From 9cbbb5e768ca4557438aafdeaeb3c47b2da89aee Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Fri, 28 Aug 2026 00:52:13 +0000 Subject: [PATCH] An escalation is not an infrastructure loss: give ExecutionAttemptLineage the arm the resident-model thesis is measured on A local model that reaches a terminal result it cannot carry, followed by a more capable model taking the next try, is the single observation the "progressively smaller models suffice" claim is denominated in. Measured on this tree, nothing could express it: grep for Episode/continuation/retry_of/ predecessor across dag/gunbc, dag/std and src/v2 returns nothing episode-shaped, and ExecutionAttemptLineage's three arms are InitialAttempt, InfrastructureRetry and RequestedReexecution. So an escalation had to be recorded as either an infrastructure retry -- which says the work told us nothing -- or as an unrelated initial attempt, which discards the edge entirely. CapabilityEscalation is a sibling of InfrastructureRetry rather than an arm of one generic Retry, because the two differ in exactly what lineage exists to record: an infrastructure loss says nothing about the work, while an escalation says the work exceeded the capability that was tried. Like its sibling it names the prior attempt AND the receipt that established the prior result, so merely resolving a more expensive model after a cheaper one is a selection fact rather than an escalation. The two arms are deliberately the same SHAPE, which is what the third witness is for: a control checking only the prior-attempt key would pass identically against a lineage that had collapsed them, so the discriminating assertion matches on the arm and fails if an escalation ever reads as a retry or the reverse. WHAT IS NOT VERIFIED, stated because a green I cannot stand behind is worse than no green. `gunbc compile` takes no --entry, and the whole-corpus run over this tree reports 31139 diagnostics ON PRISTINE MAIN, 1283 of them "expected item declaration" on `//` annotation lines -- so that CLI path does not route source annotations the way the required parse phase does, and cannot adjudicate this tree. My attempted discriminating RED (deleting one arm from an exhaustive match) returned 31139, byte-identical to the pristine baseline: it added zero errors and therefore discriminated nothing. An earlier local run appeared clean only because it was killed at its timeout mid-typecheck and the truncated output rendered identically to a completed clean one. CI is the check here. Co-Authored-By: Claude Opus 5 --- dag/product/fabric/execution.dag | 19 ++++++- .../fabric_terminal_contract_witness_test.dag | 56 ++++++++++++++++++- 2 files changed, 73 insertions(+), 2 deletions(-) diff --git a/dag/product/fabric/execution.dag b/dag/product/fabric/execution.dag index 150d29685a5..6812c737ddc 100644 --- a/dag/product/fabric/execution.dag +++ b/dag/product/fabric/execution.dag @@ -17,7 +17,20 @@ import product.fabric.supply { OfferQuote } // prior attempt AND the receipt that classified the loss, so an attempt can // never claim infrastructure loss without evidence of it - the failure mode // that makes a real compile error retry forever is a classifier that discards -// the termination reason. RequestedReexecution is a demand-driven rerun, which +// the termination reason. CapabilityEscalation is that same shape for a +// DIFFERENT cause: the prior attempt reached a terminal result its resolved +// model could not carry, and a more capable model takes the next try. It is a +// sibling of InfrastructureRetry rather than an arm of one generic Retry +// because the two differ in exactly the ways lineage exists to record -- +// authorization, accounting, and what the edge licenses you to conclude. An +// infrastructure loss says nothing about the work; an escalation says the work +// exceeded the capability that was tried, which is the single observation the +// resident-model thesis is measured on, and collapsing the two would erase it. +// Like InfrastructureRetry it names the prior attempt AND the receipt that +// established the prior result, so an attempt can never claim escalation +// without evidence of what it escalated from: merely resolving a more +// expensive model after a cheaper one is a selection fact, not an escalation. +// RequestedReexecution is a demand-driven rerun, which // is policy rather than infrastructure. An attempt carries no host and no // mutable status: the host lives on the ExecutionGrant, and the position in the run is // DERIVED from accepted receipts, never stored. @@ -27,6 +40,10 @@ type ExecutionAttemptLineage

prior_attempt: FabricIdentity, cause_receipt: ObservationReceiptRef, } + | CapabilityEscalation { + prior_attempt: FabricIdentity, + cause_receipt: ObservationReceiptRef, + } | RequestedReexecution { initiating_demand: FabricIdentity } type Attempt

{ diff --git a/dag/test/claim/fabric_terminal_contract_witness_test.dag b/dag/test/claim/fabric_terminal_contract_witness_test.dag index bfc58b77dee..ea08e0434ee 100644 --- a/dag/test/claim/fabric_terminal_contract_witness_test.dag +++ b/dag/test/claim/fabric_terminal_contract_witness_test.dag @@ -8,7 +8,7 @@ import product.fabric.identity { FabricIdentity, fabric_identity_key, DemandKey, import product.fabric.work { Shape, HardRequirements, Work, WorkContract, ExecutionRequirements, WorkStep, derive_work_key, work_for, ReceiptSatisfiable, IdempotentUnderKey, OpaqueEffects } import product.fabric.demand { Demand, AdmissionTerms, BuyTerms, SatisfactionRequirement, demand_work, demand_reservation_price, demand_maximum_buy_order } import product.fabric.supply { SupplierOffer, QuotedPerSecond, offer_quote_amount, offer_quote_currency, ObservedSupply, QuotedSupply } -import product.fabric.execution { Attempt, InitialAttempt, InfrastructureRetry, LeaseIdentity, Receipt, ExecutionReceipt, ExecutionGrant, FabricGrantObject, FabricGrantContext, FabricGrantEvidence, ReceiptAdmissible, ReceiptFromDifferentLease, ReceiptFromDifferentAttempt, ReceiptFingerprintIncomparable, ReceiptGenerationStale, admit_receipt_for_grant } +import product.fabric.execution { Attempt, InitialAttempt, InfrastructureRetry, CapabilityEscalation, LeaseIdentity, Receipt, ExecutionReceipt, ExecutionGrant, FabricGrantObject, FabricGrantContext, FabricGrantEvidence, ReceiptAdmissible, ReceiptFromDifferentLease, ReceiptFromDifferentAttempt, ReceiptFingerprintIncomparable, ReceiptGenerationStale, admit_receipt_for_grant } import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } @@ -307,10 +307,64 @@ test fn retry_is_a_new_attempt_naming_its_cause() -> Bool { InfrastructureRetry { prior_attempt: prior, cause_receipt: _ } => (prior.key as String) == (first_attempt.id.key as String) InitialAttempt { initiating_demand: _ } => false + CapabilityEscalation { prior_attempt: _, cause_receipt: _ } => false RequestedReexecution { initiating_demand: _ } => false } } +// AN ESCALATION IS A NEW ATTEMPT AT THE SAME WORK, AND IT IS NOT A RETRY. +// The two arms are deliberately the same SHAPE -- prior attempt plus the +// receipt that established the prior result -- so the only thing separating +// them is the arm itself. That is exactly why the discriminating control below +// matches on the arm rather than on its payload: a witness that only checked +// the prior-attempt key would pass identically against a lineage that had +// collapsed escalation into InfrastructureRetry, which is the collapse the +// authority's note argues against and therefore the one its evidence must be +// able to see. + +data escalated_attempt: Attempt = Attempt { + id: FabricIdentity { principal: "operator", key: "attempt-3" }, + work: FabricIdentity { principal: "operator", key: fixture_work_key }, + lineage: CapabilityEscalation { + prior_attempt: FabricIdentity { principal: "operator", key: "attempt-1" }, + cause_receipt: "obs-local-model-terminal-1", + }, + created_at: "2026-08-18T00:20:00Z", +} + +test fn escalation_is_a_new_attempt_at_the_same_work() -> Bool { + (escalated_attempt.id.key as String) != (first_attempt.id.key as String) + && (escalated_attempt.work.key as String) == (first_attempt.work.key as String) +} + +test fn escalation_names_the_attempt_it_escalated_from() -> Bool { + match escalated_attempt.lineage { + CapabilityEscalation { prior_attempt: prior, cause_receipt: _ } => + (prior.key as String) == (first_attempt.id.key as String) + InitialAttempt { initiating_demand: _ } => false + InfrastructureRetry { prior_attempt: _, cause_receipt: _ } => false + RequestedReexecution { initiating_demand: _ } => false + } +} + +// THE DISCRIMINATING CONTROL. An escalation must not read as an infrastructure +// loss and an infrastructure loss must not read as an escalation, because the +// two license opposite conclusions about the work: a lost worker says nothing +// about whether the model could carry the task, while an escalation says +// precisely that it could not. If these ever collapse into one arm, the two +// assertions below cannot both hold. +test fn escalation_and_infrastructure_retry_do_not_read_as_each_other() -> Bool { + let escalation_is_not_a_retry = match escalated_attempt.lineage { + InfrastructureRetry { prior_attempt: _, cause_receipt: _ } => false + _ => true + } + let retry_is_not_an_escalation = match retry_attempt.lineage { + CapabilityEscalation { prior_attempt: _, cause_receipt: _ } => false + _ => true + } + escalation_is_not_a_retry && retry_is_not_an_escalation +} + // A receipt carries the generation it was produced under, so a stale producer is // distinguishable from a current one.