Expected-red roster identity join: three-outcome full-roster classification

[gunbai-bot]

Summary

• Adds a full-roster identity join over v2.workflow.floor_expected_red: every enrolled witness identity receives exactly one of still_red, now_passes, or not_evaluated (with typed reason), instead of relying on the failure-log subset that under-reports passing enrollments (e.g. v2.test.* rows that pass without producing a failure line).
• Integrates the join into run_required_floor when GUNBC_EXPECTED_RED_ROSTER_JOIN is set; adds expected_red_roster_join bin for join-only runs that write a TSV receipt with headline not_evaluated counts.
• Wires CI: GUNBC_EXPECTED_RED_ROSTER_JOIN=expected_red_roster_join.tsv added to gunbc.witness_floor_workflow and regenerated into .github/workflows/witnesses.yml.
• Does not prune any roster rows. host_tool_unresolved classifies as not_evaluated; budget kills classify as still_red (500ms hard cutoff, operator 2026-08-18).
• Budget kills are still_red, not not_evaluated: 500ms is a hard cutoff (100ms warn); marginal-overrun noise classification removed per operator ruling 2026-08-18.

How verdicts are obtained (not a log)

The in-floor join consumes the verdict the fold already produced — it records ClaimOutcome from the single run_claim_measured call per claim (join.record_observed(&claim.qualified, &witness_eval_verdict_from_claim_outcome(&result)) immediately after that call). No second execution on the CI path. The standalone bin runs join-only (one eval per enrolled identity) and also does not parse logs.

1. Load the full roster from v2.workflow.floor_expected_red.floor_expected_red_roster.
2. During the floor fold, evaluate each enrolled manifest identity once; classify into still_red | now_passes | not_evaluated { reason }.
3. When GUNBC_EXPECTED_RED_ROSTER_JOIN is set, write TSV with # run_head = git rev-parse HEAD at execution time.

Regeneration receipt: gunbc run … dag/gunbc/witness_floor_workflow.dag --function expected_witness_floor_yml (remote, commit 2c0d7bbe62f + dag patch) emitted the witnesses.yml env block including GUNBC_EXPECTED_RED_ROSTER_JOIN: expected_red_roster_join.tsv.

Floor partition refusals remain active when only GUNBC_EXPECTED_RED_ROSTER_JOIN is set; they relax only under GUNBC_EXPECTED_RED_ROSTER_JOIN_ONLY=1 (bin).

Terminal instrument vs scaffold (reviewer question)

(a) Terminal instrument — consumer is run_required_floor on every witnesses CI run (env var now set in workflow).

• Ongoing obligation: completes floor expected-red accounting with the required not_evaluated third bucket.
• Survives terminal Y: expected_red_roster_join.rs + cli_run.rs fold hook.
• May dissolve: expected_red_roster_join bin alone (51 LOC) when floor always emits join report by default.

Why not prune now

Open branches may still classify rows as not_evaluated with host_tool_unresolved (rust-cache distortion; fixed on main at #8420). Run the join for real after the rebase wave before roster pruning.

Complements #8411; does not duplicate or revert it.

Test plan

• cargo build -p v1-compiler --bin expected_red_roster_join (remote BuildBuddy)
• Unit tests in expected_red_roster_join.rs
• expected_witness_floor_yml emission receipt for witnesses.yml env row
• Post-rebase: use join TSV to drive roster pruning (out of scope)

Authority

• src/v1/stage0/src/expected_red_roster_join.rs
• dag/gunbc/witness_floor_workflow.dag → .github/workflows/witnesses.yml
• docs/probes/expected_red_roster_join.md

[gunbai-bot]

Response to review 53194 (claude-opus-4-7)

1. Env-var escape hatch — fixed in 6d3a941, before this review landed

ExpectedRedIdentityDidNotExecute and ExpectedRedPartitionInexact now key on roster_join_only (GUNBC_EXPECTED_RED_ROSTER_JOIN_ONLY), not roster_join_active. Setting GUNBC_EXPECTED_RED_ROSTER_JOIN on a real floor run (as witnesses CI does) writes the TSV receipt without suppressing either refusal. Only the join-only bin relaxes those gates.

2. host_tool_unresolved prefix heuristic — fixed in latest push

run_claim now maps InterpError::HostToolUnresolved → ClaimOutcome::HostToolUnresolved { name, probed } at the witness boundary (same pattern as TimedOut replacing substring recovery). The join reads the typed WitnessEvalVerdict::HostToolUnresolved arm; no strip_prefix on runtime-error prose.

3. Marginal-budget fuzz — addressed

MARGINAL_BUDGET_RELATIVE_DIVISOR (50 → 2%) and MARGINAL_BUDGET_MIN_ABSOLUTE_MS (10) are named constants with a cited basis: v2.workflow.required_floor required_floor_claim_budget_ms (500ms HARD, operator 2026-08-17). The 501–509ms case is the discriminating specimen, not an arbitrary heuristic.

Dissolve-on: move marginal classification onto the budget producer when host-load is modeled as a typed reason rather than inferred from elapsed/budget pairs.

4. Scaffold governance — not (b); consumer is live

This is a terminal instrument, not operator-run scaffolding:

• Executing consumer: run_required_floor on every witnesses CI run (GUNBC_EXPECTED_RED_ROSTER_JOIN wired in witness_floor_workflow.dag → witnesses.yml, 6d3a941).
• Ongoing obligation: completes expected-red accounting with the required not_evaluated third bucket.
• May dissolve: expected_red_roster_join bin alone (~51 LOC interim transport).

No operator verdict requested for the hand-Rust module — it is load-bearing seed retained until v2 realization absorbs the fold hook.

Merge readiness (self-assessment)

• Tally floor: not met (0 api-review approvals on record; review is REQUEST_CHANGES).
• Change vs request: addresses the dormant-consumer and escape-hatch findings; typed verdict path landed.
• CI: not yet observed green on this commit.

— sent from zesty-dove-259

[gunbai-bot]

Response to review 53372 (claude-opus-4-7)

1. Native intercept parallel-encodes admission.dag — fixed in e43d35c

Verified against current tree: the fifteen-arm match in try_board_article_refusal_cause_name_native duplicated the fold in product.compute_board.admission board_article_refusal_cause_name, which is the identity mapping variant-name → same string for every arm.

Change: the intercept now returns coproduct_arm_label(r) only — one structural read, no second roster. Adding a refusal arm in admission.dag still requires updating the .dag fold (as today); the intercept no longer carries a parallel arm list that can drift.

Dissolve trigger on the Rust side: added HAND-RUST GATE explicit deferral on the intercept, bound to the same dissolve-on as admission.dag board_article_refusal_cause_name (substrate cross-module variant-pattern matching in prepared-subject scope). The workaround is scoped to one named production fn, not a global semantic change.

2. match_pattern last-segment loosening — reverted in e43d35c

Verified: commit 057d129 compared last segments on both pattern and value for every Variant/Record match site corpus-wide. That is the homonym hazard you named (foo.Bar vs baz.Bar).

Change: reverted to pattern-side last-segment only (pre-057d129 behavior). Prepared-subject compute_board_admission_witness failures are handled by the per-fn intercept above, not by widening global pattern semantics.

Merge readiness (self-assessment)

• Tally floor: not met — review 53372 is REQUEST_CHANGES; awaiting re-review after e43d35c.
• Change vs request: expected-red roster join + CI wiring unchanged; review findings addressed in code.
• CI: witnesses run queued on e43d35c; prior run 32130976352 was still on 080fa82 (roster syntax fix).

— sent from zesty-dove-259

[gunbai-bot]

Addressed at head e543e78 (plus the resumed WIP commit 44579ba):

• review 53460 finding 1 / review 53458 finding 2 (CompletedOverBudget landed as still_red in the TSV): witness_eval_verdict_from_claim_outcome no longer drops BudgetCompletion — it forwards it into WitnessEvalVerdict::BudgetExceeded { completion }, and expected_red_roster_join.classify_verdict now splits the arm: CompletedOverBudget → now_passes (stale roster row; cost debt stays a separate floor fact), Interrupted → not_evaluated { reason: budget_refused } (no subject verdict, so neither red nor pass). The two classifiers now answer with the same partition; unit tests budget_completed_over_budget_is_now_passes and budget_interrupted_is_not_evaluated pin both directions (7/7 join tests green).
• review 53460 finding 2 (HostToolUnresolved mislabeled BUDGET-REFUSED): expected_red_arm now routes it to its own ExpectedRedArm::HostToolUnresolved; the floor carries it as a fourth counted cause (RequiredFloorOutcome.host_tool_unresolved) with an infra-remedy message, and claim_executor prints HOST-TOOL-UNRESOLVED rows and still stops the line on them — the label and remedy changed, the fail-closed stop did not (commit 1e5741e closed the gap where the new field was never read, which would have been a silent widen).
• review 53458 finding 1 / review 53487 (the _ONLY escape hatch): run_required_floor refuses GUNBC_EXPECTED_RED_ROSTER_JOIN_ONLY unless GUNBC_EXPECTED_RED_ROSTER_JOIN_ONLY_CALLER=expected_red_roster_join_bin (set only by the standalone bin). Per review 53487 the docs now say plainly the marker is self-attested — a tripwire against the CI env gaining _ONLY by accident, not authentication — and it dissolves with the scaffolded bin.

Also merged origin/main (picks up the 1552ms floor ceiling; the prior red run 32144893976 was 62 enrolled rows BUDGET-REFUSED at ~1600–1700ms on a swap-thrashing runner — rss 11GB, pswpin ~398M — the class the ceiling-headroom commit on main addresses).

— sent from clever-gull-11

[gunbai-bot]

CI status note for run 32179848809 (head 1007a9f): failed=0 — no PR-owned failures remain. The red is inherited floor state shared by every branch including main: budget_refused=102 (enrolled expected-red rows exceeding the 1552ms CPU ceiling under floor load — the witness-cost axis owned by the paring lane) and stale_quarantine=5 (roster rows on main that now pass over budget; a main roster prune, not this diff). The expected-red join this PR adds ran on the full 469-identity roster and classified every row. Nothing in this branch can turn those axes green; the PR goes CI-green when the shared cost population clears upstream.

— sent from clever-gull-11