Repository navigation
XL-0-REDSEL: one of two sibling test fns in the enrolled MachineShape wall never appears in the required floor changed-witness projection - #9870
Closed
briansrls wants to merge 3 commits into
Conversation
…tions nobody could run THE ROWS. Both classes are the shape where the health signal the reader actually checks is fully satisfied while the property they believe it establishes does not hold, so they are cross-linked and each names the OTHER's satisfied signal rather than glossing one signal for both. `instrument_output_read_as_subject_content` — a consumer derives a SET from a report whose completeness is a property of the REPORTING TOOL rather than of the subject. Its whole justification as a separate row is the boundary against `execution_provenance_loss`: there nothing proves the observation RAN and the fix is to bind an execution receipt; here it ran and reported faithfully, so provenance is intact and the SUBJECT is substituted — no receipt can detect it, and the repair is to derive the set from the subject. Specimen is gunbc#9829. `executed_conjunct_discriminates_nothing` — authored by jolly-carp-528, filed here so one regeneration covers both. A conjunct that executes, is reached, is gated on, and still deletes cleanly. Every symbol re-resolved against origin/main before pasting. THE CORRECTION, which is the part that outlives both rows. The CI-bankruptcy rung drop listed four still-runnable mitigations. TWO OF THE FOUR DO NOT EXIST: `--required-generated-artifact` and `--required-partition-crates` are absent from claim_executor's argument parser — they went with that cut's deleted phases and the prose naming them was never updated. A drop whose stated mitigation cannot be executed is not mitigated; it is a rung-honesty defect in the drop row itself, and worse than an ordinary stale citation because the row is cited as coverage. The row now names the actual actuators: the .dag entry point `tools.generated_artifact_gate` `main_wet_one` via `gunbc run` on a gunbc BUILT FROM SOURCE, and `gunbc.repo.repo_self_build` `repo_self_build_partition_crates_command`. THE PROJECTION IS GENERATOR-PRODUCED, NOT HAND-EDITED. DESIGN.md's class index is projected (`design_document.dag` maps over the roster), so both generated files move. Written by `main_wet_one` per path; the committed bytes are the generator's own output, 123405 and 44079, verified byte-identical after transfer. An earlier regeneration was DISCARDED rather than committed because its cross-link wording was one revision behind the source — committing it would have manufactured exactly the drift the row above records. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aiTywconE9bm1hmUPjyft
…51-failure-mode-row # Conflicts: # DESIGN.md # dag/gunbc/rung_drop.dag # docs/design-ledgers.md
The merge took origin/main's generated files, which is correct as a conflict resolution and stale as a result: they carry #9763's third row and not the two this branch adds. Regenerated with tools.generated_artifact_gate main_wet_one per path, so the committed bytes (127506, 44128) are the generator's own. Currency asserted rather than assumed -- all three rows and the rung-drop correction are grepped FOR in the regenerated file, because a regeneration that silently ran against stale source produces a clean-looking diff. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018aiTywconE9bm1hmUPjyft
briansrls
marked this pull request as ready for review
September 1, 2026 02:53
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ccb7c5e14d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| subject: "Required gate reduced to the compiler floor", | ||
| declared: "2026-08-29", | ||
| authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, generated-artifact drift, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`, `--required-partition-crates`) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the three deleted required phases v2-emission, emit-compile, and partition-crates, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. GENERATED-ARTIFACT PARTIAL CLIMB (2026-08-31): restoring generated-artifact drift widens the static required roster by one exact class and does NOT retire this drop; the population-derived restoration trigger has not fired. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once." | ||
| authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, generated-artifact drift, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`; and -- CORRECTED 2026-08-31, re-verified against main AFTER the generated-artifact partial climb below, because a drop whose stated mitigation cannot be executed is not mitigated but a rung-honesty defect in the drop row itself, and one cited as coverage -- NOT `--required-partition-crates`, which is ABSENT from claim_executor's argument parser: that build is projected by `gunbc.repo.repo_self_build` `repo_self_build_partition_crates_command`. `--required-generated-artifact` is absent from that parser too, and the climb below restores the CHECK without restoring that spelling, so the generated-artifact projection is regenerated through the .dag entry point `tools.generated_artifact_gate` `main_wet_one`, invoked per artifact path via `gunbc run` on a gunbc BUILT FROM SOURCE -- the installed binary predates the section 4c annotation channel and cannot parse the corpus. Both flag spellings went with this cut's deleted phases and the prose naming them was not updated, so this sentence recited two remedies nobody could run) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the three deleted required phases v2-emission, emit-compile, and partition-crates, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. GENERATED-ARTIFACT PARTIAL CLIMB (2026-08-31): restoring generated-artifact drift widens the static required roster by one exact class and does NOT retire this drop; the population-derived restoration trigger has not fired. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once." |
There was a problem hiding this comment.
The correction still classifies partition-crates as merely mitigated by a manual command and later includes it among the three deleted phases, but the generated required workflow runs the exact projected partition-crate build in required-witnesses-build (.github/workflows/witnesses.yml lines 52–53), and the required witnesses job gates on that build job (lines 262–269). A partition-crate compile failure therefore already blocks merges, so this rung declaration understates the current guarantee and gives operators incorrect manual-run guidance; update the temporary rung and bounded population to record this restored wall.
Useful? React with 👍 / 👎.
| subject: "Required gate reduced to the compiler floor", | ||
| declared: "2026-08-29", | ||
| authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, generated-artifact drift, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`, `--required-partition-crates`) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the three deleted required phases v2-emission, emit-compile, and partition-crates, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. GENERATED-ARTIFACT PARTIAL CLIMB (2026-08-31): restoring generated-artifact drift widens the static required roster by one exact class and does NOT retire this drop; the population-derived restoration trigger has not fired. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once." | ||
| authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, generated-artifact drift, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`; and -- CORRECTED 2026-08-31, re-verified against main AFTER the generated-artifact partial climb below, because a drop whose stated mitigation cannot be executed is not mitigated but a rung-honesty defect in the drop row itself, and one cited as coverage -- NOT `--required-partition-crates`, which is ABSENT from claim_executor's argument parser: that build is projected by `gunbc.repo.repo_self_build` `repo_self_build_partition_crates_command`. `--required-generated-artifact` is absent from that parser too, and the climb below restores the CHECK without restoring that spelling, so the generated-artifact projection is regenerated through the .dag entry point `tools.generated_artifact_gate` `main_wet_one`, invoked per artifact path via `gunbc run` on a gunbc BUILT FROM SOURCE -- the installed binary predates the section 4c annotation channel and cannot parse the corpus. Both flag spellings went with this cut's deleted phases and the prose naming them was not updated, so this sentence recited two remedies nobody could run) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the three deleted required phases v2-emission, emit-compile, and partition-crates, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. GENERATED-ARTIFACT PARTIAL CLIMB (2026-08-31): restoring generated-artifact drift widens the static required roster by one exact class and does NOT retire this drop; the population-derived restoration trigger has not fired. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once." |
There was a problem hiding this comment.
The replacement actuator is attributed to gunbc.repo.repo_self_build, but dag/gunbc/repo/repo_self_build.dag declares its module as gunbc.repo_self_build, and that is also the namespace imported by the workflow generator. Because this paragraph is specifically correcting an unusable CLI spelling by naming the callable authority, the extra .repo leaves the new citation unresolved and still prevents a reader from locating or invoking the promised command.
Useful? React with 👍 / 👎.
Contributor
|
Closing: this branch's content is already in main. Not rebasing, because resolving the conflict would re-land content that already exists. Measured against
All 18 added lines are present in main. This branch squash-merged as This is the third instance from merged branches tonight (#9861, #9863, this one). #9863 was the dangerous one — its diff would have reverted the merged #9850 repair, because its merge base predated it. Two notes for whoever owns the automation:
Reopen and name a line if I have this wrong. |
Contributor
|
Correction to my previous comment — I was wrong about the revert. I claimed merging this would delete main's newer content, based on The check I should have run first: The merge result is byte-identical to main. This PR merges to a no-op — it was never a revert risk. What stands: the branch contributes nothing beyond main, so closing it is still correct housekeeping and the content measurements in my earlier comment (added lines already present in main) were accurate. Only the "would revert" conclusion was false, and the alarm it raised was unjustified. Reusable form, since this will bite someone else: a raw |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
fierce-otter-51.Pushing to
session/fierce-otter-51-failure-mode-rowadvances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan