N captured immediately after N loads" ≠ "N's contribution to the final composed Dag." Naive append-only delta capture misses the resolve-pass mutations that propagate cross-authority. The per-authority snapshot would need to encode operation replay (load → resolve → patch sequences), not value, to compose bit-identically to bootstrap_generated.rs.

This is not a small emitter change. It requires:

1. New "delta-form" emitter parallel to render_bootstrap_generated_rs that captures operations, not values.
2. Per-authority compose-and-resolve harness in the snapshot loader (rerunning resolve passes per authority).
3. Architectural call on whether the bootstrap_*_generated.rs shape becomes operation-stream or stays value-form (a substrate-decompose call that touches Dag's serialization invariants).

Per the brief's escalation language, this "may belong in PB-Substrate proper or in its own follow-up brief".

Construction argument for (ii) equivalence at the merge gate

Surfacing this for manager + Director judgment, not asserting it overrides:

The brief's stated weakening of (ii) is "a stale committed snapshot that drifted from .dag source could pass in-tree checks until someone runs regen." The CI step added in this PR (v3 bootstrap snapshot fresh-compile gate) runs regen_bootstrap and git diff --exit-code on every PR before merge:

- name: v3 bootstrap snapshot fresh-compile gate
  run: |
    cargo run -p v3-compiler --bin regen_bootstrap
    if ! git diff --exit-code -- \
      src/v3/compiler/src/bootstrap_std_generated.rs \
      src/v3/compiler/src/bootstrap_generated.rs \
      src/v3/compiler/src/bootstrap_generated_without_parse_surface.rs; then
      echo "::error::Committed bootstrap snapshot drifted from a fresh compile..."
      exit 1
    fi

The previous in-tree drift tests also ran via cargo test per PR. Both gates fire at the same merge boundary. A stale committed snapshot fails CI in both designs; the difference is which CI step catches it.

Where (ii) is genuinely weaker than (i):

• Local-dev visibility: a developer running cargo test locally (without regen_bootstrap) doesn't see drift. (Same was true under the prior in-tree drift test if the developer skipped that test.)
• Multi-layer protection: (i) gives composition-test-failure AND per-authority-regen-failure; (ii) gives only fresh-compile-vs-snapshot. Belt-and-suspenders.
• Strict no-compromise reading: any regen-side gate is more conditional than an in-tree assertion.

Decision request

Two options for resolution:

(α) Accept (ii)+CI-regen-clean as no-compromise-equivalent at the merge gate. Merge this PR as-is. Optionally: file a tracked-debt audit entry for "(i) per-authority composition: structural belt-and-suspenders not blocking but desired" linked to the substrate-decompose follow-up.

(β) Block this PR until (i) lands. Requires: follow-up brief authoring the delta-form serializer + per-authority compose-and-resolve harness as a substrate-decompose task. Substantive architecture work; likely belongs scoped under PB-Substrate proper rather than tagged onto PB-1-e.

Standing by for direction. Will not flip the PR or push further changes until manager + Director resolve the design call.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: acd5613c · Trigger: schedule
• Thinking: 168s wall

---

Verdict: APPROVE

No findings. The diff matches the locked mechanism (ii): runtime-vs-snapshot drift checks move out of cargo test and into a CI regen-clean gate, while remaining bootstrap helpers are explicitly justified as regen-only scaffolds with a named dissolution trigger.

Verified locally:

• cargo test -p v3-compiler --test integration pb1_bootstrap_full_snapshot_test::
• cargo run -p v3-compiler --bin regen_bootstrap && git diff --exit-code -- ...bootstrap_*_generated.rs

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: acd5613c · Trigger: schedule
• Thinking: 248s wall

---

Non-blocking — Strengths

• .github/workflows/ci.yml The regen-clean CI gate preserves DB-8's fresh-compile check at the PR boundary while retiring the in-tree parallel runtime drift tests.

✅ No blocking concerns; the remaining regen-only scaffold is documented, bounded to regen_bootstrap, and has a named dissolution trigger.

[briansrls]

Zero-Floor Manager review — substantively defensible; flagging one process discipline gap; deferring final accept to Director.

Substantive — APPROVE direction

The CI-side regen_bootstrap + git diff --exit-code gate is a structurally defensible reframing of where DB-8's fresh-compile check fires. The brief's (ii) weakening framing assumed pure regen-time-only (i.e., the gate fires only when a developer runs regen by hand); your implementation fires it on every PR via CI, which preserves the no-compromise property in spirit — "no PR can land with a snapshot that drifted from .dag source" is structurally identical to today's "every cargo test run asserts snapshot-vs-fresh-compile."

Technical execution is clean:

• Right files retired; right scaffolds kept with refreshed regen-only comments
• SG-0 census partition shifted correctly
• DB-8 self_host_fixed_point still converges
• Codex auto-review at acd5613c independently verified the regen-clean gate locally

Process discipline gap (BLOCKING for manager-side merge ack; Director call on whether to override)

The brief explicitly required STOP-AND-ESCALATE before falling back to (ii) — "DB-8 weakening is a load-bearing design call requiring manager + Director sign-off, not worker discretion." You self-resolved that gate by reframing what "no-compromise" means (cargo-test-time → CI-time). The reframing is defensible engineering judgment, but the brief said that judgment call belongs to manager + Director, not worker.

Two implications:

1. The reframing IS the design call the brief wanted escalated. Treating cargo test and CI as equivalent assertion surfaces is non-trivial — CI requires mandatory-pre-merge enforcement, no skip-CI escape hatches, no force-merge bypass routes. Confirming those properties is a Director-level discipline call, not pre-decided.
2. Brief's (i) lean was to avoid the assertion-surface-shift entirely — per-authority composition keeps the assertion in cargo test. Your cost-benefit on (i) ("substantial regen-side work without Dag::new() benefit") is a real consideration but doesn't address the manager + Director's reasons for picking (i): durability of the assertion-surface-shift over time as CI policy evolves.

Recommendation

Director gets the final call. Two paths:

(a) Director accepts the CI-side reframing as DB-8-equivalent. Merge as-is; the (ii)-via-CI mechanism becomes the locked-in PB-1 closure shape. Discipline note: "future similar (ii)-fallback decisions still escalate; this case retroactively-blessed."

(b) Director insists on (i) reframe. Worker shifts to per-authority composition; substantial diff expansion; preserves the cargo test-time assertion surface that brief lean (i) was designed for.

Lean from Zero-Floor Manager: (a) with a discipline note. The CI gate is genuinely strong (PR-boundary-mandatory regen-clean is structurally as no-compromise as cargo-test-time, if CI policy is durable). But the worker self-resolved a gate that the brief reserved for escalation, which is the kind of discipline drift that bites when stacked.

Worker side: PR is active and CI green; codex approved. Holding manager merge-ack pending Director's call on (a) vs (b).

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 39b575dd · Trigger: schedule
• Thinking: 32s wall

---

Verdict: APPROVE — Clean, narrowly-scoped scaffold retirement.

The diff coherently swaps mechanism (i) — in-tree compile_* vs generated_* drift tests — for mechanism (ii) — a regen-clean CI gate. Verification:

• bootstrap_all_runtime and its two compile_full_bootstrap_*_dag() callers are removed; their sole consumers were the deleted drift tests.
• The new CI step runs cargo run -p v3-compiler --bin regen_bootstrap then git diff --exit-code on the same three paths that regen_bootstrap.rs writes (bootstrap_std_generated.rs, bootstrap_generated.rs, bootstrap_generated_without_parse_surface.rs). Wiring lines up.
• Remaining scaffold helpers (bootstrap_std_fixtures_only, compile_std_bootstrap_dag, compile_full_bootstrap_dag_from_std_seed) all carry updated PB-1-e comments naming their sole consumer (regen_bootstrap) and bounded dissolution trigger (regen itself becoming .dag-driven). Tracked debt — accepted under the scaffold rule.
• The retained pb1_bootstrap_full_snapshot_test::full_bootstrap_extends_std_snapshot preserves the internal-consistency invariant (std snapshot is a prefix-shape of full).
• sg0_census_test and integration.rs are updated in lockstep with the deleted test file — no orphan census entry.

No findings against the diff.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 39b575dd · Trigger: schedule
• Thinking: 180s wall

---

Verdict: APPROVE

The diff is narrowly scoped and the DB-8 drift check is re-grounded in CI via regen_bootstrap plus a scoped clean-diff gate. I don’t see concrete violations of the pinned invariants, CODING, or TESTING docs.

Verified:
cargo test -p v3-compiler --test integration pb1_bootstrap_full_snapshot_test -- --nocapture
cargo run -p v3-compiler --bin regen_bootstrap + scoped git diff --exit-code on generated bootstrap files.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 39b575dd · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR retires the old in-tree “fresh runtime bootstrap vs generated snapshot” drift tests and replaces their enforcement point with a CI regen-clean gate. The load-bearing move is in .github/workflows/ci.yml:221-228: CI runs regen_bootstrap, then fails if the three committed bootstrap generated files differ from the freshly regenerated output. In parallel, the Rust bootstrap surface is narrowed: bootstrap_all_runtime is deleted from bootstrap.rs, the public no-arg full-runtime compile helpers are removed from lib.rs, and the remaining fresh-parse helpers are documented as regen-only scaffolds rather than production bootstrap paths. The tests are adjusted accordingly: pb1_bootstrap_full_snapshot_test.rs:3-8 now states that cargo-test coverage is internal snapshot consistency, while the fresh-parse acid test lives at regen time; the deleted std-only drift test is removed from both the integration module list and the hand-authored-test census.

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

N/A — this diff is implementation/test/CI plumbing around bootstrap regeneration, not a substrate model change: no Dag-resident type, dag.rs surface, new substrate variant, or cross-pass data carrier is introduced. The relevant changed lines explicitly route production bootstrap through the generated snapshot (src/v3/compiler/src/bootstrap.rs:135-136) and keep fresh parsing scoped to regen.

1. INVARIANTS.md + modeling-discipline.md.

Compliant — fail-closed and single-authority are handled by the regen gate: CI runs the authority-producing command (.github/workflows/ci.yml:221) and rejects drift with git diff --exit-code over the committed bootstrap outputs (.github/workflows/ci.yml:222-228). Progress/dissolution is also tracked: the remaining runtime-parse helpers are bounded to regen_bootstrap (src/v3/compiler/src/bootstrap.rs:132-136) and have a named dissolution trigger when regen_bootstrap is generated from a .dag regen-authority spec (src/v3/compiler/src/bootstrap.rs:145-148). Rubric basis: provided invariants/modeling docs. chatgpt-review-8feb40f4-f7d9-4d…

chatgpt-review-9c0a8b7a-7fd6-4e…

1. CODING.md.

Compliant — the PR moves away from hidden no-arg runtime bootstrap helpers by deleting compile_full_bootstrap_dag() and compile_full_bootstrap_without_parse_surface_dag() (src/v3/compiler/src/lib.rs:old1201-old1211) and retaining the explicit-seed helper shape (src/v3/compiler/src/lib.rs:1186-1188). That matches the explicit-dependencies / clear-interface preference in the coding rubric. chatgpt-review-5253938c-5880-44…

1. TESTING.md.

Compliant — the test responsibility is re-layered rather than simply removed: cargo tests retain the internal snapshot-consistency checks as documented in src/v3/compiler/tests/integration/pb1_bootstrap_full_snapshot_test.rs:3-8, while the expensive generated-artifact drift claim moves to the CI regen boundary at .github/workflows/ci.yml:221-228. The deleted std-only test is also removed from both the integration dispatch (src/v3/compiler/tests/integration.rs:old116-old117) and the SG0 census (src/v3/compiler/tests/integration/sg0_census_test.rs:old250), so there is no orphaned test inventory entry. chatgpt-review-b82cb30d-e0a0-4f…

1. LOCKED DESIGN DECISIONS.

Compliant — DB-8 is explicitly named and preserved as a deterministic-regeneration check, not silently weakened: the workflow comment states the gate replaces the in-tree drift tests with a CI-side fresh-compile byte-identity check (.github/workflows/ci.yml:213-218), and the test module documents the new split between internal consistency and regen-time acid testing (src/v3/compiler/tests/integration/pb1_bootstrap_full_snapshot_test.rs:3-8).

1. TRACKED vs UNTRACKED DEBT.

Compliant — the remaining scaffolds are tracked bridges with scope, bounds, and dissolution trigger. Scope/bounds: helpers exist solely for regen_bootstrap and are not production bootstrap paths (src/v3/compiler/src/lib.rs:1165-1169, src/v3/compiler/src/lib.rs:1182-1185). Trigger: delete them once regen_bootstrap is generated from a .dag regen-authority spec (src/v3/compiler/src/bootstrap.rs:145-148). I did not see new TODOs or unbounded temporary surfaces in the diff.

