ROOT-2 plan: contract identity and the quality floor as two serial construction cuts

[briansrls]

ROOT-2's plan, covering the two serial construction cuts the reviewing authority split the item into. One file, no code, no .dag changes.

This body is a single current account of the plan as it now stands — earlier revisions accumulated correction appendices that contradicted their own openings, and that is repaired here rather than extended.

Cut A — one canonical surface/name/epoch contract identity

The live gap. gunbc.fleet_revision_acceptance accept_required_ci_workflow_run checks the workflow path and the repository, each with its own refusal arm, and then admits — carrying no epoch. So a Required CI contract whose obligations changed materially is admitted under the same workflow_path. That is the DESIGN §3 meaning fork — one name, two materially different meanings, silently — live in production, which is what makes the epoch control an authorable RED rather than a decoration. The fold is reached in production through gunbc.fleet_desired_admission fleet_desired_accepted_from_event.

The construction is the §3 triple (naming surface, name, epoch), equality by field over exactly those three and never over contract internals — preserving the module's own rule that a phases_run field would make every phase added to the floor a breaking change to fleet admission. RequiredCiContractIdentity becomes a specialization, not a second authority.

It is an atomic root cut. The public domain name may survive; its old two-field representation may not. The three unacceptable shadow forms are named explicitly (field-beside-canonical, old/new/converter, old checks plus a shadow comparator), and a field-classification table keeps identity from widening into every admission prerequisite — head_repository_full_name is provenance, activity is execution state, conclusion is outcome, head_sha is the execution subject.

The observed epoch is a real observation, not a stamp. Adding epoch to the contract constructor alone would stamp the expected epoch onto the accepted result and prove nothing about what the triggering run executed. The epoch is a structural top-level env: member emitted by gunbc.witness_floor_workflow beside the four GUNBC_* pairs it already emits — not a comment or substring — read at event.head_sha rather than from ambient checkout, with a structural parser and one canonical wire spelling. ContractEpoch is an opaque branded NonEmptyStr — a discrete identity, not an ordered quantity — so the container closes the decision entirely: missing key → EpochAbsent, duplicate → EpochDuplicated, non-string or empty → EpochMalformed, nonempty string → ContractEpoch. There is deliberately no EpochUndecodable arm: once the value is a nonempty string no further decode can fail, so that arm would be a typed refusal with no authorable subject. Commit-unreadable and path-unreadable remain separate observation failures.

The experiment is designed around the tree. The epoch lives in a committed artifact, so changing it changes the tree and therefore the commit identity: "hold the revision fixed, vary only the observed epoch" is not constructible against a Git-backed read. The control is two commits whose trees differ only in the epoch member, both revision-bearing propositions agreeing inside each case, traversing fleet_desired_accepted_from_event so at least one real production-composition execution is enrolled.

The guarantee, stated honestly. Cross-epoch admission is mechanically prevented. An unbumped material contract change remains declared-version diligence — this cut does not make all same-name meaning forks structurally impossible; it gives the repository one place to declare a transition and makes a declared transition load-bearing.

Cut B — the quality floor, instantiated for evaluation budget

std.evaluation_budget is a genuinely graded dimension consumed in production (v1_interpreter, cli_run, v2.workflow.required_floor).

The inverse quality order is stated as a law, since without it a numerical ceiling is merely renamed a floor: quality(a) >= quality(b) iff elapsed(a) <= elapsed(b); meets the floor iff elapsed <= limit; breaches iff elapsed > limit. Equality belongs to the admitted side by the law, not by convention.

Consequence ownership is Terminal A, adjudicated on four recorded pieces of evidence so a later reader can re-decide it. The discriminator: a caller-owned wire code would belong to a caller refusal protocol, and "code":" occurs exactly once in all of cli_run. The terminal law forbids a freely writable consequence_code field anywhere, and requires that a production response exist because the execution produced the generic exceeded cause — not because the boundary separately chose the same text.

LimitUnset constructs no floor on that clock, entry is projected from the contract identity rather than duplicated beside it, and the verdict stays identity-bound so no detached Within value crosses the production boundary.

Production consumes the single authority through a dedicated generated Rust projection — not by riding v1_interpreter_dispatch_generated.rs, whose subject is interpreter primitive dispatch. Generated bytes carrying the literal are a derived projection and are fine; the independently maintained literal in cli_run is the forbidden state.

Enrollment completeness is mechanically preventable, not structurally impossible. artifact_location, artifact_commit_policy, artifact_eq and artifact_generate are exhaustive, but generated_artifact_registry is an explicitly authored list — a variant can join the coproduct and every match arm while being omitted from the roster, and the tree still compiles with main_wet blind to it. The plan therefore enrolls a discriminating RED that removes only the registry member, and names registry derivation as the next-rung trigger.

The two REDs are separate instruments

• semantic breach — cross exactly one declared limit with identity, consequence, entry and the other clock fixed. "Exactly one" at the correct grain: one bounded clock crossed, one EvaluationBudgetExceeded cause, one named machine consequence, one production refusal response, zero admitted. Paired controls at elapsed == limit and elapsed < limit both admit.
• authority-wiring falsifier — a moved value, never a refusal, since an always-refusing emitter would otherwise pass while proving no binding: drift RED before regeneration; after regeneration the generated Rust carries the new value, the exact seed binary rebuilds, the real budget-exceeded path executes, the response carries the perturbed code, and zero stale old values occur. The new-arm exhaustiveness mutation is enrolled separately and is not a substitute.

Why the receipt route was not selected

The typed completion receipt is the stronger observation, and it is not rejected for nonexistence — it is real, rich infrastructure with a schema, artifact name, path, typed subject, decoder and event-subject join, and its typed ReceiptMemberAbsent / ReceiptMemberMalformed causes already cover absence, malformed and duplicated members.

It is not selected because its transport is deleted: nothing writes target/floor-component-receipt.json, witnesses.yml uploads four artifacts and this is not one, and the alert that downloaded it was removed in the 2026-08-15 CI bankruptcy. The remaining work is a live writer, an upload, a run-bound download, epoch carriage and transport-unavailability causes — strictly larger than exact-commit observation, and it front-loads resurrecting a dead transport before the epoch is observable at all.

That the receipt authority still recites its transport in the present tense is a finding of the premise-contamination class DESIGN §4b names. It is not fixed here, and because Cut B deletes this plan it may not live only in this file. It was routed and carried by #9858, now merged (main@83fe4399d0), with its durable home verified on main: a receipt inside the reachability_read_as_occupancy row of gunbc.recurring_failure_mode, projected into the ledger. The sequencing rule is retained because it is why that verification happened at all — Cut A may be authored on plan approval, but may not land until such a durable repair has landed and been verified on main.

Closure and boundary

The plan tables the authority, consumer, observation, generated projection and witnesses for each cut, names the census base, and declares its own dissolution by Cut B. Cut A carries no generated budget-consequence bridge merely because one plan describes both cuts. Neither cut edits DESIGN.md or gunbc.design_document.

🤖 Generated with Claude Code

https://claude.ai/code/session_014iheRFn4BiVGDwgN6gQBQX

[briansrls]

REVIEW RULING: REQUEST CHANGES — the two-cut architecture remains accepted, but the plan contains three load-bearing factual defects and one contradictory public summary.

1. Re-census the typed-receipt alternative; its stated rejection is false. The plan says floor_component_receipt_document has “no production consumer at all” and that “nothing emits it today.” The authority says the opposite: the floor writes the receipt, it crosses a real workflow trust boundary, and it is uploaded by one run, downloaded by another, and rendered; gunbc.floor_component_receipt also documents the seed transport that constructs and writes it on exit paths. Re-evaluate the actual delta required to add epoch and make fleet admission consume it. The exact-commit workflow-artifact route may still win, but only after comparison against the real receipt path. If it remains selected, name the exact YAML field/shape, exact-commit reader, typed absent/malformed/duplicate/read-refusal causes, and prove the epoch is structural workflow data rather than a comment or substring.

2. Withdraw the rung-4 generated-artifact enrollment claim. GeneratedArtifact consumers such as artifact_location, artifact_commit_policy, artifact_eq, and artifact_generate are exhaustive matches, but generated_artifact_registry is an authored List, not an exhaustive fold. A new variant can answer every match arm yet be omitted from the registry; then committed_generated_artifact_paths, main_wet, and the drift boundary never see it. Either derive/close registry membership structurally, or add a discriminating omission wall for this projection: with all match arms present, remove only its registry member and require RED. Without structural closure, report this path as mechanically preventable, not structurally impossible.

3. Replace the nonexistent Cut-A consumer symbol. There is no required_ci_admission declaration at the census base. The existing producer is gunbc.fleet_revision_acceptance.accept_required_ci_workflow_run; the production composition used by fleet desired admission is gunbc.fleet_desired_admission.fleet_desired_accepted_from_event. Update the defect statement, consumer table, acceptance receipt, and contribution boundary to cite the exact existing symbol—or the exact replacement symbol Cut A will land. The epoch RED must traverse the production composition, not a phantom fold.

4. Make the PR body agree with the plan. Its early wiring-falsifier summary still says the value may move “or generation refuses for non-exhaustiveness,” while the amended plan correctly requires moved-value propagation and treats exhaustiveness as a separate mutation. Remove the obsolete alternative so the public contract has one acceptance rule.

Everything else remains directionally approved: Cut A before Cut B; atomic replacement of the old two-field identity representation; Terminal A consequence ownership; LimitUnset as no floor; identity-bound budget verdicts; a dedicated generated projection; separate semantic-breach and authority-wiring instruments; and no implementation before the plan is accepted.

[briansrls]

REQUEST_CHANGES at exact head d038356.

The two-cut architecture, Terminal A, exact-commit workflow observation, and dedicated generated-Rust projection remain accepted. Four corrections remain before Cut A activates.

1. The epoch RED is not authorable as written. The plan says the observed epoch comes from the workflow bytes at event.head_sha, then requires holding revision fixed while varying only the observed epoch. A real Git commit identifies one tree: changing the epoch bytes necessarily changes the tree and commit identity. Replace this with an executable receipt. One acceptable shape is (a) a reader pair over two real commits whose trees differ only in the epoch member, acknowledging that their SHAs necessarily differ, plus (b) an admission control at the observed-identity seam or a required-epoch mutation that isolates epoch comparison. Any end-to-end pair using two SHAs must prove that, within each case, Required CI and default-branch observations carry the same revision, that zero revision-mismatch cause occurs, and that the RED is exactly ContractEpochMismatch. Also name the canonical epoch carrier and its wire encoding; otherwise malformed versus undecodable is not a defined distinction.

2. Cut B still does not state the quality order. Elapsed time is numerically ceiling-shaped, so the quality order is inverse: quality(a) >= quality(b) iff elapsed(a) <= elapsed(b); floor satisfaction is elapsed <= limit. State that equality and numerically-below-limit collapse to the same admitted arm, exact elapsed may remain evidence, and LimitUnset contributes no floor on that clock. The controls imply this today, but the construction plan must own the law rather than leave readers to infer why a ceiling is called a floor.

3. The receipt-route re-census is directionally right but still factually overstates the delta and misattributes symbols. gunbc.floor_component_receipt owns the schema value/path/artifact name and document construction; gunbc.floor_component_receipt_document owns FloorComponentReceiptSubject, the decoder, and the event-subject join. ReceiptMemberAbsent/ReceiptMemberMalformed and typed subject mismatch already exist and should be reused; they are not all new causes. New work includes restoring producer/upload/download availability, epoch carriage, and any run-incomplete/transport-specific projection the fleet consumer genuinely lacks. Correct the table without changing the selected route. Also give the newly found stale-present-tense receipt recital a persistent destination or make plan deletion conditional on transferring it; deleting this plan in Cut B must not erase the only record of the finding.

4. Exact-name and PR-body cleanup is still incomplete. The module is gunbc.fleet_revision_acceptance, not gunbc.fleet.fleet_revision_acceptance; the wrong name remains in the census and closure table. The PR body still opens with nonexistent required_ci_admission and still preserves the superseded 'no production consumer at all' rationale before appending its withdrawal. Rewrite those passages rather than leaving mutually contradictory review history as the public description.

No additional subject discovery is requested. Bring back the corrected exact head; the re-review bar is these four items only.

[briansrls]

REQUEST_CHANGES at exact head a22e87a7ce23403eb203147d709ebaf009ab31f7.

The two-cut architecture and nearly all of the four-item bar are accepted. Two exact blockers remain.

1. The epoch carrier/decoder law is still underspecified. The plan now fixes the wire container as one YAML string member, but “a declared version value” does not define which strings inhabit the epoch carrier. That leaves the separately named EpochUndecodable cause without a discriminating input. Choose one terminal shape:

   • ContractEpoch is an opaque/branded non-empty string: then every non-empty YAML string decodes, and the separate undecodable arm must disappear (empty/wrong YAML shape is malformed); or
   • ContractEpoch has a canonical grammar (positive integer, semver, or another declared version form): name that grammar and one total decoder, so a structurally valid YAML string outside the grammar produces the exact undecodable cause.

   “One member, one spelling” prevents alternate encodings; it does not by itself define the value domain.

2. The live tip falsely says #9858 landed. Commit a22e87a7 changed the plan from “routed item opened before Cut A lands” to “landed as gunbc#9858.” GitHub currently reports #9858 state=open, merged=false. Therefore the durable finding is proposed but not yet landed on main. Either:

   • restore the truthful pending form and make exact landing/verification of #9858 (or an equivalent durable repair) a Cut-A landing precondition, while allowing implementation after this plan is approved; or
   • wait for #9858 to land, verify its landed symbols/projection, and then retain the landed wording.

The original four-item bar is otherwise closed at this tip: the Git-backed two-commit epoch experiment is authorable; the inverse quality order is explicit; the receipt cost accounting reuses existing typed causes; module/symbol names and the PR body are current; and the generated-artifact completeness claim is honestly rung 2 with a registry-removal RED.

Re-review is bounded to the two items above. Cut A mutation remains unauthorized until a successor head is approved.

[briansrls]

REQUEST_CHANGES — bound to 3f6df4a.

The new measured Cut A boundary is accepted. The concrete RequiredCiContractIdentity population is three .dag files; AcceptedFleetRevision reaches seven .dag files; no Rust/seed consumer is present. Therefore Cut A has no seed mirror or generated-Rust bridge, and all consequence-emission machinery remains wholly in Cut B. Treat the seven-module set as the maximum justified closure, not as permission to edit a reachable module that needs no change.

This commit does not close the two-item bar from the prior review:

1. EPOCH DOMAIN. The plan still lists a distinct epoch-undecodable cause while defining only 'a declared version value carried as a string, one member, one spelling.' That defines the container and canonical location, not the valid-value language. Choose one terminal law: (a) opaque/branded NonEmptyStr, in which case every nonempty YAML string decodes and EpochUndecodable is removed; or (b) a structured version domain with a named canonical grammar and total decoder, giving EpochUndecodable an authorable input. The current middle state retains a typed refusal with no defined subject.

2. #9858 STATUS. The plan still says the routed finding 'landed as gunbc#9858' and that its durable receipt already survives plan dissolution. GitHub currently reports #9858 open and merged=false. Restore the truthful pending form — Cut A may be built after plan approval but may not land until #9858 or an equivalent durable repair lands and is verified — or wait for the landing and verify the persistent row/projection before retaining the completed wording. The PR body and plan must say the same thing.

No other subject is reopened. After these two exact corrections, the plan is ready for approval. Cut A mutation remains unauthorized at this head.

[briansrls]

ROOT-2 PLAN — APPROVED FOR IMPLEMENTATION at exact head c5492da.

The two-item bar is closed.

1. ContractEpoch is now the correct terminal domain: an opaque branded NonEmptyStr used only as discrete identity. Missing, duplicated, non-string, and empty values have authorable typed refusals; every nonempty string constructs ContractEpoch. EpochUndecodable is correctly absent because no second decode remains that could fail. Commit-unreadable and path-unreadable remain independent observation failures.

2. #9858 is actually merged as main@83fe4399d04dbe77a718bdbcf7588ea9d7f084c6. The durable reachability_read_as_occupancy receipt and its generated ledger projection are present on main, so the plan no longer destroys the only record of its finding. The retained sequencing law is accepted and its precondition is discharged.

The measured Cut A boundary is also accepted: the old identity grain has no Rust/seed reachability, so Cut A is a .dag-only atomic root transition. It must not add a generated bridge or generated-artifact enrollment. The seven-module census is a maximum justified closure, not a required edit set; each actual changed path needs its own reason.

Cut A mutation is AUTHORIZED now, under these binding conditions:

• one canonical surface/name/epoch ContractIdentity construction;
• RequiredCiContractIdentity becomes only a specialization or wrapper with no independently writable old fields;
• no old constructor, converter, shadow comparator, or fallback path survives;
• the observed epoch is structurally emitted into WitnessFloorYamlArtifact and read from the exact event.head_sha artifact, not ambient checkout or the judge's own expected identity;
• absent, duplicate, malformed, unreadable-commit, and unreadable-path states remain typed and fail closed;
• identity refusal occurs before outcome interpretation through fleet_desired_accepted_from_event / accept_required_ci_workflow_run;
• the Git-backed two-commit epoch RED and matching control execute with exact cardinalities and an independent oracle;
• no Cut B budget-consequence bridge enters Cut A.

Cut B remains blocked for mutation until Cut A has landed through the standing conditional procedure and the landed tree is verified equal to the measured candidate tree. The plan file remains until Cut B consumes and deletes it.

This is content approval, not yet landing authorization for PR #9851. Land the plan only after the exact-head required checks are green and the current-main composition is admitted; main has advanced beyond the merge composition on which the present check suite began, but that movement does not reopen the approved plan content.