ACES naming audit: 2020 live occurrences remain after the rename (full inventory)

[Brad-Edwards]

Method

Fresh clone of dev at c2000ad, 1724 tracked files, every file read and every
match bucketed so the totals reconcile exactly.

Matching uses a word-boundary–anchored pattern
((?<![A-Za-z0-9])(ACES|Aces|aces)([-_.][A-Za-z0-9]+)*) rather than a substring
search. This matters: a naive grep aces matches spaces, surfaces,
interfaces, namespaces, workspaces, traces, replaces, races, faces, places,
braces — which is a plausible way earlier passes both over- and under-counted.

Total: 4840 occurrences across 760 files.

What is already done

Worth stating so this doesn't get re-litigated:

• Every Python package under implementations/python/packages/ is raes_*.
• The aces namespace package (implementations/python/src/aces/) is gone,
  along with the aces._compat / aces.core.sdl transitional shims.
• Zero import aces… / from aces… import statements remain.
• Only two string-form module references survive, and both are artifact names
  rather than imports (covered in §5).

The Python import rename is complete. What remains is contract, artifact, and
prose surface.

Reconciliation

Bucket	Occurrences	Files
1. Published contract (contracts/schemas, profiles, concept-authority, schema-publication)	488	115
2. Contract fixtures (contracts/fixtures)	250	106
3. Implementation code + tests	858	174
4. Specs (specs/)	72	23
5. Docs prose (docs/, excl. records)	55	16
6. Examples	53	20
7. Tools	139	21
8. Agent / CI config	87	17
9. Repo root	18	10
Live subtotal	2020	502
10. Historical records	2820	258
Total	4840	760

§1 — The published schema namespace is still aces.dev (highest impact)

Every $id in the repo is rooted at https://aces.dev/schemas. All 72 of
them. There are no exceptions.

72  "$id": "https://aces.dev/schemas/..."
36      .../schemas/semantic-invariants/...

This is the single largest item in the audit and the one with the widest blast
radius, because $id values are the identity of the published contract — any
consumer that resolves, caches, or pins a schema URL is bound to this namespace.

Decide explicitly whether aces.dev is being retired. If it is, the cutover
needs a version and probably a redirect; if it is not, that should be written
down, because right now it reads as an oversight rather than a decision.

§2 — Contract identifier strings

Identifier values in const / enum / title, i.e. matched literally by
consumers:

Identifier	Occurrences	Notes
aces-invariants	149	82 in published contract
aces-reference-processor	114	81 in fixtures
aces-semantic-invariants-v1	83	also a filename, see §4
aces-sdl-semantic	45
aces-semantic-profile	39
aces-variable-reference	35
aces-behavioral-relations	29
aces-sdl-instantiated-snapshot	15
aces-client-verified, aces-client-identity	30
aces-finite-domain-satisfiability-v1	19
aces-reusable-asset-trust-policy	8	consumed downstream by env-packs ADR 0010
aces-random-stream-v1, aces-exploit-path-analysis-v1, aces-plane, aces-validation, aces-document-phase, aces-realization-dimension, aces-structural-validation, aces-semantic-validation, aces-evidence-backed-validation, aces-trust, aces-inventory, aces-participant-semantics, aces-z3-finite-domain, aces-attack-graph, aces-exploit-path-{query,witness,invalid,unsupported}, aces-monotonic-attack-transition, aces-deterministic-attack-graph-search, aces-sdl-snapshot-attack-binding, aces-satisfiability-{witness,unsupported}, aces-unsatisfiable-core, aces-finite-domain-{constraints,theory}, aces-sdl-authoring-translation, aces-test	remainder

contracts/schemas/exploit-path-analysis/exploit-path-analysis-evidence-v1.json
and contracts/schemas/satisfiability/scenario-satisfiability-evidence-v1.json
are the densest single files here.

§3 — Wire field names and model class names

JSON object keys — renaming these is a payload-breaking change, distinct
from the identifier strings above:

• aces_boundaries — contracts/schemas/provenance/sdl-lineage-ledger-v1.json
• aces_native — same
• aces_relative_to_source — same
• aces_address — contracts/schemas/exploit-path-analysis/…

Pydantic model names in
contracts/schemas/profiles/aces-semantic-invariants-v1.json:

• AcesSemanticInvariantEntryModel
• AcesSemanticInvariantInputModel
• AcesSemanticInvariantProfileReferenceModel

§4 — Files and paths still named aces*

• contracts/schemas/profiles/aces-semantic-invariants-v1.json
• contracts/schema-publication/entries/aces-semantic-invariants-v1.json
• docs/decisions/adrs/adr-012-shared-concept-authority-and-aces-extension-discipline.md
• docs/research/specification-coverage/bundles/aces-standardized-specification-coverage-{8bf12ee,9347f64}-v1.json

The first two are published-contract paths, so renaming them is a contract move,
not a file move.