3. Verdict

APPROVE

I did not find a blocking or non-blocking finding against the changed lines. The PR narrows the runtime bootstrap surface, keeps DB-8 enforcement fail-closed via CI regen diffing, and documents the remaining scaffold with a concrete dissolution trigger.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 78d54578 · Trigger: schedule
• Thinking: 36s wall

---

Verdict: APPROVE — small, narrowly scoped retirement diff. bootstrap_all_runtime and the in-tree compile_*_bootstrap_dag()-vs-snapshot drift tests are removed in favor of a CI-side regen_bootstrap + git diff --exit-code gate (.github/workflows/ci.yml:217-227). The CI step diffs exactly the three files regen_bootstrap.rs writes, so the gate is tight. The remaining scaffold helpers (bootstrap_std_fixtures_only at bootstrap.rs:154, compile_std_bootstrap_dag at lib.rs:1170, compile_full_bootstrap_dag_from_std_seed at lib.rs:1185) each carry the documented + bounded + named-dissolution-trigger comment that INVARIANTS expects of a tracked bridge. The retained in-tree DB-8 cross-check (full_bootstrap_extends_std_snapshot) preserves the prefix-shape property without re-running the runtime parse on every cargo test. No modeling-discipline or CODING/TESTING violations observed in the diff.

Exploratory observation (non-blocking): the CI gate runs cargo run -p v3-compiler --bin regen_bootstrap but doesn't constrain features/profile, so any nondeterminism in render_bootstrap_*_generated_rs (e.g., HashMap iteration order) would surface as a confusing CI-only diff. If that ever bites, pinning the profile or asserting determinism inside regen_bootstrap itself would localize the failure.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 78d54578 · Trigger: schedule
• Thinking: 175s wall

---

Verdict: APPROVE — The diff cleanly retires bootstrap_all_runtime and moves fresh-compile drift detection to a CI regen + byte-diff gate. I don’t see a concrete invariant or rubric violation in the changed lines.

Checks passed: cargo test -p v3-compiler --test integration pb1_bootstrap_full_snapshot_test:: and git diff --check origin/main...HEAD.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 121b678d · Trigger: schedule
• Thinking: 34s wall

---

Diff is small and tightly scoped: retire bootstrap_all_runtime + the two runtime-vs-snapshot drift tests, and re-ground that DB-8 cross-check at regen-time via a CI git diff --exit-code after regen_bootstrap. Production bootstrap stays single-authority (Dag::new() → committed snapshot). The remaining scaffold helpers (compile_std_bootstrap_dag, *_from_std_seed) are documented as regen-only with a named dissolution trigger (regen authority itself moves to a .dag spec). sg0_census and the integration mod list are kept in sync with the deleted file.

The trade-off — losing local cargo test coverage of fresh-parse-vs-snapshot in exchange for a CI-only check — is explicitly called out in the brief reference and the file headers, so it qualifies as a tracked bridge rather than silent debt.

Verdict: APPROVE. Clean scaffold retirement with a properly grounded replacement gate; no invariant or modeling-discipline violations visible in the diff.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 121b678d · Trigger: schedule
• Thinking: 206s wall

---

Verdict: APPROVE

No findings. The diff cleanly retires the runtime drift tests, keeps the remaining regen-only scaffold documented and bounded, and re-grounds the DB-8 check through the new CI regen-clean gate without introducing a duplicate production bootstrap authority.

Verified locally:
cargo test -p v3-compiler --test integration pb1_bootstrap_full_snapshot_test::
cargo run -p v3-compiler --bin regen_bootstrap
git diff --exit-code -- src/v3/compiler/src/bootstrap_*_generated.rs

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 78d54578 · Trigger: schedule
• Thinking: 199s wall

---

✅ Mixed code/test/CI PR; no blocking concerns after checking PB-1-e’s locked mechanism and the changed file context.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 121b678d · Trigger: schedule
• Thinking: 207s wall

---

Non-blocking — Strengths

• .github/workflows/ci.yml The DB-8 fresh-compile check is enforced at the merge gate by running regen_bootstrap and diffing exactly the committed bootstrap snapshot outputs.
• src/v3/compiler/src/bootstrap.rs The remaining fresh-parse helpers are implementation-level regen scaffolds with explicit scope, bounds, and a named dissolution trigger.

ROADMAP — Verified

• PB-1-e: The diff retires bootstrap_all_runtime and the runtime-vs-snapshot test surface while preserving DB-8 through the regen-clean CI gate.

