diff --git a/.gitattributes b/.gitattributes index 53515bc4..8fa0dec1 100644 --- a/.gitattributes +++ b/.gitattributes @@ -31,6 +31,7 @@ harness/experiments/textual-authoring-20260911/observed/split-entry.arcadia whit harness/experiments/analysis-context-20260911/** -text whitespace=cr-at-eol harness/experiments/analysis-baseline-20260911/** -text whitespace=cr-at-eol harness/experiments/library-compatibility-20260911/** -text whitespace=cr-at-eol +harness/experiments/refined-contracts-review-20260911/** -text whitespace=cr-at-eol # Preserve checksum-bound font notices verbatim through Git round trips. scripts/windows-notices/GNOME-Cantarell-61362600e104-COPYING -text diff --git a/AGENTS.md b/AGENTS.md index c273b641..d93cddac 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,6 +8,7 @@ Use Gitea MCP to coordinate with other agents working on this project. - Respect work already in progress. Coordinate overlapping changes and preserve other agents' edits. - Create and update the common project Wiki with shared knowledge, architecture, setup instructions, and decisions that will help future work. Keep it accurate as the project changes. - Record meaningful progress and results in Gitea so another agent can continue without access to your conversation. Include relevant commits, validation results, and next steps. +- Publish versioned Gitea releases at meaningful, working milestones so the user can see progress and try the application. Include runnable builds or appropriate distributable artifacts, concise release notes, launch instructions, known limitations, and what was verified. Mark unfinished versions as prereleases. Coordinate release ownership to avoid duplicates. - Keep coordination concise and useful. Use the available MCP tools, and report access failures honestly. Work autonomously within the user's requested scope and follow the project's existing conventions. diff --git a/harness/DECISIONS.md b/harness/DECISIONS.md index fed9dca7..9e39b186 100644 --- a/harness/DECISIONS.md +++ b/harness/DECISIONS.md @@ -319,3 +319,60 @@ Revisit if complete text/native tasks expose unacceptable hidden propagation, wrong-context edits or inability to preserve reproducible independent studies. The comparison establishes semantic/text maintenance evidence, not human task timings or full quantity/library integration acceptance. + +## Analysis and library contract convergence — 2026-09-11 + +Root Codex-956atf read the complete [baseline refinement](release-analysis-baseline-contract-20260911.md), +[library refinement](release-library-compatibility-contract-20260911.md), their +complete fixtures and [independent review](release-refined-contracts-review-20260911.md). +Select the following architecture for production implementation: + +- Required property-owned Binding values, explicit ModelBaseline/Case selection, + one level of complete-case override maps and shared root checks. Clear removes + an override; Unbound masks the base. Inherited formulas evaluate dependencies + in the requested context. Pure calculations see only explicit parameters. +- Same-layer property dependencies and case targets, with explicit analysis + selection for transitions and exports. Check/case subjects may be absent; + architectural containment must not infer their selection. Validate every + effective dependency graph, including statically referenced unused branches. +- The refined R6 closed algebra, exact rational R7 literal/AST preservation, + affine point/difference distinction and declared-output kind anchoring. + Strict expression operands gather actual missing/failure causes; Boolean + control flow evaluates only the selected branch. Supported domain failures + are distinct from violated predicates and missing values. +- Whole accepted PortableDocument freeze with exact SourceBundle, local + definitions, all imported package contents/pins and validated provenance. + Replay resolves only that immutable private capture. A result report, shallow + case copy or current cache is not a reproducible freeze. +- Exact archive/reference/history identity alongside verified same-origin + typed-contract equivalence. Different nominal origins remain distinct. + Compatibility supplies a scoped expected/actual field-path and operation + correspondence; it never advances a pin or rewrites outside record identities. + Keep qualified neutral definitions, immutable mapped layered definitions and + ordinary editable pattern instances for the first coherent implementation. +- Explicit source preparation/acceptance with complete version-controlled + package/base/map/lineage state, recomputed admission and stale-input rejection. + Exact three-way facets retain independent local edits. Mounted OA/SA transfer + requires a verified exact target-layer export or an explicitly independent + editable local derivative; no relabeling or silent mutation of a mount. + +These are architecture decisions, not claims that the proposed schema8 examples +are admitted by current source7. Before real consumer integration, enumerate and +implement the class-specific canonical contract over all interpretation-bearing +fields and use sites, exact transitive archive closure and full source/history +boundaries. Retain the frozen120-assertion prototype with its documented C2 +threshold-unit coverage gap; production typing must check every operand. + +Close independent C1 before evaluator expansion: a request-local, profile-versioned +logical work meter must bound dynamic expression visits, calls, list traversal +and exact-number work. Static acyclicity/depth/node limits do not bound expanded +execution. Cache warmth must not change outcomes; terminal exhaustion stops +further traversal and marks collected causes as incomplete. Numeric ceilings and +the precise charging table require measured foundation implementation before +publishing the profile. The333-node/31-level counterexample and a nearby successful +case are mandatory tests across direct/API/frozen replay. + +The exact numeric foundation is the next bounded core implementation. Ordinary +engineering approximations, a complete low-noise text workflow, two-project +library maintenance and native/API/source parity remain required release work. +An exact-only slice cannot complete the user's first release. diff --git a/harness/PLAN.md b/harness/PLAN.md index ee8d5a6b..7dfd57f1 100644 --- a/harness/PLAN.md +++ b/harness/PLAN.md @@ -27,11 +27,11 @@ broad downstream changes. Do not silently promote a design proposal to a decisio | Milestone | Work and acceptance | Dependency/current limit | | --- | --- | --- | -| 1. Reliable direct authoring | Exercise actual minimum/wide native creation, allocation, editing, rejection, cancellation and history without implicit draft application or placement drift. Integrate compact named behavior creation after its coherent external gate. | Named creation4bb4aaf is imported afterc4e1580; current combined gate is next. Previous local desktop642/642 and GUI pass at80cf197; partial native caller/Action/history passes. Workspace/B3/palette/recovery/packages are imported. Root owns this host's Cargo/native lease. | -| 2. Coherent process/scenario work | Interactive ordered/explicit process editing; clicked root/nested scenario insertion; exact reuse bindings and caller return; measured canvas/zoom/scroll; visible scoped Create/Delete lifetimes. Validate model/source/identity and no unintended edit during navigation, including stale/deleted/retargeted references and recovery. | B1/B2/B3 regressions pass in the full suite. B4 is cfg(test) projection only; real lifetime extents, branch-local activation clipping, incomplete lanes and self-arrow endpoints require integration. Use the independently self-checked oracle for native checkpoints. | -| 3. Precise engineering analysis | Compare owned properties, analysis contexts and existing-data/external alternatives; settle quantity kind/unit/value, numerical policy, calculation/binding and Boolean/error/unknown semantics through falsifying examples. Implement mixed-unit budgets and reusable calculation/constraint definitions with full UI/source/REST parity and exact history/recovery. | New requirement audit confirms absence. Maximum-reasoning proposal tracks precede root synthesis and independent criticism; no semantic contract is ratified yet. Strings are not evaluation. | -| 4. Maintained reusable libraries | Compare package/definition/instance alternatives. Establish pinned identity/version/dependency closure, local edits, import bindings, detach and explicit three-way updates. Demonstrate two projects, two independent instances, offline reopen, conflicting updates and stable unaffected identities. | Coordinate with milestone 3 definition references and migration. Same-project includes/reuse do not satisfy maintained cross-project libraries. No package contract implemented yet. | -| 5. Understandable complete engineering tasks | Close teaching, OA↔SA transition/reconciliation, typed state/data/interface, artifact, saved-view and hosted workflows. Establish complete text-only creation/refactoring/modular maintenance with stable identity. Replace concrete long homogeneous selectors with contextual/searchable bounded choices; verify large models, keyboard access, minimum sizes and failure/recovery. Keep offline guide/examples aligned. | A complete warning-free text-only model probe passes source/identity/rename/reparent/file-move checks; measure usability separately. Anchored chooser passes13 isolated mounted tests under cfg(test); production inspector/review and native gates remain open. Reassess current goal rather than copying historical scope exclusions. | +| 1. Reliable direct authoring | Exercise actual minimum/wide native creation, allocation, editing, rejection, cancellation and history without implicit draft application or placement drift. Integrate compact named behavior creation after its coherent external gate. | Named creation4bb4aaf is imported; combined desktop676/676, format and strict Clippy pass at2cc4d11. Native80cf197 passes all four OA creations/history/reopen; new workspace fixes and production chooser await compilation. Workspace/B3/palette/recovery/packages are imported. Root owns this host's Cargo/native lease. | +| 2. Coherent process/scenario work | Interactive ordered/explicit process editing; clicked root/nested scenario insertion; exact reuse bindings and caller return; measured canvas/zoom/scroll; visible scoped Create/Delete lifetimes. Validate model/source/identity and no unintended edit during navigation, including stale/deleted/retargeted references and recovery. | B1/B2/B3 regressions pass in the full suite. Local B4 remains cfg(test); Codex-ytr83r owns production Scene integration and its independent native gate. Use the independently self-checked oracle for native checkpoints. | +| 3. Precise engineering analysis | Compare owned properties, analysis contexts and existing-data/external alternatives; settle quantity kind/unit/value, numerical policy, calculation/binding and Boolean/error/unknown semantics through falsifying examples. Implement mixed-unit budgets and reusable calculation/constraint definitions with full UI/source/REST parity and exact history/recovery. | B/shared-check/full-capture and R6/R7 architecture ratified after complete fixtures and criticism. Exact numeric/work-meter foundation is undeclared and under independent review. Approximate profile and full evaluator parity remain required. | +| 4. Maintained reusable libraries | Compare package/definition/instance alternatives. Establish pinned identity/version/dependency closure, local edits, import bindings, detach and explicit three-way updates. Demonstrate two projects, two independent instances, offline reopen, conflicting updates and stable unaffected identities. | Exact pins plus verified same-origin typed compatibility, explicit source preparation/acceptance and three-way editable updates are ratified. Finite120-assertion experiment is not production contract/archive/consumer implementation. | +| 5. Understandable complete engineering tasks | Close teaching, OA↔SA transition/reconciliation, typed state/data/interface, artifact, saved-view and hosted workflows. Establish complete text-only creation/refactoring/modular maintenance with stable identity. Replace concrete long homogeneous selectors with contextual/searchable bounded choices; verify large models, keyboard access, minimum sizes and failure/recovery. Keep offline guide/examples aligned. | A complete warning-free text-only model probe passes source/identity/rename/reparent/file-move checks; measure usability separately. Anchored chooser passes13 isolated mounted tests under cfg(test); production inspector/review integration is active; its compile/native gates remain open. Separate-host CLI is coherent at01b76a1 and awaits import here. Reassess current goal rather than copying historical scope exclusions. | | 6. Release confidence and delivery | Fresh current Windows/Linux suites, strict Clippy/format, normative reST/OpenAPI/migration/examples; actual GUI/service transport, optimized builds, runtime/notices/archive/provenance/checksums and clean-environment launch. Fresh independent requirements/domain/parity/architecture/UX/runtime review; resolve material findings, then final handoff. | Integrates all preceding capabilities. Linux runtime remains open; use an approved supported environment, preserving historical failed/denied experiments. Historical previews are not final distributions. | Milestones are capability gates, not a rigid serial schedule. Root can continue @@ -42,28 +42,32 @@ cross-representation evaluators guide implementation boundaries. ## Immediate execution sequence -1. Finish the current GUI build and format/strict Clippy checks, then run native - engineering tasks. The current 642-test desktop suite has passed; rerun for new - code or unresolved failures, not as a substitute for runtime evaluation. +1. Complete the coherent workspace/production chooser build and focused gates, + then stage a new GUI for real engineering tasks. Full676/format/Clippy passed + for2cc4d11; working changes require their own verification. 2. Exchange exact verified commits with the separate host, preserving its workspace ownership. Do not merge the bundle-transfer branch or assume remote publication. 3. Use the self-checked [scenario oracle](scenario-authoring-contract.rs), follow its [native procedure](fixtures/scenario-authoring/README.md), and compare exact whole snapshots for Undo/Redo/reopen at minimum/wide sizes. -4. Resolve the paired semantic criticism with concrete text-only package normalization, - cosmetic revision/type compatibility, subjectless analysis closure, OA/SA mounted - data transitions, baseline-versus-case maintenance and closed numeric algebra - experiments. Select coherent contracts before production metamodel expansion. +4. Integrate and measure the exact numeric/unit/work-meter foundation, resolve + independent findings, then extend actual model/source/API/GUI under the ratified + B/R6/R7/full-capture and exact-pin/typed-compatibility contracts. Preserve explicit + approximate numeric, complete consumer/archive and two-project release gates. 5. Update current ledgers and durable decisions when evidence changes the plan. Reassess unresolved assumptions before expanding downstream implementation. ## Coordination and evidence rules Use Gitea issue #1 and Wiki for current ownership/handoffs; read before resuming. -Codex-956atf and Codex-9e8r6t are distinct hosts. Cargo/native leases are host-local; -shared source ownership is coordinated. Root owns local integration and final -responsibility. Both hosts currently lack direct push authentication; authenticated -MCP and anonymous fetch support verified bundle exchange without shared-ref overwrite. +Codex-956atf, Codex-9e8r6t and Codex-ytr83r are distinct hosts. Cargo/native leases +are host-local; shared source ownership is coordinated.9e8r6t owns the next runnable +Windows named-authoring prerelease and contextual-source/CLI; ytr83r owns B4 Scene +and its platform gates. Root owns local chooser/numeric/workspace integration. +Updated AGENTS requires runnable milestone prereleases. User#178 authorizes existing +MCP credential reuse for Git/REST; secrets must never be printed or committed. +Direct branch publication replaces bundle work when available; old exact bundles +remain valid evidence and transfer branches must not be merged. Record exact source/binary, command exit, test scope and native model/source oracle. Do not add focused reruns to full-suite totals or transfer old binary acceptance. diff --git a/harness/STATE.md b/harness/STATE.md index fe3ea699..df5ef756 100644 --- a/harness/STATE.md +++ b/harness/STATE.md @@ -1,6 +1,6 @@ # Progress Ledger — first release -Updated 2026-09-11, coordination through Gitea #144. This ledger describes the +Updated 2026-09-11, coordination through Gitea #190. This ledger describes the Codex-956atf checkout; external-host evidence is labeled separately. The entire previous ledger is preserved [byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md). Historical dates, binaries, process IDs and stopped-session instructions in that @@ -15,10 +15,13 @@ acceptance. Direct behavior/scenario authoring and reduced cognitive load remain immediate priorities. Complete small and large models must be practical to develop through uncluttered text alone. The release is incomplete. -Local branch: `codex/behavior-authoring-20260910`; source now imports external -named creation `4bb4aaf3dc47b9738625b4d3f23ef8c74f286395` after local `c4e1580`. -The last full local desktop/GUI gate and active native stage remain `80cf197`; -the newly integrated source requires a fresh combined gate. +Local branch: `codex/behavior-authoring-20260910`. Last compiled source checkpoint +is `2cc4d115d0ff28423c7ed87fd5f4065efb011f2d`, including external named creation +`4bb4aaf` as `1516949`, the isolated chooser and final baseline/library contracts. +Full desktop676/676, formatting and strict Clippy pass at that source. The active +native GUI remains immutable80cf197. New workspace and production chooser changes +are outside those artifacts and await a coherent build. Numeric foundation files +are undeclared and under independent review. The authoritative goal was copied byte-identically from attachment `a49d1780-25d5-4778-ad68-6140c60e4207/goal-objective.md`; SHA256 `DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435`. @@ -43,101 +46,101 @@ under cfg(test); it is not a production selector yet. | Reproducible local toolchain | Ignored `.local/toolchain/env.ps1` selects Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW 20260908 (clang 23.1.1), with one Cargo job. First cold desktop test build completed in 58m03s; one unused import warning was corrected separately. | | B1 process authoring | `01bb52a` includes interactive empty/ordered/explicit topology and presentation-only inferred paths; first conversion preserves ordered adjacency atomically. All topology regressions pass within the current full desktop suite. Native acceptance is pending. | | B2 scenario authoring | Clicked root/operand/slot and optional lifeline feed Action/State/Reuse/Fragment adapters. Pointer-to-App, cancellation, stale-event, recovery and history tests pass within the current full desktop suite. | -| B3 caller navigation and workspace | External `3978bbe` imported as `865cd55` fixes visible-owner restoration, pending-draft guards and remaining-height workspace. Root `80cf197` keys the viewport Sensor by document/scenario; a real mounted regression failed before the fix and now passes. Current full desktop suite is green; native acceptance remains pending. | +| B3 caller navigation and workspace | External `3978bbe` imported as `865cd55` fixes visible-owner restoration, pending-draft guards and remaining-height workspace. Root `80cf197` keys the viewport Sensor by document/scenario; a real mounted regression failed before the fix and now passes. The full suite is green; actual OA caller return and source-neutral navigation pass. Remaining native scope is explicit below. | | Architecture palette | External palette commit `7d1df4f` was cherry-picked as `aed40d7`, retaining local invariant tests. Captured Escape, stale Submit/raw retention and bounded card fixes are source-integrated. External native results do not transfer to this checkout. | | Typed stored-history F1 | `b6b76ef` fixes nullable constructor cache discrimination; `4ecad78` fixes NotApplicable seeding by checking actual enum alternatives. Thirteen focused tests passed and are included in the current full suite; core validation remains authoritative. | | Lifeline lifecycle B4 | `eb5161b` adds pure local/scope-aware lifecycle projection with ten tests, declared under `cfg(test)` only. It is not production Scene wiring or native acceptance. [Design](release-scenario-lifecycle-design-20260910.md). | -| Native scenario oracle | [Independent checker](scenario-authoring-contract.rs) compiled/self-checked and verified the generated62-element/two-source baseline. Native OA root Action and exact Save/Undo/Redo pass at minimum size; native caller identity/scroll return and source-neutral navigation pass. Remaining prescribed checkpoints are open. [Native scope](release-scenario-native-20260911.md), [oracle inputs](fixtures/scenario-authoring/README.md). | +| Native scenario oracle | [Independent checker](scenario-authoring-contract.rs) compiled/self-checked and verified the generated62-element/two-source baseline. Native OA Action/State/Reuse/ALT-fragment, each exact Save/Undo/Redo, and final native reopen pass at minimum size; caller identity/scroll return and source-neutral navigation pass. Remaining prescribed checkpoints are open. [Native scope](release-scenario-native-20260911.md), [oracle inputs](fixtures/scenario-authoring/README.md). | | Normative documentation | Strict Docutils 0.22.2 language HTML regeneration passed. `semantic_schema.py --check --validate` passed 72 source7 fixtures, 204 schemas, 14 families/90 scalar leaves. These are documentation/schema gates, not a Rust build or runtime pass. | | Comparable-product study | Actual isolated Capella 7.1 scenario/activity/lifeline/LOOP creation was saved and XML inspected, then closed normally. [Report](release-capella-scenario-benchmark-20260910.md). Current Studio native evidence is recorded separately. | -| New requirement audit | [Independent delta report](release-requirements-delta-20260910.md) establishes that current expressions/unit labels are descriptive and source includes are not maintained cross-project libraries. Separate foundational design proposals remain under investigation, not ratified or implemented. | +| New requirement audit | [Independent delta report](release-requirements-delta-20260910.md) establishes that current expressions/unit labels are descriptive and source includes are not maintained cross-project libraries. Refined B/R6/R7 and exact-pin/same-origin compatibility contracts are ratified; current source7 does not implement them. | | Packaging integration | External `b98f135` imported as `6d2b961`; all 25 checked-in exact notices match the manifest. `scripts/test-package-artifacts.py` passes 11/11 and `scripts/test-windows-notices.ps1` passes synthetic package/runtime/source/font checks. Actual optimized distributions and clean-environment launches remain open. | ## Active work, ownership and unresolved findings Root Codex-956atf owns this host's integration, serialized Cargo and native UI. -The integrated command `cargo test --locked -p oa-desktop --bin arcadia-studio -- --test-threads=1` -completed with exit 0: **642 passed, zero failed/ignored**, tests 141.25 seconds, -warning-free build 36.31 seconds. Log `.local/logs/desktop-integrated-20260911.log`. -Implementation inputs match `80cf197`. The executable is -`target/debug/deps/arcadia_studio-58e30cee1fd51a8b.exe`, SHA256 -`DF122CAF7CFB63A3A9D0D2F2098944CF88F53C4ADA2C43B576B2836F6FD42BE8`. -The GUI build passed in3m28s; executable SHA256 +The source2cc4d11 gate completed with exit0: **676 passed, zero failed/ignored**, +tests611.24 seconds after warning-free compilation10m47s. Command: +`cargo test --locked -p oa-desktop --bin arcadia-studio -- --test-threads=1`. +Log `.local/logs/desktop-creation-chooser-20260911.log`. Immutable executable +`.local/creation-chooser-20260911/tests-2cc4d11/arcadia-studio-tests.exe`, SHA256 +`8D7FB35071F155B3BD07CE1885A1136B2D2EF71C4FF8C704665202499C86A721`. +Its manifest pins256 tracked input hashes. Format passed; strict all-target desktop +Clippy passed7m18s after the isolated manual-clamp correction. Final logs are copied +beside the immutable binary. These gates supersede the historical642 total, not the +current uncompiled working changes. Focused counts are included, never additive. + +Actual native Studio remains `.local/native-qa/studio-80cf197/`, GUI SHA256 `A5ED6DF334B1BFB620425AFDF3E863F0B522990E6FB47C6C401A71CF4443954A`. -Studio is running from immutable `.local/native-qa/studio-80cf197/`. Actual caller -identity/scroll return, source-neutral navigation and minimum-size OA root Action -creation with exact Save/Undo/Redo comparisons pass. [Native evidence and remaining -gates](release-scenario-native-20260911.md). Formatting passed. Strict Clippy found -two collapsible-if cases; root corrected them. The isolated chooser is now declared -under cfg(test). Its warning-free first compile completed;9/12 focused tests pass. -Three failures trace to test inputs that sent whole strings as single physical key -events; the worker is correcting realistic typing and adding paste/IME coverage. -No production chooser integration or current passing whole-suite claim follows. +That GUI build passed3m28s. At1100x700, all four OA creation checkpoints and final +reopen now pass complete Project/two-source prediction and exact UUID restoration. +Preserved snapshots end in `oa-reopened/`; no SA or new-fix acceptance is inferred. +[Native report](release-scenario-native-20260911.md) records details and two real +workspace findings: new forms retain downward scroll, and opening a form can hide +its clicked marker below the reduced canvas. Root has written a fresh form-session +key, guarded Name focus, one-time marker reveal and three meaningful mounted/App +regressions. They are not yet compiled. The isolated chooser's corrected realistic +typing/paste/IME gate passes13/13; production inspector/review integration is now +owned by local behavior_audit, with exact row/facet/group/attachment guards. -Historical first-binary runs with `--test-threads=1` passed history 13/13, pure lifecycle -10/10, topology 45/45, architecture authoring 18/18 and mounted scroll 5/5. Scenario -direct tests passed 13/14 and reproduced the known caller-return assertion failure -at `scenario.rs:2473`; do not count that filter as passing. Logs are -`.local/logs/history-fields-focused.log` and `.local/logs/focused-*.log`. The current -642/642 suite supersedes that known failure after its correction; do not add filter -counts to the full total. Gitea #97's exact integration bundle was anonymously fetched, -decoded, SHA256-verified and admitted with `git bundle verify`; selected source and -packaging commits are integrated. Source the local toolchain before commands and keep -one Cargo writer. The independent checker used completed rlibs without another -Cargo writer; its evidence is separately scoped above. +The [baseline contract](release-analysis-baseline-contract-20260911.md) supplies a +complete17-UUID proposed model,11 exact fixtures, explicit ModelBaseline/Case, +property bases and shared checks. Its transport fixtures are not parser/evaluator +acceptance. The [library contract](release-library-compatibility-contract-20260911.md) +has120 executed finite-prototype assertions, separate-process reopen and11 complete +expected/reopened file comparisons. Final81-file manifest was independently +verified; preliminary output is retained and labeled superseded. All166 experiment +files retain exact Git bytes. Root ratified B/R6/R7/full private capture, nominal +typed compatibility alongside exact pins, explicit source normalization and OA/SA +dispositions in [DECISIONS](DECISIONS.md). -Codex-9e8r6t is a separate host/team with a warm cache. It owns scenario workspace -layout/B3 correction, local named behavior creation, palette and platform/packaging. -Its coherent workspace and packaging checkpoint is imported. New local named -behavior creation passed its 20 focused tests (#115), with broader checks/review -and a verified transfer still pending. Its current native basic-editing checkpoint -passed its independent model/four-source oracle; that is external evidence, not -this host's acceptance. It owns docs/language.rst source7/default corrections, -examples/release1 README schema correction and local-creation README guidance (#116). +The [independent refined review](release-refined-contracts-review-20260911.md) +passes292 fixture/identity checks but finds C1:333 stored AST nodes can expand to +over2billion calls. Request-local dynamic/numeric work accounting is mandatory; +static depth/node limits alone fail. C2 is a finite-prototype threshold-unit gap, +not a passing production type-checker. Local requirements_delta owns undeclared +`analysis_numeric` foundation (exact arithmetic, dimension/unit operations and +terminal work meter), with semantics_critic independently reviewing correctness. +Root owns dependency/module admission and all compilation. Numeric ceiling values +remain provisional pending measured gates. Approximate engineering calculations, +full evaluator/model/source/REST/GUI parity and actual library maintenance are open. -B3 diagnosis (#79): command execution may preselect an occurrence while another -scenario remains visible; `select(same_id)` then returns without restoring the -caller owner. The imported correction now establishes owner and selection together. -Root's additional Sensor regression proves same-size owner/document changes must -remeasure Fit; see `.local/logs/scenario-sensor-before-fix.log` for the red result. -Exact source/history and mounted viewport checks pass in the integrated suite. +Codex-9e8r6t and Codex-ytr83r are separate hosts/teams. The former owns contextual +prerequisite creation, source CLI and next Windows named-authoring prerelease. +Its direct branch `codex/release1-9e8r6t` has coherent CLI checkpoint01b76a1; corrected +evidence2ec72d4 and CLI are not yet imported here. External675 staged-source and +CLI12/183-assertion results remain externally attributed. Codex-ytr83r owns B4 +production Scene wiring, independent native oracle and local Linux route. Its +rendering source has independent criticism but no passing build/native gate yet. +Do not duplicate these changes. Preserve root's distinct scenario-scroll/focus hook +when integrating other hosts' small App/behavior bridges. -Analysis/quantity and library proposals plus paired independent criticism are ready -for synthesis. Remaining material questions: text-only instance base/map creation, -cosmetic package updates versus quantity/type compatibility, subjectless case export -closure, mounted data OA/SA transition policy, repeated case assumptions and closure -of anonymous dimension operations. No production contract is ratified. Isolated -text-only source experiments, baseline-versus-complete-case experiments and an -undeclared anchored reference chooser widget are active; their passing claims must -remain separate from the 642-test implementation. Root owns their integration. - -B4 independent Scene review (#114) identifies real integration boundaries: insertion -sequence bounds are not lifetime extents; activation tails must not continue past -branch-local Delete; incomplete represented=None lifelines still need geometry; -self Create/Delete arrives at row+24. The pure projection has not yet been wired. - -Both hosts report direct Git push authentication unavailable. Anonymous fetch and -authenticated Gitea MCP remain usable. Exact verified bundles are exchanged on -`codex/behavior-transfer-20260910`; do not merge that transfer branch. Existing -bundles cover `01bb52a`, `b6b76ef`, `eb5161b` and incremental `4ecad78`; exact hashes, -prerequisites and readback are preserved in the [archived ledger](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md) -and Gitea #65/#76. Latest verified outgoing transfer is `harness/transfers/behavior-aa40345.bundle.b64` on that branch (Gitea #92): 24,926 decoded bytes, prerequisite `4ecad78`, SHA256 `21B36D5016600953D95F064AE56569B6C8E7D3EA2B3B316C97222AD122FECA4F`. Later native oracle, proposals, ledgers and Sensor correction still need publication. Root owns subsequent transfer and integration. +Updated AGENTS d93cddac adds coordinated runnable milestone prereleases. Gitea +user#178 explicitly authorizes programmatic reuse of existing MCP credentials for +Git/REST and relevant commits/tags/prereleases, without printing or committing them. +Direct push setup is in progress on this host;9e8r6t has independently succeeded. +Historical verified bundle exchange remains reproducible: c6d296a bundle on +`codex/behavior-transfer-20260910`,334830 decoded bytes, SHA256 +`526A80E2D32ED0E57A7B2372B5F02D4652E8751DFEBA81953C4F045225D6AACB`, +prerequisite1797516. Both other hosts received it. Never merge transfer branches. +Older bundles/logs retain historical scope in Git and the archived ledger. ## Remaining gates and highest-value next actions -1. Finish the active GUI build and current format/strict Clippy gates. The full - desktop suite has passed; repeat only for new source changes or unresolved risk. - Record exact implementation/binary and run the real application. -2. Integrate the externally verified workspace/B3/local creation/palette/package - checkpoints without overwriting ownership or treating their earlier tests as new - local acceptance. Wire B4 only after coordinating actual Scene geometry. +1. Freeze and compile the new workspace/chooser integration, resolve focused + failures, then build an immutable GUI and verify both native workspace fixes. + The676-test gate is complete for2cc4d11; new changes require their own evidence. +2. Publish coherent checkpoints directly; integrate9e8r6t CLI/corrected evidence + and later staged-source work, then ytr83r B4 only after its coherent handoff. + Preserve ownership and distinguish every external versus local gate. 3. Use the self-checked independent oracle to exercise current Studio at minimum/wide sizes: named creation, direct process/scenario edits, nested reuse, caller return, lifeline lifecycle, invalid/cancel/recovery, Save/Undo/Redo/reopen. Compare complete model/source and exact identities, not screenshots alone. -4. Resolve analysis/quantity/library alternatives against real engineering budgets, - unit/kind failures and two-project reuse/update examples. Then implement precise - shared-core/source/API/graphical contracts and large-model selection workflows. +4. Compile/review/measure the numeric foundation, then implement the ratified + analysis/library contracts with shared-core/source/API/graphical parity. Use real + budgets, unit/kind failures, complete text-only and two-project update workflows. + Integrate the bounded chooser and run its actual keyboard/minimum-size gates. 5. Complete current teaching, transitions, semantic review, state/data, saved-view, artifact, hosted transport and migration acceptance. Historical scoped passes remain useful references, never blanket current acceptance. @@ -151,8 +154,10 @@ and Gitea #65/#76. Latest verified outgoing transfer is `harness/transfers/behav ## Reassessment Meaningful progress continues: concrete interaction defects have been found and -corrected, all 642 desktop tests pass, exact native evaluation is prepared, -and the revised semantic requirements are no longer hidden behind metadata. +corrected,676 desktop tests pass and all four OA native creation/history/reopen +checks pass. Contracts have converged through independent falsification; numeric +implementation now addresses the exposed dynamic-work risk. The revised semantic +requirements are no longer hidden behind metadata. Passing older suites or accumulating prose would not close the user problem. Current highest information gain comes from actual build/native results and independently criticized foundational examples, while preserving existing identity, diff --git a/harness/TASK_LEDGER.md b/harness/TASK_LEDGER.md index 21bbfe9b..2e67f1e9 100644 --- a/harness/TASK_LEDGER.md +++ b/harness/TASK_LEDGER.md @@ -7,11 +7,11 @@ Its old goal references, aggregate test claims and stopped-session directives re historical scope. New semantic decisions are recorded explicitly in DECISIONS.md; prototype results retain their separate scope. -Current integration checkpoint: verified external creation4bb4aaf is imported -after local c4e1580 (13/13 isolated mounted chooser tests and equivalent lint -corrections). This host's full642-test/GUI/native evidence still refers to80cf197 -until the fresh combined gate finishes. External creation653/native results stay -attributed to Codex-9e8r6t; copied reports do not turn them into local observations. +Current compiled checkpoint2cc4d11 includes external creation4bb4aaf as1516949, +isolated chooser13, and final baseline/library contracts. Local full676/format/ +strict Clippy pass; native80cf197 now passes four OA creations, exact history and +reopen. Working workspace/production chooser changes and undeclared numeric files +have no passing gate yet. External results retain their host/source attribution. ## Goal and success criteria @@ -49,7 +49,10 @@ cannot establish completion. at effort appropriate to the question. Root owns synthesis/integration. - Project instructions require Gitea coordination, ownership preservation and durable handoffs. Current root reserves one Cargo/native operator per host. - Do not infer restart, usage reset or credential disclosure authorization. + Updated AGENTS d93cddac requires coordinated runnable milestone prereleases; + user Gitea#178 authorizes programmatic existing-MCP-credential reuse for relevant + Git/REST publication without printing/committing secrets. Restart and usage reset + remain unauthorized. ## Verified facts @@ -59,7 +62,7 @@ cannot establish completion. are evaluator evidence, not native Studio acceptance. Exact inputs/hashes are in [the fixture instructions](fixtures/scenario-authoring/README.md). -- Current local implementation is `80cf197` on `codex/behavior-authoring-20260910`, following +- The historical native implementation is `80cf197` on `codex/behavior-authoring-20260910`, following baseline `1797516`. Local commits cover B1/B2/B3 authoring, nullable history cache (`b6b76ef`), external palette integration (`aed40d7`), cfg(test) lifecycle projection (`eb5161b`), history seed correction (`4ecad78`) and exact-identity native oracle. @@ -67,9 +70,10 @@ cannot establish completion. owner restoration. Root80cf197 fixes document/scenario viewport Sensor identity with a real mounted red-before/green-after regression. - This fresh host has task-local Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW. - The integrated full desktop suite passes642/642, zero failed/ignored, with a - warning-free build. History and pure lifecycle tests are included. Current GUI - build/native and strict lint remain open. [Exact hashes/logs](STATE.md). + The integrated2cc4d11 desktop suite passes676/676, zero failed/ignored, with a + warning-free build; formatting and strict Clippy pass. History, pure lifecycle, + creation and isolated chooser are included. New working code still needs its + own gate. Native80cf197 evidence is separate. [Exact hashes/logs](STATE.md). - Strict language HTML regeneration and the source7 OpenAPI checker passed locally: 72 fixtures, 204 schemas and 90 scalar leaves. Actual isolated Capella scenario, activity/lifeline and LOOP creation was saved/inspected; this is reference study, @@ -90,11 +94,12 @@ cannot establish completion. scenario checkpoint; owner restoration and pending-draft guards pass current tests. B4 independent review #114 adds Scene integration requirements for actual lifetime extents, branch-local activation clipping, incomplete lanes and self arrows. -- Codex-9e8r6t is a separate host with independent Cargo/native leases. It owns - scenario workspace/B3/local behavior creation, palette and platform/packaging; - coherent workspace/package integration is imported, while newer named behavior - creation and docs changes await transfer. Both hosts report direct push auth - unavailable. MCP/anonymous fetch and verified bundle exchange remain usable. +- Codex-9e8r6t and Codex-ytr83r have independent host-local Cargo/native leases. + Named creation/workspace/palette/package integration is imported here.9e8r6t's + coherent CLI/evidence checkpoint01b76a1 awaits import; it owns staged-source and + the next runnable Windows prerelease. ytr83r owns production B4 and its native + oracle.9e8r6t successfully reused existing credentials for direct push; this + host is setting up the same authorized publication path. - Current Linux acceptance is open; this host has no installed WSL distribution. Historical Linux core/server/cross-build results have exact older snapshot scope. The earlier denied guest workaround did not run and must not be bypassed. @@ -103,25 +108,27 @@ cannot establish completion. - Compact contextual tools and an adequately sized scenario workspace can reduce friction; only actual engineering tasks at minimum/wide sizes can validate this. -- A bounded pure analysis model and pinned reusable packages may satisfy the new - requirements without full language/runtime adoption. This is a candidate, not a - selected architecture or a permission to treat metadata as semantics. +- The ratified bounded pure analysis and pinned-library architecture can satisfy + real engineering work without full language/runtime adoption. This remains a + product adequacy assumption until actual budgets, approximate calculations and + two-project/source/API/native workflows pass; metadata is insufficient. - Existing shared core/source/history boundaries remain suitable for additions; foundational examples and independent criticism must test that assumption. ## Open questions -- What precise owned-value, calculation, constraint-result, quantity-kind, unit and - numerical contracts meet mass/power/latency and affine/dimensional edge cases? -- Which library definition/instance/pinning/binding/update design preserves stable - identities, local engineering edits and offline reproducibility across projects? +- Do the ratified owned-value/shared-check/R6/R7 contracts meet real engineering + budgets once implemented, including approximate numeric requirements? What + measured ceilings keep work bounded without rejecting ordinary studies? +- Does actual package closure/canonical consumer typing/source preparation and + three-way update preserve every stable identity and local engineering edit? - What migration and OA↔SA treatment follows from those contracts without guessing executable meaning from old strings or silently changing old models? - How can text-only creation establish library instance bases/maps, preserve compatibility across cosmetic package revisions, export subjectless cases, and transition mounted OA/SA data without hidden GUI normalization or silent forks? -- Do explicit baseline values with one-level case overrides or complete per-case - bindings better support repeated study maintenance and reproducible evaluation? +- Will full evaluator and private-capture replay preserve effective-case and + deterministic work-limit behavior across direct, REST and cache-warm execution? - Which source-preserving refactoring/navigation and grammar changes reduce actual engineering effort while retaining stable identity and cross-file ownership? - Do current real gestures, exact caller return, nested scopes and lifecycle markers @@ -146,11 +153,14 @@ versus analysis contexts; calculation definitions/applications; numeric/unit rul and copy, linked-definition, live-instance or pinned-definition/editable-instance library architectures. Require concrete falsifiers, source/API migration effects, identity/history/recovery behavior and independent critique before convergence. -The completed analysis/library proposals and paired review remain unratified. -An isolated executable text-only fixture admits without warnings and passes exact -source/identity/rename/reparent/file-move/default checks. Separate baseline-versus- -complete-case and anchored chooser experiments are active, with no production -metamodel or selector integration implied. +These alternatives converged after concrete experiments and independent review: +B property bases/shared checks/full capture, R6/R7, exact pins with same-origin +typed compatibility and explicit portable normalization are now ratified. Complete +11-file proposed baseline and120-assertion finite library prototype remain distinct +from production admission. Independent292-check review exposed C1 dynamic-work +expansion and a C2 prototype threshold-unit gap; implementation must close both. +The text-only40-identity fixture and13 mounted chooser tests pass. Production +numeric foundation and inspector/review chooser are active, with gates pending. The subsequent context experiment passed218 assertions: shared property baselines and one-level overrides reduce repeated input maintenance while retaining explicit @@ -160,8 +170,8 @@ quantity/library/source details remain open. [Decision](DECISIONS.md), ## Decisions retained -- Keep three Rust crates and one authoritative typed Project with validated atomic - Commands. Separate semantic identity/ownership, allocation/reference/order and +- Keep explicit Rust crate responsibilities and one authoritative typed Project + with validated atomic Commands. A thin source CLI reuses the shared core. Separate semantic identity/ownership, allocation/reference/order and diagram geometry. Forms are closed adapters, not a second metamodel. New persistent semantics require core/source/UI/API/reference/transition parity. [Decisions](DECISIONS.md). - Preserve authored source ownership/comments/includes, exact identity and accepted @@ -190,13 +200,13 @@ quantity/library/source details remain open. [Decision](DECISIONS.md), ## Current strategy -Finish the GUI/native loop after the green full desktop suite while separate -agents investigate uncertain foundations. Integrate only coherent, verified -external checkpoints respecting ownership. Use independently constructed complete -model/source oracles and exact snapshot comparison for identity/history. Ratify -analysis/library contracts through alternatives and falsifying examples, then -implement shared semantics and ergonomic authoring together. Close current -cross-platform/service/package and independent end-state gates before handoff. +Finish the new workspace/chooser compile and native loop; independently review +and measure the numeric foundation before expanding the ratified semantics. +Integrate coherent external CLI/staged-source/B4 checkpoints while preserving +ownership and source attribution. Use independent complete model/source oracles +and exact identity/history comparisons. Publish coordinated runnable milestone +prereleases; close actual analysis/library/source/API/native, cross-platform, +service/package and independent end-state gates before the final handoff. The [archived Task Ledger](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md) and [archived STATE](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md) diff --git a/harness/experiments/refined-contracts-review-20260911/audit-results.json b/harness/experiments/refined-contracts-review-20260911/audit-results.json new file mode 100644 index 00000000..f1bc0bb1 --- /dev/null +++ b/harness/experiments/refined-contracts-review-20260911/audit-results.json @@ -0,0 +1,361 @@ +{ + "scope": "Read-only fixture transport/identity/manifest/hash audit; no proposed parser, full type checker, evaluator or Studio execution.", + "python": "3.12.14 (main, Aug 25 2026, 14:01:42) [MSC v.1944 64 bit (AMD64)]", + "audit_source_sha256": "a449587294c83891803e52721f727fc61a6448137b0c47e7fab6e41373846b60", + "exit_code": 0, + "checks_passed": 292, + "checks": [ + "frozen hash: harness/release-analysis-baseline-contract-20260911.md", + "frozen hash: harness/release-library-compatibility-contract-20260911.md", + "frozen hash: harness/experiments/library-compatibility-20260911/main.rs", + "frozen hash: harness/experiments/library-compatibility-20260911/EVIDENCE.json", + "exactly 11 baseline fixture files", + "strict JSON transport: evaluate-baseline.json", + "strict JSON transport: evaluate-degraded.json", + "strict JSON transport: evaluate-unmeasured.json", + "strict JSON transport: expected-observations.json", + "strict JSON transport: fixture-integrity.json", + "strict JSON transport: freeze-degraded.json.proposed", + "strict JSON transport: portable-document.json.proposed", + "strict JSON transport: r7-literal-boundaries.json", + "declared source entry", + "exact embedded source bytes", + "source byte count", + "source line count", + "freeze capsule is byte-identical to complete portable JSON", + "freeze and fixture digest agree with captured bytes", + "freeze model identity", + "parameter reference remains in declaring calculation", + "parameter reference remains in declaring calculation", + "17 distinct typed identities", + "every typed identity has exactly one explicit source id", + "canonical UUID: 4210b9f2-7046-47f0-aa3b-153f626a579d", + "canonical UUID: 188b911c-5f8b-431c-9eea-2d41f3953767", + "canonical UUID: 39053f37-fec9-4708-9f0a-3959d223f891", + "canonical UUID: 534f4672-1ba5-4157-8b0a-b9cf41d0a3ce", + "canonical UUID: fd7ce7ab-f789-40bc-b699-0c37f1b6902f", + "canonical UUID: 38036c65-16d4-449c-837b-91eb141c1d93", + "canonical UUID: 437bedbb-2cf4-44ee-a139-6563cc5086ec", + "canonical UUID: 4ab9a8a7-7552-488d-9862-e14b89e7b353", + "canonical UUID: 63a931c2-675a-4fce-89e5-04361cb99450", + "canonical UUID: 6df991ba-4c5e-4535-99e2-524ae274ee8b", + "canonical UUID: 99d3e09a-0ec3-4194-9dd4-9f3de6625cde", + "canonical UUID: bac0de99-9d2f-4e53-9158-d424ecac61bf", + "canonical UUID: bd5b68e8-65fc-4e35-9071-a73061316a4b", + "canonical UUID: c33fc772-2a60-4044-9af9-73c61c563ace", + "canonical UUID: cabec6a1-7d5d-48f3-8d2d-a7fc8cf78f59", + "canonical UUID: 28ff40b0-1b8f-4735-8536-5a6ab21b56cb", + "canonical UUID: 7a47cc1e-8ae5-4551-b2d8-8a68108e0976", + "key/record identity agrees: duration", + "key/record identity agrees: millisecond", + "key/record identity agrees: second", + "key/record identity agrees: combine", + "key/record identity agrees: degraded", + "key/record identity agrees: limit", + "key/record identity agrees: receive", + "key/record identity agrees: receive_time", + "key/record identity agrees: dispatch", + "key/record identity agrees: unmeasured", + "key/record identity agrees: budget", + "key/record identity agrees: total_time", + "key/record identity agrees: dispatch_time", + "key/record identity agrees: respond", + "root analysis element: degraded", + "root analysis element: limit", + "root analysis element: receive_time", + "root analysis element: unmeasured", + "root analysis element: budget", + "root analysis element: total_time", + "root analysis element: dispatch_time", + "four explicit property bases", + "two explicit case override entries", + "one shared check", + "four local definitions", + "ten project elements", + "two scoped parameters", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "element subject resolves", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "element subject resolves", + "local definition reference resolves", + "property expression reference resolves", + "property expression reference resolves", + "call arguments exactly match parameter identities", + "property expression reference resolves", + "property expression reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "element subject resolves", + "local definition reference resolves", + "local definition reference resolves", + "local definition reference resolves", + "element subject resolves", + "local definition reference resolves", + "explicit model-baseline selector", + "all frozen binding ASTs and base/override origins match captured context", + "all frozen shared check ASTs match captured model", + "frozen definition inventory and exact document hash agree", + "local-only fixture makes no imported freeze claim", + "valid target identities: evaluate-baseline.json/properties", + "valid target identities: evaluate-baseline.json/checks", + "valid target identities: evaluate-degraded.json/properties", + "valid target identities: evaluate-degraded.json/checks", + "valid target identities: evaluate-unmeasured.json/properties", + "valid target identities: evaluate-unmeasured.json/checks", + "independently constructed boundary value: ten_to_300", + "canonical exact wire components: ten_to_300", + "normalized rational: ten_to_300", + "actual 4096-bit boundary: ten_to_300", + "1234-digit component boundary: ten_to_300", + "canonical literal spelling agrees with exact Number node: ten_to_300", + "independently constructed boundary value: one_over_two_to_4095", + "canonical exact wire components: one_over_two_to_4095", + "normalized rational: one_over_two_to_4095", + "actual 4096-bit boundary: one_over_two_to_4095", + "1234-digit component boundary: one_over_two_to_4095", + "canonical literal spelling agrees with exact Number node: one_over_two_to_4095", + "independently constructed boundary value: negative_4096_bit_bound", + "canonical exact wire components: negative_4096_bit_bound", + "normalized rational: negative_4096_bit_bound", + "actual 4096-bit boundary: negative_4096_bit_bound", + "1234-digit component boundary: negative_4096_bit_bound", + "canonical literal spelling agrees with exact Number node: negative_4096_bit_bound", + "81 final library fixture hash entries", + "no duplicated library evidence paths", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/management/data1.mount", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/management/left/base.model", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/management/left/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/management/left/map.model", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/management/right/base.model", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/management/right/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/management/right/map.model", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/packages/28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33.library", + "only final library evidence", + "exact final library fixture: generated-final/01-initial/project.model", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/management/data1.mount", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/management/left/base.model", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/management/left/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/management/left/map.model", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/management/right/base.model", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/management/right/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/management/right/map.model", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/packages/28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33.library", + "only final library evidence", + "exact final library fixture: generated-final/01-recompiled/project.model", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/management/data1.mount", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/management/left/base.model", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/management/left/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/management/left/map.model", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/management/right/base.model", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/management/right/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/management/right/map.model", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/packages/28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33.library", + "only final library evidence", + "exact final library fixture: generated-final/02-edited/project.model", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/data1.mount", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/data2.mount", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/left/base.model", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/left/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/left/map.model", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/right/base.model", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/right/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/management/right/map.model", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/packages/28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33.library", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/packages/a35102e04b9f6822ab409ab43f83eded33edd0a3a3c1f589245bb7b123ce4779.library", + "only final library evidence", + "exact final library fixture: generated-final/03-updated/project.model", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/management/data1.mount", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/management/left/base.model", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/management/left/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/management/left/map.model", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/management/right/base.model", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/management/right/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/management/right/map.model", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/packages/28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33.library", + "only final library evidence", + "exact final library fixture: generated-final/04-reidentified/project.model", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/data1.mount", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/data2.mount", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/left/base.model", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/left/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/left/map.model", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/right/base.model", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/right/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/management/right/map.model", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/packages/28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33.library", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/packages/a35102e04b9f6822ab409ab43f83eded33edd0a3a3c1f589245bb7b123ce4779.library", + "only final library evidence", + "exact final library fixture: generated-final/05-fresh-process-reopened/project.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/data1.mount", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/data2.mount", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/left/base.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/left/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/left/map.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/right/base.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/right/lineage.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/management/right/map.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/packages/28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33.library", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/packages/a35102e04b9f6822ab409ab43f83eded33edd0a3a3c1f589245bb7b123ce4779.library", + "only final library evidence", + "exact final library fixture: generated-final/expected-full-updated/project.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-initial.model", + "only final library evidence", + "exact final library fixture: generated-final/expected-key-records.model", + "only final library evidence", + "exact final library fixture: generated-final/explicit-bridges.model", + "only final library evidence", + "exact final library fixture: generated-final/initial.request", + "only final library evidence", + "exact final library fixture: generated-final/local-edit.request", + "only final library evidence", + "exact final library fixture: generated-final/oa-sa-transition.model", + "only final library evidence", + "exact final library fixture: generated-final/package-D1.library", + "only final library evidence", + "exact final library fixture: generated-final/package-D2.library", + "only final library evidence", + "exact final library fixture: generated-final/package-D3.library", + "only final library evidence", + "exact final library fixture: generated-final/package-SA.library", + "only final library evidence", + "exact final library fixture: generated-final/RESULTS.md", + "only final library evidence", + "exact final library fixture: generated-final/selective-update.request", + "11 complete updated library files", + "complete byte equality: expected-full-updated", + "complete byte equality: 05-fresh-process-reopened", + "author's recorded 120-assertion/fresh-process results (not rerun here)" + ], + "frozen_input_hashes": { + "harness/release-analysis-baseline-contract-20260911.md": "9d294a3a8ad41ef4d07caac9fa410286f22ea5464400ccf01714f76e01ba5802", + "harness/release-library-compatibility-contract-20260911.md": "30bbfd379ec542827a22d3b604534e5b6329cd913ff243747004e1afa2983ee5", + "harness/experiments/library-compatibility-20260911/main.rs": "bc31bacf250f3711758717f18a3104696ed941c3c9b89817caa6a96e6540062a", + "harness/experiments/library-compatibility-20260911/EVIDENCE.json": "1eb643f20645a83e88e644b1f2c42d554f35259fa2cfceafa0632bf47c2ed966" + }, + "baseline_fixture_hashes": { + "README.md": "9750d50a3ad290b619ae0b31b465289099be9b216262ae3776abc7469778010d", + "active.arcadia.proposed": "a87154a106df1c0fdbf14b0a936e6ae17b2f67fa9d3c2ec280b5aa1644be35c4", + "build-fixtures.ps1": "1663eb642ab5419a3d983e8e98f030c46ca119dde6f42309660fb584dbc33d6f", + "evaluate-baseline.json": "5c794d7f8a117dad32570969deb11f1f373d0727ade277ab809ffec0b147b6da", + "evaluate-degraded.json": "9d134830a1c109b867cd4649f18b43ca245e8aed5953addf1cacb1cf712aa7b8", + "evaluate-unmeasured.json": "1b06bb31c2e95fcb107cced0e3cbb0c9db3b83c95ff8a9c9be93b3a4235d1e6d", + "expected-observations.json": "d2b0c389917de48c085ebe65611ad765b2d0f37b1d309a85ec9f3a1b84f1cbcc", + "fixture-integrity.json": "8092498eabef0ff2ebcc3b1b9ed417ea65008715b30b4fad984b9b2bf873a6b1", + "freeze-degraded.json.proposed": "e198ece3fb52ce44d960fa7af8373ad9ad2e57f5e7b5a39e752aa6c7d5501e60", + "portable-document.json.proposed": "6667773d90f83626f760b2faa2bf7d57638947d95574e3fa3e80b64416f01497", + "r7-literal-boundaries.json": "3b959dec5e100a6f03817f5314bef497347ba579ebd235476516d4bd83399181" + }, + "r7_literal_measurements": [ + { + "name": "ten_to_300", + "numerator_bits": 997, + "denominator_bits": 1, + "numerator_digits": 301, + "denominator_digits": 1 + }, + { + "name": "one_over_two_to_4095", + "numerator_bits": 1, + "denominator_bits": 4096, + "numerator_digits": 1, + "denominator_digits": 1233 + }, + { + "name": "negative_4096_bit_bound", + "numerator_bits": 4096, + "denominator_bits": 1, + "numerator_digits": 1234, + "denominator_digits": 1 + } + ], + "work_count_counterexample": { + "definition_count": 31, + "stored_expression_nodes_including_root_call": 333, + "maximum_call_levels": 31, + "dynamic_definition_calls": 2147483647, + "distinct_leaf_argument_values": 1073741824, + "largest_leaf_argument_bits": 30, + "exact_result_bits": 59, + "status": "closed-form count only; no billion-call evaluation executed" + }, + "library_recorded_execution": { + "compiler": "rustc 1.98.1 (48a229cea 2026-09-01), x86_64-pc-windows-gnullvm, LLVM 22.1.8", + "source_sha256": "bc31bacf250f3711758717f18a3104696ed941c3c9b89817caa6a96e6540062a", + "executable_sha256": "652a15a96bd9b0cf2aa732c2273ec5e651c18e9d11d668a1ae5f214d120bb310", + "assertions_passed": 120, + "run_exit_code": 0, + "fresh_process_reopen_exit_code": 0 + } +} diff --git a/harness/experiments/refined-contracts-review-20260911/audit_fixtures.py b/harness/experiments/refined-contracts-review-20260911/audit_fixtures.py new file mode 100644 index 00000000..88ca13b0 --- /dev/null +++ b/harness/experiments/refined-contracts-review-20260911/audit_fixtures.py @@ -0,0 +1,253 @@ +"""Read-only audit of frozen proposal fixtures, not a language implementation. + +Only this directory's audit-results.json is written. No parser, type checker, +numeric evaluator, package materializer or Studio admission is implemented here. +""" + +import base64 +import hashlib +import json +import math +from pathlib import Path +import re +import sys +import uuid + + +HERE = Path(__file__).resolve().parent +ROOT = HERE.parents[2] +ANALYSIS = ROOT / "harness/experiments/analysis-baseline-20260911" +LIBRARY = ROOT / "harness/experiments/library-compatibility-20260911" +checks = [] + + +def require(condition, label): + if not condition: + raise AssertionError(label) + checks.append(label) + + +def digest(data): + return hashlib.sha256(data).hexdigest() + + +def pairs_without_duplicates(pairs): + result = {} + for key, value in pairs: + if key in result: + raise ValueError(f"duplicate JSON key: {key}") + result[key] = value + return result + + +def read_json(path): + return json.loads(path.read_bytes(), object_pairs_hook=pairs_without_duplicates) + + +def walk(value): + yield value + if isinstance(value, dict): + for child in value.values(): + yield from walk(child) + elif isinstance(value, list): + for child in value: + yield from walk(child) + + +def tree(directory): + return {p.relative_to(directory).as_posix(): p.read_bytes() + for p in directory.rglob("*") if p.is_file()} + + +frozen_hashes = { + "harness/release-analysis-baseline-contract-20260911.md": + "9d294a3a8ad41ef4d07caac9fa410286f22ea5464400ccf01714f76e01ba5802", + "harness/release-library-compatibility-contract-20260911.md": + "30bbfd379ec542827a22d3b604534e5b6329cd913ff243747004e1afa2983ee5", + "harness/experiments/library-compatibility-20260911/main.rs": + "bc31bacf250f3711758717f18a3104696ed941c3c9b89817caa6a96e6540062a", + "harness/experiments/library-compatibility-20260911/EVIDENCE.json": + "1eb643f20645a83e88e644b1f2c42d554f35259fa2cfceafa0632bf47c2ed966", +} +for name, expected in frozen_hashes.items(): + require(digest((ROOT / name).read_bytes()) == expected, f"frozen hash: {name}") + +analysis_files = tree(ANALYSIS) +require(len(analysis_files) == 11, "exactly 11 baseline fixture files") +for name in analysis_files: + if ".json" in name: + read_json(ANALYSIS / name) + checks.append(f"strict JSON transport: {name}") + +portable_bytes = (ANALYSIS / "portable-document.json.proposed").read_bytes() +portable = read_json(ANALYSIS / "portable-document.json.proposed") +frozen = read_json(ANALYSIS / "freeze-degraded.json.proposed") +integrity = read_json(ANALYSIS / "fixture-integrity.json") +source_bytes = (ANALYSIS / "active.arcadia.proposed").read_bytes() +source = source_bytes.decode("utf-8") +require(portable["source"]["entry"] == "active.arcadia", "declared source entry") +require(portable["source"]["files"] == {"active.arcadia": source}, "exact embedded source bytes") +require(len(source_bytes) == integrity["source_utf8_bytes"] == 2678, "source byte count") +require(len(source.splitlines()) == integrity["source_lines"] == 55, "source line count") +capsule = frozen["captured_document"] +require(base64.b64decode(capsule["bytes_base64"], validate=True) == portable_bytes, + "freeze capsule is byte-identical to complete portable JSON") +require(digest(portable_bytes) == capsule["sha256"] == integrity["portable_document_sha256"], + "freeze and fixture digest agree with captured bytes") +model = portable["model"] +require(model["id"] == frozen["model_id"], "freeze model identity") +definitions = model["definitions"] +elements = model["elements"] +parameters = [] +for record in definitions.values(): + calculation = record["body"].get("Calculation") + if calculation: + scoped = {p["id"] for p in calculation["parameters"]} + parameters.extend(scoped) + for node in walk(calculation["body"]): + if isinstance(node, dict) and "Parameter" in node: + require(node["Parameter"] in scoped, "parameter reference remains in declaring calculation") +declared_ids = [model["id"], *definitions, *elements, *parameters] +source_ids = re.findall(r'\bid "([0-9a-f-]+)"', source) +require(len(declared_ids) == len(set(declared_ids)) == 17, "17 distinct typed identities") +require(set(source_ids) == set(declared_ids) and len(source_ids) == 17, + "every typed identity has exactly one explicit source id") +for identity in declared_ids: + require(str(uuid.UUID(identity)) == identity, f"canonical UUID: {identity}") +for key, record in {**definitions, **elements}.items(): + require(key == record["id"], f"key/record identity agrees: {record['alias']}") + +properties, cases, shared_checks = {}, {}, {} +for identity, record in elements.items(): + layer = record["body"]["Oa"] + shared = layer.get("Shared", {}) if isinstance(layer, dict) else {} + for variant, output in (("EngineeringProperty", properties), + ("AnalysisCase", cases), ("AnalysisCheck", shared_checks)): + if variant in shared: + output[identity] = shared[variant] + require(record["parent"] is None, f"root analysis element: {record['alias']}") +require(len(properties) == integrity["base_bindings"] == 4, "four explicit property bases") +require(sum(len(c["overrides"]) for c in cases.values()) == integrity["override_bindings"] == 2, + "two explicit case override entries") +require(len(shared_checks) == integrity["shared_checks"] == 1, "one shared check") +require(len(definitions) == integrity["local_definitions"] == 4, "four local definitions") +require(len(elements) == integrity["project_elements"] == 10, "ten project elements") +require(len(parameters) == integrity["scoped_parameters"] == 2, "two scoped parameters") +for node in walk(model): + if not isinstance(node, dict): + continue + if set(node) == {"Local"}: + require(node["Local"] in definitions, "local definition reference resolves") + if set(node) == {"Property"}: + require(node["Property"] in properties, "property expression reference resolves") + if set(node) == {"Element"}: + require(node["Element"] in elements, "element subject resolves") + if set(node) == {"Call"}: + call = node["Call"] + definition = definitions[call["definition"]["Local"]]["body"]["Calculation"] + require(set(call["arguments"]) == {p["id"] for p in definition["parameters"]}, + "call arguments exactly match parameter identities") + +case_id = frozen["context"]["Case"] +selected_case = cases[case_id] +require(selected_case["base"] == "ModelBaseline", "explicit model-baseline selector") +expected_bindings = [] +for identity, prop in sorted(properties.items()): + overridden = identity in selected_case["overrides"] + expected_bindings.append({ + "property": identity, + "binding": selected_case["overrides"][identity] if overridden else prop["base"], + "origin": {"CaseOverride": case_id} if overridden else "ModelBaseline", + }) +require(frozen["effective_bindings"] == expected_bindings, + "all frozen binding ASTs and base/override origins match captured context") +require(frozen["check_predicates"] == [ + {"check": identity, "predicate": check["predicate"]} + for identity, check in sorted(shared_checks.items()) +], "all frozen shared check ASTs match captured model") +require(frozen["definition_capture"] == { + "document_sha256": digest(portable_bytes), "imports": [], + "local_definitions": sorted(definitions), +}, "frozen definition inventory and exact document hash agree") +require(portable["packages"] == model["imports"] == model["definition_mounts"] == {}, + "local-only fixture makes no imported freeze claim") +for name in ("evaluate-baseline.json", "evaluate-degraded.json", "evaluate-unmeasured.json"): + request = read_json(ANALYSIS / name) + for key, pool in (("properties", properties), ("checks", shared_checks)): + ids = request["targets"][key] + require(len(ids) == len(set(ids)) and set(ids) <= set(pool), f"valid target identities: {name}/{key}") + +literal_summary = [] +expected_literals = { + "ten_to_300": (10 ** 300, 1), + "one_over_two_to_4095": (1, 2 ** 4095), + "negative_4096_bit_bound": (-(2 ** 4096 - 1), 1), +} +for packet in read_json(ANALYSIS / "r7-literal-boundaries.json"): + number = packet["expression"]["Number"] + n, d = int(number["numerator"]), int(number["denominator"]) + require((n, d) == expected_literals[packet["name"]], + f"independently constructed boundary value: {packet['name']}") + require(str(n) == number["numerator"] and str(d) == number["denominator"], + f"canonical exact wire components: {packet['name']}") + require(d > 0 and math.gcd(n, d) == 1, f"normalized rational: {packet['name']}") + require(abs(n).bit_length() <= 4096 and d.bit_length() <= 4096, + f"actual 4096-bit boundary: {packet['name']}") + require(max(len(str(abs(n))), len(str(d))) <= 1234, + f"1234-digit component boundary: {packet['name']}") + expected_source = str(n) if n >= 0 and d == 1 else f"ratio({n}, {d})" + require(packet["canonical_source"] == expected_source, + f"canonical literal spelling agrees with exact Number node: {packet['name']}") + literal_summary.append({"name": packet["name"], "numerator_bits": abs(n).bit_length(), + "denominator_bits": d.bit_length(), + "numerator_digits": len(str(abs(n))), "denominator_digits": len(str(d))}) + +evidence = read_json(LIBRARY / "EVIDENCE.json") +require(len(evidence["files"]) == evidence["fixture_count"] == 81, "81 final library fixture hash entries") +require(len({p["path"] for p in evidence["files"]}) == 81, "no duplicated library evidence paths") +for entry in evidence["files"]: + require(entry["path"].startswith("generated-final/"), "only final library evidence") + data = (LIBRARY / entry["path"]).read_bytes() + require(digest(data) == entry["sha256"] and len(data) == entry["bytes"], + f"exact final library fixture: {entry['path']}") +updated = tree(LIBRARY / "generated-final/03-updated") +require(len(updated) == 11, "11 complete updated library files") +for folder in ("expected-full-updated", "05-fresh-process-reopened"): + require(updated == tree(LIBRARY / "generated-final" / folder), f"complete byte equality: {folder}") +require(evidence["assertions_passed"] == 120 and evidence["run_exit_code"] == 0 + and evidence["fresh_process_reopen_exit_code"] == 0, + "author's recorded 120-assertion/fresh-process results (not rerun here)") + +# Mathematical work-count witness, NOT an implementation or execution of fn. +# f0(x)=x; fn(x)=f(n-1)(2*x)+f(n-1)(2*x+1); evaluate f30(0). +# Each non-leaf body has 11 AST nodes; the root call has 2 more nodes. +# At depth k all 2**k argument values differ; result sums 0..2**30-1. +n = 30 +work_witness = { + "definition_count": n + 1, + "stored_expression_nodes_including_root_call": 11 * n + 1 + 2, + "maximum_call_levels": n + 1, + "dynamic_definition_calls": 2 ** (n + 1) - 1, + "distinct_leaf_argument_values": 2 ** n, + "largest_leaf_argument_bits": (2 ** n - 1).bit_length(), + "exact_result_bits": ((2 ** n) * (2 ** n - 1) // 2).bit_length(), + "status": "closed-form count only; no billion-call evaluation executed", +} + +results = { + "scope": "Read-only fixture transport/identity/manifest/hash audit; no proposed parser, full type checker, evaluator or Studio execution.", + "python": sys.version, + "audit_source_sha256": digest(Path(__file__).read_bytes()), + "exit_code": 0, + "checks_passed": len(checks), + "checks": checks, + "frozen_input_hashes": frozen_hashes, + "baseline_fixture_hashes": {name: digest(data) for name, data in sorted(analysis_files.items())}, + "r7_literal_measurements": literal_summary, + "work_count_counterexample": work_witness, + "library_recorded_execution": {key: evidence[key] for key in + ("compiler", "source_sha256", "executable_sha256", "assertions_passed", + "run_exit_code", "fresh_process_reopen_exit_code")}, +} +(HERE / "audit-results.json").write_text(json.dumps(results, indent=2) + "\n", encoding="utf-8", newline="\n") +print(json.dumps({key: results[key] for key in ("checks_passed", "audit_source_sha256", "exit_code")}, indent=2)) diff --git a/harness/release-refined-contracts-review-20260911.md b/harness/release-refined-contracts-review-20260911.md new file mode 100644 index 00000000..e9a8926e --- /dev/null +++ b/harness/release-refined-contracts-review-20260911.md @@ -0,0 +1,101 @@ +# Independent review of the refined analysis and library contracts + +Codex-956atf `/root/semantics_critic`, 2026-09-11. Read-only review assigned by root; ownership announced in Gitea issue #1 comment 156, coordination reread through comment 162. Owned only this report and `harness/experiments/refined-contracts-review-20260911/`. The frozen proposals, earlier experiments/review, production, ledgers and Git state were not edited. No Cargo, compiler, native input or prototype evaluator was run in this review. Root retains ratification and integration. + +## Recommendation and blocking finding + +Retain the refined direction: required property-owned base bindings, explicit `ModelBaseline | Case(id)`, one level of case overrides, shared independently targeted checks, pure parameter-only calculations and complete immutable document freeze. Retain exact package/reference/base identity alongside verified same-origin typed-contract equivalence and a scoped expected-to-actual member/path/operation map. The paired reports now agree on these boundaries; the previous R1/R2/R3/R5/R6/R7 objections do not justify returning to complete bindings in every active case or strict whole-archive identity as quantity compatibility. + +**C1 is a P1 resource-policy omission to close before evaluator implementation:** small acyclic accepted calculations can demand billions of dynamic calls while satisfying the listed static limits. Define deterministic total-work accounting and exhaustion behavior. It does not require changing the metamodel or compatibility direction. **C2 is a P2 limitation of the finite library prototype's evidence:** its Budget evaluator omits limit-unit kind validation. The production analysis contract already requires that rejection. + +The reports establish a coherent next implementation contract, not production acceptance. In particular, neither the 120-assertion library prototype nor the 218-assertion context prototype executes the complete proposed UUID source/typed/frozen analysis examples. The nonempty imported freeze, complete operator/type profile, real source/history adapters and broad approximate engineering mathematics remain separate required work. + +## Exact inputs and independent readback + +| Frozen input | Independently verified SHA-256 | +| --- | --- | +| [Baseline contract](release-analysis-baseline-contract-20260911.md) | `9D294A3A8AD41EF4D07CAAC9FA410286F22EA5464400CCF01714F76E01BA5802` | +| [Library contract](release-library-compatibility-contract-20260911.md) | `30BBFD379EC542827A22D3B604534E5B6329CD913FF243747004E1AFA2983EE5` | +| [Final library prototype source](experiments/library-compatibility-20260911/main.rs) | `BC31BACF250F3711758717F18A3104696ED941C3C9B89817CAA6A96E6540062A` | +| [Final library evidence manifest](experiments/library-compatibility-20260911/EVIDENCE.json) | `1EB643F20645A83E88E644B1F2C42D554F35259FA2CFCEAFA0632BF47C2ED966` | + +The isolated [audit script](experiments/refined-contracts-review-20260911/audit_fixtures.py) completed **292 checks, exit 0**, using Python 3.12.14. Its [results](experiments/refined-contracts-review-20260911/audit-results.json) enumerate every check and all 11 baseline fixture hashes. It reads JSON with duplicate-key rejection, hashes bytes, compares typed fixture records/manifests and calculates literal boundaries and a closed-form work-count witness. It does not implement the proposed source parser, evaluator, type checker, package materializer or Studio admission. + +Command used: + +```powershell +& 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe' 'harness/experiments/refined-contracts-review-20260911/audit_fixtures.py' +``` + +Audit source SHA-256: `A449587294C83891803E52721F727FC61A6448137B0C47E7FAB6E41373846B60`. Result SHA-256: `BA51FA4A98569D17D86772A30C7D9F3E305CF1879E6081170ECDD5EE99ACC594`. The script writes only its own result file. + +Independent results: + +- The proposed active source is exactly 55 lines and 2,678 UTF-8 bytes. Its 17 explicit distinct UUIDs equal the typed project/element/definition/scoped-parameter identity set. All inspected local definition, subject, property and parameter/call references resolve in their intended fixture categories. +- The complete portable JSON embeds those exact source bytes. The decoded freeze capsule equals the complete portable file byte for byte, SHA-256 `6667773D90F83626F760B2FAA2BF7D57638947D95574E3FA3E80B64416F01497`. +- All four frozen effective binding ASTs and Base/Override origins equal the captured degraded context. The shared predicate, four-definition inventory and document hash match. Imports/packages are explicitly empty, appropriate to this local example. +- All **81** final library fixture hashes and byte counts match the recorded manifest. All **11** updated files equal both the complete expected document and separate-process reopened files. Only `generated-final/` was used; the superseded preliminary directory supplies no evidence here. +- The library author records 120 assertions and a separate fresh-process reopen, both exit 0; this review independently checked their persisted outputs, without rerunning that program. The earlier context experiment executed 218 assertions in its own limited integer-duration dialect. Counts are not counts of independent production tests. + +## C1 — P1: static bounds do not define a total evaluation-work bound + +**Locations:** baseline contract lines 100, 108, 120, 134 and 182; the retained numeric profile in `release-analysis-semantics-design-20260910.md:240`. The latter lists depth 128, 65,536 expression nodes per case/definition closure, list length 1,024 and call depth 32. It bounds numeric intermediates and promises NumericLimit on computational exhaustion, but does not define whether closure nodes count distinct stored AST nodes, expanded work, or a runtime fuel charge. + +**Minimal falsifier**, using only pure acyclic Number definitions and allowed exact operations: + +```text +f0(x) = x +fn(x) = f(n-1)(2*x) + f(n-1)(2*x + 1), for n = 1..30 +requested result = f30(0) +``` + +There are 31 definitions, **333 stored expression nodes including the root call**, and at most **31 call levels**. Each nonleaf body has 11 expression nodes; `f0` has one and the requested call adds two. Each body's AST depth is small. The expanded call graph has **2,147,483,647 dynamic definition invocations**. At depth k the arguments are the distinct integers 0 through `2^k-1`, so memoization keyed by definition and arguments does not collapse that work. Leaf inputs need only 30 bits and the exact result, the sum of 0 through `2^30-1`, needs 59 bits. No large literal, overflow, recursion, list or anonymous dimension is involved. The audit computes these counts algebraically; it does not execute billions of calls. + +Under the natural distinct-stored-node interpretation, this passes the named bounds but can occupy a worker for excessive time. If “nodes per closure” was meant to charge expanded work, the contract must state that rule and how it is counted without first expanding the graph. A bounded report trace alone does not bound evaluation. + +**Recommended resolution:** add a numeric-profile-versioned deterministic work budget covering dynamic expression visits, function invocations, list elements and required exact-number work, with a separate aggregate request ceiling. Charge work through the shared evaluator, including calls and all requested outputs. Define a stable target/operand traversal and logical accounting so cache warmth or implementation optimization does not change Value versus NumericLimit. A fresh request-local accounting context is required; a process-wide mutable counter is unsuitable. Exact integer bit/intermediate limits still apply independently. + +When fuel is exhausted, stop boundedly and return a located supported-operation failure/Unresolved outcome with NumericLimit and the causes actually collected. The strict rule to collect required-child causes must explicitly yield to terminal work exhaustion; it cannot require traversing all remaining siblings after the budget is gone. Do not present the resulting cause list as exhaustive. Admission can continue to accept a well-typed acyclic but expensive model; evaluation must fail predictably rather than hang or silently approximate. Choose the actual numeric ceiling from measured implementation costs before publishing the profile. + +**Acceptance falsifier:** the example must terminate at the documented logical work limit with the same outcome and location under cold/warm caches and source/REST/private frozen replay. A nearby bounded example must succeed. Target ordering/aggregation and strict missing-plus-failure cases must obey the documented exhaustion rule. Root concurred that this is an implementation-blocking resource-policy omission, not a reason to reject B or typed compatibility. + +## C2 — P2: the finite Budget probe does not validate its threshold's kind + +**Locations:** `harness/experiments/library-compatibility-20260911/main.rs:781`, `:820`, `:870` and `:908`. Admission only gathers the Budget's left/right record references. `evaluate_policy` validates declared/input/unit kind compatibility for the two addends, then calls `millis(limit)` without checking the limit unit against the Budget's declared kind. `millis` reads the first `millis=` scale field and multiplies the magnitude; it does not itself establish a kind. In contrast, `evaluate_check` at lines 862–865 explicitly checks both effective input and limit kinds. + +**Source-derived counterexample, not an executed negative test:** construct a valid initial fixture package with its existing Duration/Energy definitions and an additional row `def|joule|Unit|Neutral|millis=1|Energy`, using that archive's actual new digest. Keep both duration properties unchanged and set only the outside Budget limit to `2000@controls1:joule`. This finite dialect can parse that unit row. The Budget path checks the duration addends, computes 1,500, converts the threshold numerically to 2,000 and reports satisfied; it does not reach a Duration-versus-Energy comparison. The odd `millis=` label is the prototype's scalar representation, not a claim about physical joules. + +**Resolution:** do not cite the 120 assertions as full dimensional rejection coverage. The common production expression type checker must validate the comparison's threshold and every other operand, including unused/unselected checks; baseline contract lines 108 and 169 already require this. If this prototype is extended as evidence, add the same limit-unit kind check used by `evaluate_check` and explicit wrong-kind threshold cases. No frozen prototype was patched or rerun for this review. This finding does not invalidate its correct 1,500/1,650 ms examples or its same-origin compatibility comparison. + +## What the refinement resolves + +| Earlier concern | Concrete resolution checked | Evidence boundary | +| --- | --- | --- | +| R4: repeated fixed assumptions across complete active cases | Properties own required bases; an absent override uses the base expression in the requested context. Explicit Unbound masks it; clearing removes only the override key. Checks are shared and targets explicit. | The 218-assertion comparison supports this choice. The new property-owned-base representation and UUID grammar are complete paper fixtures, not that executable's grammar. | +| R6: unnamed intermediate operators were incomplete | The table closes N/L/P/A operations, anonymous addition/comparison, Number normalization of A(0), explicit AsKind, affine point/difference rules and flat list Sum with an explicit initial value. Every unlisted combination rejects. | Specification-level closure; no complete force/length/affine/list type checker has run here. | +| R7: accepted exact literals could not round-trip through source | The component limit is 1,234 decimal digits with an actual 4,096-bit test. Integer/ratio canonical spelling avoids mandatory decimal expansion. Signed ratio literals preserve Number versus UnaryNegate AST identity. | Independently checked exact packet values and spellings; source-to-AST-to-source execution and the separate unary-negation packet remain implementation gates. | +| R1: concise instance source omitted authoritative state | Pending request, prepared directory and accepted source are distinct. Accepted files contain exact packages, typed bases, original/current maps and lineage. Stored old inputs verify the old base. | Final 11-file readback is complete for the finite dialect; production UUID allocation, atomic directory acceptance, stale plans and source/history parity remain unexecuted. | +| R2: cosmetic package update broke arithmetic and outside typed consumers | Exact DefRefs/pins remain distinct. Same nominal origin plus verified canonical rooted contract permits compatible typed use. Public result identity is anchored to its declared output reference. Scoped maps preserve expected/actual path and allocation identity. | The finite update retains `900 D1.ms`, declares `D2.Duration`, preserves the right instance/outside records and yields 1,650 ms. It covers one Boolean item/interface path, not every real data consumer. | +| R3: subjectless case/check export disappeared | Both contracts require explicit properties/checks/whole-case selection, all selected binding dependencies, and explicit external roles. No inverse pull of every case using a property. | Final D1 bytes explicitly contain P/K/C selection and the outside Q/G context. Complete Studio selection/transition is future work. | +| R5: immutable OA data could not become SA data by relabeling | Exact pinned target-layer counterpart or a fresh editable local derivative; no global OA/SA identity equivalence or mutation of the original mount. Reverse refinement must meet the actual demanded contract. | Finite complete dictionary/ports/exchange records exercise the disposition. Actual transition, operation occurrence and history integration remain separate gates. | + +The R7 measurements are concrete: `10^300` has 301 digits/997 bits; `1/(2^4095)` has a 1,233-digit/4,096-bit denominator; `-(2^4096-1)` has a 1,234-digit/4,096-bit numerator. All are reduced and their source strings exactly represent the intended Number nodes. The ratio constructor makes the negative-literal distinction explicit without constant-folding arbitrary unary source. + +R6 also intentionally allows dimension erasure through multiplication/division: Energy/Torque yields Number, while their addition/comparison and direct `AsKind(Energy, TorqueValue)` reject. An explicit dimension-algebra expression can reconstruct an anonymous quantity and then assert a kind. This is consistent with the proposed operator table; it must not be advertised as a proof that authors cannot deliberately reinterpret quantity meaning. + +## Engineering usability and remaining bounded integration gates + +The active study contract no longer requires a first case, reusable calculation or a separate baseline identity to enter one property value. A small inline budget is legal. The complete 55-line example includes an optional reusable two-parameter calculation and threshold property to exercise identity and variation; those lines are not unavoidable overhead for every two-value budget. In the earlier 20-case experiment, B kept 62 binding rows versus D's 480, and changing one fixed assumption touched one B binding versus 20 D bindings. Factoring formulas also helped D, so only the repeated-input saving should be attributed to inheritance. D remains useful for independently authored studies; a complete private snapshot provides that independence for a frozen B study. + +The required context explanation is now concrete: inherited formulas read the selected case, and every result/provenance stamp names its captured model and context. In the complete local example, baseline gives 7/4 s and satisfied; degraded gives 9/4 s and violated; unmeasured is Missing; Clear restores 7/4 s. These are hand-derived fixture expectations. The frozen manifest correctly selects the 1,250 ms override and shared formula; transport equality alone does not prove that an implementation evaluates it correctly. + +Text-only library maintenance now has an explicit route to all required state. Generated version-controlled management files are acceptable as inspectable source state; the engine must own their legal transitions and cannot trust hand-edited historical claims. The final normalized update has 11 files/125 lines/5,708 bytes as reported. The 11-line creation request is a finite scenario macro dialect: `budget` supplies a 2,000 ms limit and `global_case` a 3,000 ms override from `main.rs:605` and `:638`; those values become explicit in accepted output. That count is not evidence of a general public authoring grammar or human comprehension. This is not the earlier missing-prototype defect: all reusable prototype records are now in the exact package bytes. + +Keep the following implementation gates concrete rather than repeating the broader design exercise: + +1. **One common evaluator/type checker:** run the complete UUID source/typed examples; prove AST/source/AST identity for the three exact boundary packets and distinct UnaryNegate; add the wrong-kind threshold and C1 exhaustion controls. Exercise `3 N * 4 m + 2 N * 7 m`, one outer Energy assertion and 26 J; anonymous compare/sum; named-kind mismatch; point subtraction, point-plus-difference and point-plus-point rejection. Approximate engineering operations require their own reproducible profile; exact rationals do not complete the release's full numeric scope. +2. **Imported freeze and two-project reuse:** use the final complete D1/D2 payloads as transport fixtures, then the real archive implementation. A second project must reopen solely from its declared files; selectively advance the first project's left instance while the second project and first project's right instance retain exact D1. Freeze with both D1 and D2, remove ambient files/cache, replay privately, corrupt one byte under an unchanged pin and require rejection. Later compatible content must never replace frozen bytes. The present library run creates two instances in Alpha; it is not an executed two-project library lifecycle or imported analysis freeze. +3. **Actual typed consumer coverage:** implement the class-specific rooted contract profile and feed the same proof through item/interface satisfaction, carried paths, exact operation allocations, message values and history/query projections. Existing `crates/oa-core/src/data.rs:129` and `:138` only apply local identity/ancestry; replacing those booleans alone is insufficient. The bounded path walker at `:159` also illustrates why finite type graphs and bounded work are distinct requirements. Test repeated paths, two operations carrying one item, inheritance and changed cardinality without rewriting outside identities. +4. **Ordinary source maintenance:** execute first property, small budget, twenty-case fixed assumption edit, Unbound/Clear, selective library update and exact undo/reopen using the actual source/document boundary. Verify no-op compile, alias-only rename, stale prepared input and missing/corrupt management bytes. Measure wrong-context edits and repair comprehension as well as source size. Current `Project` in `crates/oa-core/src/model.rs:1621` still lacks the proposed analysis/definition/import fields; current source/GUI successes do not establish these gates. + +The exact package contract remains authoritative for resolution, update facets, history and freeze. Compatibility is a derived, versioned typed-use proof. That distinction is sufficient to converge now; adding global bridges, mandatory baseline elements, implicit case selection or cross-origin dimensional coercions would add state without resolving C1 or the remaining concrete integration gates. diff --git a/harness/release-scenario-native-20260911.md b/harness/release-scenario-native-20260911.md index 00745c24..636ae421 100644 --- a/harness/release-scenario-native-20260911.md +++ b/harness/release-scenario-native-20260911.md @@ -144,16 +144,46 @@ exact reachable sources. The new occurrence UUID is `FFF7A28855033717DF8060EA9D459B8106FA54E1ACC79E14AAE661161C3B26F9`. The reusable definition and all existing lifelines retain their original IDs. +## OA root fragment and final reopen: exact history pass + +At the same minimum size, armed Add fragment, scrolled to the original root exit +and clicked its preceding root slot. The form explicitly displayed **OA A caller +→ before OA Root exit**. Entered **OA native alternative**, retained **ALT · +alternatives**, and supplied guards `ticket.priority > 2` and `ticket.priority <= +2`. Create added the fragment and its two empty operands in one transaction; +the saved model has68 objects. The retained form-offset/hidden-marker findings +above repeated and remain separate open usability work. + +Create/Save passed `check oa-fragment`, preserved as `oa-fragment-verified/`. +Ctrl+Z/Save passed `check oa-reuse` and exact `same` against the original reuse +snapshot; Ctrl+Y/Save passed `check oa-fragment` and exact `same` against the +original fragment snapshot. Separate `oa-fragment-undo/` and +`oa-fragment-redo/` snapshots retain both results. Fragment UUID is +`22f33339-fe1e-41c8-960f-a1ef9a9eb8c8`; operand UUIDs are +`68e9fb77-2f68-4cde-b0dd-16a7fb325c39` and +`30f9cf01-252b-44ab-90ac-1ca8aca99d8d`. Verified entry SHA256 is +`5DD1EFC998D11FE12325312267F0B9BFDBB974F4400CE5ADC3A99516B2B153CE`. + +Opened the same `oa/project.arcadia` through the actual native file picker, +then saved. The architecture page opened with68 objects. `check oa-fragment` +and exact `same` against the pre-reopen verified snapshot both passed. All three +physical fixture files (two reachable sources plus expected-baseline.json) +also matched byte-for-byte; `oa-reopened/` preserves the result. Every oracle +command exited0. Thus all four OA creation/history checkpoints and final reopen +pass their complete model/source/identity contract on this GUI. + ## Open native gates -OA fragment and all four SA creation checkpoints, -final reopen, blocked navigation/cancellation/recovery, detailed-list definition +All four SA creation checkpoints and SA final reopen, +blocked navigation/cancellation/recovery, detailed-list definition entry, minimum-size nested caller return, and B4 lifecycle rendering remain open. This report does not infer them from the passing root action. B4 is still a pure cfg(test) projection; independent Scene review identified lifetime bounds, branch-local activation clipping, incomplete-lane geometry and self-arrow endpoint work before production integration. -Continue from the saved OA reuse checkpoint in the run directory, following the exact +The app now displays the reopened OA project in Architecture; the saved OA result +is complete for the four-step contract. Continue with the separate SA baseline, +following the exact fixture procedure. Root retains native input; concurrent source builds use the separate target tree and must not overwrite the running staged executable.