§5 — Runtime artifact names (user-visible, not tracked files)

These are names the tooling writes or reads at runtime, so they never show
up in a file listing and are easy to miss:

Artifact	Where
aces.lock.json — module lockfile	packages/raes/module_registry.py:37 (LOCKFILE_NAME)
aces-trust.yaml — trust policy file consumers author	15 refs
OCI container labels aces.workspace, aces.address	packages/raes_reference_backend/drivers/oci.py:52
libvirt domain naming aces.libvirt.scenario*	15 refs, incl. aces.libvirt.scenario-evidence-run
aces-sdl-policy.out, aces-sdl-gc.out	CI output artifacts

§6 — Runtime event topic namespace

The whole event vocabulary is still aces.*:

aces.participant_runtime.{lifecycle,outcome_report,observation,shared_state,joint_action}
aces.outcome.interpreted        aces.observation.emitted
aces.lifecycle.operation_state.completed
aces.operation_state.running    aces.shared_state.commit
aces.challenge                  aces.cross

§7 — Environment variables

• ACES_REQUIREMENT_UID (21)
• ACES_REAL_LIBVIRT_URI (9)
• ACES_RELATIVE_TO_SOURCE (2)
• ACES_NATIVE (2)

§8 — Code identifiers in implementation

aces_invariant* (81), aces_uuid (24), aces_revision (23), aces_level,
aces_semantic_invariant_annotations (12), plus 213 bare aces tokens in
docstrings and comments across 174 files. Densest: raes_contracts/contracts/schema_constraints.py
(39), raes_contracts/contracts/schema_invariants.py (24),
raes_backend_libvirt/guest_appliance.py (23), and the runtime test modules
(test_libvirt_backend_driver.py 35, test_runtime_contracts.py 34,
test_runtime_control_plane_api.py 30, test_runtime_planner.py 23).

§9 — Specs, docs, examples, tools, config

• specs/ — 72 across 23 files; specs/concept-authority/* (4 files) and
  specs/formal/* carry most of it, including the identifier aces-extension-discipline.md.
• tools/ — 139 across 21 files; tools/real-daemon/libvirt_smoke.py (38) is
  the densest, plus tools/policy/* and the check_*.py gate scripts.
• agent/CI config — 87 across 17 files, incl. .github/workflows/ci.yml,
  .github/dependabot.yml, .github/PULL_REQUEST_TEMPLATE.md, .gc/plan-rules.md,
  and the .claude/ + .codex-skills/ skill definitions (already named
  raes-*, but ACES survives in their bodies — 60 occurrences).
• repo root — 18 across README.md, AGENTS.md, CONTRIBUTING.md,
  noxfile.py, sonar-project.properties, .ground-control.yaml, .mcp.json,
  .gitleaks.toml, implementations/python/pyproject.toml, contracts/README.md.
• examples/ — 53 across 20 files, incl. aces-library-pattern,
  aces-library-template.
• docs/ prose — 55 across 16 files, mostly the aces-inventory /
  aces_inventory.py capture tooling.

§10 — Historical records (2820, 58% of total)

File / area	Occurrences
docs/decisions/ (ADRs + preflights)	1509
docs/research/	627
contracts/provenance/sdl-lineage-ledger-v1.json	346
CHANGELOG.md	297
docs/migration/, docs/lessons/	41

These are dated records of decisions and derivation. My recommendation is to
leave them as written and let the names be historically accurate — the lineage
ledger in particular is a provenance artifact whose whole value is that it was
not edited after the fact. Flagging rather than deciding, since the instruction
was to find everything.

Suggested order

1. Decide aces.dev (§1) — everything else in the contract layer depends on it.
2. Decide frozen-vs-rename for identifiers (§2) and wire keys (§3) together;
   they share consumers.
3. §5–§7 (artifacts, events, env vars) — user-visible, independently shippable.
4. §8–§9 — mechanical, no consumer impact.
5. §10 — decide once, apply never or apply wholesale.

Downstream tracking: OpenRAE/env-packs#139, #907.

Requirements

• GOV-944

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 908-aces-naming-audit, 2026-07-26T14:30:08.496Z.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #908). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #908). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Implementation plan

Issue #908 is requirement-free. ADR-093 remains authoritative; this change completes the audit classification and performs only the non-breaking internal cleanup authorized by the architecture preflight.

1. Preserve docs/decisions/issue-908-aces-naming-audit-preflight.md as the binding classification record and update docs/migration/raes-rename.md so every ambiguous audit bucket has an explicit owner and disposition. https://aces.dev/schemas/..., contract/profile/wire identifiers, apparatus identities, module and evidence artifacts, auth headers, environment/workflow keys, host ownership names, participant wire vocabularies, and historical evidence remain unchanged.
2. Use TDD for the safe implementation slice. First update the focused libvirt ownership test to require a RAES-named private UUID helper and assert the previously emitted UUID for provision.node.web remains exactly 049f04cb-0e5b-50b5-935e-acee9fe0cce9; confirm the test fails because the new helper does not yet exist.
3. Rename only private/internal implementation names that are project branding rather than governed identities: _aces_uuid and its private namespace constant become RAES-named while retaining the fixed UUID namespace value, and the local aces_sets variable becomes raes_sets. Update internal imports/callers and the test name. Do not alter _WORKSPACE_PREFIX, provider prefixes, OCI/libvirt labels, guest paths, persisted ownership markers, schema/profile helpers whose names describe retained x-aces-* contracts, or any emitted value.
4. Run the focused libvirt driver tests and cross-backend corpus tests, then verify the exact emitted UUID and ownership/conflict behavior remain unchanged. Run git diff --check and inspect the diff for accidental literal/protocol changes.
5. Run the required repository gates on the final tree: ACES_REQUIREMENT_UID=GOV-866 implementations/python/.venv/bin/python tools/check_repo_policy.py, ACES_REQUIREMENT_UID=GOV-866 implementations/python/.venv/bin/python tools/check_requirement_governance.py, ACES_REQUIREMENT_UID=GOV-866 implementations/python/.venv/bin/python tools/verify_all.py, and the configured nox/policy completion gate. GOV-866 is the existing ACTIVE RAES identity constraint used only to satisfy the repository-required environment binding; no new requirement or status transition is introduced by this requirement-free issue.

Security: preserve fail-closed ownership comparison, fixed UUID identity, fixed-argv execution, auth headers, redaction, request-size handling, and secret boundaries. No secret, URI value, environment dump, raw payload, host output, or credential is read or recorded.

Maintainability: reuse the existing libvirt UUID helper, ownership checks, provider_resource_name(), schema publication and bundle gates, lifecycle policy, and canonical nox graph. No alias registry, compatibility service, duplicate validator, or rename-specific exception/log/store is added.

Extensibility: future naming changes remain parameterized by surface class and version/lineage at each owning boundary. This change does not create a global ACES-to-RAES substitution seam.

Whole-repo view: the implementation considers published contracts and fixtures, generated-schema parity, module/config loading, processor/backend manifests, evidence artifacts, participant DTOs, runtime authentication/persistence, OCI/libvirt ownership, workflow keys, immutable ADR/research/provenance records, and downstream migration guidance; only the documented private-symbol slice changes executable code.

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 908-gov-866-naming-audit, 2026-07-26T14:59:09.589Z.

[Brad-Edwards]

gc_codex_review — cycle 1 of 1 (pre-push) on issue #908 (branch 908-gov-866-naming-audit)
Diff mode: inline — the complete diff was supplied in one prompt

Core review

Verdict: ship

This change is shaped correctly: it establishes an explicit migration boundary between internal naming cleanup and externally persistent identities, then applies that distinction narrowly by renaming a private libvirt helper and namespace constant while preserving the fixed UUID namespace and routing every ownership, discovery, teardown, XML, and guest-correlation path through the same canonical derivation seam. The added compatibility assertion pins the externally consequential UUID value, so the refactor cannot silently orphan existing resources. The documentation leaves future contract, protocol, and host-identity migrations at their owning versioned boundaries rather than introducing a global alias layer, and it does not foreclose lineage-aware namespace evolution.

No blocking findings.

