One authority for how this repo builds its own binaries, with a subject and verb axis for the emitted-tree consumer

[briansrls]

Closes a four-way fork in how this repository builds its own binaries, and lands two DESIGN authority/projection corrections. No behaviour change: proven by regeneration, not by inspection.

The fork

"How this repo builds its compiler" had four owners — three workflow authorities each spelling the argv independently, plus one hand-authored — with differing bin sets and nothing relating them. Operator ruling 2026-08-24: everything compiles through the same point.

- run: "cargo build --release -p v1-compiler --bin claim_executor\n",
+ run: concat(repo_self_build_command(bins: ["claim_executor"]), "\n"),

- fold(witness_floor_required_bins, init: "cargo build --release -p v1-compiler",
-      f: fn(acc, bin) { concat(acc, concat(" --bin ", bin)) })
+ repo_self_build_command(bins: witness_floor_required_bins)

That last hunk is the point: witness_floor_workflow had already written this fold, correctly, in private. What was missing was not the idea but its REACH — three other consumers could not call it. The new module is that function promoted to where every consumer reaches it.

The split follows §3. The cargo build shape is upstream's; which package and bins is business policy and lives here; how a consumer transports it is realization and lives with the consumer.

Two axes, added for a waiting consumer

crisp-crab-430 needs to cargo check an emitted candidate tree — the one required-regen writes and then compares byte-wise without ever asking whether either side compiles.

The module argued against itself: repo_self_build_authority_note pins the package as data because "a caller free to name the package could build a different crate and still look like a conforming call." Their subject is a different crate, so the exact property the note relies on is what excluded them. The note is right about the danger and was wrong about the remedy.

type CargoBuildSubject = RepositoryCrate | EmittedCandidateTree { manifest_path: String }
type CargoVerb         = CargoBuild | CargoCheck

A closed vocabulary keeps the guarantee structurally — no constructor names an arbitrary crate — while admitting the one other legitimate breadth. The verb is a second axis because the base command hardcoded cargo build, and check is measured at 59.8s/2.5GB against build's 155s/4.7GB with every diagnostic of interest check-visible. Left hardcoded, the next consumer writes cargo check beside it and the fork reappears one field down.

repo_self_build_command keeps its signature, so the three rewired consumers are untouched: it is now the RepositoryCrate/CargoBuild instance of the general form.

Evidence

The rewires emit byte-identical workflow YAML. Regenerating every committed artifact over this tree moves zero files. That zero is discriminating rather than saturated: the identical command on this identical tree moved DESIGN.md two runs earlier, so the instrument is demonstrably able to detect a change.

repo_self_build.dag compiles: 9 files emitted, 0 diagnostics.

DESIGN corrections (two drifts, opposite directions)

1. Authority ahead of projection. Bankrupt the measurement corpus: delete docs/probes whole, boards and instruments alike #9132's edits (deleted probe link, the name-the-instrument ruling) were never projected, so committed DESIGN.md had been stale against its own source since that merge.

2. Projection ahead of authority. The required roster is four phases, not three: #9035 added one and DESIGN never noticed #9085 corrected a false phase count — the required roster is four phases, not three — by hand-editing DESIGN.md and never touching gunbc.design_document. The authority still asserted the count that PR disproved, so any regeneration silently reverts the fix. Main's corrected sentence is ported into the authority here.

Both in the file every session reads to decide what to work on. The generated-artifact drift gate that would catch either is on the unguarded list in this document's own CI rung-drop row.

3. The reconcile clause now names its instrument instead of transcribing a duration. It read "reconcile's eight minutes are ~92% typecheck_with_census_extra" (2026-08-20); run 32791076677 emits compile.reconcile done in 15 minutes over 3892 modules. The doubling is not asserted — the subject behind the eight-minute figure is recoverable neither from the document nor from 67437fc, and reconcile's cost is a function of subject size (measured the same night at 32s for a four-module closure and 25s for ~134 regen surfaces). Two retractions produced that wording: a 31x gap I published and a 33x one smart-ram-730 published, both comparing different-sized subjects. The ratio is kept because it is structural; the duration is dropped because it is a property of one run.

Not included

The module-grain affected-set selector moved to session/deep-ant-102-affected-set-selector. It compiles clean and has no caller, so merging it here would land machinery nothing gates on — §6's coverage by illusion. It merges when wired to a consumer with a measured pruned run.