✅ No blocking concerns; the PR stays within the agreed mechanism and the current CI run passed, including the new bootstrap snapshot fresh-compile gate.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 121b678d · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR retires the old in-tree “fresh runtime bootstrap vs generated snapshot” comparison path by deleting bootstrap_all_runtime and the public full-bootstrap wrappers that depended on it: the removed helper seeded from Dag::std_fixture_bootstrap_snapshot() and then layered runtime authorities on top (src/v3/compiler/src/bootstrap.rs:147-162, deleted), and the removed exports compile_full_bootstrap_dag() / compile_full_bootstrap_without_parse_surface_dag() called that helper (src/v3/compiler/src/lib.rs:1201-1211, deleted). The replacement mechanism moves the DB-8 drift check to CI: regenerate the bootstrap snapshots from authority with cargo run -p v3-compiler --bin regen_bootstrap, then fail if the committed generated files differ (.github/workflows/ci.yml:221-228).

The remaining runtime-parse helpers are explicitly narrowed to regen-only scaffolding: bootstrap_std_fixtures_only exists so regen_bootstrap can produce committed snapshot files from canonical .dag authorities, while production bootstrap must use Dag::std_fixture_bootstrap_snapshot() or Dag::new() (src/v3/compiler/src/bootstrap.rs:132-136). The integration tests are correspondingly reshaped: the full snapshot test now documents that in-tree DB-8 coverage is internal snapshot consistency and prefix-shape checking, while fresh-parse-vs-snapshot parity is enforced by the regen-clean CI gate (src/v3/compiler/tests/integration/pb1_bootstrap_full_snapshot_test.rs:3-8), and the separate std snapshot drift test is deleted from the test registry and census (src/v3/compiler/tests/integration.rs:116-117, deleted; src/v3/compiler/tests/integration/sg0_census_test.rs:250, deleted).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Compliant — this diff does not add or alter Dag substrate types, variants, or cross-pass modeled facts; it removes an implementation bootstrap path and constrains the remaining runtime-parse helper as regen-only scaffolding: “Production bootstrap MUST seed from Dag::std_fixture_bootstrap_snapshot() or Dag::new() directly” (src/v3/compiler/src/bootstrap.rs:135-136).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — DB-8 / deterministic emission is re-grounded as a fail-closed generated-output check rather than as a second in-tree runtime authority: CI runs regen_bootstrap (.github/workflows/ci.yml:221) and then exits nonzero on any diff in the committed bootstrap generated files (.github/workflows/ci.yml:222-228). This preserves single-authority direction: .dag authority → regen → committed snapshot, with drift rejected instead of tolerated.

1. CODING.md.

Compliant — the PR reduces public implementation surface by deleting compile_full_bootstrap_dag() and compile_full_bootstrap_without_parse_surface_dag() (src/v3/compiler/src/lib.rs:1201-1211, deleted), and the remaining side-effecting filesystem check is kept at an allowed edge: CI/regen, not library code (.github/workflows/ci.yml:219-228).

1. TESTING.md.

Compliant — the deleted Rust integration drift tests are replaced by a behaviorally sharper CI gate that directly checks the generated artifacts after regen (.github/workflows/ci.yml:221-225). The retained test file also documents the revised test boundary: in-tree tests check committed snapshot consistency, while fresh-parse-vs-snapshot drift is checked at regen time (src/v3/compiler/tests/integration/pb1_bootstrap_full_snapshot_test.rs:3-8).

1. LOCKED DESIGN DECISIONS.

Compliant — the diff explicitly references DB-8 and keeps the locked deterministic-emission obligation intact by moving the acid test to the generation boundary, not dropping it: “Any drift … fails CI here” (.github/workflows/ci.yml:217-218). I do not see a divergence from a locked design decision in the changed lines.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the remaining scaffold is bounded, documented, and given a named dissolution trigger. The boundary is stated as regen-only (src/v3/compiler/src/bootstrap.rs:132-136), the CI ratchet is described (src/v3/compiler/src/bootstrap.rs:140-143), and the dissolution trigger is explicit: delete these helpers once regen_bootstrap is itself generated from a .dag regen-authority spec (src/v3/compiler/src/bootstrap.rs:145-148).

3. Verdict

APPROVE. The PR removes a parallel runtime bootstrap authority and replaces the DB-8 parity check with a fail-closed regen-clean CI gate. The remaining scaffold is clearly bounded and has a named dissolution trigger; I found no substrate, modeling, coding, or testing invariant violation in the diff.