Security review

Verdict: ship

This is shaped correctly: the change classifies naming surfaces at their owning contract and security boundaries, then limits implementation to private-symbol renames while preserving the fixed libvirt UUID namespace and every ownership-check call path. The key security seam—deterministic UUID-based proof before convergence or teardown—remains intact and is pinned by a compatibility assertion, so existing resources are neither orphaned nor misclassified as foreign. No exploitable security control is weakened and the design leaves future identifier migrations to their versioned owners.

No blocking findings.

[Brad-Edwards]

gc_codex_review pre-push cycle 1 of 1 complete for issue #908 on branch '908-gov-866-naming-audit'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

[Brad-Edwards]

Review decision record — codex cycle 1 (issue #908)

Reviewer: codex
Cycle: 1

Architectural read:

Core reviewer: This change is shaped correctly: it establishes an explicit migration boundary between internal naming cleanup and externally persistent identities, then applies that distinction narrowly by renaming a private libvirt helper and namespace constant while preserving the fixed UUID namespace and routing every ownership, discovery, teardown, XML, and guest-correlation path through the same canonical derivation seam. The added compatibility assertion pins the externally consequential UUID value, so the refactor cannot silently orphan existing resources. The documentation leaves future contract, protocol, and host-identity migrations at their owning versioned boundaries rather than introducing a global alias layer, and it does not foreclose lineage-aware namespace evolution.

Security reviewer: This is shaped correctly: the change classifies naming surfaces at their owning contract and security boundaries, then limits implementation to private-symbol renames while preserving the fixed libvirt UUID namespace and every ownership-check call path. The key security seam—deterministic UUID-based proof before convergence or teardown—remains intact and is pinned by a compatibility assertion, so existing resources are neither orphaned nor misclassified as foreign. No exploitable security control is weakened and the design leaves future identifier migrations to their versioned owners.

Blocking findings: 0 (clean run)

[Brad-Edwards]

gc_test_quality_review cycle 1 of 1 — issue #908

Reviewer: test-quality (claude-sonnet-5 via gc_test_quality_review)
Branch: 908-gov-866-naming-audit
Cycle: 1 / 1
Findings: 0 (clean run)

[Brad-Edwards]

gc_test_quality_review cycle 1 of 1 complete for issue #908 on branch '908-gov-866-naming-audit'. Posted by the MCP server to enforce the gc_test_quality_review hard-cap-1 contract (issue #884 follow-up, default lowered in #906). Do not edit or delete — used by the next gc_test_quality_review invocation to count cycles.

[Brad-Edwards]

Review decision record — test-quality cycle 1 (issue #908)

Reviewer: test-quality
Cycle: 1

Architectural read:

This diff is a pure mechanical identifier rename inside an already-reviewed test file (aces_backend_libvirt → raes_backend_libvirt module paths, _aces_uuid → _raes_uuid function name, one test renamed to match), part of the repo-wide GOV-866 naming audit. It introduces zero new test logic or coverage change except one added line pinning the exact computed UUID value (_raes_uuid("provision.node.web") == "049f04cb-0e5b-50b5-935e-acee9fe0cce9"), which is a net-positive regression guard against the rename accidentally altering the fixed UUID namespace literal that convergence/ownership safety depends on. The existing suite already exercises real assertions on fake-object state (destroyed/undefined/created), real filesystem permission bits via tmp_path, and negative/ownership-conflict paths — none of that character changed by this diff. This is shaped correctly for what it is: a safe rename with a bonus pinning assertion.

Blocking findings: 0 (clean run)

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at 94fd223a5e14e38ddb5a0d14b0f7623575cccd88
• Outcome: already_current
• Published feature head: 816e03f13dfd3c09ea72af659ceb7d8bfa623ea0
• Verified tree: 557bf863bf07f89ebae0c1e0923fda56797fa1eb

[Brad-Edwards]

Execution obligation OBL-908-SONAR-1 — Opened

Category: workflow
Observed state: The repository and all non-Sonar CI checks are green, but SonarCloud analysis processing timed out after upload.
Impact: PR #915 cannot reach the required Sonar terminal gate while SonarCloud has not processed the uploaded report.
Current obligation: Obtain a terminal SonarCloud quality-gate result for PR #915 and repair any findings if the completed analysis reports them.

Evidence

• GitHub Actions run 30207590901 sonar job 89809298086 uploaded analysis report for commit 816e03f.
• Sonar scanner waited 600 seconds and failed with 'Quality Gate check timeout exceeded'.
• Public SonarCloud PR API returned quality status NONE with zero issues and zero hotspots after the timeout.