Bazel-compatible target model: label subset, target identity, //:required aggregate, typed Build/TestStanding in .dag

[briansrls]

What was missing

The repository decides its required set with run-level counters in the seed (RequiredFloorOutcome's planned / executed / passed / known_red_held / route_gap) and with per-identity ClaimDisposition rows in v2.workflow.floor_terminal_ledger. What does not exist anywhere is a target-grain carrier: a thing that says this identity, these edges, this standing, over which an aggregate can be folded. This lands one, on Bazel's own vocabulary rather than a name string.

The four cited surfaces (dag/extdeps/bazel/)

One ExternalModelScope per module, one shared subject symbol (bazel.dag bazel_product_name), per DESIGN §3 external upstream decomposition. All four enrolled in scope_carrier_paths.

• label.dag — the label grammar as a declared subset. Four families the cited authority admits and this module does not — @repo//, package-relative :t / t, target patterns (..., :all, :*), and target names containing / — each refuse with their own named cause, not one MalformedLabel { text }. The repository axis has no field on Label at all, so an @repo// string cannot become a value later readers must remember to check (structural impossibility rather than a validator over a writable state). The cited shorthand (//my/app/lib ≡ //my/app/lib:lib) is folded at parse time, so the two spellings reach one value and label_eq is a usable identity.
• test_status.dag — BlazeTestStatus at upstream arity (9) and upstream wire numbers, decoded fail-closed: an unknown wire number is BlazeTestStatusUnknownWireNumber, not NO_STATUS. Those are ⊥-as-answer and ⊥-as-ignorance, and their remedies are opposite (schedule the test / update this module).
• build_event_stream.dag — Aborted.AbortReason, whole. Upstream's numbering is non-contiguous (NO_ANALYZE = 8, NO_BUILD = 9, after SKIPPED = 7); it is reproduced as declared, and a witness asserts exactly that, because a renumbered mirror of a wire vocabulary is a decode that silently lies.

Arms carry TestStatus / Abort prefixes deliberately: Passed and Failed collide with ClaimDisposition, and DESIGN §4b records that an ambiguous type name in this compiler resolves by silent last-import-wins rather than refusing. The upstream spelling is not lost — blaze_test_status_proto_name / abort_reason_proto_name carry it verbatim, which is what a wire comparison joins on.

The target model (dag/gunbc/build_target.dag)

• Identity is the label and there is no second key. No id, no slug. target_identity renders it on every call, so it cannot drift from it.
• //:required is an ordinary root-package target, not a distinguished constant of some AggregateId type — modelling the most important node in the graph outside the target vocabulary would put it outside every operation the graph supports.
• BuildStanding is the pair upstream actually emits: TargetCompleted { success } or TargetAborted { reason }. A single built: Bool reports an analysis failure and a compile failure identically, and they have different owners.
• TestStanding carries ClaimDisposition; it does not copy its arms. The floor owns that vocabulary one module away, and a parallel eleven-arm coproduct here would be §3 nicknaming. What this layer adds is the policy over it — a downstream fact by the same section — stated once in claim_disposition_satisfies, arm by arm with no wildcard, so a twelfth disposition added upstream fails to compile here instead of inheriting whichever verdict a _ happened to name.

Two states the obvious implementation gets wrong, refused in their own arms:

• AggregateNoDependencies — a conjunction folded over an empty list is true, so the natural implementation reports a //:required that requires nothing as fully satisfied: the strongest green from the weakest evidence, and exactly what a mis-wired discovery pass produces.
• DependencyStandingAbsent — a dependency nobody observed is not silence. Otherwise a standings list that lost rows reports the survivors as the whole answer (the empty-observation narrow, guarded at the join).

The aggregate reports every unsatisfied dependency, not the first: short-circuiting would make it a bisection tool where the number of runs needed equals the number of broken things.

Evidence — green by execution, with discriminating controls

20 witnesses in dag/test/claim/bazel_target_model_witness_test.dag, each run through gunbc run on the real compile path (--source-root dag --source-root src/v2). The file declares SubstrateInputsOnly, without which the floor's fail-closed default declines it — discovered, counted, never run.

The controls are what make them discriminating rather than green by construction:

• the excluded label families are asserted against their own causes, so merging two arms goes red;
• build_standing_dominates_test_standing uses a fixture whose test standing is a PASS, so consulting the test first or merging the two would make it satisfied;
• aggregate_over_zero_dependencies_refuses carries a one-dependency positive control beside it, so it cannot pass by refusing everything;
• abort_reason_preserves_upstream_numbering asserts the non-contiguous values, so tidying them into declaration order goes red;
• export_reports_the_observation_not_the_policy asserts both halves: a held known-red satisfies //:required and exports as FAILED. Exporting it as PASSED would fabricate an observation nobody made; this is what keeps the policy and the observation from being merged in either direction.

What is deliberately out of scope

Nothing populates //:required from the live floor roster. That is wiring — the parent lane's move off claim_executor — and doing it here would have meant landing a discovery pass under a model-landing brief. The model is the prerequisite, and it is consumed by the floor's own ClaimDisposition today, so it is not an artifact with no final consumer.

Rung honesty

The label subset's excluded families sit at structurally impossible for the repository axis (no field exists) and structurally guaranteed for the rest (parse refuses on the acceptance path, measured). claim_disposition_satisfies' totality is structurally guaranteed — the wildcard-free match is the wall, not a lens over it. The aggregate's two refusal arms are mechanically preventable: the states are representable and the fold refuses them, rather than being unwritable. Their next-rung trigger is a non-empty-list carrier for the dependency roster and a standings map keyed by identity, neither of which exists in std today.

[gunbai-bot]

Addressed in 6b81731 — all three findings in review 55919 accepted and fixed. Thank you for the first one in particular; it caught this diff contradicting its own comment.

blaze_test_status_is_pass — deleted, not relocated. You were right that it placed consumer policy in the upstream interface module, and the sharpest evidence was the comment sitting directly above it: it said a consumer treating FLAKY as a pass has decided a policy question this vocabulary does not own, and then the function decided exactly that, there, on every consumer's behalf. The arm-by-arm judgment now lives at the policy layer as gunbc.build_target blaze_test_status_verdict, returning StandingVerdict, wildcard-free. extdeps.bazel.test_status now carries a note above BlazeTestStatus recording why it holds no green/not-green predicate.

claim_disposition_satisfies → claim_disposition_verdict -> StandingVerdict and aggregate_standing_blocks → required_gate_decision -> RequiredGateDecision. I kept both as functions rather than pushing the match to every call site, and want to be explicit about that choice: the grouping each expresses is a genuine single authority — that KnownRedHeld satisfies the required set, and that an aggregate requiring nothing stops the line, are policies every consumer must agree on, and inlining them would let gates drift apart. What was wrong was the Bool return, not the existence of one decision point. Both now carry the reason in the type.

What the Bools were actually costing, which is the argument I should have made myself: exhaustiveness at every call site. A tenth BlazeTestStatus or a twelfth ClaimDisposition would have been absorbed into false with no call site asked to decide — the same silent-absorption shape the rest of this model refuses, committed by the three functions guarding it. I added w_refused_verdict_names_the_disposition_it_refused to assert the recovered fact: the refused arm names which disposition it refused, where the Bool said only false.

Witnesses now match the coproducts directly rather than through a predicate, following the codex_preflight_ok precedent in roadmap_belt_actuate_witness_test — which makes the same point, that matching in place recovers what the Bool discarded.

Verified: 21 witnesses green through gunbc run on the real compile path, and 3998 files parse-clean via v1_src_dag_parse over src/v1, dag, src/v2.

— sent from bold-hawk-65