diff --git a/dag/gunbc/non_fold_residue.dag b/dag/gunbc/non_fold_residue.dag index 970f5410c0b..ca9a4aa4ca9 100644 --- a/dag/gunbc/non_fold_residue.dag +++ b/dag/gunbc/non_fold_residue.dag @@ -44,6 +44,10 @@ data nfr_reason_mint_era: String = "match over a closed-coproduct param carrying data nfr_dissolve_wildcard_total: DissolutionCondition = unbound_dissolution(description: "the site's wildcard arm migrates to a total match — or the fn is declared kernel-permanent in cla_is_kernel_permanent_fn, which forces this row's deletion (DESIGN §6 exclusivity, per non_fold_residue_stale_row_ruling_note) — and the row deletes") +data nfr_reason_floor_discovery_transport: String = "typed transport-state projection: the observation coproduct's non-applicable variants share one located refusal arm at each phase; enumerating them would duplicate the same wrong-phase refusal rather than add semantic coverage. Declared with the transport boundary so the ratchet remains armed." + +data nfr_dissolve_floor_discovery_transport: DissolutionCondition = unbound_dissolution(description: "generated transport realization derives wrong-phase refusal from the observation-state partition and the shared arms become named total cases; the row deletes with the hand-Rust transport scaffold") + data nfr_reason_ci_floor_gate_membership: String = "gate-identity membership fold (match on the Gate param with an off-variant wildcard arm continuing the fold) landed with the CI fail-fast cheap-gate early batch (#7088); surfaced by the re-home PR's whole-corpus receipt after per-PR affected-set selection predict-skipped the corpus-read nfr witness at landing time (the masking class); declared so the ratchet re-arms" data nfr_dissolve_gate_membership: DissolutionCondition = unbound_dissolution(description: "derived equality on Gate from inhabitance lands (dag/std/algebra, DESIGN §3/§4): the nested per-variant match is a hand-rolled sg-equals-g test, so the membership fold collapses to found or sg == g, the nested matches delete, and the row deletes with them") @@ -933,6 +937,11 @@ data non_fold_residue_frontier: List = [ reason: nfr_reason_release_identity_absent_split, dissolution: nfr_dissolve_release_identity_absent_split, }, + FrontierRow { + subject: PathSubject { path: "src/v2/workflow/floor_discovery_transport.dag::floor_discovery_transport_observe" }, + reason: nfr_reason_floor_discovery_transport, + dissolution: nfr_dissolve_floor_discovery_transport, + }, ] fn non_fold_residue_frontier_units() -> List { diff --git a/dag/test/claim/floor_discovery_exact_subject_witness_test.dag b/dag/test/claim/floor_discovery_exact_subject_witness_test.dag new file mode 100644 index 00000000000..8338f4526c5 --- /dev/null +++ b/dag/test/claim/floor_discovery_exact_subject_witness_test.dag @@ -0,0 +1,296 @@ +module test.claim.floor_discovery_exact_subject_witness + +import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } +import std.types { List, String } +import std.execution_mode { ExecutionMode, Hermetic, Wet } +import std.content_hash { Fnv1a64Structural, Sha1Digest, content_hash_atom } +import extdeps.git.object_store { GitObjectId, GitSha1ObjectId } +import v2.workflow.floor_discovery { + FloorDiscoverySubject, + FloorDiscoveryRequest, + FloorDiscoverySubjectBound, + FloorDiscoverySubjectRefused, + FloorDiscoveryTestedCommitMismatch, + FloorDiscoveryTestedTreeMismatch, + FloorDiscoverySourceRootsMismatch, + FloorDiscoveryRequestBound, + FloorDiscoveryRequestRefused, + FloorDiscoveryRequestSubjectMismatch, + FloorDiscoveryScopeMismatch, + FloorDiscoveryExecutionModeMismatch, + floor_discovery_subject_bind, + floor_discovery_request_bind, + floor_discovery_request_identity, + floor_discovery_commit_id, + floor_discovery_tree_id, +} +import v2.workflow.floor_discovery_transport { + TransportNeedsTree, + TransportNeedsTrackedWorktree, + TransportNeedsUntrackedWorktree, + TransportNeedsPublication, + TransportRefused, + TransportReady, + CommitObserved, + TreeObserved, + TrackedWorktreeObserved, + UntrackedWorktreeObserved, + SnapshotPublished, + FloorDiscoverySnapshotArtifact, + FloorDiscoverySnapshotWriteReceipt, + floor_discovery_transport_initialize, + floor_discovery_transport_observe, +} + +data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly + +data tested_commit: GitObjectId = GitSha1ObjectId { + digest: Sha1Digest { hex: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } +} +data other_commit: GitObjectId = GitSha1ObjectId { + digest: Sha1Digest { hex: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" } +} + +data tested_tree: GitObjectId = GitSha1ObjectId { + digest: Sha1Digest { hex: "1111111111111111111111111111111111111111" } +} + +data other_tree: GitObjectId = GitSha1ObjectId { + digest: Sha1Digest { hex: "2222222222222222222222222222222222222222" } +} + +fn naming_identity() -> Fnv1a64Structural { + content_hash_atom(value: "floor-discovery-naming-authority-fixture") +} + +fn tool_identity() -> Fnv1a64Structural { + content_hash_atom(value: "floor-discovery-tool-fixture") +} + +fn subject_fx( + commit: GitObjectId, + tree: GitObjectId, + roots: List, +) -> FloorDiscoverySubject { + FloorDiscoverySubject { + tested_commit: floor_discovery_commit_id(object_id: commit), + tested_tree: floor_discovery_tree_id(object_id: tree), + source_roots: roots, + execution_authority_source_roots: ["dag", "src/v2"], + naming_authority_identity: naming_identity(), + tool_identity: tool_identity(), + } +} + +fn request_fx( + subject: FloorDiscoverySubject, + scope: List, + mode: ExecutionMode, +) -> FloorDiscoveryRequest { + FloorDiscoveryRequest { + subject: subject, + scan_dirs: ["dag/test/claim"], + exclude_substrings: ["/long/"], + discovery_scope_dirs: scope, + execution_mode: mode, + } +} + +fn canonical_subject() -> FloorDiscoverySubject { + subject_fx(commit: tested_commit, tree: tested_tree, roots: ["dag", "src/v1"]) +} + +fn canonical_request() -> FloorDiscoveryRequest { + request_fx(subject: canonical_subject(), scope: ["dag/test/claim"], mode: Hermetic) +} + +test fn exact_subject_binds() -> Bool { + match floor_discovery_subject_bind( + expected: canonical_subject(), + observed: canonical_subject(), + ) { + FloorDiscoverySubjectBound { subject: _ } => true + FloorDiscoverySubjectRefused { cause: _ } => false + } +} + +test fn wrong_commit_refuses_at_commit_coordinate() -> Bool { + match floor_discovery_subject_bind( + expected: canonical_subject(), + observed: subject_fx(commit: other_commit, tree: tested_tree, roots: ["dag", "src/v1"]), + ) { + FloorDiscoverySubjectRefused { + cause: FloorDiscoveryTestedCommitMismatch { expected: _, observed: _ } + } => true + _ => false + } +} + +test fn wrong_tree_refuses_at_tree_coordinate() -> Bool { + match floor_discovery_subject_bind( + expected: canonical_subject(), + observed: subject_fx(commit: tested_commit, tree: other_tree, roots: ["dag", "src/v1"]), + ) { + FloorDiscoverySubjectRefused { + cause: FloorDiscoveryTestedTreeMismatch { expected: _, observed: _ } + } => true + _ => false + } +} + +test fn source_root_order_is_part_of_the_subject() -> Bool { + match floor_discovery_subject_bind( + expected: canonical_subject(), + observed: subject_fx(commit: tested_commit, tree: tested_tree, roots: ["src/v1", "dag"]), + ) { + FloorDiscoverySubjectRefused { + cause: FloorDiscoverySourceRootsMismatch { expected: _, observed: _ } + } => true + _ => false + } +} + +test fn request_preserves_subject_refusal() -> Bool { + let wrong_subject = subject_fx(commit: tested_commit, tree: other_tree, roots: ["dag", "src/v1"]) + match floor_discovery_request_bind( + expected: canonical_request(), + observed: request_fx(subject: wrong_subject, scope: ["dag/test/claim"], mode: Hermetic), + ) { + FloorDiscoveryRequestRefused { + cause: FloorDiscoveryRequestSubjectMismatch { + cause: FloorDiscoveryTestedTreeMismatch { expected: _, observed: _ } + } + } => true + _ => false + } +} + +test fn wrong_scope_refuses_without_widening() -> Bool { + match floor_discovery_request_bind( + expected: canonical_request(), + observed: request_fx(subject: canonical_subject(), scope: [], mode: Hermetic), + ) { + FloorDiscoveryRequestRefused { + cause: FloorDiscoveryScopeMismatch { expected: _, observed: _ } + } => true + _ => false + } +} + +test fn wrong_execution_mode_refuses() -> Bool { + match floor_discovery_request_bind( + expected: canonical_request(), + observed: request_fx(subject: canonical_subject(), scope: ["dag/test/claim"], mode: Wet), + ) { + FloorDiscoveryRequestRefused { + cause: FloorDiscoveryExecutionModeMismatch { expected: _, observed: _ } + } => true + _ => false + } +} + +test fn exact_request_binds() -> Bool { + match floor_discovery_request_bind( + expected: canonical_request(), + observed: canonical_request(), + ) { + FloorDiscoveryRequestBound { request: _ } => true + FloorDiscoveryRequestRefused { cause: _ } => false + } +} + +test fn commit_and_tree_each_move_request_identity() -> Bool { + let canonical = floor_discovery_request_identity(request: canonical_request()) + let changed_commit = floor_discovery_request_identity( + request: request_fx( + subject: subject_fx(commit: other_commit, tree: tested_tree, roots: ["dag", "src/v1"]), + scope: ["dag/test/claim"], + mode: Hermetic, + ) + ) + let changed_tree = floor_discovery_request_identity( + request: request_fx( + subject: subject_fx(commit: tested_commit, tree: other_tree, roots: ["dag", "src/v1"]), + scope: ["dag/test/claim"], + mode: Hermetic, + ) + ) + canonical.digest != changed_commit.digest + && canonical.digest != changed_tree.digest + && changed_commit.digest != changed_tree.digest +} + +test fn canonical_request_identity_matches_bootstrap_golden() -> Bool { + floor_discovery_request_identity(request: canonical_request()).digest == "f8e90d00ba0ad7f8" +} + +test fn transport_preserves_exact_subject_and_refuses_dirty_worktree() -> Bool { + let request = canonical_request() + let after_commit = floor_discovery_transport_observe( + state: floor_discovery_transport_initialize(request: request), + observation: CommitObserved { commit: floor_discovery_commit_id(object_id: tested_commit) }, + ) + let after_tree = floor_discovery_transport_observe( + state: after_commit, + observation: TreeObserved { tree: floor_discovery_tree_id(object_id: tested_tree) }, + ) + match floor_discovery_transport_observe( + state: after_tree, + observation: TrackedWorktreeObserved { modified_paths: ["src/v1/stage0/src/cli_run/floor_discovery_snapshot.rs"] }, + ) { + TransportRefused { cause: _ } => true + _ => false + } +} + +test fn transport_requires_clean_worktree_before_publication() -> Bool { + let request = canonical_request() + let s0 = floor_discovery_transport_initialize(request: request) + let s1 = floor_discovery_transport_observe( + state: s0, + observation: CommitObserved { commit: floor_discovery_commit_id(object_id: tested_commit) }, + ) + let s2 = floor_discovery_transport_observe( + state: s1, + observation: TreeObserved { tree: floor_discovery_tree_id(object_id: tested_tree) }, + ) + let s3 = floor_discovery_transport_observe( + state: s2, + observation: TrackedWorktreeObserved { modified_paths: [] }, + ) + let s4 = floor_discovery_transport_observe( + state: s3, + observation: UntrackedWorktreeObserved { paths: [] }, + ) + let s5 = floor_discovery_transport_observe( + state: s4, + observation: SnapshotPublished { + receipt: FloorDiscoverySnapshotWriteReceipt { + artifact: FloorDiscoverySnapshotArtifact { + request_identity_digest: floor_discovery_request_identity(request: request), + payload_digest: floor_discovery_request_identity(request: request), + }, + walk_attempt_id: "attempt-test", + }, + }, + ) + match s5 { + TransportReady => true + _ => false + } +} + +test fn all_floor_discovery_exact_subject_controls_hold() -> Bool { + exact_subject_binds() + && wrong_commit_refuses_at_commit_coordinate() + && wrong_tree_refuses_at_tree_coordinate() + && source_root_order_is_part_of_the_subject() + && request_preserves_subject_refusal() + && wrong_scope_refuses_without_widening() + && wrong_execution_mode_refuses() + && exact_request_binds() + && commit_and_tree_each_move_request_identity() + && canonical_request_identity_matches_bootstrap_golden() + && transport_preserves_exact_subject_and_refuses_dirty_worktree() + && transport_requires_clean_worktree_before_publication() +} diff --git a/dag/test/claim/floor_preparation_witness_test.dag b/dag/test/claim/floor_preparation_witness_test.dag new file mode 100644 index 00000000000..d2e26faead1 --- /dev/null +++ b/dag/test/claim/floor_preparation_witness_test.dag @@ -0,0 +1,277 @@ +module test.claim.floor_preparation_witness + +import std.types { Bool, List, String } +import std.content_hash { Fnv1a64Structural, Sha1Digest, content_hash_atom } +import std.execution_mode { Hermetic } +import std.measure { byte_size } +import extdeps.git.object_store { GitObjectId, GitSha1ObjectId } +import std.realization_schedule { + ScheduleWitnessEntry, + CorpusWitnessKind, + ExecutionWitnessKind, +} +import std.materialization_provider { + ArtifactPart, + MaterializedArtifact, + ResolvedGraphArtifact, + ProviderProbe, + ProbeAbsent, + ProbeFound, + ProviderMiss, + ProviderRefusedWrongArtifact, + artifact_content_digest, + request_key, +} +import v2.workflow.floor_discovery { + FloorDiscoverySubject, + FloorDiscoveryRequest, + floor_discovery_commit_id, + floor_discovery_tree_id, +} +import v2.workflow.floor_preparation { + ResolveSelectedClosuresV1, + PreparedFloorEntryRequest, + PreparedFloorSubjectRequest, + PreparedFloorEntryProbe, + PreparedFloorSubjectReady, + PreparedFloorSubjectRefused, + PreparedFloorDuplicateSelectedIdentities, + PreparedFloorDuplicateProbeIdentities, + PreparedFloorMissingProbeIdentities, + PreparedFloorUnexpectedProbeIdentities, + PreparedFloorProviderRefused, + prepared_floor_entry_artifact_request, + prepared_claim_subject_identity, + prepared_floor_subject_serve, +} + +data tested_commit: GitObjectId = GitSha1ObjectId { + digest: Sha1Digest { hex: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } +} + +data tested_tree: GitObjectId = GitSha1ObjectId { + digest: Sha1Digest { hex: "1111111111111111111111111111111111111111" } +} + +fn discovery_request() -> FloorDiscoveryRequest { + FloorDiscoveryRequest { + subject: FloorDiscoverySubject { + tested_commit: floor_discovery_commit_id(object_id: tested_commit), + tested_tree: floor_discovery_tree_id(object_id: tested_tree), + source_roots: ["dag", "src/v2"], + execution_authority_source_roots: ["dag", "src/v2"], + naming_authority_identity: content_hash_atom(value: "floor-preparation-naming-fixture"), + tool_identity: content_hash_atom(value: "floor-preparation-tool-fixture"), + }, + scan_dirs: ["dag/test/claim"], + exclude_substrings: [], + discovery_scope_dirs: ["dag/test/claim"], + execution_mode: Hermetic, + } +} + +fn witness_a() -> ScheduleWitnessEntry { + ScheduleWitnessEntry { + entry: "dag/test/claim/a_test.dag", + function: "a", + kind: CorpusWitnessKind, + } +} + +fn witness_b() -> ScheduleWitnessEntry { + ScheduleWitnessEntry { + entry: "dag/test/claim/b_test.dag", + function: "b", + kind: ExecutionWitnessKind, + } +} + +fn witness_extra() -> ScheduleWitnessEntry { + ScheduleWitnessEntry { + entry: "dag/test/claim/extra_test.dag", + function: "extra", + kind: CorpusWitnessKind, + } +} + +fn entry_request(witness: ScheduleWitnessEntry, closure: String) -> PreparedFloorEntryRequest { + PreparedFloorEntryRequest { + witness: witness, + closure_digest: content_hash_atom(value: closure), + } +} + +fn entry_a() -> PreparedFloorEntryRequest { + entry_request(witness: witness_a(), closure: "closure-a") +} + +fn entry_b() -> PreparedFloorEntryRequest { + entry_request(witness: witness_b(), closure: "closure-b") +} + +fn request_with(selected: List) -> PreparedFloorSubjectRequest { + PreparedFloorSubjectRequest { + discovery: discovery_request(), + selected: selected, + policy: ResolveSelectedClosuresV1 {}, + } +} + +fn canonical_request() -> PreparedFloorSubjectRequest { + request_with(selected: [entry_a(), entry_b()]) +} + +fn artifact_part(label: String) -> ArtifactPart { + ArtifactPart { + digest: content_hash_atom(value: label), + bytes: byte_size(count: 1), + } +} + +fn artifact_for(entry: PreparedFloorEntryRequest) -> MaterializedArtifact { + ResolvedGraphArtifact { + request_key: request_key( + req: prepared_floor_entry_artifact_request( + discovery: discovery_request(), + entry: entry, + ) + ), + resolved_graph: artifact_part(label: concat(entry.witness.entry, ".graph")), + source_indices: artifact_part(label: concat(entry.witness.entry, ".indices")), + compile_clean_diagnostic_union: artifact_part(label: concat(entry.witness.entry, ".union")), + } +} + +fn probe_for(entry: PreparedFloorEntryRequest) -> PreparedFloorEntryProbe { + let artifact = artifact_for(entry: entry) + PreparedFloorEntryProbe { + witness: entry.witness, + probe: ProbeFound { + artifact: artifact, + observed_digest: artifact_content_digest(artifact: artifact), + } + } +} + +test fn exact_prepared_artifact_set_serves() -> Bool { + let request = canonical_request() + match prepared_floor_subject_serve( + request: request, + probes: [probe_for(entry: entry_a()), probe_for(entry: entry_b())], + ) { + PreparedFloorSubjectReady { identity: identity, entries: entries } => + identity == prepared_claim_subject_identity(request: request) + && entries.count() == 2 + && entries.first().witness.entry == witness_a().entry + PreparedFloorSubjectRefused { cause: _ } => false + } +} + +test fn missing_prepared_identity_refuses() -> Bool { + match prepared_floor_subject_serve( + request: canonical_request(), + probes: [probe_for(entry: entry_a())], + ) { + PreparedFloorSubjectRefused { + cause: PreparedFloorMissingProbeIdentities { missing: missing } + } => missing.count() == 1 && missing.first().entry == witness_b().entry + _ => false + } +} + +test fn absent_artifact_is_typed_miss_without_cold_fallback() -> Bool { + match prepared_floor_subject_serve( + request: request_with(selected: [entry_a()]), + probes: [PreparedFloorEntryProbe { witness: witness_a(), probe: ProbeAbsent }], + ) { + PreparedFloorSubjectRefused { + cause: PreparedFloorProviderRefused { + witness: witness, + lookup: ProviderMiss { key: _ }, + } + } => witness.entry == witness_a().entry + _ => false + } +} + +test fn wrong_artifact_key_refuses() -> Bool { + let wrong = artifact_for(entry: entry_b()) + match prepared_floor_subject_serve( + request: request_with(selected: [entry_a()]), + probes: [PreparedFloorEntryProbe { + witness: witness_a(), + probe: ProbeFound { + artifact: wrong, + observed_digest: artifact_content_digest(artifact: wrong), + } + }], + ) { + PreparedFloorSubjectRefused { + cause: PreparedFloorProviderRefused { + witness: _, + lookup: ProviderRefusedWrongArtifact { key: _, found_key: _ }, + } + } => true + _ => false + } +} + +test fn duplicate_selected_identity_refuses() -> Bool { + match prepared_floor_subject_serve( + request: request_with(selected: [entry_a(), entry_a()]), + probes: [probe_for(entry: entry_a())], + ) { + PreparedFloorSubjectRefused { + cause: PreparedFloorDuplicateSelectedIdentities { duplicates: duplicates } + } => duplicates.count() == 2 + _ => false + } +} + +test fn duplicate_probe_identity_refuses() -> Bool { + match prepared_floor_subject_serve( + request: request_with(selected: [entry_a()]), + probes: [probe_for(entry: entry_a()), probe_for(entry: entry_a())], + ) { + PreparedFloorSubjectRefused { + cause: PreparedFloorDuplicateProbeIdentities { duplicates: duplicates } + } => duplicates.count() == 2 + _ => false + } +} + +test fn unexpected_probe_identity_refuses() -> Bool { + let extra = entry_request(witness: witness_extra(), closure: "closure-extra") + match prepared_floor_subject_serve( + request: request_with(selected: [entry_a()]), + probes: [probe_for(entry: entry_a()), probe_for(entry: extra)], + ) { + PreparedFloorSubjectRefused { + cause: PreparedFloorUnexpectedProbeIdentities { unexpected: unexpected } + } => unexpected.count() == 1 && unexpected.first().entry == witness_extra().entry + _ => false + } +} + +test fn changed_closure_changes_prepared_artifact_set_identity() -> Bool { + let canonical = prepared_claim_subject_identity( + request: request_with(selected: [entry_a()]) + ) + let changed = prepared_claim_subject_identity( + request: request_with( + selected: [entry_request(witness: witness_a(), closure: "changed-closure-a")] + ) + ) + canonical.artifact_set_identity.digest != changed.artifact_set_identity.digest +} + +test fn all_floor_preparation_controls_hold() -> Bool { + exact_prepared_artifact_set_serves() + && missing_prepared_identity_refuses() + && absent_artifact_is_typed_miss_without_cold_fallback() + && wrong_artifact_key_refuses() + && duplicate_selected_identity_refuses() + && duplicate_probe_identity_refuses() + && unexpected_probe_identity_refuses() + && changed_closure_changes_prepared_artifact_set_identity() +} diff --git a/docs/plans/cross-worker-typecheck-share-design.md b/docs/plans/cross-worker-typecheck-share-design.md index ef9f5b7b8dd..899d2cfd2ea 100644 --- a/docs/plans/cross-worker-typecheck-share-design.md +++ b/docs/plans/cross-worker-typecheck-share-design.md @@ -6,6 +6,89 @@ > > Parent lanes (referenced, not forked): [resolver-graph-major-design](resolver-graph-major-design.md) §7 move-2 staging, [interface-summary-declared-use-arity](interface-summary-declared-use-arity.md), [v1-run-stability-throughline](v1-run-stability-throughline.md) Track A receipt, [lens-input-authority-design](lens-input-authority-design.md) §1 per-shard W× residual. +## 2026-08-10 correction — exact-subject preparation supersedes the host-first mechanism + +The historical sections below remain as the evidence trail for the in-process worker-thread +hypothesis, but their proposed landing order and immediate mechanism are superseded wherever they +conflict with this correction. + +Three current facts change the next move: + +1. The required-path floor normally drains at width one against one process-shared index. The old + `W` private thread-index picture is not the dominant required-path cost now. +2. The ordinary and scoped workers do repeat the same pre-plan discovery over the enclosing + `dag`/`src/v2` execution-authority universe. That is an exact duplicate and is now handed across + the child boundary as one complete `FloorDiscoverySnapshot`. +3. The scoped witness subject itself is different: it prepares `dag`/`src/v1` for the five + file-grain scoped entries (currently expanding to 27 witnesses), while the ordinary subject is + `dag`/`src/v2`. A raw ordinary `MultiEntryIndex` is therefore not the scoped prepared subject. + Sharing it would widen roots and fabricate equivalence. + +The authority sequence is now: + +```text +v2.workflow.floor_discovery + FloorDiscoverySubject / FloorDiscoveryRequest + exact commit + tree + ordered root universes + naming/tool identities + ↓ +one verified discovery snapshot + absent / damaged / wrong subject → refuse, never recompute + ↓ +v2.workflow.floor_preparation + PreparedFloorSubjectRequest + ↓ derives existing std.materialization_provider ResolveClosureRequest keys + PreparedClaimSubjectIdentity (sole_constructor) + ↓ +provider_serve over one probe per selected witness identity + hit → witness-bound modeled artifact metadata + miss / wrong key / wrong content / incomplete / duplicate / missing / unexpected → typed refusal + ↓ +host realization + live immutable capability OR exact materialized artifact + never MultiEntryIndex in the semantic API +``` + +This also corrects the staging rule in historical §6: the model is not “parallel, not blocking”. +The domain types and refusal laws land before a live pipeline consumer. Rust may then realize host +physics behind that boundary; it may not invent the prepared identity, provider outcome, fallback +policy, or selected population. + +### What is live in the first precursor + +- `FloorDiscoveryRequest.tested_commit` and `tested_tree` are distinct coordinates. The tree uses + the repository's observed Git object format; a commit id no longer inhabits a tree-named field. +- Cross-process discovery sharing binds the complete request and payload digest. A dirty/untracked + worktree, missing snapshot, damaged payload, or request mismatch refuses without activating the + producer. +- The Rust request-identity mirror and the `.dag` derivation share an executed golden digest. +- `PreparedClaimSubjectIdentity` and the provider serve/refusal fold are modeled and witnessed. + No live scoped preparation consumer is claimed by those types alone. + +### Next terminal consumer and construction wall + +The next consumer is the scoped population, but it may switch only when an exact producer exists +for every selected `ResolveClosureRequest` and the child can probe those artifacts before broad +index construction. The acceptance counters remain structural: + +```text +exact subject observations = 1 +discovery fact constructions = 1 +prepared artifact-set constructions = 1 +scoped cold reconstructions = 0 +fallback reconstructions = 0 +missing / duplicate / unexpected identities = 0 +``` + +Restoring a scoped cold constructor must make a control red. An absent prepared artifact is a +typed provider miss and stops; it never falls through to `build_multi_entry_index`. + +This does **not** authorize simply retaining both current worlds in one process. The batch's +`SequentialChildProcess` note records an observed same-process death after ordinary discovery at +7.113 GB RSS. Keep the child lifetime boundary until immutable prepared state is separated from +per-population evaluator/symbol-index scratch and the same-subject memory receipt proves the new +co-residence safe. The host may instead materialize exact prepared artifacts across the existing +child boundary; both choices implement the same modeled identity. + --- ## 0. The displaced cost (one line) diff --git a/src/v1/stage0/src/bin/claim_executor.rs b/src/v1/stage0/src/bin/claim_executor.rs index ea8b1079ea9..541cc3dc528 100644 --- a/src/v1/stage0/src/bin/claim_executor.rs +++ b/src/v1/stage0/src/bin/claim_executor.rs @@ -16,8 +16,8 @@ use v1_compiler::cli_run::{ floor_discovery_consumer_role_from_env, heartbeat_feed_enter_batch, heartbeat_feed_entry_completed, heartbeat_feed_snapshot, install_floor_compile_clean_receipt, make_eval_context, project_witness_cost_receipt, record_resolution_divergence_phase, - render_selection_degradation_receipt_body, request_identity_digest, - reset_resolution_divergence_phase_receipt, resolution_divergence_parent_plan_capture_begin, + render_selection_degradation_receipt_body, reset_resolution_divergence_phase_receipt, + resolution_divergence_parent_plan_capture_begin, resolution_divergence_parent_plan_capture_finish, resolve_entry_graph, resolve_entry_graph_shared, run_claim, run_discovery_corpus_with_options, run_value, set_phase, top_n_slowest_witnesses, verify_floor_discovery_terminal_for_coordinator, BudgetKind, @@ -10022,8 +10022,9 @@ fn maybe_run_floor_coordinator(args: &[String]) -> Option { ))); } }; - let digest = request_identity_digest(&pre_plan_request); - if let Err(msg) = verify_floor_discovery_terminal_for_coordinator(&walk_attempt_id, &digest) { + if let Err(msg) = + verify_floor_discovery_terminal_for_coordinator(&walk_attempt_id, &pre_plan_request) + { return Some(coordinator_terminal_refusal(&format!( "floor coordinator snapshot terminal refusal: {msg}" ))); diff --git a/src/v1/stage0/src/cli_run/floor_discovery_snapshot.rs b/src/v1/stage0/src/cli_run/floor_discovery_snapshot.rs index 45ed76f772c..96db7187351 100644 --- a/src/v1/stage0/src/cli_run/floor_discovery_snapshot.rs +++ b/src/v1/stage0/src/cli_run/floor_discovery_snapshot.rs @@ -20,7 +20,9 @@ use std::time::{Instant, SystemTime, UNIX_EPOCH}; use serde::{Deserialize, Serialize}; -use crate::std_content_hash::{content_hash_atom, content_hash_combine_structural}; +use crate::std_content_hash::{ + content_hash_atom, content_hash_combine_structural, fnv1a64_structural_hex_digest, +}; use crate::v1_rt; pub const FLOOR_ATTEMPTS_DIR: &str = "target/floor-attempts"; @@ -42,6 +44,7 @@ pub enum FloorDiscoveryConsumerRole { #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] pub struct FloorDiscoveryRequest { + pub tested_commit: String, pub tested_tree: String, pub source_roots: Vec, pub scan_dirs: Vec, @@ -89,6 +92,7 @@ pub struct FloorDiscoverySnapshot { #[derive(Debug, Clone, Serialize, Deserialize)] pub struct FloorDiscoveryTerminalReceipt { + pub tested_commit: String, pub tested_tree: String, pub walk_attempt_id: String, pub request_identity_digest: String, @@ -125,8 +129,10 @@ pub fn build_floor_discovery_request( execution_mode: &str, execution_authority_source_roots: &[String], ) -> Result { + let (tested_commit, tested_tree) = floor_tested_commit_and_tree()?; Ok(FloorDiscoveryRequest { - tested_tree: floor_tested_tree()?, + tested_commit, + tested_tree, source_roots: source_roots.to_vec(), scan_dirs: scan_dirs.to_vec(), exclude_substrings: exclude_substrings.to_vec(), @@ -138,10 +144,14 @@ pub fn build_floor_discovery_request( }) } -pub fn request_identity_digest(request: &FloorDiscoveryRequest) -> String { - let seed = content_hash_atom("floor-discovery-request-identity-v1".to_string()); - let mut acc = - content_hash_combine_structural(seed, content_hash_atom(request.tested_tree.clone())); +pub fn request_identity_digest(request: &FloorDiscoveryRequest) -> Result { + let seed = content_hash_atom("floor-discovery-request-identity-v2".to_string()); + let with_commit = + content_hash_combine_structural(seed, content_hash_atom(request.tested_commit.clone())); + let mut acc = content_hash_combine_structural( + with_commit, + content_hash_atom(request.tested_tree.clone()), + ); for root in &request.source_roots { acc = content_hash_combine_structural(acc, content_hash_atom(root.clone())); } @@ -158,38 +168,149 @@ pub fn request_identity_digest(request: &FloorDiscoveryRequest) -> String { for root in &request.execution_authority_source_roots { acc = content_hash_combine_structural(acc, content_hash_atom(root.clone())); } - acc = content_hash_combine_structural( - acc, - content_hash_atom(request.naming_authority_digest.clone()), - ); - acc = content_hash_combine_structural(acc, content_hash_atom(request.tool_identity.clone())); - acc.digest.clone() + let naming_authority = fnv1a64_structural_hex_digest(request.naming_authority_digest.clone()) + .ok_or_else(|| { + format!( + "floor naming authority identity `{}` is not a modeled lower-hex Fnv1a64Structural digest", + request.naming_authority_digest + ) + })?; + acc = content_hash_combine_structural(acc, naming_authority); + let tool_identity = + fnv1a64_structural_hex_digest(request.tool_identity.clone()).ok_or_else(|| { + format!( + "floor tool identity `{}` is not a modeled lower-hex Fnv1a64Structural digest", + request.tool_identity + ) + })?; + acc = content_hash_combine_structural(acc, tool_identity); + Ok(acc.digest.clone()) } -fn floor_tested_tree() -> Result { - if let Ok(sha) = std::env::var("GITHUB_SHA") { - let lower = sha.to_ascii_lowercase(); - if lower.len() == 40 && lower.chars().all(|c| c.is_ascii_hexdigit()) { - return Ok(lower); - } +fn git_rev_parse(spec: &str, coordinate: &str) -> Result { + let output = std::process::Command::new("git") + .args(["rev-parse", "--verify", spec]) + .output() + .map_err(|e| format!("floor {coordinate} git rev-parse `{spec}`: {e}"))?; + if !output.status.success() { + return Err(format!( + "floor {coordinate} git rev-parse `{spec}` failed: {}", + String::from_utf8_lossy(&output.stderr) + )); } + Ok(String::from_utf8_lossy(&output.stdout).trim().to_string()) +} + +fn floor_git_object_format() -> Result { let output = std::process::Command::new("git") - .args(["rev-parse", "HEAD"]) + .args(["rev-parse", "--show-object-format=storage"]) .output() - .map_err(|e| format!("floor tested_tree git rev-parse: {e}"))?; + .map_err(|e| format!("floor git object format observation: {e}"))?; if !output.status.success() { return Err(format!( - "floor tested_tree git rev-parse failed: {}", + "floor git object format observation failed: {}", String::from_utf8_lossy(&output.stderr) )); } - let sha = String::from_utf8_lossy(&output.stdout) - .trim() - .to_ascii_lowercase(); - if sha.len() != 40 || !sha.chars().all(|c| c.is_ascii_hexdigit()) { - return Err(format!("floor tested_tree invalid git HEAD `{sha}`")); + let format = String::from_utf8_lossy(&output.stdout).trim().to_string(); + match format.as_str() { + "sha1" | "sha256" => Ok(format), + _ => Err(format!( + "floor git object format `{format}` is unsupported; expected sha1 or sha256" + )), + } +} + +fn validate_git_object_hex(value: &str, format: &str, coordinate: &str) -> Result<(), String> { + let expected_len = match format { + "sha1" => 40, + "sha256" => 64, + _ => { + return Err(format!( + "floor {coordinate} cannot validate unsupported git object format `{format}`" + )); + } + }; + if value.len() != expected_len + || value != value.to_ascii_lowercase() + || !value.chars().all(|c| c.is_ascii_hexdigit()) + { + return Err(format!( + "floor {coordinate} `{value}` is not a canonical lowercase {format} object id" + )); + } + Ok(()) +} + +fn floor_tested_commit_and_tree() -> Result<(String, String), String> { + let object_format = floor_git_object_format()?; + let selected_commit = match std::env::var("GITHUB_SHA") { + Ok(sha) => { + validate_git_object_hex(&sha, &object_format, "tested_commit GITHUB_SHA")?; + sha + } + Err(std::env::VarError::NotPresent) => git_rev_parse("HEAD^{commit}", "tested_commit")?, + Err(std::env::VarError::NotUnicode(_)) => { + return Err("floor tested_commit GITHUB_SHA is not Unicode".to_string()); + } + }; + let canonical_commit = + git_rev_parse(&format!("{selected_commit}^{{commit}}"), "tested_commit")?; + validate_git_object_hex(&canonical_commit, &object_format, "tested_commit")?; + if canonical_commit != selected_commit { + return Err(format!( + "floor tested_commit mismatch: selected `{selected_commit}`, canonical `{canonical_commit}`" + )); + } + let tree_hex = git_rev_parse(&format!("{canonical_commit}^{{tree}}"), "tested_tree")?; + validate_git_object_hex(&tree_hex, &object_format, "tested_tree")?; + Ok((canonical_commit, format!("{object_format}:{tree_hex}"))) +} + +fn verify_floor_worktree_matches_subject(request: &FloorDiscoveryRequest) -> Result<(), String> { + let diff = std::process::Command::new("git") + .args([ + "diff", + "--quiet", + "--no-ext-diff", + &request.tested_commit, + "--", + ]) + .status() + .map_err(|e| format!("floor exact-subject tracked-worktree observation: {e}"))?; + match diff.code() { + Some(0) => {} + Some(1) => { + return Err(format!( + "floor exact-subject refusal: tracked worktree bytes differ from tested commit {}", + request.tested_commit + )); + } + code => { + return Err(format!( + "floor exact-subject tracked-worktree observation failed with status {code:?}" + )); + } + } + + let untracked = std::process::Command::new("git") + .args(["ls-files", "--others", "--exclude-standard"]) + .output() + .map_err(|e| format!("floor exact-subject untracked-worktree observation: {e}"))?; + if !untracked.status.success() { + return Err(format!( + "floor exact-subject untracked-worktree observation failed: {}", + String::from_utf8_lossy(&untracked.stderr) + )); + } + let untracked_paths = String::from_utf8_lossy(&untracked.stdout); + if let Some(first) = untracked_paths.lines().next() { + return Err(format!( + "floor exact-subject refusal: untracked worktree path `{first}` is not named by tested tree {}", + request.tested_tree + )); } - Ok(sha) + Ok(()) } const NAMING_AUTHORITY_PATHS: &[&str] = &[ @@ -363,11 +484,45 @@ fn digest_facts_snapshot(facts: &ModuleGraphFactsSnapshot) -> String { content_hash_atom(json).digest.clone() } +#[derive(Serialize)] +struct FloorDiscoveryPayloadDigestView<'a> { + request: &'a FloorDiscoveryRequest, + request_identity_digest: &'a str, + roster: &'a [DiscoveryRowSnapshot], + roster_digest: &'a str, + naming_hygiene_refusal: &'a Option, + orphan_helper_refusal: &'a Option, + module_graph_facts: &'a ModuleGraphFactsSnapshot, + module_graph_facts_digest: &'a str, +} + fn digest_payload(snapshot: &FloorDiscoverySnapshot) -> String { - let json = serde_json::to_string(snapshot).unwrap_or_default(); + let payload = FloorDiscoveryPayloadDigestView { + request: &snapshot.request, + request_identity_digest: &snapshot.request_identity_digest, + roster: &snapshot.roster, + roster_digest: &snapshot.roster_digest, + naming_hygiene_refusal: &snapshot.naming_hygiene_refusal, + orphan_helper_refusal: &snapshot.orphan_helper_refusal, + module_graph_facts: &snapshot.module_graph_facts, + module_graph_facts_digest: &snapshot.module_graph_facts_digest, + }; + let json = serde_json::to_string(&payload) + .expect("floor discovery payload view contains only infallibly serializable fields"); content_hash_atom(json).digest.clone() } +fn verify_snapshot_payload_integrity(snapshot: &FloorDiscoverySnapshot) -> Result<(), String> { + let observed = digest_payload(snapshot); + if observed != snapshot.payload_digest { + return Err(format!( + "floor discovery snapshot payload digest mismatch: recorded {}, observed {observed}", + snapshot.payload_digest + )); + } + Ok(()) +} + fn row_to_snapshot(row: &super::DiscoveryRow) -> DiscoveryRowSnapshot { DiscoveryRowSnapshot { label: row.label.clone(), @@ -459,7 +614,7 @@ pub fn produce_floor_discovery_snapshot( } let roster: Vec = rows.iter().map(row_to_snapshot).collect(); let facts_snapshot = facts_to_snapshot(&facts); - let request_identity_digest = request_identity_digest(request); + let request_identity_digest = request_identity_digest(request)?; let roster_digest = digest_rows(&roster); let module_graph_facts_digest = digest_facts_snapshot(&facts_snapshot); let snapshot = FloorDiscoverySnapshot { @@ -493,6 +648,7 @@ pub fn publish_floor_discovery_snapshot( fs::write(&json_path, json) .map_err(|e| format!("write snapshot {}: {e}", json_path.display()))?; let terminal = FloorDiscoveryTerminalReceipt { + tested_commit: snapshot.request.tested_commit.clone(), tested_tree: snapshot.request.tested_tree.clone(), walk_attempt_id: walk_attempt_id.to_string(), request_identity_digest: snapshot.request_identity_digest.clone(), @@ -509,8 +665,10 @@ pub fn publish_floor_discovery_snapshot( pub fn verify_floor_discovery_terminal_for_coordinator( walk_attempt_id: &str, - expected_request_digest: &str, + expected_request: &FloorDiscoveryRequest, ) -> Result { + verify_floor_worktree_matches_subject(expected_request)?; + let expected_request_digest = request_identity_digest(expected_request)?; let terminal_path = snapshot_terminal_path(walk_attempt_id); let bytes = fs::read_to_string(&terminal_path).map_err(|e| { format!( @@ -530,6 +688,18 @@ pub fn verify_floor_discovery_terminal_for_coordinator( terminal.walk_attempt_id )); } + if terminal.tested_commit != expected_request.tested_commit { + return Err(format!( + "coordinator snapshot terminal tested_commit mismatch: expected {}, got {}", + expected_request.tested_commit, terminal.tested_commit + )); + } + if terminal.tested_tree != expected_request.tested_tree { + return Err(format!( + "coordinator snapshot terminal tested_tree mismatch: expected {}, got {}", + expected_request.tested_tree, terminal.tested_tree + )); + } if terminal.request_identity_digest != expected_request_digest { return Err(format!( "coordinator snapshot terminal request_identity_digest mismatch: expected {expected_request_digest}, got {}", @@ -551,6 +721,12 @@ pub fn verify_floor_discovery_terminal_for_coordinator( })?; let snapshot: FloorDiscoverySnapshot = serde_json::from_str(&snapshot_bytes) .map_err(|e| format!("coordinator snapshot payload parse: {e}"))?; + if snapshot.request != *expected_request { + return Err( + "coordinator snapshot payload request subject mismatch — recompute refused".to_string(), + ); + } + verify_snapshot_payload_integrity(&snapshot)?; if snapshot.payload_digest != terminal.payload_digest { return Err( "coordinator snapshot payload_digest does not match terminal receipt".to_string(), @@ -566,7 +742,7 @@ pub fn load_floor_discovery_snapshot_coordinated( walk_attempt_id: &str, request: &FloorDiscoveryRequest, ) -> Result { - let expected_digest = request_identity_digest(request); + let expected_digest = request_identity_digest(request)?; let json_path = snapshot_json_path(walk_attempt_id); let bytes = fs::read_to_string(&json_path).map_err(|_| { format!( @@ -588,6 +764,8 @@ pub fn load_floor_discovery_snapshot_coordinated( .to_string(), ); } + verify_snapshot_payload_integrity(&snapshot) + .map_err(|e| format!("coordinated floor discovery consumer: {e} — recompute refused"))?; Ok(snapshot) } @@ -616,7 +794,10 @@ pub fn discover_floor_witness_roster_with_snapshot( execution_mode, execution_authority_source_roots, )?; - let request_digest = request_identity_digest(&request); + if consumer != FloorDiscoveryConsumerRole::Standalone { + verify_floor_worktree_matches_subject(&request)?; + } + let request_digest = request_identity_digest(&request)?; let started = Instant::now(); let started_ms = trace_epoch_millis(); @@ -699,11 +880,114 @@ pub fn discover_floor_witness_roster_with_snapshot( mod tests { use super::*; + fn minimal_snapshot(request: FloorDiscoveryRequest) -> FloorDiscoverySnapshot { + let facts = ModuleGraphFactsSnapshot { + edges: vec![], + nodes: vec![], + adjacency: BTreeMap::new(), + selection_adjacency: BTreeMap::new(), + reference_unaccounted: vec![], + path_to_module: BTreeMap::new(), + observed_paths: vec![], + read_refusals: vec![], + declared_paths: vec![], + }; + let mut snapshot = FloorDiscoverySnapshot { + request_identity_digest: request_identity_digest(&request).expect("request identity"), + request, + roster: vec![], + roster_digest: digest_rows(&[]), + naming_hygiene_refusal: None, + orphan_helper_refusal: None, + module_graph_facts_digest: digest_facts_snapshot(&facts), + module_graph_facts: facts, + payload_digest: String::new(), + }; + snapshot.payload_digest = digest_payload(&snapshot); + snapshot + } + + #[test] + fn tested_commit_and_tree_are_distinct_exact_git_coordinates() { + let (commit, tree) = floor_tested_commit_and_tree().expect("exact subject"); + let format = floor_git_object_format().expect("git object format"); + let expected_commit = git_rev_parse("HEAD^{commit}", "test commit").expect("HEAD commit"); + let expected_tree = + git_rev_parse(&format!("{expected_commit}^{{tree}}"), "test tree").expect("HEAD tree"); + assert_eq!(commit, expected_commit); + assert_eq!(tree, format!("{format}:{expected_tree}")); + assert_ne!( + commit, expected_tree, + "a commit id is not its tree object id" + ); + } + + #[test] + fn request_identity_binds_commit_and_tree_independently() { + let request = build_floor_discovery_request( + &["dag".to_string()], + &[], + &[], + &[], + "Hermetic", + &["dag".to_string()], + ) + .expect("request"); + let canonical = request_identity_digest(&request).expect("canonical request identity"); + let changed_commit = FloorDiscoveryRequest { + tested_commit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(), + ..request.clone() + }; + let changed_tree = FloorDiscoveryRequest { + tested_tree: "sha1:1111111111111111111111111111111111111111".to_string(), + ..request + }; + assert_ne!( + canonical, + request_identity_digest(&changed_commit).expect("changed commit identity") + ); + assert_ne!( + canonical, + request_identity_digest(&changed_tree).expect("changed tree identity") + ); + assert_ne!( + request_identity_digest(&changed_commit).expect("changed commit identity"), + request_identity_digest(&changed_tree).expect("changed tree identity") + ); + } + + #[test] + fn request_identity_matches_modeled_golden() { + let request = FloorDiscoveryRequest { + tested_commit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(), + tested_tree: "sha1:1111111111111111111111111111111111111111".to_string(), + source_roots: vec!["dag".to_string(), "src/v1".to_string()], + scan_dirs: vec!["dag/test/claim".to_string()], + exclude_substrings: vec!["/long/".to_string()], + discovery_scope_dirs: vec!["dag/test/claim".to_string()], + execution_mode: "Hermetic".to_string(), + execution_authority_source_roots: vec!["dag".to_string(), "src/v2".to_string()], + naming_authority_digest: content_hash_atom( + "floor-discovery-naming-authority-fixture".to_string(), + ) + .digest + .clone(), + tool_identity: content_hash_atom("floor-discovery-tool-fixture".to_string()) + .digest + .clone(), + }; + assert_eq!( + request_identity_digest(&request).expect("request identity"), + "f8e90d00ba0ad7f8" + ); + } + #[test] fn coordinated_consumer_refuses_absent_snapshot() { reset_floor_discovery_snapshot_for_test(); let request = FloorDiscoveryRequest { - tested_tree: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(), + tested_commit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(), + tested_tree: "sha1:1111111111111111111111111111111111111111".to_string(), source_roots: vec!["dag".to_string()], scan_dirs: vec![], exclude_substrings: vec![], @@ -711,7 +995,7 @@ mod tests { execution_mode: "Hermetic".to_string(), execution_authority_source_roots: vec!["dag".to_string()], naming_authority_digest: "0123456789abcdef".to_string(), - tool_identity: "tool".to_string(), + tool_identity: "fedcba9876543210".to_string(), }; assert!( load_floor_discovery_snapshot_coordinated("attempt-a", &request).is_err(), @@ -733,7 +1017,7 @@ mod tests { .expect("request"); let mut snapshot = FloorDiscoverySnapshot { request: request.clone(), - request_identity_digest: request_identity_digest(&request), + request_identity_digest: request_identity_digest(&request).expect("request identity"), roster: vec![], roster_digest: digest_rows(&[]), naming_hygiene_refusal: None, @@ -788,7 +1072,7 @@ mod tests { .expect("request"); let snapshot = FloorDiscoverySnapshot { request: request.clone(), - request_identity_digest: request_identity_digest(&request), + request_identity_digest: request_identity_digest(&request).expect("request identity"), roster: vec![], roster_digest: digest_rows(&[]), naming_hygiene_refusal: None, @@ -820,17 +1104,10 @@ mod tests { let mut snapshot = snapshot; snapshot.payload_digest = digest_payload(&snapshot); publish_floor_discovery_snapshot("attempt-c", &snapshot).expect("publish"); - let rows = discover_floor_witness_roster_with_snapshot( - &request.source_roots, - &request.scan_dirs, - &request.exclude_substrings, - &request.discovery_scope_dirs, - "attempt-c", - FloorDiscoveryConsumerRole::CoordinatedConsumer, - &request.execution_mode, - &request.execution_authority_source_roots, - ) - .expect("coordinated consumer must consume published snapshot"); + let loaded = load_floor_discovery_snapshot_coordinated("attempt-c", &request) + .expect("coordinated consumer must load published snapshot"); + install_floor_discovery_snapshot(&loaded); + let rows: Vec<_> = loaded.roster.iter().map(snapshot_to_row).collect(); assert!(rows.is_empty()); assert_eq!( coordinated_discovery_compute_count(), @@ -838,4 +1115,45 @@ mod tests { "coordinated consumer must not invoke produce_floor_discovery_snapshot" ); } + + #[test] + fn coordinated_consumer_refuses_damaged_payload_without_recompute() { + reset_floor_discovery_snapshot_for_test(); + let request = build_floor_discovery_request( + &["dag".to_string()], + &[], + &[], + &[], + "Hermetic", + &["dag".to_string()], + ) + .expect("request"); + let snapshot = minimal_snapshot(request.clone()); + publish_floor_discovery_snapshot("attempt-d", &snapshot).expect("publish"); + + let path = snapshot_json_path("attempt-d"); + let mut damaged: FloorDiscoverySnapshot = + serde_json::from_str(&fs::read_to_string(&path).expect("read snapshot")) + .expect("decode snapshot"); + damaged.roster.push(DiscoveryRowSnapshot { + label: "damaged".to_string(), + entry: "dag/test/claim/damaged_test.dag".to_string(), + function: "damaged".to_string(), + reads_live_tree: false, + }); + fs::write( + &path, + serde_json::to_string_pretty(&damaged).expect("encode damaged snapshot"), + ) + .expect("write damaged snapshot"); + + let error = load_floor_discovery_snapshot_coordinated("attempt-d", &request) + .expect_err("damaged payload must refuse"); + assert!(error.contains("payload digest mismatch"), "{error}"); + assert_eq!( + coordinated_discovery_compute_count(), + 0, + "damage must never activate a cold reconstruction" + ); + } } diff --git a/src/v2/workflow/floor_discovery.dag b/src/v2/workflow/floor_discovery.dag index 4c8d7ce0379..51f5f64d23a 100644 --- a/src/v2/workflow/floor_discovery.dag +++ b/src/v2/workflow/floor_discovery.dag @@ -1,6 +1,18 @@ module v2.workflow.floor_discovery import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree, SubstrateInputsOnly } +import std.execution_mode { ExecutionMode, Hermetic, Wet, Record, execution_mode_eq } +import std.content_hash { + Fnv1a64Structural, + content_hash_atom, + content_hash_combine_structural, +} +import extdeps.git.object_store { + GitObjectId, + GitSha1ObjectId, + GitSha256ObjectId, + git_object_id_eq, +} import v2.workflow.floor_naming_hygiene { floor_test_marked_decl_allowed_in_entry, floor_wire_contract_decl_allowed_in_entry, @@ -16,6 +28,244 @@ import v2.std.optional { optional_present } +data floor_discovery_exact_subject_note: String = "The exact subject for the cross-worker discovery result. `tested_commit` and `tested_tree` are two different Git facts: the commit names the revision selected for execution, while the GitObjectId is that commit's tree object. The seed formerly stored `git rev-parse HEAD` in a String field named tested_tree, so a commit id inhabited a tree-named coordinate and a consumer could not distinguish same commit/different tree metadata from an exact source-tree binding. Source roots and execution-authority roots remain ordered semantic lists here; a digest is DERIVED only for the storage/request identity and is never carried beside the lists as a caller-asserted duplicate. Naming-authority and tool identities use the existing Fnv1a64Structural family, matching the floor snapshot's current byte/structural identity realization. This is deliberately floor-discovery grain, not a new generic compute subject beside the execution-spine lane and not the gated WalkPlan executor state machine." + +type FloorDiscoveryCommitId sole_constructor { + object_id: GitObjectId +} + +type FloorDiscoveryTreeId sole_constructor { + object_id: GitObjectId +} + +fn floor_discovery_commit_id(object_id: GitObjectId) -> FloorDiscoveryCommitId { + FloorDiscoveryCommitId { object_id: object_id } +} + +fn floor_discovery_tree_id(object_id: GitObjectId) -> FloorDiscoveryTreeId { + FloorDiscoveryTreeId { object_id: object_id } +} + +type FloorDiscoverySubject { + tested_commit: FloorDiscoveryCommitId + tested_tree: FloorDiscoveryTreeId + source_roots: List + execution_authority_source_roots: List + naming_authority_identity: Fnv1a64Structural + tool_identity: Fnv1a64Structural +} + +type FloorDiscoveryRequest { + subject: FloorDiscoverySubject + scan_dirs: List + exclude_substrings: List + discovery_scope_dirs: List + execution_mode: ExecutionMode +} + +type FloorDiscoverySubjectMismatch + = FloorDiscoveryTestedCommitMismatch { expected: GitObjectId, observed: GitObjectId } + | FloorDiscoveryTestedTreeMismatch { expected: GitObjectId, observed: GitObjectId } + | FloorDiscoverySourceRootsMismatch { expected: List, observed: List } + | FloorDiscoveryExecutionAuthorityRootsMismatch { expected: List, observed: List } + | FloorDiscoveryNamingAuthorityMismatch { + expected: Fnv1a64Structural, + observed: Fnv1a64Structural + } + | FloorDiscoveryToolIdentityMismatch { + expected: Fnv1a64Structural, + observed: Fnv1a64Structural + } + +type FloorDiscoverySubjectBinding + = FloorDiscoverySubjectBound { subject: FloorDiscoverySubject } + | FloorDiscoverySubjectRefused { cause: FloorDiscoverySubjectMismatch } + +fn floor_discovery_subject_bind( + expected: FloorDiscoverySubject, + observed: FloorDiscoverySubject, +) -> FloorDiscoverySubjectBinding { + if !git_object_id_eq(left: expected.tested_commit.object_id, right: observed.tested_commit.object_id) { + FloorDiscoverySubjectRefused { + cause: FloorDiscoveryTestedCommitMismatch { + expected: expected.tested_commit.object_id, + observed: observed.tested_commit.object_id, + } + } + } else if !git_object_id_eq(left: expected.tested_tree.object_id, right: observed.tested_tree.object_id) { + FloorDiscoverySubjectRefused { + cause: FloorDiscoveryTestedTreeMismatch { + expected: expected.tested_tree.object_id, + observed: observed.tested_tree.object_id, + } + } + } else if expected.source_roots != observed.source_roots { + FloorDiscoverySubjectRefused { + cause: FloorDiscoverySourceRootsMismatch { + expected: expected.source_roots, + observed: observed.source_roots, + } + } + } else if expected.execution_authority_source_roots != observed.execution_authority_source_roots { + FloorDiscoverySubjectRefused { + cause: FloorDiscoveryExecutionAuthorityRootsMismatch { + expected: expected.execution_authority_source_roots, + observed: observed.execution_authority_source_roots, + } + } + } else if expected.naming_authority_identity.digest != observed.naming_authority_identity.digest { + FloorDiscoverySubjectRefused { + cause: FloorDiscoveryNamingAuthorityMismatch { + expected: expected.naming_authority_identity, + observed: observed.naming_authority_identity, + } + } + } else if expected.tool_identity.digest != observed.tool_identity.digest { + FloorDiscoverySubjectRefused { + cause: FloorDiscoveryToolIdentityMismatch { + expected: expected.tool_identity, + observed: observed.tool_identity, + } + } + } else { + FloorDiscoverySubjectBound { subject: expected } + } +} + +type FloorDiscoveryRequestMismatch + = FloorDiscoveryRequestSubjectMismatch { cause: FloorDiscoverySubjectMismatch } + | FloorDiscoveryScanDirsMismatch { expected: List, observed: List } + | FloorDiscoveryExclusionsMismatch { expected: List, observed: List } + | FloorDiscoveryScopeMismatch { expected: List, observed: List } + | FloorDiscoveryExecutionModeMismatch { expected: ExecutionMode, observed: ExecutionMode } + +type FloorDiscoveryRequestBinding + = FloorDiscoveryRequestBound { request: FloorDiscoveryRequest } + | FloorDiscoveryRequestRefused { cause: FloorDiscoveryRequestMismatch } + +fn floor_discovery_request_bind( + expected: FloorDiscoveryRequest, + observed: FloorDiscoveryRequest, +) -> FloorDiscoveryRequestBinding { + match floor_discovery_subject_bind(expected: expected.subject, observed: observed.subject) { + FloorDiscoverySubjectRefused { cause: c } => + FloorDiscoveryRequestRefused { cause: FloorDiscoveryRequestSubjectMismatch { cause: c } } + FloorDiscoverySubjectBound { subject: _ } => { + if expected.scan_dirs != observed.scan_dirs { + FloorDiscoveryRequestRefused { + cause: FloorDiscoveryScanDirsMismatch { + expected: expected.scan_dirs, + observed: observed.scan_dirs, + } + } + } else if expected.exclude_substrings != observed.exclude_substrings { + FloorDiscoveryRequestRefused { + cause: FloorDiscoveryExclusionsMismatch { + expected: expected.exclude_substrings, + observed: observed.exclude_substrings, + } + } + } else if expected.discovery_scope_dirs != observed.discovery_scope_dirs { + FloorDiscoveryRequestRefused { + cause: FloorDiscoveryScopeMismatch { + expected: expected.discovery_scope_dirs, + observed: observed.discovery_scope_dirs, + } + } + } else if !execution_mode_eq(left: expected.execution_mode, right: observed.execution_mode) { + FloorDiscoveryRequestRefused { + cause: FloorDiscoveryExecutionModeMismatch { + expected: expected.execution_mode, + observed: observed.execution_mode, + } + } + } else { + FloorDiscoveryRequestBound { request: expected } + } + } + } +} + +fn floor_discovery_execution_mode_identity(mode: ExecutionMode) -> String { + match mode { + Hermetic => "Hermetic" + Wet => "Wet" + Record => "Record" + } +} + +fn floor_discovery_tree_identity(tree: FloorDiscoveryTreeId) -> String { + match tree.object_id { + GitSha1ObjectId { digest: d } => concat("sha1:", d.hex) + GitSha256ObjectId { digest: d } => concat("sha256:", d.hex) + } +} + +fn floor_discovery_commit_identity(commit: FloorDiscoveryCommitId) -> String { + match commit.object_id { + GitSha1ObjectId { digest: d } => d.hex + GitSha256ObjectId { digest: d } => d.hex + } +} + +fn floor_discovery_identity_fold_strings( + seed: Fnv1a64Structural, + values: List, +) -> Fnv1a64Structural { + fold( + values, + init: seed, + f: fn(acc, value) { + content_hash_combine_structural(left: acc, right: content_hash_atom(value: value)) + } + ) +} + +fn floor_discovery_request_identity(request: FloorDiscoveryRequest) -> Fnv1a64Structural { + let with_commit = content_hash_combine_structural( + left: content_hash_atom(value: "floor-discovery-request-identity-v2"), + right: content_hash_atom(value: floor_discovery_commit_identity(commit: request.subject.tested_commit)) + ) + let with_tree = content_hash_combine_structural( + left: with_commit, + right: content_hash_atom(value: floor_discovery_tree_identity(tree: request.subject.tested_tree)) + ) + let with_source_roots = floor_discovery_identity_fold_strings( + seed: with_tree, + values: request.subject.source_roots, + ) + let with_scan_dirs = floor_discovery_identity_fold_strings( + seed: with_source_roots, + values: request.scan_dirs, + ) + let with_exclusions = floor_discovery_identity_fold_strings( + seed: with_scan_dirs, + values: request.exclude_substrings, + ) + let with_scope = floor_discovery_identity_fold_strings( + seed: with_exclusions, + values: request.discovery_scope_dirs, + ) + let with_mode = content_hash_combine_structural( + left: with_scope, + right: content_hash_atom(value: floor_discovery_execution_mode_identity(mode: request.execution_mode)) + ) + let with_execution_authority = floor_discovery_identity_fold_strings( + seed: with_mode, + values: request.subject.execution_authority_source_roots, + ) + let with_naming_authority = content_hash_combine_structural( + left: with_execution_authority, + right: request.subject.naming_authority_identity, + ) + content_hash_combine_structural( + left: with_naming_authority, + right: request.subject.tool_identity, + ) +} + +data floor_discovery_exact_subject_seed_scaffold_note: String = "DECLARED SCAFFOLD for the existing Rust snapshot transport only. `src/v1/stage0/src/cli_run/floor_discovery_snapshot.rs` observes tested_commit and the format-qualified tree object selected by that commit, refuses cross-process sharing when tracked or untracked worktree bytes differ from the selected commit tree, derives this request identity in the field order above, and refuses a coordinated snapshot whose complete request differs. It does not evaluate this model per floor request because doing so would resolve another compiler world inside the path whose duplicate setup this lane removes. The executable model witness pins the authority and Rust unit controls pin the mirror. DISSOLVE-ON: generated host-effect transport can construct FloorDiscoveryRequest and its typed binding directly; then the Rust request/terminal mirror and this scaffold note delete." + type FloorDiscoveryRow { label: String entry: String diff --git a/src/v2/workflow/floor_discovery_transport.dag b/src/v2/workflow/floor_discovery_transport.dag new file mode 100644 index 00000000000..179cb2ae2ca --- /dev/null +++ b/src/v2/workflow/floor_discovery_transport.dag @@ -0,0 +1,172 @@ +module v2.workflow.floor_discovery_transport + +import std.types { List, String } +import std.content_hash { Fnv1a64Structural } +import extdeps.git.object_store { git_object_id_eq } +import v2.workflow.floor_discovery { + FloorDiscoveryCommitId, + FloorDiscoveryTreeId, + FloorDiscoveryRequest, + FloorDiscoverySubjectMismatch, + floor_discovery_request_identity, +} +import v2.std.optional { Absent, Present } + +data floor_discovery_transport_authority_note: String = "The transport is a host-effect boundary, not a second discovery implementation. It sequences the existing typed Git/filesystem observations and hands their results to v2.workflow.floor_discovery; it owns neither request identity nor snapshot semantics. A missing, mismatched, or damaged observation stops the transport with a located refusal. There is deliberately no recompute arm. The current Rust snapshot module is the transitional realization of this state machine; generated host-effect transport dissolves that mirror when this state machine is generated and its verified artifact is consumed directly." + +type FloorDiscoveryTransportAction + = ObserveSelectedCommit + | ObserveSelectedTree { commit: FloorDiscoveryCommitId } + | ObserveTrackedWorktree { commit: FloorDiscoveryCommitId } + | ObserveUntrackedWorktree { tree: FloorDiscoveryTreeId } + | PublishVerifiedSnapshot { request: FloorDiscoveryRequest } + +type FloorDiscoverySnapshotArtifact { + request_identity_digest: Fnv1a64Structural + payload_digest: Fnv1a64Structural +} + +type FloorDiscoverySnapshotWriteReceipt { + artifact: FloorDiscoverySnapshotArtifact + walk_attempt_id: String +} + +type FloorDiscoveryTransportObservation + = CommitObserved { commit: FloorDiscoveryCommitId } + | TreeObserved { tree: FloorDiscoveryTreeId } + | TrackedWorktreeObserved { modified_paths: List } + | UntrackedWorktreeObserved { paths: List } + | SnapshotPublished { + receipt: FloorDiscoverySnapshotWriteReceipt + } + | TransportObservationRefused { cause: String } + +type FloorDiscoveryTransportRefusal + = TransportCommitMismatch { expected: FloorDiscoveryCommitId, observed: FloorDiscoveryCommitId } + | TransportTreeMismatch { expected: FloorDiscoveryTreeId, observed: FloorDiscoveryTreeId } + | TransportTrackedWorktreeDirty + | TransportUntrackedWorktree { path: String } + | TransportSubjectRefused { cause: FloorDiscoverySubjectMismatch } + | TransportObservationRefusalCause { cause: String } + +type FloorDiscoveryTransportState + = TransportNeedsCommit { request: FloorDiscoveryRequest } + | TransportNeedsTree { request: FloorDiscoveryRequest } + | TransportNeedsTrackedWorktree { request: FloorDiscoveryRequest } + | TransportNeedsUntrackedWorktree { request: FloorDiscoveryRequest } + | TransportNeedsPublication { request: FloorDiscoveryRequest } + | TransportRefused { cause: FloorDiscoveryTransportRefusal } + | TransportReady + +fn floor_discovery_transport_initialize( + request: FloorDiscoveryRequest, +) -> FloorDiscoveryTransportState { + TransportNeedsCommit { request: request } +} + +fn floor_discovery_transport_next( + state: FloorDiscoveryTransportState, +) -> FloorDiscoveryTransportAction? { + match state { + TransportNeedsCommit { request: _ } => Present { value: ObserveSelectedCommit } + TransportNeedsTree { request: request } => + Present { value: ObserveSelectedTree { commit: request.subject.tested_commit } } + TransportNeedsTrackedWorktree { request: request } => + Present { value: ObserveTrackedWorktree { commit: request.subject.tested_commit } } + TransportNeedsUntrackedWorktree { request: request } => + Present { value: ObserveUntrackedWorktree { tree: request.subject.tested_tree } } + TransportNeedsPublication { request: request } => + Present { value: PublishVerifiedSnapshot { request: request } } + TransportRefused { cause: _ } => Absent + TransportReady => Absent + } +} + +fn floor_discovery_transport_observe( + state: FloorDiscoveryTransportState, + observation: FloorDiscoveryTransportObservation, +) -> FloorDiscoveryTransportState { + match state { + TransportNeedsCommit { request: request } => match observation { + CommitObserved { commit: observed } => { + if git_object_id_eq(left: observed.object_id, right: request.subject.tested_commit.object_id) { + TransportNeedsTree { request: request } + } else { + TransportRefused { + cause: TransportCommitMismatch { + expected: request.subject.tested_commit, + observed: observed, + } + } + } + } + TransportObservationRefused { cause: cause } => + TransportRefused { cause: TransportObservationRefusalCause { cause: cause } } + _ => TransportRefused { + cause: TransportObservationRefusalCause { cause: "commit observation arrived in the wrong phase" } + } + } + TransportNeedsTree { request: request } => match observation { + TreeObserved { tree: observed } => { + if git_object_id_eq(left: observed.object_id, right: request.subject.tested_tree.object_id) { + TransportNeedsTrackedWorktree { request: request } + } else { + TransportRefused { + cause: TransportTreeMismatch { + expected: request.subject.tested_tree, + observed: observed, + } + } + } + } + TransportObservationRefused { cause: cause } => + TransportRefused { cause: TransportObservationRefusalCause { cause: cause } } + _ => TransportRefused { + cause: TransportObservationRefusalCause { cause: "tree observation arrived in the wrong phase" } + } + } + TransportNeedsTrackedWorktree { request: request } => match observation { + TrackedWorktreeObserved { modified_paths: paths } => match paths.first() { + Present { value: _ } => TransportRefused { cause: TransportTrackedWorktreeDirty } + Absent => TransportNeedsUntrackedWorktree { request: request } + } + TransportObservationRefused { cause: cause } => + TransportRefused { cause: TransportObservationRefusalCause { cause: cause } } + _ => TransportRefused { + cause: TransportObservationRefusalCause { cause: "tracked worktree observation arrived in the wrong phase" } + } + } + TransportNeedsUntrackedWorktree { request: request } => match observation { + UntrackedWorktreeObserved { paths: paths } => match paths.first() { + Present { value: path } => + TransportRefused { cause: TransportUntrackedWorktree { path: path } } + Absent => TransportNeedsPublication { request: request } + } + TransportObservationRefused { cause: cause } => + TransportRefused { cause: TransportObservationRefusalCause { cause: cause } } + _ => TransportRefused { + cause: TransportObservationRefusalCause { cause: "untracked worktree observation arrived in the wrong phase" } + } + } + TransportNeedsPublication { request: request } => match observation { + SnapshotPublished { receipt: receipt } => { + if receipt.artifact.request_identity_digest == floor_discovery_request_identity(request: request) { + TransportReady + } else { + TransportRefused { + cause: TransportObservationRefusalCause { + cause: "published snapshot request identity does not match transport request" + } + } + } + } + TransportObservationRefused { cause: cause } => + TransportRefused { cause: TransportObservationRefusalCause { cause: cause } } + _ => TransportRefused { + cause: TransportObservationRefusalCause { cause: "publication observation arrived in the wrong phase" } + } + } + TransportRefused { cause: cause } => TransportRefused { cause: cause } + TransportReady => TransportReady + } +} diff --git a/src/v2/workflow/floor_preparation.dag b/src/v2/workflow/floor_preparation.dag new file mode 100644 index 00000000000..80026e590f1 --- /dev/null +++ b/src/v2/workflow/floor_preparation.dag @@ -0,0 +1,418 @@ +module v2.workflow.floor_preparation + +import std.types { Bool, List, Map, String } +import std.content_hash { + Fnv1a64Structural, + content_hash_atom, + content_hash_combine_structural, + serialize_content_hash, +} +import std.materialization_provider { + ArtifactRequest, + MaterializedArtifact, + ProviderProbe, + ProviderLookup, + ProviderHit, + ResolveClosureRequest, + compiler_identity_input, + provider_serve, + request_key, +} +import std.realization_schedule { + ScheduleWitnessEntry, + CorpusWitnessKind, + ExecutionWitnessKind, + NativeBundleWitnessKind, +} +import v2.workflow.floor_discovery { + FloorDiscoveryRequest, + floor_discovery_request_identity, +} +import v2.std.algebra { list_reverse } +import v2.std.optional { Absent, Present } + +data prepared_floor_subject_authority_note: String = "The prepared floor subject is an opaque semantic identity over the exact discovery request, selected witness identities, and the existing std.materialization_provider ResolveClosureRequest keys. It deliberately does NOT carry MultiEntryIndex or any other compiler container. ProviderProbe is the host read-back seam and provider_serve remains the one request/artifact binding authority. A miss, damaged artifact, incomplete artifact, wrong key, wrong content, or wrong hash family remains the corresponding typed ProviderLookup inside PreparedFloorProviderRefused. There is no cold-construction or fallback arm. SequentialChildProcess may therefore realize this identity as verified materialized resolved-closure artifacts while SharedWalkProcess may realize it as live capabilities; neither realization changes the semantic identity. FIRST CONSUMER: the scoped-witness population named by ROADMAP ci-scoped-worker-shared-substrate. The old scoped cold constructor may delete only after that consumer can serve every exact selected identity through this contract." + +type FloorPreparationPolicy + = ResolveSelectedClosuresV1 {} + +type PreparedFloorEntryRequest { + witness: ScheduleWitnessEntry + closure_digest: Fnv1a64Structural +} + +type PreparedFloorSubjectRequest { + discovery: FloorDiscoveryRequest + selected: List + policy: FloorPreparationPolicy +} + +type PreparedClaimSubjectIdentity sole_constructor { + discovery_request_identity: Fnv1a64Structural + selected_identity_digest: Fnv1a64Structural + preparation_policy_identity: Fnv1a64Structural + artifact_set_identity: Fnv1a64Structural +} + +type PreparedFloorEntryProbe { + witness: ScheduleWitnessEntry + probe: ProviderProbe +} + +type PreparedFloorEntryArtifact { + witness: ScheduleWitnessEntry + artifact: MaterializedArtifact +} + +type PreparedFloorSubjectRefusal + = PreparedFloorDuplicateSelectedIdentities { duplicates: List } + | PreparedFloorDuplicateProbeIdentities { duplicates: List } + | PreparedFloorMissingProbeIdentities { missing: List } + | PreparedFloorUnexpectedProbeIdentities { unexpected: List } + | PreparedFloorProviderRefused { witness: ScheduleWitnessEntry, lookup: ProviderLookup } + +type PreparedFloorSubjectServe + = PreparedFloorSubjectReady { + identity: PreparedClaimSubjectIdentity + entries: List + } + | PreparedFloorSubjectRefused { cause: PreparedFloorSubjectRefusal } + +fn floor_preparation_policy_identity(policy: FloorPreparationPolicy) -> Fnv1a64Structural { + match policy { + ResolveSelectedClosuresV1 {} => content_hash_atom(value: "floor-preparation.resolve-selected-closures-v1") + } +} + +fn prepared_floor_witness_kind_identity(witness: ScheduleWitnessEntry) -> String { + match witness.kind { + CorpusWitnessKind => "corpus" + ExecutionWitnessKind => "execution" + NativeBundleWitnessKind => "native-bundle" + } +} + +fn prepared_floor_witness_identity(witness: ScheduleWitnessEntry) -> Fnv1a64Structural { + let with_entry = content_hash_combine_structural( + left: content_hash_atom(value: "prepared-floor-witness-v1"), + right: content_hash_atom(value: witness.entry), + ) + let with_function = content_hash_combine_structural( + left: with_entry, + right: content_hash_atom(value: witness.function), + ) + content_hash_combine_structural( + left: with_function, + right: content_hash_atom(value: prepared_floor_witness_kind_identity(witness: witness)), + ) +} + +fn prepared_floor_selected_identity( + selected: List, +) -> Fnv1a64Structural { + selected |> fold( + init: content_hash_atom(value: "prepared-floor-selected-v1"), + f: (acc, entry) => content_hash_combine_structural( + left: acc, + right: prepared_floor_witness_identity(witness: entry.witness), + ) + ) +} + +fn prepared_floor_entry_artifact_request( + discovery: FloorDiscoveryRequest, + entry: PreparedFloorEntryRequest, +) -> ArtifactRequest { + ResolveClosureRequest { + closure_digest: entry.closure_digest, + compiler: compiler_identity_input(digest: discovery.subject.tool_identity), + } +} + +fn prepared_floor_artifact_set_identity( + request: PreparedFloorSubjectRequest, +) -> Fnv1a64Structural { + request.selected |> fold( + init: content_hash_atom(value: "prepared-floor-artifact-set-v1"), + f: (acc, entry) => content_hash_combine_structural( + left: acc, + right: content_hash_atom( + value: serialize_content_hash( + hash: request_key( + req: prepared_floor_entry_artifact_request( + discovery: request.discovery, + entry: entry, + ) + ) + ) + ), + ) + ) +} + +fn prepared_claim_subject_identity( + request: PreparedFloorSubjectRequest, +) -> PreparedClaimSubjectIdentity { + PreparedClaimSubjectIdentity { + discovery_request_identity: floor_discovery_request_identity(request: request.discovery), + selected_identity_digest: prepared_floor_selected_identity(selected: request.selected), + preparation_policy_identity: floor_preparation_policy_identity(policy: request.policy), + artifact_set_identity: prepared_floor_artifact_set_identity(request: request), + } +} + +type PreparedFloorWitnessMultiplicityIndex { + witnessed: Map + duplicated: Map +} + +fn prepared_floor_identity_map_contains( + identities: Map, + witness: ScheduleWitnessEntry, +) -> Bool { + match map_get(identities, witness) { + Absent => false + Present { value: _ } => true + } +} + +fn prepared_floor_witness_multiplicity_step( + index: PreparedFloorWitnessMultiplicityIndex, + witness: ScheduleWitnessEntry, +) -> PreparedFloorWitnessMultiplicityIndex { + if prepared_floor_identity_map_contains(identities: index.witnessed, witness: witness) { + PreparedFloorWitnessMultiplicityIndex { + witnessed: index.witnessed, + duplicated: map_insert(index.duplicated, witness, true), + } + } else { + PreparedFloorWitnessMultiplicityIndex { + witnessed: map_insert(index.witnessed, witness, true), + duplicated: index.duplicated, + } + } +} + +fn prepared_floor_selected_multiplicity_index( + selected: List, +) -> PreparedFloorWitnessMultiplicityIndex { + selected |> fold( + init: PreparedFloorWitnessMultiplicityIndex { + witnessed: empty_map(), + duplicated: empty_map(), + }, + f: (index, entry) => prepared_floor_witness_multiplicity_step( + index: index, + witness: entry.witness, + ) + ) +} + +type PreparedFloorProbeIndex { + multiplicity: PreparedFloorWitnessMultiplicityIndex + by_witness: Map +} + +fn prepared_floor_probe_index_step( + index: PreparedFloorProbeIndex, + entry: PreparedFloorEntryProbe, +) -> PreparedFloorProbeIndex { + PreparedFloorProbeIndex { + multiplicity: prepared_floor_witness_multiplicity_step( + index: index.multiplicity, + witness: entry.witness, + ), + by_witness: map_insert(index.by_witness, entry.witness, entry), + } +} + +fn prepared_floor_probe_index( + probes: List, +) -> PreparedFloorProbeIndex { + probes |> fold( + init: PreparedFloorProbeIndex { + multiplicity: PreparedFloorWitnessMultiplicityIndex { + witnessed: empty_map(), + duplicated: empty_map(), + }, + by_witness: empty_map(), + }, + f: (index, entry) => prepared_floor_probe_index_step(index: index, entry: entry) + ) +} + +type PreparedFloorIdentityIndex { + selected: PreparedFloorWitnessMultiplicityIndex + probes: PreparedFloorProbeIndex +} + +fn prepared_floor_identity_index( + selected: List, + probes: List, +) -> PreparedFloorIdentityIndex { + PreparedFloorIdentityIndex { + selected: prepared_floor_selected_multiplicity_index(selected: selected), + probes: prepared_floor_probe_index(probes: probes), + } +} + +fn prepared_floor_probe_for_witness( + index: PreparedFloorIdentityIndex, + witness: ScheduleWitnessEntry, +) -> PreparedFloorEntryProbe? { + map_get(index.probes.by_witness, witness) +} + +data prepared_floor_identity_index_cost_law: String = "THE SELECTED/PROBE JOIN IS INDEXED ON THE EXISTING ScheduleWitnessEntry IDENTITY. The former duplicate, missing, unexpected, and serve lookups filtered an entire population once per row, so preparing n witnesses performed quadratic identity comparisons before any artifact could be served. Each side now makes one pass through the existing native Map substrate: the witnessed map establishes membership, the duplicated map preserves multiplicity standing, and the probe map serves the already-proven singleton row. The four refusal projections then make one linear pass each while preserving input order. There is no digest-key shortcut and therefore no collision state — every map key is ScheduleWitnessEntry itself, whose structural equality is the same entry/function/kind grain as schedule_witness_entry_eq." + +fn prepared_floor_duplicate_selected_identities( + selected: List, + index: PreparedFloorIdentityIndex, +) -> List { + selected + |> filter(entry => prepared_floor_identity_map_contains( + identities: index.selected.duplicated, + witness: entry.witness, + )) + |> map(entry => entry.witness) +} + +fn prepared_floor_duplicate_probe_identities( + probes: List, + index: PreparedFloorIdentityIndex, +) -> List { + probes + |> filter(entry => prepared_floor_identity_map_contains( + identities: index.probes.multiplicity.duplicated, + witness: entry.witness, + )) + |> map(entry => entry.witness) +} + +fn prepared_floor_missing_probe_identities( + selected: List, + index: PreparedFloorIdentityIndex, +) -> List { + selected + |> filter(entry => !prepared_floor_identity_map_contains( + identities: index.probes.multiplicity.witnessed, + witness: entry.witness, + )) + |> map(entry => entry.witness) +} + +fn prepared_floor_unexpected_probe_identities( + probes: List, + index: PreparedFloorIdentityIndex, +) -> List { + probes + |> filter(entry => !prepared_floor_identity_map_contains( + identities: index.selected.witnessed, + witness: entry.witness, + )) + |> map(entry => entry.witness) +} + +type PreparedFloorServeFold + = PreparedFloorServeContinue { entries: List } + | PreparedFloorServeStopped { cause: PreparedFloorSubjectRefusal } + +fn prepared_floor_serve_one( + request: PreparedFloorSubjectRequest, + index: PreparedFloorIdentityIndex, + state: PreparedFloorServeFold, + entry: PreparedFloorEntryRequest, +) -> PreparedFloorServeFold { + match state { + PreparedFloorServeStopped { cause: c } => PreparedFloorServeStopped { cause: c } + PreparedFloorServeContinue { entries: entries } => { + match prepared_floor_probe_for_witness( + index: index, + witness: entry.witness, + ) { + Absent => PreparedFloorServeStopped { + cause: PreparedFloorMissingProbeIdentities { missing: [entry.witness] } + } + Present { value: prepared_probe } => match provider_serve( + req: prepared_floor_entry_artifact_request( + discovery: request.discovery, + entry: entry, + ), + probe: prepared_probe.probe, + ) { + ProviderHit { artifact: artifact, identity: _ } => + PreparedFloorServeContinue { + entries: concat([PreparedFloorEntryArtifact { + witness: entry.witness, + artifact: artifact, + }], entries), + } + other => PreparedFloorServeStopped { + cause: PreparedFloorProviderRefused { + witness: entry.witness, + lookup: other, + } + } + } + } + } + } +} + +data prepared_floor_serve_accumulator_cost_law: String = "THE SERVE FOLD PREPENDS AND REVERSES ONCE. Right-appending one artifact to the growing prefix copied the accumulated list on every selected witness, making the success path quadratic even after identity lookup was indexed. prepared_floor_serve_one now conses the singleton artifact before the accumulator; prepared_floor_subject_serve reverses exactly once at the successful boundary so PreparedFloorSubjectReady.entries remains in selected-request order. The exact_prepared_artifact_set_serves control observes that order and reds if the terminal reverse is removed." + +fn prepared_floor_subject_serve( + request: PreparedFloorSubjectRequest, + probes: List, +) -> PreparedFloorSubjectServe { + let index = prepared_floor_identity_index(selected: request.selected, probes: probes) + let duplicate_selected = prepared_floor_duplicate_selected_identities( + selected: request.selected, + index: index, + ) + let duplicate_probes = prepared_floor_duplicate_probe_identities( + probes: probes, + index: index, + ) + let missing = prepared_floor_missing_probe_identities( + selected: request.selected, + index: index, + ) + let unexpected = prepared_floor_unexpected_probe_identities( + probes: probes, + index: index, + ) + if duplicate_selected.count() > 0 { + PreparedFloorSubjectRefused { + cause: PreparedFloorDuplicateSelectedIdentities { duplicates: duplicate_selected } + } + } else if duplicate_probes.count() > 0 { + PreparedFloorSubjectRefused { + cause: PreparedFloorDuplicateProbeIdentities { duplicates: duplicate_probes } + } + } else if missing.count() > 0 { + PreparedFloorSubjectRefused { + cause: PreparedFloorMissingProbeIdentities { missing: missing } + } + } else if unexpected.count() > 0 { + PreparedFloorSubjectRefused { + cause: PreparedFloorUnexpectedProbeIdentities { unexpected: unexpected } + } + } else { + match request.selected |> fold( + init: PreparedFloorServeContinue { entries: [] }, + f: (state, entry) => prepared_floor_serve_one( + request: request, + index: index, + state: state, + entry: entry, + ) + ) { + PreparedFloorServeContinue { entries: entries } => PreparedFloorSubjectReady { + identity: prepared_claim_subject_identity(request: request), + entries: list_reverse(xs: entries), + } + PreparedFloorServeStopped { cause: cause } => PreparedFloorSubjectRefused { cause: cause } + } + } +}