Skip to content

Fix whole-tree compile-clean: 10 unresolved-type diagnostics on main - #7908

Merged
briansrls merged 6 commits into
mainfrom
session/merry-wren-185
Aug 6, 2026
Merged

briansrls merged 6 commits into
mainfrom
session/merry-wren-185

Conversation

@briansrls

@briansrls briansrls commented Aug 6, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Main's whole-tree gunbc compile --source-root dag --source-root src/v2 --target dag still fails with 10 hard diagnostics (annotation violations fixed separately in #7918). This PR clears the remaining unresolved-type population in four files:

Not in scope: nvidia.dag and generated_artifact_drift_test.dag annotation moves — already landed on main via #7918.

Namespace-lane handoff (not held for closure): three #6848 import-strip specimens recorded in v2.lens.module_graph namespace_wave_import_strip_specimens_note.

Merged origin/main (merge commit, no force-push).

Measurement (fresh local binary)

Built with ctrl-build --local -- cargo build --release --bin gunbc -p v1-compiler; verified 0 .rs files newer than the binary.

tree hard diagnostics
origin/main @ 34210a0d07 10
this branch 0

Oracle: gunbc compile (not the CI compile-clean gate — different frontend, 49/1308 src/v2 modules).

Test plan

  • ctrl-build --local -- cargo build --release --bin gunbc -p v1-compiler
  • gunbc compile --source-root dag --source-root src/v2 --target dag — 0 blocking errors on branch; 10 on main baseline

@gunbai-bot
gunbai-bot Bot marked this pull request as ready for review August 6, 2026 04:47
@gunbai-bot gunbai-bot Bot changed the title Main compile-clean red: 19 hard diagnostics Fix whole-tree compile-clean: 19 hard diagnostics on main Aug 6, 2026
gunbai-bot Bot pushed a commit that referenced this pull request Aug 6, 2026
…ect falsifier control dark-window claim; add execution-proof honesty note

CI failure on #7894 (run 31069215347): maintenance_census_report_positive_control_derives_from_current_head
reaches git.Inspect.HeadCommit unmocked, refusing under the hermetic discovery envelope and failing the whole
7298-row batch. Split it into stage0_rust_maintenance_census_report_live_witness_test.dag (offline-local
recipe, mirrors stage0_rust_host_observation_live_witness_test.dag) and registered the exclusion row in
ci_layer_roots.dag.

Per parent session still-bat-561 (msg_7ae919df): corrected falsifier_control_prerequisite_note — the dark
window predates #7812 (default success() gate already skipped cold controls whenever the floor reddened,
and the floor was red on every checked run); #7812 was itself a repair that introduced the cross-job
steps.release_build.outcome bug, making the skip unconditional; #7894 is the third fix. Corpus damage this
control failed to catch traces to the namespace-6848 change merged 2026-07-20, 19 diagnostics cleared
separately by #7908.

Added falsifier_control_prerequisite_execution_proof_note: the two prior repairs shipped with shape-based
witnesses while the control stayed dark on real runs, so this fix is not entitled to be declared done at
merge — the acceptance gate is the first real scheduled falsifier run showing both cold-control steps
concluding success/failure, never skipped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@cursor

cursor Bot commented Aug 6, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

briansrls added a commit that referenced this pull request Aug 6, 2026
…ger compile fix (#7894)

* WIP: Current hand-Rust maintenance census and roadmap reconciliation

* WIP: Current hand-Rust maintenance census and roadmap reconciliation

* WIP: Current hand-Rust maintenance census and roadmap reconciliation

* Reconcile stale RetirementTrigger citation flagged in review 49280; fix falsifier.yml cross-job gate hole

capability_retirement_trigger_naming_note in v1_complexity_capability_census.dag
still described stage0_rust_lifecycle_totality's axis as a bare
RetirementTrigger after this branch's own rename to
LifecycleTotalityRetirementTriggerUnmodeled — a stale symbol citation
per DESIGN.md §3. Corrected the note to name the one live collision
(stage0_rust_honest_frontier_projection's RetirementTrigger variant)
and to state explicitly that this census does not discharge
lifecycle_totality_retirement_trigger_dissolve_on.

Also root-caused and fixed an independent, currently-active CI gate
hole: falsifier_control_prerequisite_if cited
falsifier_release_build_step_id ("release_build"), a step id belonging
to falsifier_build_job(), from falsifier_floor_job()'s cold-control
steps. GitHub Actions' steps.<id> context is job-scoped, so the
cross-job reference resolved to null and both cold controls
(compile-clean whole-tree, native-cache) were unconditionally skipped
from commit 491ee01 (2026-08-05, #7812) through 2026-08-06. Repointed
to the correct same-job step id (release_bins) and regenerated
falsifier.yml via generated_artifact_gate main_wet. Added a witness
asserting the if-condition cites the same-job step and no longer
contains the wrong job's step id.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* WIP: Current hand-Rust maintenance census and roadmap reconciliation

* Fix CI: split live-git census-report test to hermetic exclusion; correct falsifier control dark-window claim; add execution-proof honesty note

CI failure on #7894 (run 31069215347): maintenance_census_report_positive_control_derives_from_current_head
reaches git.Inspect.HeadCommit unmocked, refusing under the hermetic discovery envelope and failing the whole
7298-row batch. Split it into stage0_rust_maintenance_census_report_live_witness_test.dag (offline-local
recipe, mirrors stage0_rust_host_observation_live_witness_test.dag) and registered the exclusion row in
ci_layer_roots.dag.

Per parent session still-bat-561 (msg_7ae919df): corrected falsifier_control_prerequisite_note — the dark
window predates #7812 (default success() gate already skipped cold controls whenever the floor reddened,
and the floor was red on every checked run); #7812 was itself a repair that introduced the cross-job
steps.release_build.outcome bug, making the skip unconditional; #7894 is the third fix. Corpus damage this
control failed to catch traces to the namespace-6848 change merged 2026-07-20, 19 diagnostics cleared
separately by #7908.

Added falsifier_control_prerequisite_execution_proof_note: the two prior repairs shipped with shape-based
witnesses while the control stayed dark on real runs, so this fix is not entitled to be declared done at
merge — the acceptance gate is the first real scheduled falsifier run showing both cold-control steps
concluding success/failure, never skipped.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* WIP: Current hand-Rust maintenance census and roadmap reconciliation

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Brian Searls and others added 3 commits August 6, 2026 16:50
Restore namespace-stripped imports in complexity and receipts, bind Empty
explicitly in rust_test_fixtures, use Outcome<Unit> for translate grounding
gates, and hoist the drift-test witness comment to module-item grain.

Co-authored-by: Cursor <cursoragent@cursor.com>
std.types.Unit typechecks but has no runtime value; heal's
generated_artifact_gate eval failed with undefined variable: Unit.
Use outcome_accepted(true), matching target_model wire-schema gates.

Co-authored-by: Cursor <cursoragent@cursor.com>
@gunbai-bot
gunbai-bot Bot force-pushed the session/merry-wren-185 branch from 6cb30d2 to a7b4019 Compare August 6, 2026 16:58
@gunbai-bot gunbai-bot Bot changed the title Fix whole-tree compile-clean: 19 hard diagnostics on main Fix whole-tree compile-clean: 10 unresolved-type diagnostics on main Aug 6, 2026
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace Outcome<Bool> with Outcome<GroundingGatePassed> per operator
ruling: Bool admits a meaningful false the gate never produces. Record

Co-authored-by: Cursor <cursoragent@cursor.com>
#6848 import-strip specimens for the namespace lane in module_graph.
gunbai-bot Bot pushed a commit that referenced this pull request Aug 6, 2026
…t jobs, four-PR gate

Three operator rulings supersede what this branch previously recorded.

NAMED SUCCESSOR, corrected shape. The provenance carrier is
FrontierEvidenceProvenance, not FrontierMeasurementProvenance, and
ExecutionMeasured takes a TYPED subject and a TYPED receipt rather than
free-form fields:

  ExecutionMeasured   { subject: FrontierSurveySubject, receipt: FrontierProbeReceipt }
  KnowledgeAttributed { source: DeclarationRef, dissolve_on: DeclarationRef }
  OracleDerived       { oracle: DeclarationRef }

The row constructor must CONSUME the variant, so a row cannot claim
execution-measured provenance without carrying the receipt that proves it. That
turns this branch's rung-inflation finding from a documented defect into an
unwritable one -- a constructor named execution_measured_* that accepts ordinary
caller-provided blocker fields is a name-level claim, not evidence.

EXECUTION MODEL: 27 INDEPENDENT JOBS, NOT ONE PROCESS. One pinned subject, 27
independent module jobs, one receipt artifact per module, one exact-subject
aggregator. This is designed directly out of the failure this receipt records:
the costly property of the six runs was not that they died but that each death
cost EVERYTHING -- the one-shot lost all 27 modules when module 1 was killed. A
killed job now yields one interrupted row, rerun independently, and twenty-six
completed rows survive the twenty-seventh being SIGKILLed. A monolithic process
must not be retried in the same opaque envelope: the ancestor killer is still
unobservable from inside, so the answer is a visible kill boundary, not a bigger
cap.

GATE IS FOUR MERGES, NOT ONE: #7908 (whole-tree compile zero), #7902 (de-fork,
now READY at 227d9cb with its eight-control admission envelope green and the
arity ruling applied), #7925 (all-seven stage0 partition crate compile gate),
then this receipt. No authoritative survey runs on a head carrying compiler
diagnostics or a duplicated admission authority.

Also records the required output shape, whose last line is load-bearing: blocker
groups by DETAILED cause, not high-level reason strings. The 14 modules sharing
parse_grammar_choice_overlap_residue must have their detailed causes separated,
because the next phase ranks by largest DETAILED group on the premise that one
root governs many.

The receipt gets a pointer to the execution model rather than a copy of it; the
carrier stays the single authority.

Verified: zero own-file diagnostics.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@briansrls
briansrls merged commit a6bcf6c into main Aug 6, 2026
5 checks passed
@briansrls
briansrls deleted the session/merry-wren-185 branch August 6, 2026 22:08
briansrls pushed a commit that referenced this pull request Aug 7, 2026
…) + roster provenance rung-inflation finding (#7901)

* WIP: Authoritative exact-head 27/27 frontier survey

* Frontier survey: executed memory-refusal receipt + roster provenance finding

The authoritative 27/27 exact-head survey DID NOT RUN. This lands the
executed refusal, not a measurement, and carries no frontier counts.

frontier_probe_emit_from_ingest is OOM-killed before emitting a receipt
for any module: five invocations, five kills, zero receipts. One-shot
over all 27 (killed during module 1 of 27), plus 03_normalize, 03_resolve
and 01_tokenize individually at --source-root src/v2 + dag, plus
03_normalize at src/v2 alone. Host cgroup memory.max = 33578549248
(31.3 GiB). All five die at the same place: after the per-module probe
begins, inside the interpreted evaluation, with the ingest closure
already fully read.

Instrument control, because exit 137 alone proves nothing: cgroup
oom_kill incremented 1 through 5, one per killed run, in lockstep. A
15-second RSS sampler saw only ~2.6 GB because the climb happens between
samples; that figure is an artifact, not the working set.

Two hypotheses raised and REFUTED by execution before being reported as
causes: (a) that the 10 never-measured modules are the memory-bound ones
-- refuted by 01_tokenize, one of the 17 that DID measure at 9f978aa;
(b) that the widened src/v2 + dag root set is the cause -- refuted by
03_normalize OOMing at src/v2 alone. Cause remains open.

Regression vs host capacity is UNRESOLVED and not resolvable here: three
builds of the probe at old head 9f978aa were all OOM-killed
(jobs=15, jobs=1, debug). The single-job attempt is decisive -- one rustc
process still exceeded the cap, so this host cannot cold-build
v1-compiler at all, and the current-head build succeeded only via
sccache. Reported, not chased, per operator direction; a probe trimmed
to fit a box measures a different question.

Consequence: 27/27 is unreachable by BOTH documented paths, since a
single module in a fresh process exhausts the cap alone. Fanning the 27
across workers does not address a per-module failure.

Second, independent finding (DESIGN 4b rung inflation in the roster
carrier): knowledge_attributed_blocker_class_seed_retained_row has ZERO
call sites repo-wide, while all 10 never-measured roster modules are
authored through execution_measured_seed_retained_row, whose name
asserts execution measurement. That constructor takes blocker, stage and
reason as ordinary parameters, so it cannot distinguish measured from
attributed -- the NAME asserts a provenance the TYPE does not carry. No
roster row is edited here; frontier.dag is load-bearing and the
construction fix (a provenance field) is flagged for routing.

Recipe corrections found by execution: ctrl-build defaults to remote and
BuildBuddy refuses a detached worktree, so the mandated detached
worktree and the default build path are mutually exclusive and
ctrl-build --local is required.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Correct the memory attribution: cgroup never hit its cap; both claims withdrawn

An independent same-cap control cold-built v1-compiler at a 3.26 GiB peak
with zero kills, refuting this receipt's earlier host-capacity claim. Re-reading
my own counters refutes the other one.

  memory.max     33578549248   31.3 GiB
  memory.peak     9136902144    8.5 GiB   high-water across EVERY run
  memory.events   max 0   oom 0   oom_kill 10

max 0 means allocation NEVER reached memory.max; oom 0 means the CGROUP oom
killer was never invoked; in cgroup v2 oom_kill also counts tasks reaped by a
killer above this cgroup. The cgroup never exceeded 27% of its cap, so the kill
decisions were made outside its limit entirely.

WITHDRAWN (marked withdrawn in place, not deleted):
  - "the probe requires more than 31 GiB"      -> memory.peak is 8.5 GiB
  - "this host cannot cold-build v1-compiler"  -> refuted by the control

Root error, named so it does not recur: oom_kill incrementing in lockstep is a
sound control for "was this a kill" and worthless for "what hit the limit".
memory.events max/oom and memory.peak answer that, and were available throughout.

Not a leak either: memory.current was 391MB before the jobs=1 build with no
cargo/rustc running, and memory.peak never moved. A retry under low host load
survived to 3.5 minutes at ~2.0 GB, past every earlier run, then was killed
anyway without raising memory.peak. Cause is not attributable from inside the
container (/proc/self/cgroup is namespaced to 0::/); reported as an operator
finding rather than guessed at.

Consequently the lane is INTERRUPTED AND RETRYABLE, not blocked, and probe
memory cost is UNMEASURED rather than high. Doc and carrier note renamed off
"memory_refusal", which asserted the conclusion the evidence killed.

Both recipe-defect predictions also refuted by execution:
  - no module collision: duplicate module in a third root does not refuse,
    tested both inside and outside target/
  - target/-resident roots ARE indexed: an invalid .dag there fails the compile
    loudly (parse error naming the file, exit 101), so the emitted manifest
    will be read
Only the ctrl-build --local defect survives. The vacuous-green property is
recorded separately: partition-totality passes on an empty manifest, so it can
never evidence that a survey ran.

Verification: all three edited .dag modules compile with zero own-file
diagnostics. Incidental and unrelated: 4 hard diagnostics in
dag/extdeps/systems/nvidia.dag (SPARK-0, byte offsets, DESIGN 4c body-grain
annotation refusal), present tree-wide and untouched by this branch.

Rung-inflation finding is unaffected and unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Name #7902 as the gating branch and record the operator retry sequence

Answers the question this lane could not resolve earlier: the
ConstructorReferenceAdmission de-fork is #7902 (defork-constructor-admission).
#7859 CREATED the fork it removes, so #7859 is not the de-fork and the gate must
never be inferred from main moving. #7902 changes src/v1/04_infer.dag, so any
frontier measurement taken before it merges is stale by construction.

Records the operator-ordered sequence on the closeout carrier: interrupted-run
receipt, then the FrontierMeasurementProvenance coproduct (so the survey does not
rewrite roster rows through the provenance-conflating constructor this branch
documents), then #7902, then the authoritative survey.

Records the retry environment ruling: the survey must run in a fresh job or
runner whose real kill boundary is observable, not in a session envelope
reporting cgroup 0::/ that an ancestor can kill invisibly. The 27 modules shard,
every receipt carries the same exact subject, and a killed shard is RERUN --
never hand-reconciled, since reconciling a shard that ran against a different
subject is what turns a partial survey into a fabricated one.

Verified: zero own-file diagnostics.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Align the recipe and bind rows with the corrected reading (review 49553)

Review found that commit c2edc86 corrected the survey carrier but left the
LOCAL RECIPE text carrying the pre-correction reading -- a second, contradictory
authority for the same facts, which is the DESIGN 3 single-authority violation
this PR otherwise documents. Both findings verified against current code and both
are real.

gunbc.ci_layer_roots compiler_frontier_per_module_probe_exclusion_note: replaced
"BLOCKED BY EXECUTED REFUSAL / OOM-killed / both paths unreachable / a single
module exhausts the cap alone" with what the counters support -- runs
interrupted, cause OPEN and not a demonstrated capacity limit (memory.events
max 0, oom 0; memory.peak 8.5 GiB against a 31.3 GiB cap), probe memory cost
UNMEASURED, "unreachable" NOT established, retry in a fresh job or runner with an
observable kill boundary. The clause now points at
frontier_probe_run_interruption_note rather than restating it, so there is one
authority instead of two.

gunbc.doc_graph_roots: dropped the "(memory refusal resolved)" parenthetical and
"refusal receipt" wording from the bind dissolution; the trigger is the carrier's
own -- the probe emits a receipt for at least one module.

Swept the rest of the diff for the same staleness rather than fixing only what
review cited, which surfaced two more the review did not mention:

  - the interruption note still opened "EXECUTED REFUSAL" and said
    frontier_probe_emit_from_ingest "is OOM-killed"
  - BOTH the note and the receipt said FIVE invocations; there were SIX. The
    low-host-load 01_tokenize retry -- the run that survived to 3.5 minutes at
    ~2.0 GB and is the strongest single piece of evidence against the capacity
    reading -- was described in prose but missing from the count and the table.

An undercount in a receipt whose whole purpose is negative evidence is the same
defect class review caught, so it is fixed here rather than left for a later
reader to trip over.

Verified: all three edited .dag modules compile with zero own-file diagnostics.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Apply operator refinements: FrontierEvidenceProvenance, 27 independent jobs, four-PR gate

Three operator rulings supersede what this branch previously recorded.

NAMED SUCCESSOR, corrected shape. The provenance carrier is
FrontierEvidenceProvenance, not FrontierMeasurementProvenance, and
ExecutionMeasured takes a TYPED subject and a TYPED receipt rather than
free-form fields:

  ExecutionMeasured   { subject: FrontierSurveySubject, receipt: FrontierProbeReceipt }
  KnowledgeAttributed { source: DeclarationRef, dissolve_on: DeclarationRef }
  OracleDerived       { oracle: DeclarationRef }

The row constructor must CONSUME the variant, so a row cannot claim
execution-measured provenance without carrying the receipt that proves it. That
turns this branch's rung-inflation finding from a documented defect into an
unwritable one -- a constructor named execution_measured_* that accepts ordinary
caller-provided blocker fields is a name-level claim, not evidence.

EXECUTION MODEL: 27 INDEPENDENT JOBS, NOT ONE PROCESS. One pinned subject, 27
independent module jobs, one receipt artifact per module, one exact-subject
aggregator. This is designed directly out of the failure this receipt records:
the costly property of the six runs was not that they died but that each death
cost EVERYTHING -- the one-shot lost all 27 modules when module 1 was killed. A
killed job now yields one interrupted row, rerun independently, and twenty-six
completed rows survive the twenty-seventh being SIGKILLed. A monolithic process
must not be retried in the same opaque envelope: the ancestor killer is still
unobservable from inside, so the answer is a visible kill boundary, not a bigger
cap.

GATE IS FOUR MERGES, NOT ONE: #7908 (whole-tree compile zero), #7902 (de-fork,
now READY at 227d9cb with its eight-control admission envelope green and the
arity ruling applied), #7925 (all-seven stage0 partition crate compile gate),
then this receipt. No authoritative survey runs on a head carrying compiler
diagnostics or a duplicated admission authority.

Also records the required output shape, whose last line is load-bearing: blocker
groups by DETAILED cause, not high-level reason strings. The 14 modules sharing
parse_grammar_choice_overlap_residue must have their detailed causes separated,
because the next phase ranks by largest DETAILED group on the premise that one
root governs many.

The receipt gets a pointer to the execution model rather than a copy of it; the
carrier stays the single authority.

Verified: zero own-file diagnostics.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Fix gate enumeration (five prerequisites, not four) and align dissolve-on with the doc bind

Both findings in review 49609 verified against the tree and confirmed real.

GATE ENUMERATION. The closeout note said "FOUR merges gate the authoritative
survey" and "the gate opens after all four", then added a fifth prerequisite --
FrontierEvidenceProvenance -- in a later sentence of the same paragraph. Read as
written, the four-merge list authorizes a survey run before provenance is
structural, which would rewrite roster rows through the provenance-conflating
constructor: precisely the rung inflation this receipt files. The note now says
FIVE prerequisites and separates the two gates it was conflating -- the MERGE
gate opens after the four merges, the SURVEY gate only after the fifth -- and
states plainly that reading the four merges as the whole gate authorizes the
defect. The duplicate provenance sentence downstream is deleted rather than left
beside the corrected one, since two statements of one gate is how the
disagreement arose in the first place.

DISSOLVE-ON. frontier_probe_run_interruption_note dissolved on ONE condition (a
probe receipt at a pinned subject) while the HandAuthoredDocBind for the same
artifact requires TWO (receipt AND structural roster provenance). The bind is
correct and the note was wrong: that bind carries
frontier_roster_provenance_constructor_inflation_note as an additional work, so
the weaker trigger would have deleted the receipt while the provenance finding
it carries was still live -- a scaffold dissolving before its own trigger fires.
The note now carries both conditions and names the bind as the single authority
for when the doc deletes, so the two cannot drift apart again silently. Checked
the md for a third copy: it states no dissolution, so there are exactly two
authorities and they now agree.

Verified: zero own-file diagnostics.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Correct two stale #7902 status passages: DRAFT at 42b5d00, seven of eight controls green

Operator pass found two status claims in the closeout note that had rotted since
they were written. Neither touches the interruption receipt or the roster
provenance rung-inflation finding, which are the value of this PR and are
unchanged.

HEAD AND STATE. The note named #7902 as READY (not draft) at head 227d9cb. It
is now DRAFT by operator ruling at head 42b5d00.

ENVELOPE. The note claimed all eight admission controls green by execution. They
are not, and the gap is a real defect rather than an unwritten test: writing
control 2 exposed a fail-open where an unlisted caller can reference or invoke a
ZERO-ARITY sealed constructor with no admission diagnostic at all, in both the
bare-reference and the explicit-call spelling, proven by execution on two
fixtures identical but for constructor arity. #7902 carries it as an inverted
known-red, and the operator has ruled it is closed inside #7902 rather than
merged as a known-red. Accurate statement is seven of eight green with the
eighth quarantined pending that fix, so the gate does not open on a claim of
eight. Recorded with the consequence for this lane attached: a survey taken
against a head where a zero-arity sealed constructor is reachable without
admission measures the wrong tree.

Dropped the trailing "arity ruling applied" clause rather than carrying it
forward unverified. That is the point of this correction - a status claim
restated in a second place is a claim that rots silently, which is the same
defect class this PR exists to record, so the note now asserts only the status
the gate actually depends on.

Gate structure is unchanged and stays separated as landed last round: four
merges gate the merge, the FrontierEvidenceProvenance coproduct is the fifth and
gates the survey.

Verified: zero own-file diagnostics; no stale 227d9cb or eight-control
reference survives anywhere in the tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Replace the mutable gate status with a static admission contract

Operator ruling, superseding the two status patches it follows. The defect was
not that the sentences were wrong; it was that the note was acting as a MUTABLE
BOARD, so every merge made it wrong again and the fix arrived as another
hand-patch. Two rounds of that is the signal.

REMOVED from the closeout note: the four-PR gate list, the de-fork's head SHA,
its draft state, and the seven-of-eight control tally. No PR number, no SHA, no
lifecycle state, no tally survives anywhere in the file.

REPLACED WITH conditions on the tree, which stay true as heads move and changes
land. The authoritative survey may start only when all four hold: whole-tree
hard diagnostics equals zero; ConstructorReferenceAdmission has one authority
and no known-red control; all seven partition crates are continuously checked;
FrontierEvidenceProvenance is construction-enforced. Each is decidable against
whatever head is current, and for which change carries which condition the
reader is sent to the board rather than to a second copy of it here.

Two conditions are spelled out because they are easy to under-read. Condition 2
is not discharged by a de-fork landing while a control stays inverted -- one
authority AND no known-red are both required, since a partially admitted
constructor authority means the survey measures a tree in which a sealed
constructor is reachable without admission. Condition 4 is what stops the survey
writing all 27 roster rows through the conflating constructor.

Why the reasoning is kept rather than just the list: a receipt that restates
mutable status is a claim asserted in a place that cannot check it, which is the
same defect class frontier_roster_provenance_constructor_inflation_note files
one layer down. Recording that connection is what stops the next author
reintroducing a status line here.

Also sharpened the successor so it cannot read as landed implementation: the
contract now says condition 4 is a construction wall to be BUILT and that this
receipt does not build it -- this receipt RECORDS the provenance defect, the
separate FrontierEvidenceProvenance change FIXES it. The PR body carries the
same correction, retitled proposed shape NOT landed here, with the closing line
changed from asserting the finding is already unwritable to stating that the
defect stands recorded and unfixed until that change lands.

Substantive content is untouched: zero receipts means no frontier measurement,
the run was interrupted rather than proven memory-bound, the visible cgroup
never reached its own limit, the survey needs independent module jobs, and the
existing constructor inflates knowledge-attributed rows to execution-measured.

Verified by execution: zero own-file diagnostics.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
briansrls pushed a commit that referenced this pull request Aug 7, 2026
* ci: gate cargo check on all seven stage0 partition crates (C1)

Model one build-job step that runs cargo check -p for every
v1-stage0-* partition crate derived from stage0_partition_crate_rows,
with witnesses and ci_workflow backstop receipt updated.

Split from #7892 per operator ruling: C2 closure and C3 oracle follow
in separate PRs after #7908 lands.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ci): restore floor upstream-red refusal preflight on ci job

The C1 split accidentally dropped heal_generated_artifacts from ci needs,
the !cancelled() guard, and the upstream-red refusal step when ci.yml was
sourced from a stale combined branch. Restores main's fail-closed semantics
so a skipped required check cannot report success when build/regen/heal fail.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant