Repository navigation
DESIGN §4b owes a retirement: its present-tense claim that the sole_constructor audit probes DO NOT EXECUTE is now false — #9106 fired the trigger it names, and 6 of those probes fail - #9651
Closed
gunbai-bot[bot] wants to merge 3 commits into
Conversation
briansrls
marked this pull request as ready for review
August 28, 2026 23:07
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 52eb6b0afb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| **Placed here because it is what §4's decidability buys, before §5 legislates the floor (operator directive 2026-07-31; worked examples and the rung census live in the recovery analysis linked below).** Safety is not the presence of diagnostics or the absence of crashes — it is the reduction of the state space in which a program can silently do the wrong thing. Every discovered error class sits on one ordered ladder and is obligated to climb it: **mitigatable** (the failure occurs; harm is contained by total operations, typed outcomes, bounds, rollback, isolation) → **mechanically preventable** (a generated test, lens, or gate reliably exposes and blocks it — but the invalid state remains writable, and safety depends on that mechanism executing and staying enrolled) → **structurally guaranteed** (the source can still describe the invalid state, but no `Accepted` program contains it: the compiler derives a proof or refusal from modeled structure) → **structurally impossible** (the invalid state has no constructor or representation in the canonical model — validation is unnecessary because the bad state cannot be written, and a refusal at the source boundary is then a symptom of the carrier's shape, not a separate check). **At this rung, ask whether the check's RED is authorable before writing the check** (2026-08-22): if the forbidden state cannot be expressed *anywhere the check could run*, the check is not a weak wall but a decoration — permanently green *by construction*, carrying no information, and worse than absent because it will be cited as coverage. **That question has two boundaries and only the second decides it**, a distinction an earlier revision of this clause collapsed: a state unrepresentable in the ACCEPTED corpus may still be perfectly representable as SOURCE HANDED TO THE COMPILER BY A FIXTURE, and a compiler is precisely a thing whose regression probes are invalid programs. So the rule fires only after checking the fixture boundary: if the refusal is still authorable there, the evidence is enrollable there and declining it is the specification-without-execution failure, not a saving. Where no fixture harness can express the subject, that missing harness is the class's next-rung trigger (§4b(2)) rather than a permanent ceiling. That is a sharper objection than redundancy: a redundant check can still fail, this one cannot. It does **not** contradict meta-obligation (4) below — that clause keeps evidence whose RED stays authorable at the source boundary (the compiler still admits the text and refuses it), which is exactly the case where the probe can flip; the rule here bites only where no source text expresses the violation, so nothing can flip it. Receipt, carried through BOTH boundaries because the first alone would have been the collapse this clause warns about: the reach roster's placement is enforced by §3's acyclicity law — measured on a two-module discriminating pair, the acyclic direction compiling with 0 diagnostics and one back-edge refusing with `circular dependency detected` naming both modules — so the annotation was corrected to say *enforced*. No witness was authored, and the reason is the FIXTURE boundary rather than the corpus one: `gunbc.compile_diagnostic_census` takes a single source string, and measured by execution a two-module string returns `BLOCKING: ParseError` — for the ACYCLIC control as well as the cyclic one, so the harness refuses the shape and could never reach the cycle wall. The missing multi-module compile fixture is therefore this class's next-rung trigger, not a ceiling. The higher rung subsumes the lower — construction over proof, proof over validation, validation over mitigation; §5's construction-before-validation preference is this ladder's top two rungs, and its fail-closed doctrine is the law of the floor. Below the floor sits **silent wrongness, which is not a rung: it is outside the ladder and forbidden outright** (§5). Adjacent — and deliberately **not a fifth rung** — is **outside the modeled guarantee**: external reality, undecidable properties, undeclared intent. That column is observed, refused, or mitigated at a declared boundary, never fabricated (§5), and keeping it off the ladder prevents "we do not model this" from masquerading as a weak implementation that should climb. | ||
|
|
||
| Every class carries an **attainable ceiling — derived, not aspirational**: a decidable, fully modeled class may reach structural impossibility; a decidable class missing its authority is §5's *wall after grounding*; a class blocked on a missing-or-unverified language capability names the capability as its trigger (the live one: **unforgeable construction** for carrier-borne invariants — `sole_constructor` is a real, executing wall for a census-unique plain-record type — on the source→`.dag`-acceptance path specifically, confirmed by execution to refuse a cross-module record literal at four positions (fn body, module-scope `data` initializer, list-element, map-value) and at `ExprCast` (including generic instantiation) — and confirmed by execution to leave three further gaps open on that same path (named below: one name-resolution gap, one unwired construction form, and one unrefused construction position), so the mapped boundary is a mix, not a clean coverage claim even before crossing to another realization target. A second, distinct per-function `admit_callers` admission wall confirmed alongside it (`sole_constructor` gates WHO MAY CONSTRUCT; `admit_callers` gates WHO MAY CALL the mint; a caller-supplied validator decides WHAT IS PROVEN and is separately defeasible, below). The compiler-module check exemption `module_skips_direct_call_arg_check` was found (code read, not execution) to be scoped entirely to the direct-call argument-type judgment and does not reach `sole_constructor`'s construction check at either call site — a positive finding that retires this axis, not an absence of any exemption anywhere. On the source→`.dag`-acceptance path the audit closed with three confirmed structural holes, not a clean ceiling: a census-AMBIGUOUS type name resolves by silent last-import-wins instead of refusing; coproduct/variant construction of a `sole_constructor` type is entirely unwired; and a record literal in a parameter's declared default-value expression gets no diagnostic at all (all three 0 live exposure today by targeted grep, all three decidable fixes once scoped, not ratchets). Separately, and more severely, on the source→Rust-emission path: a production `sole_constructor` type's own emitted mirror is confirmed by execution to be silently forgeable — `extdeps.uri` `UriValidatedScalar` (fixed-law mint `uri_validated_scalar_construction`, no caller-supplied validator) emits as a `pub` struct with a `pub` field deriving `serde::Deserialize`, and both `serde_json::from_value` and a direct struct literal admit one representative from each of the mint's three refusal partitions — negative, surrogate, and above the Unicode maximum (the mint refuses whole ranges; the receipt executes a representative per branch, not every refused value), confirmed against a shape-control discriminator so the admits are load-bearing, not a harness artifact (no production caller established to have exercised this — mechanism confirmed, no confirmed victim). Executed downstream, the forgery is not inert: passed to the carrier's percent-encoding consumer `uri_percent_encode_admitted_scalar_wire` (not its only declared consumer — `uri_validated_scalar_code_point` also takes the type, as an accessor returning the raw code point; "sole" was an unverified quantifier in an earlier revision of this clause), the surrogate and above-maximum representatives reach output as invalid UTF-8 percent-encoding (`%ED%A0%80`, `%F4%90%80%80`), while the negative representative is refused there by `uri_utf8_octet_construction` — so the consumer independently catches one of the three partitions, and for the other two the wall's absence is a PRODUCED-OUTPUT defect rather than merely a constructible-value one. This is below floor (§5), not a rung on the ladder, and it is categorically worse than the three `.dag`-path holes above, which are decidable zero-exposure gaps in an otherwise-real wall. And one confirmed scope boundary, more consequential than any single hole above: even where the wall fires with full coverage it confines only WHO/WHERE constructs the carrier, establishing nothing about WHAT invariant a sanctioned caller's own predicate enforces, so a mint lacking a fixed, module-owned validator gives no guarantee beyond confinement — `std.interval` `closed_interval` takes a caller-supplied `le` and accepts reversed bounds under a lying predicate (the failing case); `std.interval` `degenerate_interval` is total and needs no predicate at all (the working case). These two findings are complementary, not duplicative, on one claim from opposite directions: one shows a caller-supplied validator can lie; the other shows a FIXED validator with zero caller freedom can still be defeated once the carrier crosses into a realization where confinement itself doesn't survive — neither is a defect in `sole_constructor` as specified. A reconstruction path that bypasses source construction also exists in the interpreter; that audit is IN FLIGHT as PR #8658 (not yet merged), so its row is not yet in the linked document — named here so the claim is verifiable and the gap is expected, not a broken pointer. **THE PROBES BEHIND THIS AUDIT DO NOT CURRENTLY EXECUTE** — its 26 witness identities sit in the required floor's `DeclinedLiveTree` arm, discovered every run and folded never, so what is written above was measured once and is re-measured by nothing; the population, the specimen and the single deletion that ends it are gap-analysis §11 item 28. Full audit: `docs/plans/compiler-guarantee-recovery-gap-analysis.md`; an earlier revision of this paragraph claimed no such capability exists, refuted by review 2026-07-31, a later revision called its completeness unverified, and this 2026-08-20 revision folds in a second, independently-ruled realization path (ARM 3, PR #8661, also not yet merged) that changes rather than extends that result: a mapped boundary per path, not one closed ceiling); an undecidable property honestly remains a ratchet or validator; an external fact remains a boundary obligation. **Below ceiling is a correctness gap, never optional elegance** — this clause is what keeps §6's purity trap from pricing out mandatory walls, the exact failure mode by which the recovered guarantee decayed unnoticed. Four meta-obligations make the ladder operational: (1) **rung honesty, at a declared subject grain** — the reported rung must equal the rung established by executed evidence, a discriminating RED refused on the real acceptance path plus an accepted positive control, **measured against a declared boundary** (source→interpretation, source→each emission target, phase-carrier→phase-carrier are different paths with independently different rungs: the interpreter refuses a mislabeled call that the emitter reorders into positional leftovers); a class's current rung is the **minimum across its in-scope paths**, or one row per structurally distinct path — citing the strongest path while another stays silent is inflation, and a type name, diagnostic variant, inert lens, or plan establishes nothing. **Rung inflation** (a carrier named for the top rung while occupying the bottom; a status ledger's "DONE") is the fabricated-plausible-output failure applied to the compiler's self-description — worse than sitting low, because an inflated class never ranks for climbing. (2) **no untracked stall** — a class below its ceiling must name its next-rung trigger, separating *cannot climb further* from *can climb after one grounding* from *can climb now but unbuilt*; only the first is permanent. (3) **no silent regression** — a change may lower a rung only by declaring previous rung, temporary rung, reason, bounded population, and restoration trigger; a compatibility exemption is not bootstrap glue, it is a visible safety regression with a finite runway. **AND THE TRIGGER MUST NAME THE CAPABILITY, NOT AN ARTIFACT THAT WOULD CONTRIBUTE TO ONE (2026-08-26).** A declared drop is retired BY ITS TRIGGER AND BY NOTHING ELSE, so the trigger *is* the whole check, and a trigger naming less than the capability it restores is the one direction this machinery structurally cannot see: **it will be satisfied while the capability stays dead.** What makes it invisible is that no step is wrong — the instrument author builds exactly what the trigger asked, the trigger fires honestly, the row retires correctly, and the thing the row existed to protect is still gone. Nobody has to be careless for this to happen, which is why it needs a rule rather than diligence. Receipt, and it is this document's own row: the measurement-bankruptcy entry above records losing *the only executable route to a self-host emission BOARD measurement* and then writes a trigger naming *a `.dag` entry point that emits, assembles and compiles ONE ENTRY* — a board is per-entry across MANY entries, so the two halves sit five lines apart in one row at different grains, and the row then declares the trigger fired. Measured by code read, the instrument that fired it takes a fresh temporary directory per invocation and path-depends on the whole stage0 crate, so every entry rebuilds the bootstrap compiler cold and the cost is entry-INDEPENDENT — one entry is the only thing it can do. **The rule:** a restoration trigger states the CAPABILITY, in the same words the drop used to describe the loss; where a trigger names an artifact instead, the row must state what that artifact must be SUFFICIENT FOR, and the artifact retires the row only when that sufficiency is shown. **The review tell is a grain mismatch between the loss sentence and the trigger sentence** — a plural loss with a singular trigger, a corpus loss with a per-module trigger, a route loss with a single-call trigger. Found by `loyal-lark-254` and verified against this document's text by `smart-ram-730`, and it is downstream of a refusal to report a number they could not stand behind: a pricing run that had returned any plausible figure would have closed the question and left the trigger defect standing. (4) **dissolution on climb — production handling only, never the evidence** — a climb deletes the redundant lower-rung *production* machinery it obsoletes (§2/§3: the proof that makes a state unwritable replaces the validator of the writable form, never accumulates beside it, unless that machinery independently guards an external boundary), but the class's discriminating RED and positive control **remain enrolled as the executing evidence that the higher rung stays real** — deleting them would recreate specification-without-execution one rung up; an expecting-red probe that greens when its wall lands flips to a permanent regression control, it does not retire (correction per review 2026-07-31: an earlier revision would have deleted the evidence with the machinery). Every newly discovered error class — incident, review finding, runtime exception, falsifier divergence — files or updates one row: invalid state, harm, distinguishing facts, rung found at, ceiling with reason, next trigger. That is how "any class we find climbs" is a repository rule rather than a cultural preference. | ||
| Every class carries an **attainable ceiling — derived, not aspirational**: a decidable, fully modeled class may reach structural impossibility; a decidable class missing its authority is §5's *wall after grounding*; a class blocked on a missing-or-unverified language capability names the capability as its trigger (the live one: **unforgeable construction** for carrier-borne invariants — `sole_constructor` is a real, executing wall for a census-unique plain-record type — on the source→`.dag`-acceptance path specifically, confirmed by execution to refuse a cross-module record literal at four positions (fn body, module-scope `data` initializer, list-element, map-value) and at `ExprCast` (including generic instantiation) — and confirmed by execution to leave three further gaps open on that same path (named below: one name-resolution gap, one unwired construction form, and one unrefused construction position), so the mapped boundary is a mix, not a clean coverage claim even before crossing to another realization target. A second, distinct per-function `admit_callers` admission wall confirmed alongside it (`sole_constructor` gates WHO MAY CONSTRUCT; `admit_callers` gates WHO MAY CALL the mint; a caller-supplied validator decides WHAT IS PROVEN and is separately defeasible, below). The compiler-module check exemption `module_skips_direct_call_arg_check` was found (code read, not execution) to be scoped entirely to the direct-call argument-type judgment and does not reach `sole_constructor`'s construction check at either call site — a positive finding that retires this axis, not an absence of any exemption anywhere. On the source→`.dag`-acceptance path the audit closed with three confirmed structural holes, not a clean ceiling: a census-AMBIGUOUS type name resolves by silent last-import-wins instead of refusing; coproduct/variant construction of a `sole_constructor` type is entirely unwired; and a record literal in a parameter's declared default-value expression gets no diagnostic at all (all three 0 live exposure today by targeted grep, all three decidable fixes once scoped, not ratchets). Separately, and more severely, on the source→Rust-emission path: a production `sole_constructor` type's own emitted mirror is confirmed by execution to be silently forgeable — `extdeps.uri` `UriValidatedScalar` (fixed-law mint `uri_validated_scalar_construction`, no caller-supplied validator) emits as a `pub` struct with a `pub` field deriving `serde::Deserialize`, and both `serde_json::from_value` and a direct struct literal admit one representative from each of the mint's three refusal partitions — negative, surrogate, and above the Unicode maximum (the mint refuses whole ranges; the receipt executes a representative per branch, not every refused value), confirmed against a shape-control discriminator so the admits are load-bearing, not a harness artifact (no production caller established to have exercised this — mechanism confirmed, no confirmed victim). Executed downstream, the forgery is not inert: passed to the carrier's percent-encoding consumer `uri_percent_encode_admitted_scalar_wire` (not its only declared consumer — `uri_validated_scalar_code_point` also takes the type, as an accessor returning the raw code point; "sole" was an unverified quantifier in an earlier revision of this clause), the surrogate and above-maximum representatives reach output as invalid UTF-8 percent-encoding (`%ED%A0%80`, `%F4%90%80%80`), while the negative representative is refused there by `uri_utf8_octet_construction` — so the consumer independently catches one of the three partitions, and for the other two the wall's absence is a PRODUCED-OUTPUT defect rather than merely a constructible-value one. This is below floor (§5), not a rung on the ladder, and it is categorically worse than the three `.dag`-path holes above, which are decidable zero-exposure gaps in an otherwise-real wall. And one confirmed scope boundary, more consequential than any single hole above: even where the wall fires with full coverage it confines only WHO/WHERE constructs the carrier, establishing nothing about WHAT invariant a sanctioned caller's own predicate enforces, so a mint lacking a fixed, module-owned validator gives no guarantee beyond confinement — `std.interval` `closed_interval` takes a caller-supplied `le` and accepts reversed bounds under a lying predicate (the failing case); `std.interval` `degenerate_interval` is total and needs no predicate at all (the working case). These two findings are complementary, not duplicative, on one claim from opposite directions: one shows a caller-supplied validator can lie; the other shows a FIXED validator with zero caller freedom can still be defeated once the carrier crosses into a realization where confinement itself doesn't survive — neither is a defect in `sole_constructor` as specified. A reconstruction path that bypasses source construction also exists in the interpreter; that audit is IN FLIGHT as PR #8658 (not yet merged), so its row is not yet in the linked document — named here so the claim is verifiable and the gap is expected, not a broken pointer. **THE PROBES BEHIND THIS AUDIT NOW EXECUTE** — #9106 deleted the required floor's `DeclinedLiveTree` arm, firing the trigger recorded in gap-analysis §11 item 28. All 26 witness identities are now folded: 20 pass and six fail. Four f10 failures expose import-order-dependent resolution of the census-AMBIGUOUS name; f13 confirms variant construction remains unwired, and f19 confirms a record literal in a parameter default remains unrefused. The six failures are enrolled expected-red debt, so a repair that makes one pass refuses as stale quarantine until that probe is converted to its permanent regression-control shape rather than silently disappearing. Full audit: `docs/plans/compiler-guarantee-recovery-gap-analysis.md`; an earlier revision of this paragraph claimed no such capability exists, refuted by review 2026-07-31, a later revision called its completeness unverified, and this 2026-08-20 revision folds in a second, independently-ruled realization path (ARM 3, PR #8661, also not yet merged) that changes rather than extends that result: a mapped boundary per path, not one closed ceiling); an undecidable property honestly remains a ratchet or validator; an external fact remains a boundary obligation. **Below ceiling is a correctness gap, never optional elegance** — this clause is what keeps §6's purity trap from pricing out mandatory walls, the exact failure mode by which the recovered guarantee decayed unnoticed. Four meta-obligations make the ladder operational: (1) **rung honesty, at a declared subject grain** — the reported rung must equal the rung established by executed evidence, a discriminating RED refused on the real acceptance path plus an accepted positive control, **measured against a declared boundary** (source→interpretation, source→each emission target, phase-carrier→phase-carrier are different paths with independently different rungs: the interpreter refuses a mislabeled call that the emitter reorders into positional leftovers); a class's current rung is the **minimum across its in-scope paths**, or one row per structurally distinct path — citing the strongest path while another stays silent is inflation, and a type name, diagnostic variant, inert lens, or plan establishes nothing. **Rung inflation** (a carrier named for the top rung while occupying the bottom; a status ledger's "DONE") is the fabricated-plausible-output failure applied to the compiler's self-description — worse than sitting low, because an inflated class never ranks for climbing. (2) **no untracked stall** — a class below its ceiling must name its next-rung trigger, separating *cannot climb further* from *can climb after one grounding* from *can climb now but unbuilt*; only the first is permanent. (3) **no silent regression** — a change may lower a rung only by declaring previous rung, temporary rung, reason, bounded population, and restoration trigger; a compatibility exemption is not bootstrap glue, it is a visible safety regression with a finite runway. **AND THE TRIGGER MUST NAME THE CAPABILITY, NOT AN ARTIFACT THAT WOULD CONTRIBUTE TO ONE (2026-08-26).** A declared drop is retired BY ITS TRIGGER AND BY NOTHING ELSE, so the trigger *is* the whole check, and a trigger naming less than the capability it restores is the one direction this machinery structurally cannot see: **it will be satisfied while the capability stays dead.** What makes it invisible is that no step is wrong — the instrument author builds exactly what the trigger asked, the trigger fires honestly, the row retires correctly, and the thing the row existed to protect is still gone. Nobody has to be careless for this to happen, which is why it needs a rule rather than diligence. Receipt, and it is this document's own row: the measurement-bankruptcy entry above records losing *the only executable route to a self-host emission BOARD measurement* and then writes a trigger naming *a `.dag` entry point that emits, assembles and compiles ONE ENTRY* — a board is per-entry across MANY entries, so the two halves sit five lines apart in one row at different grains, and the row then declares the trigger fired. Measured by code read, the instrument that fired it takes a fresh temporary directory per invocation and path-depends on the whole stage0 crate, so every entry rebuilds the bootstrap compiler cold and the cost is entry-INDEPENDENT — one entry is the only thing it can do. **The rule:** a restoration trigger states the CAPABILITY, in the same words the drop used to describe the loss; where a trigger names an artifact instead, the row must state what that artifact must be SUFFICIENT FOR, and the artifact retires the row only when that sufficiency is shown. **The review tell is a grain mismatch between the loss sentence and the trigger sentence** — a plural loss with a singular trigger, a corpus loss with a per-module trigger, a route loss with a single-call trigger. Found by `loyal-lark-254` and verified against this document's text by `smart-ram-730`, and it is downstream of a refusal to report a number they could not stand behind: a pricing run that had returned any plausible figure would have closed the question and left the trigger defect standing. (4) **dissolution on climb — production handling only, never the evidence** — a climb deletes the redundant lower-rung *production* machinery it obsoletes (§2/§3: the proof that makes a state unwritable replaces the validator of the writable form, never accumulates beside it, unless that machinery independently guards an external boundary), but the class's discriminating RED and positive control **remain enrolled as the executing evidence that the higher rung stays real** — deleting them would recreate specification-without-execution one rung up; an expecting-red probe that greens when its wall lands flips to a permanent regression control, it does not retire (correction per review 2026-07-31: an earlier revision would have deleted the evidence with the machinery). Every newly discovered error class — incident, review finding, runtime exception, falsifier divergence — files or updates one row: invalid state, harm, distinguishing facts, rung found at, ceiling with reason, next trigger. That is how "any class we find climbs" is a repository rule rather than a cultural preference. |
There was a problem hiding this comment.
When a reader follows the new Full audit reference, docs/plans/compiler-guarantee-recovery-gap-analysis.md:2767-2776 still says these 26 identities are declined and never folded, and lines 2872-2875 still present deleting DeclinedLiveTree as future work. Thus this correction leaves the document it identifies as the detailed authority asserting the exact opposite execution state; update or explicitly supersede item 28 and its dependent present-tense cells along with this summary.
Useful? React with 👍 / 👎.
Contributor
Author
|
Closing: the §4b half is already on main, and the DESIGN half would now revert main rather than advance it. The retirement landed. Main already carries this branch's §4b text —
Checked against the tree: both files exist on main at The Net: nothing unique, one active regression. #9639 covers the only live content. Nothing about the original subject is disputed — the retirement was correct and it merged. If some part is genuinely missing from main, reopen naming the specific sentence; I could not find one. — sent from calm-ram-380 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
gentle-owl-888.Pushing to
session/gentle-owl-888advances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan