TransportScript is a sole-constructor record: close the meta-exec construction half, and the cast form of sole_constructor with it

[gunbai-bot]

What this closes

extdeps.shell.exec declared type TransportScript = String where brand("TransportScript") — a transparent brand, so as TransportScript was writable from any module. DESIGN's shell → intent row said so plainly (correction of 2026-07-27, review 43600): the ShellOnHost route was construction-walled, but shell.Exec.Run's own transport was lens-guarded only, and closing it was named as the meta-exec confinement milestone.

TransportScript is now a sole_constructor record with a body: String field. transport_script_seal is the single mint, admit_callers-sealed to exactly two production decls:

• gunbc.retained_shell_script retained_shell_script_to_transport
• gunbc.bash_materialized_transport bash_materialized_transport (new — the Bash-materialization adapter)

No test declaration is admitted. The execution witness obtains its TransportScript through the production adapter. The adapter takes the materialization, not its source text, so no caller can launder self-built text through it, and it refuses with Absent rather than an empty script (§5 — no fabricated plausible output).

The spike (the gating unknown), by execution

Dotted-field interpolation into argv had precedent. Routing a record field to stdin had none — every stdin: in the corpus was a bare identifier, and inferring stdin support from dotted argv is exactly what this spike existed to not do. Run in a detached, branchless scratch worktree with no remote publication; removed afterward, nothing committed or pushed from it.

Established:

• stdin: script.body compiles, and exact bytes arrive — alpha\nbeta\ttab {brace} $dollar 'sq' "dq" end echoed through cat.
• bash -s fed the same way executes and returns stdout spike-out / stderr spike-err.
• argv: ["sh", "-c", "{command.body}"] discriminates: test 1 -eq 1 → true, test 1 -eq 2 → false.

The caveat is discharged. An earlier revision of this section recorded that the strict echo round-trip returned false and attributed it to the transport's trailing-newline trim — reasoned, not executed. That attribution has been replaced by a witness rather than by a better argument: dag/test/claim/transport_script_stdin_byte_fidelity_witness_test.dag runs two wet controls through the production bridge and both PASS —

• transport_script_stdin_delivers_exact_bytes (tab, unexpanded dollar, embedded double quotes; bytes back == bytes in) — subject digest 898c66066ad4a8b6
• transport_script_stdin_fidelity_is_independent_of_terminal_newline (same shape with and without a terminal newline, pinning the difference to the RETURN side) — subject digest bd9eebc35c6f2d49

with [expectation-frontier] shell.Exec.Run=3, three real dispatches, so the pass is not vacuous. Both controls execute a real shell, so they are enrolled wet (LiveTreeDisposition = ReadsLiveTree, a BinWitnessWet exclusion from dry discovery, two bin_wet roster rows) — a dry-satisfiable version would assert nothing about byte delivery, which is the one fact the wall rests on.

The language hole this uncovered

sole_constructor was enforced at the record literal only. std.coercion dag_cast_rules judges a cast only when source AND target both sit in the primitive cast domain, so a cast into a sealed record was entirely unjudged — the wall would have leaked at exactly the form the change must refuse.

src/v1/04_infer.dag sole_constructor_construction_diags is now the one authority both construction forms consult (infer_record_lit and the ExprCast arm). This touches a load-bearing pipeline stage, so:

• Corpus census before landing: zero as <sealed type> casts exist across all 17 sole_constructor types — the form closed without refusing any existing site.
• regen_stage0 --verify → regen_divergence_count=0, committed stage0 matches fresh self-compile.

Evidence

check	result
whole-tree compile-clean (--target dag)	0 blocking errors (6646 advisories, pre-existing policy-level)
guarantee-probe suite	5/5 PASS
regen_stage0 --verify	divergence 0
mutation test	wall confirmed load-bearing

Probes (three new rows in gunbc.guarantee_probe_corpus, each with an executing witness):

• sole_ctor_cast_red_probe → ExpectBlockingRefusal{SoleConstructorViolation} — source Int is a cast-domain type and the target is not, so only the sole-constructor check can refuse it
• sole_ctor_unadmitted_caller_red_probe → ExpectBlockingRefusal{ConstructorCallAdmissionRefused}
• sole_ctor_admitted_caller_green_probe → ExpectZeroDiagnostics

plus the pre-existing forged-literal red and sanctioned-mint green controls.

Mutation test (per the standing rule that a green witness is not a working wall): unwiring only the cast_sole_ctor_diags concat, regenerating and rebuilding, gives FAIL sole_constructor_cross_module_cast_red_refuses while PASS forged_literal_red_refuses and PASS admitted_caller_green_control hold — the hole was real, the mutation was surgical, and the wall does the work. Wall restored from saved copies and probes re-confirmed 5/5 on the restored binaries.

Callers moved

Three production shell.Exec.Run sites route through retained_runtime with declared reasons: gunbc.command_runner (generic ArgvCommand heredoc transport, pending the typed host_effect_apply argv handler) and two gunbc.bmc_netboot_serve sites (pre-runtime bootstrap window).

Ladder disposition

This class climbs from mechanically preventable (a lens that reds a new raw literal) to structurally impossible for both writable forms: a cross-module record literal and an as TransportScript cast now have no constructor. Per DESIGN §4b(4) the discriminating REDs and positive controls stay enrolled as the evidence the higher rung is real. The host_language_transport_script lens is reclassified in prose as a regression control rather than deleted — it stays deliberately green on ComputedApplication, so it still backstops a class construction does not own.

DESIGN.md / ROADMAP.md are regenerated from their .dag authorities (gunbc.design_document, gunbc.roadmap_authority); the roadmap capability-audit row is narrowed, not closed — the cast form and caller admission are audited, while generics, coproduct variants, default values and module_skips_direct_call_arg_check remain unverified, so that node stays open.

Standing gap, named accurately

The .dag⇄Rust transport seam's execution suite (v1-compiler-tests) does not run in CI. Two things this is not:

• It is not uncovered here. .github/workflows/ci.yml runs cargo test -p v1-compiler-tests --release --no-run as a compile-contract gate on every run — the third amendment to commit_gate_rust_suite_removed_disposition (operator ruling, 2026-07-31, on the Typecheck perf: sink the where-refinement peel, wire the once-per-closure variant base, share the process index #7490 repair). The compile half of the seam is gated on this PR.
• It is not this PR's debt. That disposition is Terminal and repo-wide: nextest was removed 2026-07-11 by operator ruling (non-required, red on main, ~37 GiB — the fleet's largest CI memory job), and the record says the suite runs locally only. Every PR touching this seam has had exactly this gap since. It leaves with the v1 seed at the DESIGN §7 collapse.

An earlier revision of this section claimed the seam had "no CI coverage" and named cargo test -p v1-compiler as the run that would close it. Both were wrong: the compile half is gated, and v1-compiler and v1-compiler-tests are distinct workspace members, so that command resolves and runs the compiler crate's own unit tests rather than the seam suite. A green from it would not have supported the claim it was offered for.

[gunbai-bot]

review 49822 — both findings fixed, and the caveat it flagged is now discharged by execution

Both findings were repaired in the tree before this comment; this reply is the owed acknowledgement plus the receipt the review asked for.

1. The retained-shell-script witness cast a now-record value as String. Fixed: it reads the field — t.body == "echo hi" and retained_shell_script_to_transport(rss: rss).body == "systemctl daemon-reload". Green by execution, 2/2.
2. design_document.dag contradicted itself across two ends of the same row. Fixed at both ends: the row now states the construction half is CLOSED and names the String-bridge residue as precisely what remains open, rather than describing the carrier as a transparent brand it no longer is.

The stdin caveat is no longer a caveat

The PR body carried one honest caveat: the strict round-trip returned false and I attributed it to the transport's trailing-newline trim by reasoning, not by execution. That is exactly the thing this lane forbids, so it has been replaced with a witness rather than a better argument.

dag/test/claim/transport_script_stdin_byte_fidelity_witness_test.dag — two controls, both wet, both PASS:

• transport_script_stdin_delivers_exact_bytes — a payload carrying a tab, an unexpanded dollar and embedded double quotes goes through the production bridge and the bytes that come back are the bytes that went in. Subject digest 898c66066ad4a8b6.
• transport_script_stdin_fidelity_is_independent_of_terminal_newline — the same shape run with and without a terminal newline, pinning the difference to the RETURN side rather than to stdin delivery. Subject digest bd9eebc35c6f2d49.

[expectation-frontier] 1 site(s), 3 dispatch(es) undeclared: shell.Exec.Run=3 — three real dispatches, so the pass is not vacuous.

Those digests are the post-enrollment values and differ from the ones measured during the spike, because the witness module gained a LiveTreeDisposition declaration between the two runs. Reporting the current ones.

The CI red on beec1bd was mine, and the fix is enrollment rather than a weaker assertion

Both controls execute a real shell through the transport, so dry discovery ran them and both compared false — 2 of 7767 discovery witness(es) failed, enumerating exactly those two. A dry-satisfiable version of this witness would assert nothing about byte delivery, which is the single fact the wall rests on, so the repair is to run it wet: LiveTreeDisposition = ReadsLiveTree on the module, a BinWitnessWet exclusion from dry discovery, and two bin_wet roster rows — the same shape as effect_plan_bash_materialize_real_execution_witness_test.

The second refusal in that run (NativeBundleEscapingEntry … never ran) is not claimed as downstream of mine. It is not on my carrier and this diff does not touch src/v2/test/claim/execution. I have no evidence either way and will read it off the next run rather than reason about it.

Merge resolution

origin/main merged in (merge commit, not rebase). Two generated artifacts and one authority row conflicted:

• dag/gunbc/design_document.dag — one row edited by both sides, disjoint within the row. Word-grain three-way merge, then verified by name that markers from both sides survive (sole_constructor RECORD / transport_script_seal / String-bridge residue from this branch; #7978 / bash_nearest_ancestor_locate_assign_command / proc_self_cgroup from main) and that each side's deleted base phrases are gone. An empty side means moved, not deleted, until checked — so nothing here was resolved by count.
• src/v1/stage0/src/v1_compiler_infer.rs — a generated seed, not hand-merged. Worth recording why the obvious resolution was wrong: main deleted the FuncSigLookup variant FuncSigCallerNotAdmitted from src/v1/04_sigs.dag, so taking this branch's seed left the only reference in the tree to a variant no .dag declares, and the build failed on it. The ours side was the stale party. Took main's seed as compilable input and regenerated from the merged authority.
• DESIGN.md — regenerated, not resolved byte-wise.

Seed obligation discharged in the prescribed order, including the second pass: main_wet ExitSuccess → regen_stage0 → fresh rebuild → regen_stage0 --verify → regen_divergence_count=0, committed stage0 matches fresh self-compile. The rebuild before verify is not ceremony: one pass can self-verify at divergence 0 for the wrong reason on a binary that predates the change it emits.

sole_constructor_construction_diags survived the merge in the authority and is still wired at both construction forms — the ExprCast arm and the record-literal path.

Still not done

cargo test -p v1-compiler — the .dag⇄Rust transport seam, which has no CI coverage since nextest was removed — has still not completed; the host has been SIGKILLing heavy processes from an ancestor cgroup (our own cgroup reports oom_kill 0 while a process is killed). Not claiming it as passing, and not working around it.

— sent from quick-wolf-733