DB-8

[briansrls]

Opened from session-dashboard for session keen-bear-80.

[briansrls]

Zero-Floor Manager review — strong architectural execution. Surfacing relationship to #787 for Director reconciliation call.

What this PR does

Extracts the full fresh-parse subsystem (tokenize/parse/lower deps + std_fixtures + STAGED/V3_SPECS/COMPILER includes + load_fixtures + parse_fixture) out of bootstrap.rs into a new bootstrap_regen_fresh.rs module, gated behind a bootstrap-regen-fresh Cargo feature. Production builds don't compile fresh-parse code at all; only regen_bootstrap (with the feature enabled) carries it.

Net diff: 183/-250 across 3 files. Substantial restructure, but mostly by relocation rather than logic change.

Why this is structurally stronger than #787

#787 (mechanism (ii)) retires the in-tree drift tests and adds a CI-side regen-clean gate, but the fresh-parse code (tokenize/parse/lower for bootstrap) stays in the production binary's compile graph — compile_full_bootstrap_dag_from_std_seed and friends remain pub fns with full deps.

#789 makes the scaffold-vs-production separation structural, not just documentary:

• Production v3-compiler binary doesn't link tokenize/parse/lower for bootstrap. The fresh-parse path literally doesn't exist in production builds.
• Feature flag enforces the boundary at compile time. A future drift where production code starts depending on bootstrap_regen_fresh would fail to compile without the feature — a stronger no-parallel-implementation gate than runtime/test discipline.
• DB-8 cross-check preserved: regen_bootstrap --verify (or whatever the regen flow is) builds with --features bootstrap-regen-fresh, exercises the fresh path, diffs against committed snapshots.

This is closer to the brief's mechanism (i)/(iii) territory in spirit — separating the regen scaffold from production via a structural mechanism rather than relying on file naming + comment policing.

Relationship to #787 — needs Director reconciliation

#787 (worker warm-raven-373) is active, CI green, codex-approved at acd5613c, mechanism (ii). I posted manager review deferring to Director on whether to accept (a) CI-side reframing or (b) insist on (i) reframe.

#789 is effectively answer (b) — and stronger than the brief's (i) lean. It addresses both:

• The DB-8 weakening worry (CI gate + structural feature flag both fire on snapshot drift)
• The process discipline gap (worker self-resolving a STOP gate is moot if the design call lands via DB-8 #789's structural fix)

Three reconciliation paths for Director:

1. Land DB-8 #789, abandon feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787. DB-8 #789 supersedes — its structural feature-flag separation gives strictly stronger no-parallel-implementation discipline than feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787's documentary-only retirement. Closes PB-1-e cleanly.
2. Stack: land feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787, then DB-8 #789 on top. feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787 retires the no-seed publics + drift tests; DB-8 #789 then restructures what's left behind a feature flag. Both contribute, in sequence. But feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787's compile_full_bootstrap_dag_from_std_seed retention conflicts with DB-8 #789's relocation of those into the feature-gated module — would need rebase work.
3. Land DB-8 #789, close feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787 as superseded. Same as (1) but explicit. Worker on feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787 didn't waste cycles — their CI-side regen-clean gate idea may transfer into DB-8 #789's regen flow as the cementing assertion.

Lean: (1) or (3). #789's structural separation is durably better; #787's CI-gate idea is good but is a sub-property of what #789 enables structurally.

Substantive review of #789 itself (not blocking the reconciliation question)

• ✅ Right scope: bootstrap.rs slims down to production paths only; bootstrap_regen_fresh.rs picks up fresh-parse subsystem.
• ✅ Feature flag at lib.rs module declaration: #[cfg(feature = "bootstrap-regen-fresh")] mod bootstrap_regen_fresh; is the right enforcement site.
• ✅ Helper visibility shifts: patch_kernel_bool_boolean_algebra_inhabits and materialize_pipeline_realizations go pub(crate) so the regen module can call them — minimal API surface bump.
• 🟡 Need to verify: regen_bootstrap binary updated to enable the feature in its Cargo.toml. CI is currently skipping; need green checks before this assertion is verified.
• 🟡 Need to verify: tests using compile_full_bootstrap_dag etc. — those still pass because they're behind the same feature, OR the tests are also retired (matching feat(v3): PB-1-e — retire bootstrap_all_runtime; re-ground DB-8 via regen-clean CI gate (mechanism ii) #787's test retirement). Diff of test files not visible in my partial view; need full check.

CI is skipping while draft. Mark ready when CI green; full checklist verdict pending CI close.

Pending Director call on #787 vs #789 reconciliation.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 5323de50 · Trigger: schedule
• Thinking: 153s wall

---

Findings

• src/v3/compiler/src/lib.rs:723 gates the moved fresh-bootstrap helpers behind regen_bootstrap_compile, removing the old root exports while src/bin/regen_bootstrap.rs and PB1 integration tests still import v3_compiler::compile_* from the crate root. cargo test -p v3-compiler --no-run now fails with unresolved imports for compile_std_bootstrap_dag and the full-bootstrap helpers. This violates the testing/build discipline: the PR leaves the existing test and regen entrypoints uncompilable.

Verdict: REQUEST_CHANGES. The refactor direction is understandable, but the package does not compile as submitted. Update the callers/gating and declare the feature if it is meant to exist.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 5323de50 · Trigger: schedule
• Thinking: 84s wall

---

Findings

• Build is broken — bootstrap-regen-fresh feature is referenced but never declared. src/v3/compiler/src/lib.rs:719,722 gates mod bootstrap_regen_fresh and pub mod regen_bootstrap_compile on cfg(feature = "bootstrap-regen-fresh"), but src/v3/compiler/Cargo.toml has no [features] section defining it. The new module is unreachable in every build configuration.

• regen_bootstrap binary fails to compile (src/v3/compiler/src/bin/regen_bootstrap.rs:4-5): it still imports compile_full_bootstrap_dag_from_std_seed, compile_full_bootstrap_without_parse_surface_dag_from_std_seed, and compile_std_bootstrap_dag from the crate root, but the diff deleted those public functions from lib.rs. Even if the feature flag existed, the binary imports from the wrong path (root, not regen_bootstrap_compile::) and Cargo.toml does not enable any default features for the bin. cargo check -p v3-compiler --bins errors with E0432.

• Integration tests fail to compile. tests/integration/pb1_bootstrap_full_snapshot_test.rs:4 imports compile_full_bootstrap_dag and compile_full_bootstrap_without_parse_surface_dag — both of these were entirely removed in the diff (lib.rs -1190..-1213) with no replacement anywhere, not even behind the new feature flag. tests/integration/pb1_bootstrap_std_snapshot_test.rs:4 imports compile_std_bootstrap_dag from the crate root, which is now gated behind a non-existent feature.

• Single-authority concern (lighter, but worth noting): bootstrap_regen_fresh.rs:1-30 re-include!s the same OUT_DIR arrays (v3_staged_files.rs, v3_specs.rs, v3_compiler_files.rs) and re-declares the LOGIC_DAG/BIT_DAG/... include_str! constants and EXTDEPS_BOOTSTRAP_FIXTURES. Since the originals were deleted from bootstrap.rs, this is a move rather than a duplication today — but the declaration_name_preference_rank helper is now unique to this regen-only module while the snapshot-baking process must continue to agree with whatever rank policy was used at bake time. Worth a comment that this rank policy is the single authority and any future runtime equivalent must be derived from it (CODING.md: cost of change = 1).

Verdict

REQUEST_CHANGES — the PR doesn't build. cargo check -p v3-compiler --bins --tests fails with three E0432s: the missing Cargo feature definition, the regen_bootstrap bin's imports, and the two PB-1 integration tests still calling deleted functions. Fix by (a) adding [features] bootstrap-regen-fresh = [] (and likely default = ["bootstrap-regen-fresh"] or enabling it for the bin/tests), (b) repointing the bin and tests at v3_compiler::regen_bootstrap_compile::*, and (c) deciding what replaces the deleted compile_full_bootstrap_dag / compile_full_bootstrap_without_parse_surface_dag consumed by pb1_bootstrap_full_snapshot_test.rs.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 9558204a · Trigger: schedule
• Thinking: 235s wall

---

BLOCKING (1)

Root Cause

• src/v3/compiler/src/lib.rs regen API was moved behind a gated submodule without wiring the Cargo/bin boundary → declare the feature and either keep feature-gated crate-root re-exports or update regen_bootstrap.rs to import v3_compiler::regen_bootstrap_compile::*.

Non-blocking — Strengths

• src/v3/compiler/src/bootstrap_regen_fresh.rs Feature-gating the fresh tokenize/parse/lower bootstrap path is the right structural separation for the pure-bootstrap and no-parallel-implementations invariants once the regen path is reachable.

ROADMAP — Incomplete

• DB-8: The fixed-point ratchet intent is preserved structurally, but the regen verification lane is incomplete until the gated fresh path can be built and run.

⚠️ The shape is good, but the gated regen path must compile before this can land.

[briansrls]

Verified on current session/keen-bear-80 tip — this finding matched an earlier revision (before [features] landed) and is not true of HEAD:

1. Feature is declared: src/v3/compiler/Cargo.toml has [features] → bootstrap-regen-fresh = [] (Cargo.toml:11–14), and regen_bootstrap is the only bin with required-features = ["bootstrap-regen-fresh"] (Cargo.toml:33–36).

2. Crate-root imports resolve when the feature is on: lib.rs gates mod bootstrap_regen_fresh / pub mod regen_bootstrap_compile on the same cfg(feature = "bootstrap-regen-fresh") (lib.rs:719–731), and re-exports the three compile_* helpers at the crate root under the same cfg (lib.rs:733–741). So regen_bootstrap.rs importing v3_compiler::{ compile_std_bootstrap_dag, … } is intentional and type-correct for that build configuration.

3. DB-8 verify path: CI runs cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify so the feature is enabled for the fresh-vs-snapshot gate.

Local repro: cargo check -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap succeeds. (A bare cargo check --bin regen_bootstrap without --features errors by Cargo design for any required-features target — same hint Cargo prints on the CLI.)

[briansrls]

Re-verified (dashboard relay, 2026-04-25) on feb131420 — finding still not applicable to HEAD.

1. bootstrap-regen-fresh is declared in src/v3/compiler/Cargo.toml [features] (lines 11–14) and regen_bootstrap has required-features = ["bootstrap-regen-fresh"] (lines 33–36).

2. Crate-root compile_* symbols exist when the feature is on: lib.rs:737–741 pub use regen_bootstrap_compile::{ … } under the same #[cfg(feature = "bootstrap-regen-fresh")] as mod bootstrap_regen_fresh / regen_bootstrap_compile (719–731). So regen_bootstrap.rs importing v3_compiler::{ compile_std_bootstrap_dag, … } is the intended surface for the regen build.

3. Compiles: cargo check -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap ✅ on this tip.

4. DB-8: CI still runs cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify.

The blocking text describes an older tree (pre-[features] / pre–crate-root re-export). No code change required for this ping.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5323de50d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep bootstrap compile helpers reachable to existing callers

This change moves the fresh-bootstrap helpers behind regen_bootstrap_compile with #[cfg(feature = "bootstrap-regen-fresh")], but the existing call sites still import them from the crate root (src/v3/compiler/src/bin/regen_bootstrap.rs and src/v3/compiler/tests/integration/pb1_bootstrap_*). As a result, cargo build -p v3-compiler/cargo test -p v3-compiler --test integration now fail with unresolved imports (E0432), so the package no longer builds.

Useful? React with 👍 / 👎.

[briansrls]

Verified on current session/keen-bear-80 tip (8d12a06df):

1. PB-1 integration tests no longer import compile_* from the crate root — they only use generated_* + Dag::new() / serialize (pb1_bootstrap_full_snapshot_test.rs imports generated_full_bootstrap_dag, etc.; pb1_bootstrap_std_snapshot_test.rs imports generated_std_bootstrap_dag only). The word compile_full_bootstrap_* appears only in a module doc comment.

2. cargo build -p v3-compiler succeeds on default features (regen bin is skipped via required-features).

3. cargo test -p v3-compiler --test integration --no-run succeeds — no E0432.

4. regen_bootstrap still imports compile_* from v3_compiler::…, which is OK because lib.rs re-exports those three symbols at the crate root under the same #[cfg(feature = "bootstrap-regen-fresh")] as regen_bootstrap_compile, and the bin declares required-features = ["bootstrap-regen-fresh"] so that configuration is the one used when the bin is built for regen/CI.

So the “package no longer builds / integration E0432” outcome was accurate for an intermediate diff, but not for HEAD.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 5323de50 · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR separates the “fresh tokenize/parse/lower bootstrap” path from the production bootstrap path. bootstrap.rs is trimmed back to the runtime/snapshot-facing pieces, and its header now states that staged/spec/compiler/extdeps fresh loading lives in bootstrap_regen_fresh.rs behind bootstrap-regen-fresh; Dag::new() no longer loads those authorities from disk at runtime (src/v3/compiler/src/bootstrap.rs:8-11). The moved fresh path is reintroduced as a feature-gated module that compiles std fixtures, then layers staged/spec/compiler authorities from an explicit std seed (src/v3/compiler/src/bootstrap_regen_fresh.rs:45-59, src/v3/compiler/src/bootstrap_regen_fresh.rs:112-146). The crate-root public API is tightened: fresh compile helpers are removed from the default public surface and re-exported only through regen_bootstrap_compile when the feature is enabled (src/v3/compiler/src/lib.rs:719-727), while the generated snapshot helpers remain the default production entry points (src/v3/compiler/src/lib.rs:1177-1184).

2. Invariant categories

1. LAYER MODEL — N/A.

N/A — this is an implementation-level Rust bootstrap/refactor change; it does not add or alter substrate types, dag.rs variants, or cross-pass data carriers. The load-bearing layer decision is the feature boundary at src/v3/compiler/src/lib.rs:719-727.

1. INVARIANTS.md + modeling-discipline.md — Compliant.

Boundary Discipline / single authority: the default runtime path is explicitly kept on committed generated snapshots, while fresh on-disk parsing is confined to the regen feature path (src/v3/compiler/src/bootstrap.rs:8-11, src/v3/compiler/src/lib.rs:719-727). Fail-closed handling is preserved in the moved parser helper: tokenize/parse errors attach diagnostics before returning absence (src/v3/compiler/src/bootstrap_regen_fresh.rs:152-160).

1. CODING.md — Compliant.

The new surface stays in data + free-function style with explicit inputs: compile_full_bootstrap_dag_from_std_seed(std_seed: Dag) -> Dag takes the seed directly rather than hiding it behind global state (src/v3/compiler/src/bootstrap_regen_fresh.rs:51-55), and the production/root namespace is narrowed by moving these helpers under the feature-gated regen_bootstrap_compile module (src/v3/compiler/src/lib.rs:722-727).

1. TESTING.md — Finding, NON-BLOCKING.

src/v3/compiler/src/lib.rs:719 adds #[cfg(feature = "bootstrap-regen-fresh")], so default cargo test will not type-check bootstrap_regen_fresh.rs. The diff adds the feature-only fresh bootstrap path (src/v3/compiler/src/bootstrap_regen_fresh.rs:45-59) but does not add or wire a feature build / regen verification test in the diff, which leaves this moved path dependent on out-of-band CI coverage. A focused cargo check/test path under bootstrap-regen-fresh, or explicit wiring into the regen-bootstrap verification job, would close this.

1. LOCKED DESIGN DECISIONS — Compliant.

The diff does not alter a locked substrate design surface; it preserves the generated snapshot as the production bootstrap authority via generated_std_bootstrap_dag() and generated_full_bootstrap_dag() (src/v3/compiler/src/lib.rs:1177-1184) and isolates the PB-1-e fresh/snapshot acid-test mechanism to regen-only code (src/v3/compiler/src/bootstrap_regen_fresh.rs:3-7).

1. TRACKED vs UNTRACKED DEBT — Finding, NON-BLOCKING.

The new module documents scope and bounds — “only” for regen_bootstrap, behind bootstrap-regen-fresh, and not on every cargo test (src/v3/compiler/src/bootstrap_regen_fresh.rs:3-7) — but the moved fresh-bootstrap scaffold no longer carries the named dissolution trigger that the removed helper documented (src/v3/compiler/src/lib.rs:1165-1169). Because this is still the fresh-vs-snapshot side path, the new module should either preserve the dissolution trigger or explicitly reclassify the path as a permanent regen verification mechanism rather than scaffold debt.

3. Verdict

APPROVE_WITH_COMMENTS

The structural direction is good: production bootstrap authority is narrowed to generated snapshots, and the fresh path is isolated behind a regen-only feature boundary. The two comments are non-blocking but worth tightening: feature-gated code needs explicit build/verification coverage, and the moved PB-1 scaffold should not lose its debt tracking trigger.

[briansrls]

Re: codex blocking review @ `9558204af` (scheduled) — verified against current tip `8d12a06df`

That review’s root cause was real on `9558204a` (no `[features]` in `src/v3/compiler/Cargo.toml`; see `git show 9558204:src/v3/compiler/Cargo.toml` — only `[dependencies]`). It is not true of HEAD.

Current wiring (DB-8 / regen lane compiles and runs):

• `Cargo.toml`: `[features] bootstrap-regen-fresh = []`, `autobins = false`, explicit `[[bin]]`s, `regen_bootstrap` has `required-features = ["bootstrap-regen-fresh"]`.
• `lib.rs`: `#[cfg(feature = "bootstrap-regen-fresh")]` on `bootstrap_regen_fresh` + `regen_bootstrap_compile`, plus crate-root `pub use` of the three `compile_*` helpers under the same cfg (so `regen_bootstrap` can import from `v3_compiler::…` when the feature is on).
• CI: `cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify`.

Local verification on `8d12a06df`:

• `cargo check -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap` ✅
• `cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify` ✅ (`committed snapshots match fresh compile`)

So the “gated regen path must compile before this can land” gate is satisfied on the branch tip; the bot was pinned to an older SHA where the Cargo/feature boundary had not landed yet.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: ef42ea33 · Trigger: schedule
• Thinking: 48s wall

---

This PR scopes the fresh-parse bootstrap path behind a bootstrap-regen-fresh Cargo feature, used only by the regen_bootstrap binary, and moves the fresh-compile-vs-snapshot drift check from cargo test integration tests to a CI regen_bootstrap --verify step.

What I verified:

• Single authority preserved. declaration_name_preference_rank, load_fixtures, std_fixtures, parse_fixture, etc. were moved out of bootstrap.rs (lines 257-265, 342-386, 423-438 deleted) into bootstrap_regen_fresh.rs (new). They are not duplicated — old bootstrap.rs no longer carries them. The note at bootstrap_regen_fresh.rs:24-27 makes the lockstep contract explicit.
• Production path unchanged. Dag::new() still loads committed snapshots; compile_full_bootstrap_dag() / compile_full_bootstrap_without_parse_surface_dag() are removed from lib.rs:1212-1228, and the only fresh-parse entry points live behind the feature flag and re-export at lib.rs:657-673.
• Drift contract still gated. .github/workflows/ci.yml:17-18 invokes regen_bootstrap -- --verify, and the assert_disk_matches helper at regen_bootstrap.rs:151-166 panics on mismatch with a clear remediation message. The retired cargo test drift cases (pb1_bootstrap_full_snapshot_test.rs, pb1_bootstrap_std_snapshot_test.rs) are replaced with cheap structural pins (clean diagnostics, expected names present).
• Scaffold dissolution. The header at bootstrap_regen_fresh.rs:10-15 reclassifies the module as permanent PB-1-e regen substrate (not the old "delete when drift harness retires" scaffold) with an explicit dissolution trigger ("PB-Bootstrap-Process replaces this hand-Rust regen host with a declared bootstrap.dag"). Documented + bounded + named — meets the tracked-debt bar.
• autobins = false in Cargo.toml:33 plus explicit [[bin]] listings is a sensible guardrail to prevent a new src/bin/*.rs from silently inheriting the feature gate.

Minor observations (non-blocking, not asks):

• The compile_* helpers are exposed via three paths under the same cfg: bootstrap_regen_fresh (mod), regen_bootstrap_compile (public re-export module), and crate-root re-exports (lib.rs:669-673). The crate-root pub use and the regen_bootstrap_compile wrapper both exist; one could be dropped to leave a single import surface, but this is style, not authority.
• The #[cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code))] sprinkled across bootstrap.rs:84, bootstrap.rs:172, bootstrap.rs:236, lower.rs:2189, dag.rs:2168, and three fields of PipelineStageAuthority is a lot of cfg surface to keep in sync if more helpers become regen-only. Consider whether materialize_pipeline_realizations + patch_kernel_bool_boolean_algebra_inhabits would be cleaner relocated into bootstrap_regen_fresh.rs so the cfg attribute footprint shrinks. Not required.

Verdict: APPROVE — the diff cleanly enforces "production uses snapshots, regen has the only fresh-parse path" and preserves single authority for the staged-vs-dsl/ ranking policy. The CI --verify gate keeps the drift contract intact.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: ef42ea33 · Trigger: schedule
• Thinking: 144s wall

---

Verdict: APPROVE

This looks clean. The diff keeps the fresh bootstrap path out of the default runtime graph, adds a CI regen_bootstrap --verify gate for snapshot drift, and the scaffold/feature boundary is documented and bounded.

Verified locally:
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify
cargo test -p v3-compiler --no-run --features bootstrap-regen-fresh
git diff --check origin/main...HEAD

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 0c44da14 · Trigger: schedule
• Thinking: 69s wall

---

This PR splits the fresh tokenize/parse/lower bootstrap path out of bootstrap.rs into a feature-gated bootstrap_regen_fresh.rs module that only the regen_bootstrap binary enables. Production lib builds (and Dag::new()) now never compile fresh-parse code; the snapshot-vs-fresh-compile drift gate moves from in-tree integration tests to a CI step (regen_bootstrap --verify). The runtime drift tests in pb1_bootstrap_*_snapshot_test.rs are retired in favor of structural-stability assertions.

I read the diff against INVARIANTS.md, docs/modeling-discipline.md, CODING.md, and TESTING.md. No violations.

Notes on the principles I weighed:

• Single authority / facts flow forward. Moving STAGED_FILES / V3_SPECS / COMPILER_FILES include!s and declaration_name_preference_rank into bootstrap_regen_fresh.rs (and out of bootstrap.rs) keeps the staged-vs-dsl/ tie-break in exactly one place. The committed snapshot is downstream of that policy via regen — not a parallel representation.
• Tracked debt. bootstrap_regen_fresh.rs:9-15 documents classification, dissolution trigger ("PB-Bootstrap-Process replaces this hand-Rust regen host with a declared bootstrap.dag"), and bounded scope (regen verification only). Three properties present.
• Layer. This is implementation-layer scaffolding, not substrate; cfg_attr(allow(dead_code)) annotations on pipeline_authority.rs:19-26, lower.rs:2189, dag.rs:2166, and bootstrap.rs:88/171/235 are appropriate Rust hygiene for code that's only live with the feature.
• Testing. The retired drift assertions (generated_full_bootstrap_snapshot_matches_runtime_full_bootstrap, generated_std_bootstrap_snapshot_matches_runtime_std_bootstrap) are replaced by the CI --verify step at .github/workflows/ci.yml:217-221, plus structural smoke tests at pb1_bootstrap_full_snapshot_test.rs:25-43 and pb1_bootstrap_std_snapshot_test.rs:7-21. The contract is preserved; enforcement just moved one layer out.

Exploratory observations (non-blocking)

• Local cargo test no longer catches snapshot drift. Previously compile_std_bootstrap_dag vs generated_std_bootstrap_dag ran on every cargo test. Now drift is only caught by cargo run … --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify in CI. A developer editing a .dag and running cargo test will pass locally and break CI. Worth a one-line note in CLAUDE.md or a pre-push hook addition. The PR body presumably covers this trade — calling it out for completeness.
• Two re-export paths (v3_compiler::regen_bootstrap_compile::compile_* and v3_compiler::compile_*, lib.rs:721-739) for the same three functions. Minor; the diff explains why (call-site convenience). Could be one path.
• The mod tests block in bootstrap.rs (still present, untouched) calls materialize_pipeline_realizations — that's why it remained in bootstrap.rs rather than moving with the rest. Consider a comment at the top of bootstrap.rs explaining what's left and why, since the file is now ~80% empty after the move.

Verdict

APPROVE — clean scaffolding refactor with documented dissolution. Single-authority preserved, drift gate intact (relocated, not removed), feature boundary is enforced by autobins = false + required-features so a stray src/bin/*.rs can't accidentally pull the regen path into a default build.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 0c44da14 · Trigger: schedule
• Thinking: 236s wall

---

Verdict: APPROVE

This looks clean. I found no diff-grounded violations of the pinned invariants, modeling discipline, coding guidance, or testing guidance. The fresh bootstrap path is feature-gated, has a named dissolution path, and the replacement regen_bootstrap --verify receipt passed locally.

Verified:
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify
cargo test -p v3-compiler --no-run --features bootstrap-regen-fresh
cargo test -p v3-compiler --no-run

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 14c27569 · Trigger: schedule
• Thinking: 65s wall

---

Looking at this PR carefully against the modeling discipline rubric.

What this PR does: Moves the fresh tokenize/parse/lower bootstrap path out of the production lib build and behind Cargo feature bootstrap-regen-fresh, gated on the regen_bootstrap binary alone via required-features. The runtime "fresh-compile vs snapshot" drift tests are retired from cargo test and replaced with regen_bootstrap --verify in CI.

Modeling check:

• Single authority (INVARIANTS): Strengthened, not weakened. Before, bootstrap.rs carried both the snapshot path and a parallel fresh-parse path that production lib builds compiled. After, the production lib has exactly one bootstrap authority (Dag::new() → committed snapshot); the fresh-parse path is feature-gated to regen only. The required-features + autobins = false (Cargo.toml:33,50) is real API-level enforcement — symbols don't exist in production builds.
• No duplication: EXTDEPS_BOOTSTRAP_FIXTURES, std_fixtures(), load_fixtures(), declaration_name_preference_rank() are removed from bootstrap.rs and only live in bootstrap_regen_fresh.rs. Shared helpers patch_kernel_bool_boolean_algebra_inhabits and materialize_pipeline_realizations correctly stay single-source in bootstrap.rs and are called from regen via pub(crate) (bootstrap.rs:92,175) — single authority preserved.
• Tracked debt: bootstrap_regen_fresh.rs:8-15 documents (1) classification, (2) bounded scope (regen verification only), and (3) a named dissolution trigger ("when PB-Bootstrap-Process replaces this hand-Rust regen host with a declared bootstrap.dag"). All three properties present.
• Fail-closed: regen_bootstrap --verify panics on drift with a clear remediation message (regen_bootstrap.rs:156-165). CI invokes it (ci.yml:18). The acid test still exists; it just moved from runtime tests to a dedicated CI step.
• Test discipline (TESTING.md): The replacement integration tests (generated_full_bootstrap_snapshots_are_clean, generated_std_bootstrap_snapshot_is_clean_and_substantive) are weaker than the drift checks they replaced taken in isolation, but the drift contract is now enforced in a single authoritative place (the regen --verify step) — that's the correct factoring rather than test duplication.

Minor exploratory observations (non-blocking):

• CI now clippies with --features bootstrap-regen-fresh but doesn't separately clippy the default feature set. The #[cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code))] annotations sprinkled through pipeline_authority.rs:19,22,24, lower.rs:2189, dag.rs:2166, bootstrap.rs:92,175,242 suggest the no-feature build was hand-checked, but a default-feature clippy step would lock that in. Not required.
• Two pub use paths to the same three compile_* symbols (lib.rs:667-672 and 679-682) — the inner regen_bootstrap_compile module + the crate-root re-export. The doc comment justifies it but it's two surfaces for the same three symbols. If only one call style is in use, dropping the other would simplify.

Verdict: APPROVE — this is a well-designed authority consolidation. The fresh-parse bootstrap is now provably absent from production builds (Cargo-level enforcement, not just convention), single authority is preserved across shared helpers, and the drift acid test is preserved at a single authoritative location (regen_bootstrap --verify in CI). Dissolution trigger is documented.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 14c27569 · Trigger: schedule
• Thinking: 151s wall

---

Verdict: APPROVE

No concrete violations found in the diff. The regen-only bootstrap path is feature-gated, has an explicit dissolution trigger, and the snapshot drift check moved to regen_bootstrap --verify without weakening DB-8 coverage.

Verification run:

• cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify
• cargo test -p v3-compiler --no-run --features bootstrap-regen-fresh
• git diff --check origin/main...HEAD

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 14c27569 · Trigger: schedule
• Thinking: 271s wall

---

Non-blocking — Strengths

• .github/workflows/ci.yml The default-feature plus bootstrap-regen-fresh CI steps turn the regen feature boundary into an executable API-level check.
• src/v3/compiler/src/bootstrap_regen_fresh.rs The fresh tokenize/parse/lower path is isolated behind bootstrap-regen-fresh with a named PB-Bootstrap-Process dissolution trigger, so it does not become a production bootstrap authority.

ROADMAP — Verified

• DB-8: The fixed-point ratchet now has a required regen_bootstrap --verify gate on the PR CI path.

✅ No blocking concerns; the prior gated-regeneration compile gap is fixed.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: feb13142 · Trigger: schedule
• Thinking: 69s wall

---

Findings

None blocking. The change is consistent with the PB-1-e brief (docs/briefs/pb-1-e-residual-scaffold-retirement-worker.md) and preserves single authority — the fresh tokenize/parse/lower path moves wholesale to bootstrap_regen_fresh.rs rather than being duplicated, and the std/extdeps include_str! constants now live in exactly one place. The cross-check that fresh-parse equals the committed snapshot moves from cargo test to CI's regen_bootstrap --verify step (.github/workflows/ci.yml:24), which is a stricter byte-equality check on rendered Rust.

A few small observations (non-blocking):

• lib.rs:719-740 exports the regen helpers twice: once as pub mod regen_bootstrap_compile { pub use ... } and again as pub use regen_bootstrap_compile::{...} at the crate root. Two paths for the same three symbols — pick one to keep the surface narrow. Not a substrate concern, just API hygiene given CODING.md's preference for one obvious path.
• Local enforcement gap. Previously generated_full_bootstrap_snapshot_matches_runtime_full_bootstrap and the std equivalent ran inside cargo test, so a stale snapshot was caught locally. After this PR the only enforcement is the CI step (and developers remembering to run regen_bootstrap --verify before push). The PR header comment in regen_bootstrap.rs:8-12 documents this; worth considering a pre-push hook addition in a follow-up to mirror the cargo fmt pattern already in .githooks/.
• #[cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code))] is sprinkled on Dag::empty, resolve_pending_identifiers, three bootstrap.rs helpers, and three PipelineStageAuthority fields. The CI now clippies both feature graphs (ci.yml:13-16), so this stays honest, but the pub(crate) + allow(dead_code) combo is load-bearing scaffolding — if any future caller appears in the default-feature graph, the allow will silently mask the new dependency. Worth a one-liner doc comment on Dag::empty saying "if you find yourself wanting this in the default graph, the regen-vs-runtime authority split needs revisiting."

Verdict

APPROVE_WITH_COMMENTS — clean execution of the PB-1-e split. Single authority preserved, dissolution trigger documented in bootstrap_regen_fresh.rs:11-15, CI gate added. The one substantive question (loss of in-test drift detection) is mitigated by --verify in CI and explicitly framed in the PR's design.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: b84f762d · Trigger: schedule
• Thinking: 59s wall

---

This is a well-scoped PB-1-e refactor: it isolates the fresh tokenize/parse/lower bootstrap behind feature bootstrap-regen-fresh so it's only compiled into regen_bootstrap, and replaces the in-repo runtime-vs-snapshot drift tests with a regen_bootstrap --verify CI gate.

I checked the change against modeling discipline (single authority, scaffold dissolution rules) and the relevant CODING/TESTING guidance:

• Single authority preserved. The fresh-parse helpers (load_fixtures, std_fixtures, parse_fixture, declaration_name_preference_rank, bootstrap_std_fixtures_only, load_runtime_bootstrap_authorities) move from bootstrap.rs (lines 219–402, 439–454 deleted) into the new bootstrap_regen_fresh.rs. materialize_pipeline_realizations and patch_kernel_bool_boolean_algebra_inhabits stay in bootstrap.rs and are called via crate::bootstrap::… from the regen module — not duplicated. Good.
• Tracked-bridge criteria met. bootstrap_regen_fresh.rs:11–16 gives an explicit dissolution trigger (PB-Bootstrap-Process replacing the hand-Rust regen host with a bootstrap.dag). Cargo.toml:37–45 and dag.rs:652–656 document the boundary and warn against growing allow(dead_code) on Dag::empty() for default-feature callers.
• Acid test relocated, not weakened. pb1_bootstrap_full_snapshot_test.rs and pb1_bootstrap_std_snapshot_test.rs retire the runtime-vs-generated first_difference checks; the equivalent contract is now cargo run … --bin regen_bootstrap -- --verify in ci.yml:223–224. The new in-tree tests still pin clean diagnostics, byte stability, and structural inclusion (Bool in std, parse stage in full).
• cfg_attr(not(feature)…allow(dead_code)) discipline. Each annotation has a short justification (bootstrap.rs:269, dag.rs:652–656, pipeline_authority.rs:18–22, lower.rs:2189). The Dag::empty() comment explicitly tells future maintainers to revisit the split rather than add more allow(dead_code). That's the right framing.
• CI coverage matrix. Three orthogonal gates: default-feature clippy --all-targets, regen-feature clippy + cargo test --no-run, and --verify. Good belt-and-suspenders for the dead-code annotations.

Exploratory observations (not asks)

• compile_std_bootstrap_dag does let mut dag = Dag::empty(); bootstrap_std_fixtures_only(&mut dag);, and bootstrap_std_fixtures_only immediately re-runs *dag = Dag::empty(); (bootstrap_regen_fresh.rs:524–546). One redundant init. Trivially collapsible if you ever touch this again — not worth a churn commit.
• assert_disk_matches (regen_bootstrap.rs:158–173) panics with byte-length only — fine for a CI gate, but if a fresh failure ever lands in practice, a tiny first_difference-style hint (or pointing at the first divergent byte) would shorten the recovery loop. No need to do it pre-emptively.

Verdict

APPROVE — diff is a clean substrate-vs-implementation split. The fresh-parse path was always implementation glue for regen; gating it behind a feature both shrinks the default build graph and tightens the snapshot-as-single-authority story. No invariant violations observed.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: b84f762d · Trigger: schedule
• Thinking: 158s wall

---

Verdict: APPROVE

Diff is narrowly scoped and the PB-1-e split looks clean: fresh bootstrap compilation is feature-gated to regen_bootstrap, the snapshot drift check moved to --verify, and CI now exercises that path. No concrete violations of the pinned invariants observed.

Verified:
cargo check -p v3-compiler --lib
cargo check -p v3-compiler --bin regen_bootstrap --features bootstrap-regen-fresh
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify
cargo test -p v3-compiler --test integration pb1_bootstrap -- --nocapture

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: d84ef33e · Trigger: schedule
• Thinking: 62s wall

---

Findings

None blocking. A couple of optional style nits if you want them:

• src/v3/compiler/src/lib.rs:719-741 exposes the same three compile_* helpers twice — once via pub mod regen_bootstrap_compile { pub use … } and again via crate-root pub use regen_bootstrap_compile::{…}. Both are #[cfg(feature = "bootstrap-regen-fresh")] so it's safe, but the doc-comment justification ("call sites and tests that import compile_* from v3_compiler without reaching into the submodule") could be satisfied by just the crate-root re-export — the inner pub mod looks vestigial.
• src/v3/compiler/src/bootstrap_regen_fresh.rs:73-83: bootstrap_std_fixtures_only and bootstrap_runtime_authorities_on are single-use private wrappers each delegating to one helper. Inlining would shorten the file by ~10 lines without losing clarity.
• src/v3/compiler/src/bin/regen_bootstrap.rs:101-110: assert_disk_matches reports only byte lengths on mismatch. Since the previous in-test drift harness used first_difference for human-readable diffs, surfacing a first-diff offset (or even the line number) here would make CI failures less of a "rerun and eyeball the file" exercise. Not blocking — the panic message tells you exactly which command to run.

Verdict

APPROVE — the diff cleanly relocates the fresh-tokenize/parse/lower path into a feature-gated bootstrap_regen_fresh module and re-grounds the DB-8 drift contract on regen_bootstrap --verify (now wired in CI). Single-authority is preserved: Dag::new() remains the only production seed, and the regen path is the lone fresh-parse consumer of the same OUT_DIR fixture arrays. The cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code)) annotations are tightly scoped to items only the feature-on path uses, and the explicit autobins = false + per-bin manifest stops a future src/bin/*.rs from silently inheriting the feature. The bootstrap_regen_fresh.rs module header documents classification, dissolution trigger, and single-authority constraint in line with the modeling discipline for tracked scaffolds.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: d84ef33e · Trigger: schedule
• Thinking: 82s wall

---

Verdict: APPROVE

No concrete violations observed in the diff. The regen-only fresh bootstrap path is feature-gated, --verify fails closed on snapshot drift, and the runtime bootstrap remains snapshot-based. Checked with cargo check -p v3-compiler, cargo check -p v3-compiler --features bootstrap-regen-fresh, and cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: f68c09d9 · Trigger: schedule
• Thinking: 67s wall

---

Verdict: APPROVE — clean PB-1-e split with no diff-grounded violations.

The refactor moves fresh-tokenize/parse/lower into a feature-gated bootstrap_regen_fresh.rs module, retires the runtime-vs-snapshot drift integration tests in favor of a regen_bootstrap --verify CI gate, and removes the now-unused public scaffold helpers from lib.rs. Single-authority is preserved: declaration_name_preference_rank, load_fixtures, and the fixture lists live in exactly one place (the regen-only module). The shared substrate-level helpers materialize_pipeline_realizations / patch_kernel_bool_boolean_algebra_inhabits remain in bootstrap.rs because the #[cfg(test)] module there genuinely uses them (verified at bootstrap.rs:412), so the cfg_attr(not(feature=...), allow(dead_code)) gating is correct rather than a dead-code papering. Dissolution trigger for the new module is documented (bootstrap_regen_fresh.rs:11-15), and the Dag::empty() annotation explicitly forbids growing the allow(dead_code) instead of revisiting the split (dag.rs:2166-2167) — that's tracked-debt with all three properties present.

Exploratory observation (non-blocking): moving the fresh-vs-snapshot acid test out of cargo test means a local cargo test run no longer detects bootstrap snapshot drift; only cargo run --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify (or CI) catches it. The CI step at ci.yml:223-224 enforces this, and assert_disk_matches produces a useful hint, so the loss is purely local-feedback latency. Worth flagging in a developer-facing doc if not already, but not a violation.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: d84ef33e · Trigger: schedule
• Thinking: 291s wall

---

Non-blocking — Strengths

• src/v3/compiler/src/bootstrap_regen_fresh.rs The fresh tokenize/parse/lower path is bounded to the regen host with a named PB-Bootstrap-Process dissolution trigger, so it does not become a production bootstrap authority.
• .github/workflows/ci.yml The v3 CI job now exercises default clippy, feature clippy, feature test linkage, and regen_bootstrap --verify.

ROADMAP — Verified

• DB-8: The current PR head has a successful ci workflow including the regen_bootstrap --verify gate and staged self_host_ratchet checks.

✅ No blocking concerns; the DB-8 verification path looks clean.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: f68c09d9 · Trigger: schedule
• Thinking: 137s wall

---

Verdict: APPROVE

The diff is narrowly scoped: fresh bootstrap regen moves behind bootstrap-regen-fresh, and the deleted runtime drift tests are replaced by the regen_bootstrap --verify gate. I found no concrete violations of the pinned invariants, coding discipline, or testing guidance.

Verified with:
cargo check -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap
cargo check -p v3-compiler --all-targets
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: f68c09d9 · Trigger: schedule
• Thinking: 328s wall

---

Non-blocking — Strengths

• src/v3/compiler/src/bootstrap_regen_fresh.rs The fresh tokenize/parse/lower path is feature-gated to the regen host with a named PB-Bootstrap-Process dissolution trigger, so it stays out of the default Dag::new() authority.
• .github/workflows/ci.yml CI now checks default clippy, feature clippy, feature test linkage, and regen_bootstrap --verify, which closes the DB-8 snapshot drift gate.

ROADMAP — Verified

• DB-8: Head workflow run 24924996730 completed successfully, including the added bootstrap verification gates.

✅ No blocking concerns found; the PR cleanly fixes the prior feature/linkage gap and keeps the fresh bootstrap path bounded to verification.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: f68c09d9 · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR moves the fresh tokenize/parse/lower bootstrap path out of the default compiler build and behind a new bootstrap-regen-fresh feature. Production Dag::new() remains snapshot-backed, while regen_bootstrap becomes the explicit host for rebuilding or verifying the committed bootstrap_*_generated.rs snapshots. The load-bearing mechanism is the Cargo boundary: autobins = false plus explicit [[bin]] entries make regen_bootstrap the only listed binary with required-features = ["bootstrap-regen-fresh"], and lib.rs only re-exports the fresh bootstrap constructors under that feature.

The old runtime-vs-generated integration drift tests are retired in favor of a CI regen_bootstrap --verify gate that recompiles from .dag authorities and byte-compares against committed snapshots. The remaining default integration tests now pin cheap structural properties of the committed snapshots, while the fresh bootstrap implementation lives in bootstrap_regen_fresh.rs with a documented dissolution trigger toward a future data-native bootstrap producer.

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Compliant — this touches dag.rs but does not introduce a new Dag-resident substrate fact, variant, or cross-pass representation; the only Dag change is scoping the existing Dag::empty dead-code allowance to the regen-feature split at src/v3/compiler/src/dag.rs:2170: #[cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code))].

1. INVARIANTS.md + modeling-discipline.md.

Compliant — DB-8 deterministic emission is enforced fail-closed by exact snapshot comparison: CI runs src/v3/compiler/src/bin/regen_bootstrap.rs in verify mode via .github/workflows/ci.yml:226-227, and the verifier rejects any byte mismatch at src/v3/compiler/src/bin/regen_bootstrap.rs:95-103 instead of accepting or normalizing drift.

1. CODING.md.

Finding (NON-BLOCKING) — src/v3/compiler/src/bin/regen_bootstrap.rs:33: let verify_only = env::args().skip(1).any(|a| a == "--verify"); makes the CLI boundary convention-based rather than fail-closed. An unknown or misspelled flag is silently ignored, so --verfiy falls into write mode instead of failing with usage. For this regen edge, prefer an exact argument match, e.g. accept only [] and ["--verify"], and panic/exit on anything else.

1. TESTING.md.

Finding (NON-BLOCKING) — the new test src/v3/compiler/tests/integration/pb1_bootstrap_full_snapshot_test.rs:26: fn generated_full_bootstrap_snapshots_are_clean() { bundles two behavioral claims: snapshot cleanliness at src/v3/compiler/tests/integration/pb1_bootstrap_full_snapshot_test.rs:35: dag.diagnostics().is_empty(), and pipeline-stage presence at src/v3/compiler/tests/integration/pb1_bootstrap_full_snapshot_test.rs:40: dag.declaration_by_name("parse").is_some(),. This is small, but it diverges from the “one claim per test” discipline; split into “snapshots are clean” and “snapshots include parse stage” if this file is touched again.

1. LOCKED DESIGN DECISIONS.

N/A — the diff references PB-1-e / Zero-Floor implementation boundaries, but I do not see a changed substrate/design decision marked as locked; the PR enforces the existing runtime-snapshot vs regen-fresh split rather than diverging from it.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the new regen module states its classification and dissolution path in the diff: src/v3/compiler/src/bootstrap_regen_fresh.rs:10-16 names it as PB-1-e regen verification substrate and gives a concrete trigger, “when PB-Bootstrap-Process replaces this hand-Rust regen host with a declared bootstrap.dag / generated producer path.”

3. Verdict

APPROVE_WITH_COMMENTS

The core architecture looks sound: the fresh bootstrap path is isolated behind a feature, production stays snapshot-backed, and CI now has an exact fresh-vs-committed verification gate. The two comments are non-blocking implementation/test hygiene around fail-closed CLI parsing and one-claim-per-test discipline; neither undermines the substrate split or DB-8 snapshot gate.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 8d02a9a9 · Trigger: schedule
• Thinking: 58s wall

---

Verdict: APPROVE

This is a clean, well-justified PB-1-e split. Production Dag::new() keeps a single snapshot authority; the fresh tokenize/parse/lower path is now feature-gated to bootstrap_regen_fresh.rs, used only by regen_bootstrap, and the no-drift contract is preserved by the new regen_bootstrap --verify CI gate that replaces the retired runtime-vs-snapshot tests. The changes match what docs/briefs/pb-1-e-residual-scaffold-retirement-worker.md calls for.

Things I checked and was satisfied with:

• No duplication of the std-vs-staged name-preference policy: declaration_name_preference_rank was moved (not copied) — the only definition lives in bootstrap_regen_fresh.rs:54-60, and the in-line comment names the lockstep rule.
• The cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code)) annotations on patch_kernel_bool_boolean_algebra_inhabits, materialize_pipeline_realizations, report_pipeline_authority_error (bootstrap.rs), resolve_pending_identifiers (lower.rs), and the PipelineStageAuthority fields (pipeline_authority.rs) are correct: the #[cfg(test)] module in bootstrap.rs still exercises these on Dag::new(), so they're not actually dead in test builds, but they are dead in default-feature non-test lib builds. The header comment in bootstrap.rs:60-66 explicitly explains why they didn't move.
• autobins = false + explicit [[bin]] blocks is a real defense-in-depth move — keeps the regen feature from being silently picked up by future src/bin/*.rs drivers.
• The replacement integration tests (*_have_no_diagnostics, *_include_parse_stage, dag_new_bootstrap_is_clean_and_byte_stable) are weaker than the retired drift checks in isolation, but the drift contract itself moved to CI (regen_bootstrap --verify), which is strictly equivalent and called out in the file headers.
• The Dag::empty() annotation in dag.rs:2167-2171 includes a clear "do not grow allow(dead_code)" instruction, naming the architectural revisit trigger — tracked-debt criteria met.

Exploratory observation (non-blocking): the new bootstrap_regen_fresh.rs module classifies itself as a "permanent PB-1-e regen verification substrate" with dissolution tied to PB-Bootstrap-Process going data-native. That's a reasonable framing, but it's worth being honest that this module is now the fresh-parse bootstrap implementation — if anyone ever re-introduces a runtime fresh-parse path (e.g. a debug build flag), the lockstep comment in declaration_name_preference_rank becomes load-bearing rather than aspirational. Not something to fix here, just a mental note that the "single authority" claim hinges on regen_bootstrap staying the sole consumer.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 8d02a9a9 · Trigger: schedule
• Thinking: 156s wall

---

Verdict: APPROVE. I found no concrete violations of the pinned invariants or coding/testing discipline in this diff. Verified with regen_bootstrap --verify, cargo check -p v3-compiler, targeted PB1 bootstrap tests, and git diff --check; all passed.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 8d02a9a9 · Trigger: schedule
• Thinking: 242s wall

---

Non-blocking — Strengths

• src/v3/compiler/src/bootstrap_regen_fresh.rs The fresh tokenize/parse/lower path is feature-scoped to regen verification with a named PB-Bootstrap-Process dissolution trigger.
• .github/workflows/ci.yml The CI gates cover default clippy, feature clippy, feature test linkage, and regen_bootstrap --verify, so the DB-8 snapshot contract remains fail-closed.

ROADMAP — Verified

• DB-8: Head workflow run 24929662085 passed, including the added bootstrap verification gates and DB-8 ratchets.

✅ No blocking concerns found.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 5136a075 · Trigger: schedule
• Thinking: 146s wall

---

Findings

• Test duplication, non-blocking. The new tests/integration/pb1_bootstrap_std_snapshot_test.rs:11-20 asserts exactly the same two facts (clean diagnostics + Bool present) that were just added to pb1_bootstrap_full_snapshot_test.rs:28-44 as generated_std_bootstrap_snapshot_has_no_diagnostics and generated_std_bootstrap_snapshot_includes_bool. Two files asserting the same structural facts about the same snapshot is a small parallel-representation smell — pick one home (TESTING.md: hermetic + single authority for behavior). Easy win is to drop the new file or drop the std-only assertions from the full file.

• Minor doc nit, non-blocking. bootstrap.rs:11-13 (header comment) now says "STAGED_FILES / V3_SPECS / COMPILER_FILES / extdeps primitives — fresh tokenize/parse/lower lives in bootstrap_regen_fresh.rs". Worth adding "the runtime path constructs Dag::new() from the committed snapshot, never from these arrays" to keep the single-authority story crisp for someone landing here cold.

Verdict: APPROVE_WITH_COMMENTS.

The split is well-motivated and clean: fresh tokenize/parse/lower moves whole-cloth to a feature-gated module with regen_bootstrap as the sole consumer, the cross-check moves from in-tree git diff to regen_bootstrap --verify, and the shared-authority pieces (patch_kernel_bool_boolean_algebra_inhabits, materialize_pipeline_realizations, declaration_name_preference_rank) stay single-source — bootstrap_regen_fresh calls back into bootstrap rather than copying. cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code)) is used surgically and each instance carries a comment warning not to grow it (e.g., dag.rs:2166-2168, pipeline_authority.rs:19-25). Dissolution trigger is named (PB-Bootstrap-Process / data-native regen host), autobins = false plus required-features keeps the boundary from drifting silently, and CI now runs clippy under both feature configurations. Both cargo clippy --all-targets and --features bootstrap-regen-fresh pass clean locally.

Exploratory observations

• assert_disk_matches/first_text_mismatch_hint (regen_bootstrap.rs:104-145) gives byte-offset + lengths but not a context window. If a future regen drift triggers in CI, "first differing byte index: 47213" without any surrounding bytes is mildly painful to triage. A few bytes of on_disk[offset.saturating_sub(40)..offset+40] vs expected[..] would make the failure self-explanatory. Optional — git diff after a local regen is the real triage path.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 5136a075 · Trigger: schedule
• Thinking: 198s wall

---

Verdict: APPROVE — the diff cleanly moves fresh bootstrap regeneration behind the regen-only feature, keeps the snapshot authority checked by regen_bootstrap --verify, and does not introduce a concrete invariant/modeling violation.

Verified:
cargo test -p v3-compiler --no-run --features bootstrap-regen-fresh
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify
cargo clippy -p v3-compiler --all-targets -- -D warnings
cargo clippy -p v3-compiler --all-targets --features bootstrap-regen-fresh -- -D warnings
git diff --check origin/main...HEAD

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 1ec0a3a4 · Trigger: schedule
• Thinking: 40s wall

---

Meta-Review: PR #789 (DB-8)

Loop summary

~12 review rounds over ~9 hours (05:06Z → 14:06Z). ~14 codex CLI reviews, ~9 claude CLI reviews, 2 openai-pro reviews. One real round of REQUEST_CHANGES (round 1: missing feature declaration broke the build). Every round after that: APPROVE or APPROVE_WITH_COMMENTS.

Forward progress evidence

Real, and concentrated in the early rounds:

• Substrate consolidation landed. Fresh tokenize/parse/lower moved out of the production lib build into feature-gated bootstrap_regen_fresh.rs. Dag::new() now has exactly one bootstrap authority (committed snapshots). Single-authority claim is enforced at the Cargo level (autobins = false + required-features), not by convention.
• Drift gate relocated, not weakened. Retired runtime cargo test drift checks; replaced by regen_bootstrap --verify in CI with byte-exact comparison and a fail-closed panic. CI now runs clippy under both feature configurations.
• Tracked-debt accounting. New module documents classification, dissolution trigger ("PB-Bootstrap-Process replaces this hand-Rust regen host with a declared bootstrap.dag"), and bounded scope. Dag::empty carries an explicit "do not grow allow(dead_code), revisit the split instead" comment — three properties present.
• First-diff hint added to assert_disk_matches mid-loop (responding to a reviewer ask).

Consumer enabled: regen_bootstrap --verify is itself the new consumer that justifies the substrate split. Net scaffolds: roughly net-zero (moved, not added; old bootstrap_std_fixtures_only etc. retired).

Debt accumulation evidence

Loop is recycling the same handful of nits in different words:

• "Two re-export paths for compile_*" — flagged by claude in rounds 4, 6, 8, and 11. Never addressed, never escalated. Pure style.
• "Local cargo test no longer catches drift" — flagged in rounds 5, 8, 10, 11. Already explicitly designed for and called out in the PR. Reviewers keep "discovering" it.
• "assert_disk_matches should show a context window, not just byte offset" — flagged in round 8, then again in round 12 (after the hint was already added).
• "One-claim-per-test" nit on *_have_no_diagnostics + *_include_parse_stage (round 11), and the symmetric "test duplication between std and full files" nit (round 12). These are the same finding from opposite directions.

No new invariants graduated to INVARIANTS.md despite the recurring "single authority" theme being structurally relevant.

Cheating signal

Low. The implementer is documenting compromises explicitly (every cfg_attr(allow(dead_code)) carries a comment, every scaffold has a dissolution trigger, the Dag::empty annotation actively warns future maintainers). Recent fixes are structural, not "good enough for now." This is not an exhausted-implementer loop — it's an exhausted-reviewer loop.

Path to convergence

Ship. The substrate split is sound, single authority is enforced at the Cargo boundary, the DB-8 drift contract is preserved in CI, and tracked-debt criteria are met on every new scaffold. The remaining findings are style (one re-export surface vs. two), test factoring (one test or two), and ergonomics (richer mismatch hint) — none load-bearing.

Acceptable debt to carry, no follow-up artifact required:

• Two re-export paths to the same three compile_* symbols.
• Slight assertion overlap between the two PB-1 integration test files.
• Local-feedback latency for snapshot drift (mitigated by CI --verify; a pre-push hook is a nice-to-have, not a gate).

A 13th round will find another ~2 stylistic nits and approve. There is no signal that another implementation pass would change the substrate.

Meta-verdict

⚖️ SHIP_WITH_DEBT

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: cb7d43c6 · Trigger: schedule
• Thinking: 69s wall

---

Loop Summary

7 review rounds across 20 commits. I count 15 codex review passes and 12 browser/non-codex review passes in the supplied history, plus 2 inline threads. Elapsed time: about 9 hours from PR open at 2026-04-25T04:52Z to the latest review at 2026-04-25T14:06Z.

Forward Progress Evidence

This loop made real progress.

The first blocking class was concrete and consumer-defined: the regen path did not compile. That was fixed by adding the bootstrap-regen-fresh feature, required-features on regen_bootstrap, crate-root re-exports, and CI coverage.

The PR enabled real consumers:

• CI now runs default clippy.
• CI now runs clippy with bootstrap-regen-fresh.
• CI now compiles test targets with the regen feature.
• CI now runs regen_bootstrap --verify, which is the actual DB-8 fresh-vs-committed snapshot consumer.

The loop also dissolved prior scaffolding: the old in-tree fresh-vs-snapshot runtime tests were removed from slow-test exemptions and replaced by a dedicated regen verification consumer. That is not just substrate growth; it moves the check to the layer that actually owns the behavior.

The scaffold accounting improved. bootstrap_regen_fresh.rs explicitly scopes the fresh parse/lower path to regen verification and names the dissolution trigger: replace the hand-Rust regen host with a declared bootstrap.dag / generated producer path.

Debt Accumulation Evidence

Debt is present, but mostly tracked and low-grade.

The main new debt is the cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code)) surface across bootstrap.rs, dag.rs, lower.rs, and pipeline_authority.rs. That is real maintenance load, but the comments mostly explain why it exists and when not to extend it.

Recurring non-blocking findings did appear:

• duplicated public import surfaces for compile_*;
• local cargo test no longer catching snapshot drift;
• duplicated std snapshot structural assertions;
• mismatch hints could be more ergonomic;
• doc wording could be clearer.

These are mostly polish. They are not evidence that the core design is shifting debt instead of converging.

Cheating Signal

Low cheating signal.

The implementer is documenting compromises rather than hiding them. The most recent fixes are structural: feature-gated regen module, explicit Cargo bin boundaries, CI gates for both feature graphs, and --verify as the real consumer. The loop did not devolve into quiet “good enough” patches.

The only warning sign is review fatigue: late rounds are mostly re-approving the same architecture and surfacing minor nits. That means marginal review value is now low, not that the implementation is unsound.

Path To Convergence

Do not keep iterating on code review rounds unless one of these happens:

• Resolve or explicitly close the stale inline blocker threads, since they describe old commits.
• Optionally remove the duplicate std snapshot assertions or leave a follow-up issue.
• Track the remaining debt in a follow-up artifact: “PB-Bootstrap-Process: replace hand-Rust bootstrap_regen_fresh with declared/generated regen authority.”

That is enough. The acceptable carried debt is the feature-gated regen host plus small API/test hygiene nits, because the debt is bounded, named, and covered by a real CI consumer.

Meta-verdict

⚖️ SHIP_WITH_DEBT — diminishing returns, accept tracked debt, merge and address in follow-up PRs.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 59079f29 · Trigger: schedule
• Thinking: 68s wall

---

This PR splits the fresh-parse bootstrap (tokenize/parse/lower from dsl/std/*.dag + staged sources) into a feature-gated bootstrap_regen_fresh module that only builds with --features bootstrap-regen-fresh, and replaces the in-tree fresh-vs-snapshot drift tests with a regen_bootstrap --verify gate in CI. Production Dag::new() is now unambiguously snapshot-only.

I checked the diff against INVARIANTS.md (single authority, layer model), CODING.md, TESTING.md, and modeling-discipline.md.

Things I considered and cleared:

• Duplicate authority risk. declaration_name_preference_rank, std_fixtures(), the rank-resolution loop, and the OUT_DIR include!s now live only in bootstrap_regen_fresh.rs — they were moved out of bootstrap.rs, not duplicated. Single authority preserved.
• Layer. The split is implementation-layer (compiler internals); no DAG-substrate types are introduced or duplicated.
• Tracked-bridge discipline. bootstrap_regen_fresh.rs:564–579 documents what it is, bounds it (required-features + cfg), and names a dissolution trigger ("PB-Bootstrap-Process replaces this hand-Rust regen host with a declared bootstrap.dag"). Same for the Dag::empty() cfg_attr note at dag.rs:2166–2169.
• Test discipline. The dropped slow-test exemptions (scripts/slow-test-exemptions.txt:67–69) match real test removals; the new structural tests in pb1_bootstrap_full_snapshot_test.rs:27–82 are unit-cheap and behavior-driven (snapshot diagnostic-clean; std snapshot includes Bool; full snapshots include parse stage). The byte-equality acid test moved to regen_bootstrap --verify in CI (ci.yml:40–41), which is a strictly better signal — explicit hint output via first_text_mismatch_hint instead of an opaque git diff --exit-code.
• cfg_attr(not(feature), allow(dead_code)) on patch_kernel_bool_boolean_algebra_inhabits, materialize_pipeline_realizations, report_pipeline_authority_error, resolve_pending_identifiers, PIPELINE_REALIZATION_META, and three PipelineStageAuthority fields — each is genuinely only read from the feature-gated regen path or from #[cfg(test)] exercises in bootstrap.rs. The dead_code allowance is precise, not a blanket lint suppression.
• Cost-of-change. Adding a new staged .dag is still one filesystem edit (build.rs picks it up; both runtime snapshot and regen module read the same OUT_DIR array). Adding a new bin requires a Cargo.toml entry now (autobins=false) — that's a deliberate gate, called out in the comment, and only affects bins, not language extensibility.

Minor observation (not a finding): the new cargo test -p v3-compiler --no-run --features bootstrap-regen-fresh CI step (ci.yml:38) only verifies linkage, never runs the feature-on test pass. Given the only feature-gated code is regen-host plumbing and --verify exercises it end-to-end one step later, this is fine — but if the regen module ever grows behavior worth asserting beyond "snapshot matches," it'll want a real test invocation.

Verdict

APPROVE — clean PB-1-e scaffold split. Single authority preserved, the regen-only fresh-parse module is documented and bounded with a named dissolution trigger, and the move from git diff drift detection to an explicit --verify mode with mismatch hints is a real ergonomic improvement. No invariant or modeling-discipline violations grounded in the diff.

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 59079f29 · Trigger: schedule
• Thinking: 280s wall

---

Verdict: APPROVE — I found no diff-grounded violations of the pinned invariants, modeling discipline, coding, or testing docs.

Verified with:
cargo check -p v3-compiler --all-targets
cargo check -p v3-compiler --all-targets --features bootstrap-regen-fresh
cargo test -p v3-compiler --no-run --features bootstrap-regen-fresh
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify
cargo test -p v3-compiler --test integration pb1_bootstrap_full_snapshot_test -- --nocapture

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 8cefcf0c · Trigger: schedule
• Thinking: 65s wall

---

Verdict: APPROVE — diff is well-scoped and the split is principle-respecting.

The change extracts the fresh tokenize/parse/lower bootstrap loop out of bootstrap.rs and into a new feature-gated module bootstrap_regen_fresh.rs (--features bootstrap-regen-fresh), used solely by the regen_bootstrap binary. CI's drift gate moves from "regen + git diff" to a self-contained regen_bootstrap --verify step that compares a fresh compile against committed snapshots — semantically equivalent enforcement, with a more direct single-binary contract.

What I checked, briefly:

• Single authority (INVARIANTS). Runtime Dag::new() materializes only from committed bootstrap_*_generated.rs; the fresh-parse path no longer compiles into the default lib graph. The declaration_name_preference_rank / load_fixtures / std_fixtures helpers exist in exactly one place (the regen module). The header comment in bootstrap.rs:200-237 even calls out that any future runtime path re-parsing the same fixtures must keep the rank policy in lockstep — explicit cost-of-change note.
• Tracked debt. The new module is documented, bounded by required-features, and has a named dissolution trigger ("PB-Bootstrap-Process replaces this hand-Rust regen host with a declared bootstrap.dag" — bootstrap_regen_fresh.rs:493-498). Meets the three-property bar.
• Drift enforcement. regen_bootstrap --verify (bin/regen_bootstrap.rs:123-133, assert_disk_matches) panics on mismatch with a useful first-byte hint; the CI step calls it. The previous git diff --exit-code check is replaced cleanly.
• Dead-code hygiene. materialize_pipeline_realizations, patch_kernel_bool_boolean_algebra_inhabits, resolve_pending_identifiers, Dag::empty, and the PipelineStageAuthority fields are gated with cfg_attr(not(feature = "bootstrap-regen-fresh"), allow(dead_code)). CI runs clippy under both feature configurations (ci.yml:213-217), which prevents quiet rot in either build graph.
• Tests. New structural assertions on generated_*_bootstrap_dag() (clean diagnostics, presence of Bool and parse stage) tighten the in-tree cross-check exactly where the fresh-compile parity test was retired. sg0_census_test.rs updated to include the new file.

Exploratory observation (non-blocking): Dag::empty()'s allow(dead_code) comment (dag.rs:657-661) is a nice load-bearing sign that this module is the only legitimate user — worth preserving that exact framing if anyone is later tempted to broaden the allow rather than question why a default-feature caller wants empty().

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 59079f29 · Trigger: schedule
• Thinking: 222s wall

---

Non-blocking — Strengths

• src/v3/compiler/src/bootstrap_regen_fresh.rs The fresh tokenize/parse/lower path is isolated to the regen feature with a named PB-Bootstrap-Process dissolution trigger, so it does not become a second production bootstrap authority.
• .github/workflows/ci.yml The added default-feature clippy, feature clippy, feature test linkage, and regen_bootstrap --verify gates make the fresh-vs-snapshot contract fail closed.

ROADMAP — Verified

• DB-8: Head workflow run 24933319356 passed, including the bootstrap-regen-fresh gates and staged DB-8 ratchets.

✅ No blocking concerns found.