diff --git a/compiler/README.md b/compiler/README.md index 07c91a3..453ad1b 100644 --- a/compiler/README.md +++ b/compiler/README.md @@ -41,15 +41,17 @@ cargo test --manifest-path compiler/Cargo.toml -p orangec --test s3a_conformance ## D-004 pre-epoch decision laboratory The `orange-compiler` integration tests contain a standard-library-only, -non-product D-004 laboratory. It strictly parses and canonicalizes an -input-only `draft_unfrozen` packet, binds the conditional suite and accepted -S3a baseline by SHA-256, preserves the 5-candidate by 5-case matrix, 14 required -relationships, 10 hard gates, and 26 mutations named explicitly by the suite, -binds a closed catalog with five positive and 26 named-mutation subjects plus -42 unreviewed domain-level structural proposals and their corresponding -candidate-neutral byte-materialized subjects, authenticates five unreviewed -structural candidate graph proposals and 70 unresolved SR mapping rows, and -prepares one deterministic balanced 25-slot identity plan: +non-product D-004 laboratory. Its v0.5 parser still authenticates the immutable +`draft_unfrozen` review subject byte for byte. A separate +`d004-v0.6-reviewed-protocol` layer records the `solo-reviewed` D004-PRE-01 +disposition at exact review-subject revision +`7d09a27369649855ce987c76315271b0d34a20ef`. It preserves the 5-candidate by +5-case matrix, 14 required relationships, 10 hard gates, 26 named mutations, +73 candidate-neutral suite subjects, and five-graph/70-row mapping catalog: + +The acceptance covers those immutable review subjects. The resulting v0.6 +implementation closure remains `provisional_pending_exact_merged_revision` +until the validated overlay is available at an exact merged revision. ```sh cargo test --manifest-path compiler/Cargo.toml -p orange-compiler \ @@ -60,18 +62,22 @@ The proposal manifest names 14 missing-edge, 13 identity-substitution, and five each of ambiguity, unsupported-behavior, and domain-exhaustion proposals. The three added identity targets bind the model, dependency manifest, and positive subject. The cross-cutting and case-subject catalogs byte-materialize exactly -73 suite-only subjects under `draft_unreviewed_input_only`. Closed parsers -authenticate the ordered proposal and named-mutation joins, case baselines, and -per-subject identities, then bounded structural integrity oracles check the -fixed models in memory. Those checks are not candidate executions and create no -candidate observation, result, evidence, verdict, or capability credit. All -five class sufficiency reviews and freeze blockers remain unresolved. Candidate-adapter -failure cannot satisfy an unsupported subject, domain exhaustion verifies no -replay ceiling, and replay repetitions remain unassigned. The separate -`d004-v0.5-candidate-mappings.json` catalog uses schema -`d004-candidate-mapping-catalog-v0.1`; its five graphs and 70 SR rows are -authenticated input-only hypotheses, not reviewed mapping conformance. The -laboratory also checks a closed, in-memory future-schema descriptor that +73 suite-only subjects under the immutable v0.5 +`draft_unreviewed_input_only` snapshot. Closed parsers authenticate the ordered +proposal and named-mutation joins, case baselines, and per-subject identities, +then bounded structural integrity oracles check the fixed models in memory. +Those checks are not candidate executions and create no candidate observation, +result, evidence, verdict, or capability credit. + +D004-PRE-01 finds the five fixture classes reviewed and sufficient only for +bounded suite coverage: 5 ambiguity, 14 missing-edge, 13 identity-substitution, +5 unsupported, and 5 resource-exhaustion subjects. It reviews the five +candidate graphs and 70 SR rows only as symmetric, falsifiable test hypotheses; +their semantic status remains unaccepted and their conformance remains +unresolved until execution. Candidate-adapter failure cannot satisfy an +unsupported subject, and domain exhaustion verifies no replay ceiling. + +The laboratory also checks a closed, in-memory future-schema descriptor that enumerates all 31 top-level future case-record fields, their nested shapes, and their cross-field invariants. It binds both authenticated subject catalogs into an exact 73-row observation oracle and the candidate-mapping catalog into five @@ -79,18 +85,21 @@ exact graph/map identity rows, so a future result cannot supply or broaden its own allowed outcomes or substitute another mapping. The descriptor defines a 10-field scheduled-slot preimage contract and fail-closed verdict conditions, including checked resource bounds and SR dependency joins. The 25-slot identity -plan exists, but no concrete slot preimage or digest is available until the -epoch, packet identity, and replay-plan identity are frozen. +plan is expanded in repetition-major order to exactly three planned executions +per unit, or 75 reviewed schedule rows. Each repetition requires a fresh empty +candidate-specific cache and equality of the specified deterministic fields. +No concrete scheduled-execution digest exists until the epoch, packet identity, +and executable manifests are frozen. + This synthetic contract accepts no populated records, launches no process or -adapter, and persists nothing. It approves no schema, assigns no replay -cardinality, and neither ratifies the separate mapping proposals nor supplies -an adapter. The epoch remains null and unfrozen, owner protocol review remains -`none`, execution remains 0/25 with evidence `none`, and selection and -conclusion remain null. No adapter, execution, evidence, review, freeze, -selection, or readiness credit follows from mapping authentication. D-003 -acceptance does not accept D-004, alter compiler behavior, authorize S3b, or -grant roadmap or version 1.0.0 readiness credit; both `roadmap_gate_credit` and -`readiness_credit` remain `none`. +adapter, and persists nothing. Candidate adapters, closed payload schemas, +exact executable and dependency manifests, enforcing isolation, result parsers, +an execution-subject revision, and a separate owner freeze record remain +absent. The epoch is null and unfrozen, execution is unauthorized, and evidence +remains zero completed of 25 required candidate-case units and 0 of 75 result +records. Selection and conclusion remain null. D-004 remains proposed, S3b +remains blocked, both `roadmap_gate_credit` and `readiness_credit` remain +`none`, and Orange's 3-of-10 (30%) binary gate-closure score is unchanged. ## D-005 decision laboratory @@ -714,17 +723,17 @@ disabled modules do not qualify. This is an exact evidence map, not a claim that a named test exhausts its rule. Policy validation binds the production constants to the specification, while injected-limit unit tests exercise exact semantic-event, Core-node, and evaluation accounting and fail-closed behavior -at reachable boundaries. This indexed mapping does not complete S3 and adds no source -construct, semantic rule, canonical Core identity, proof, target, claim, or S3b -authority. +at reachable boundaries. This indexed mapping does not complete S3 and adds no +source construct, semantic rule, canonical Core identity, proof, target, claim, +or S3b authority. ## Layout - `crates/orange-compiler`: reusable source, span, diagnostic, edition, lexer, syntax-tree, parser, semantic, Core, and evaluator library; -- `crates/orange-compiler/tests/d004_decision_suite.rs`: input-only D-004 - pre-epoch packet, subject-catalog, balanced-plan, and future result-contract - checks; +- `crates/orange-compiler/tests/d004_decision_suite.rs`: historical input-only + and v0.6 reviewed-not-executable D-004 protocol, subject-catalog, exact + 75-record replay-plan, and future result-contract checks; - `crates/orange-compiler/tests/d005_decision_suite.rs`: draft-only D-005 packet, transport-identity, and synthetic capture-integrity checks; - `crates/orange-compiler/tests/d006_decision_suite.rs`: input-only D-006 diff --git a/compiler/crates/orange-compiler/tests/d004_decision_suite.rs b/compiler/crates/orange-compiler/tests/d004_decision_suite.rs index fc14e0b..2cbb5b8 100644 --- a/compiler/crates/orange-compiler/tests/d004_decision_suite.rs +++ b/compiler/crates/orange-compiler/tests/d004_decision_suite.rs @@ -18,8 +18,14 @@ mod fixtures; mod packet; #[path = "d004_support/result_contract.rs"] mod result_contract; +#[path = "d004_support/reviewed_protocol.rs"] +mod reviewed_protocol; +#[path = "d004_support/reviewed_result_contract.rs"] +mod reviewed_result_contract; #[path = "d004_support/runner.rs"] mod runner; +#[path = "d004_support/schedule.rs"] +mod schedule; #[path = "d005_support/sha256.rs"] mod sha256; #[path = "d005_support/strict_json.rs"] @@ -45,7 +51,7 @@ use cases::MUTATIONS; use domain::{ BUDGETS, CANDIDATES, CASE_SCOPED_CROSS_CUTTING_PROPOSALS, CASE_VERDICTS, CASES, CROSS_CUTTING_PROPOSAL_CLASS_STATUSES, CROSS_CUTTING_PROPOSAL_COUNT, - CROSS_CUTTING_PROPOSAL_NONCLAIMS, DOMAIN_OBSERVATION_STATES, HARD_GATES, + CROSS_CUTTING_PROPOSAL_NONCLAIMS, CandidateId, CaseId, DOMAIN_OBSERVATION_STATES, HARD_GATES, IDENTITY_SUBSTITUTION_PROPOSALS, INPUT_BINDINGS, InputBindingId, MISSING_EDGE_PROPOSAL_IDS, NONCLAIMS, PROTOCOL_GAPS, RELATIONSHIPS, REQUIRED_CANDIDATE_CASES, SOURCE_ROLES, UNRESOLVED_CROSS_CUTTING_FIXTURE_CLASSES, @@ -76,7 +82,25 @@ use result_contract::{ SR_APPLICABILITY_STATES, SR_CONFORMANCE_STATES, SUBJECT_ORACLE_FIELDS, canonical_draft_result_contract_descriptor_bytes, parse_draft_result_contract_descriptor, }; +use reviewed_protocol::{ + AUTHORIZATION_SUBJECT_REVISION, DETERMINISTIC_EQUALITY_FIELDS, EPOCH_FREEZE_BLOCKERS, + EXECUTION_IDENTITY_PREIMAGE_FIELDS, FORBIDDEN_AGGREGATION, + OWNER_RECORD_CANONICAL_IDENTITY_SHA256, OWNER_RECORD_RAW_SHA256, + REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256, REVIEWED_PROTOCOL_RAW_SHA256, + REVIEWED_REPLAY_PLAN_CANONICAL_IDENTITY_SHA256, REVIEWED_REPLAY_PLAN_RAW_SHA256, + ReviewedProtocolErrorKind, VARIABLE_RESOURCE_FIELDS, parse_owner_protocol_record, + parse_reviewed_protocol, parse_reviewed_replay_plan, +}; +use reviewed_result_contract::{ + RepetitionClosureErrorKind, RepetitionRecordSummary, ReviewedResultContractErrorKind, + canonical_reviewed_result_contract_descriptor_bytes, parse_reviewed_result_contract_descriptor, + validate_repetition_closure, +}; use runner::{ReplayError, ReplayInputs}; +use schedule::{ + REQUIRED_EXECUTION_RECORDS, REQUIRED_REPETITIONS_PER_SLOT, latin_base_schedule, + repetition_major_execution_schedule, +}; use strict_json::{JsonErrorKind, JsonValue}; const CHECKED_IN_PACKET: &[u8] = @@ -93,6 +117,15 @@ const CASE_SUBJECTS: &[u8] = include_bytes!("../../../../research/decisions/D-004/d004-v0.4-case-subjects.json"); const CANDIDATE_MAPPINGS: &[u8] = include_bytes!("../../../../research/decisions/D-004/d004-v0.5-candidate-mappings.json"); +const D004_PRE_01_OWNER_RECORD: &[u8] = include_bytes!( + "../../../../research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json" +); +const REVIEWED_PROTOCOL: &[u8] = include_bytes!( + "../../../../research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json" +); +const REVIEWED_REPLAY_PLAN: &[u8] = include_bytes!( + "../../../../research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json" +); const DECISION_SUITE: &[u8] = include_bytes!("../../../../docs/SEMANTIC_STRATA_DECISION_SUITE.md"); const PRODUCT_FORM_DECISION_PACKET: &[u8] = include_bytes!("../../../../docs/PRODUCT_FORM_DECISION_PACKET.md"); @@ -182,6 +215,20 @@ fn checked_in_catalogs() -> (CaseSubjectCatalog, FixtureCatalog, CandidateMappin ) } +fn checked_in_reviewed_protocol() -> ( + reviewed_protocol::OwnerProtocolRecord, + reviewed_protocol::ReviewedProtocol, + reviewed_protocol::ReviewedReplayPlan, +) { + let owner = parse_owner_protocol_record(D004_PRE_01_OWNER_RECORD) + .expect("checked-in D004-PRE-01 owner record"); + let protocol = + parse_reviewed_protocol(REVIEWED_PROTOCOL, &owner).expect("checked-in reviewed protocol"); + let plan = parse_reviewed_replay_plan(REVIEWED_REPLAY_PLAN, &owner, &protocol) + .expect("checked-in reviewed replay plan"); + (owner, protocol, plan) +} + fn canonical_json_file_bytes(value: &JsonValue) -> Vec { let mut bytes = strict_json::canonical_bytes(value); bytes.push(b'\n'); @@ -2755,39 +2802,522 @@ fn replay_schedule_is_balanced_latin_deterministic_and_still_zero_of_25() { } #[test] -fn d004_research_tree_is_exactly_seven_input_only_files() { +fn reviewed_protocol_artifacts_are_exact_canonical_bound_and_still_pre_epoch() { + let (owner, protocol, plan) = checked_in_reviewed_protocol(); + + assert_eq!( + owner.canonical_bytes(), + D004_PRE_01_OWNER_RECORD + .strip_suffix(b"\n") + .expect("owner transport LF") + ); + assert_eq!(owner.digest_hex(), OWNER_RECORD_CANONICAL_IDENTITY_SHA256); + assert_eq!( + protocol.canonical_bytes(), + REVIEWED_PROTOCOL + .strip_suffix(b"\n") + .expect("protocol transport LF") + ); + assert_eq!( + protocol.digest_hex(), + REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256 + ); + assert_eq!( + plan.canonical_bytes(), + REVIEWED_REPLAY_PLAN + .strip_suffix(b"\n") + .expect("replay transport LF") + ); + assert_eq!( + plan.digest_hex(), + REVIEWED_REPLAY_PLAN_CANONICAL_IDENTITY_SHA256 + ); + assert!(!protocol.execution_authorized()); + assert_eq!(protocol.replay_repetitions(), REQUIRED_REPETITIONS_PER_SLOT); + + let owner_root = json_object(owner.value()); + assert_eq!( + owner_root + .get("authorization_subject_revision") + .and_then(JsonValue::as_str), + Some(AUTHORIZATION_SUBJECT_REVISION) + ); + let authority = json_object(owner_root.get("authority").expect("owner authority")); + assert_eq!( + authority.get("review_label").and_then(JsonValue::as_str), + Some("solo-reviewed") + ); + assert_eq!( + authority + .get("independent_review") + .and_then(JsonValue::as_str), + Some("unavailable") + ); + + let protocol_root = json_object(protocol.value()); + assert_eq!(protocol_root.get("epoch"), Some(&JsonValue::Null)); + assert_eq!( + protocol_root + .get("epoch_status") + .and_then(JsonValue::as_str), + Some("unfrozen") + ); + assert_eq!( + protocol_root.get("execution_authorized"), + Some(&JsonValue::Bool(false)) + ); + assert!(json_array(protocol_root.get("protocol_gaps").expect("closed gaps")).is_empty()); + assert_eq!( + json_array( + protocol_root + .get("epoch_freeze_blockers") + .expect("freeze blockers") + ), + &EPOCH_FREEZE_BLOCKERS.map(|value| JsonValue::String(value.to_owned())) + ); + let execution = json_object(protocol_root.get("execution").expect("execution state")); + assert_eq!( + execution + .get("required_candidate_cases") + .and_then(JsonValue::as_integer), + Some(25) + ); + assert_eq!( + execution + .get("required_execution_records") + .and_then(JsonValue::as_integer), + Some(75) + ); + assert_eq!( + execution + .get("result_record_count") + .and_then(JsonValue::as_integer), + Some(0) + ); + + let bindings = json_object(protocol_root.get("bindings").expect("protocol bindings")); + let owner_binding = json_object(bindings.get("owner_record").expect("owner binding")); + assert_eq!( + owner_binding.get("raw_sha256").and_then(JsonValue::as_str), + Some(OWNER_RECORD_RAW_SHA256) + ); + assert_eq!( + owner_binding + .get("canonical_sha256") + .and_then(JsonValue::as_str), + Some(OWNER_RECORD_CANONICAL_IDENTITY_SHA256) + ); + let plan_root = json_object(plan.value()); + let protocol_binding = json_object(plan_root.get("protocol").expect("protocol binding")); + assert_eq!( + protocol_binding + .get("raw_sha256") + .and_then(JsonValue::as_str), + Some(REVIEWED_PROTOCOL_RAW_SHA256) + ); + assert_eq!( + protocol_binding + .get("canonical_sha256") + .and_then(JsonValue::as_str), + Some(REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256) + ); + + let replay = json_object( + protocol_root + .get("replay_contract") + .expect("replay contract"), + ); + assert_eq!( + json_array( + replay + .get("execution_identity_preimage_fields") + .expect("execution identity preimage") + ), + &EXECUTION_IDENTITY_PREIMAGE_FIELDS.map(|value| JsonValue::String(value.to_owned())) + ); + let mut expected_equality = DETERMINISTIC_EQUALITY_FIELDS + .map(|value| JsonValue::String(value.to_owned())) + .to_vec(); + expected_equality.push(JsonValue::String( + "measured_resources_stdout_bytes_and_stderr_bytes".to_owned(), + )); + assert_eq!( + json_array( + replay + .get("deterministic_equality_fields") + .expect("deterministic equality fields") + ), + expected_equality + ); + assert_eq!( + json_array( + replay + .get("variable_fields_within_frozen_bounds") + .expect("variable resource fields") + ), + &VARIABLE_RESOURCE_FIELDS.map(|value| JsonValue::String(value.to_owned())) + ); + assert_eq!( + json_array( + replay + .get("forbidden_aggregation") + .expect("forbidden aggregation") + ), + &FORBIDDEN_AGGREGATION.map(|value| JsonValue::String(value.to_owned())) + ); +} + +#[test] +fn reviewed_replay_plan_is_three_complete_latin_traversals_in_physical_order() { + let (_, _, plan) = checked_in_reviewed_protocol(); + let logical = latin_base_schedule(); + let expected = repetition_major_execution_schedule(); + assert_eq!(logical.len(), REQUIRED_CANDIDATE_CASES); + assert_eq!(plan.schedule(), expected); + assert_eq!(plan.schedule().len(), REQUIRED_EXECUTION_RECORDS); + + let coordinates = plan + .schedule() + .iter() + .map(|execution| { + ( + execution.repetition, + execution.logical_slot_ordinal, + execution.candidate, + execution.case, + ) + }) + .collect::>(); + assert_eq!(coordinates.len(), REQUIRED_EXECUTION_RECORDS); + + for (repetition_index, traversal) in plan + .schedule() + .chunks_exact(REQUIRED_CANDIDATE_CASES) + .enumerate() + { + assert_eq!(traversal.len(), REQUIRED_CANDIDATE_CASES); + for (slot_index, execution) in traversal.iter().enumerate() { + assert_eq!( + execution.execution_ordinal, + repetition_index * 25 + slot_index + 1 + ); + assert_eq!(execution.repetition, repetition_index + 1); + assert_eq!(execution.logical_slot_ordinal, slot_index + 1); + assert_eq!(execution.logical_slot(), logical[slot_index]); + } + assert_eq!( + traversal + .iter() + .map(|execution| (execution.candidate, execution.case)) + .collect::>() + .len(), + REQUIRED_CANDIDATE_CASES + ); + for round in traversal.chunks_exact(CANDIDATES.len()) { + assert_eq!( + round + .iter() + .map(|execution| execution.candidate) + .collect::>(), + CANDIDATES.into_iter().collect() + ); + assert_eq!( + round + .iter() + .map(|execution| execution.case) + .collect::>(), + CASES.into_iter().collect() + ); + } + } +} + +#[test] +fn reviewed_protocol_parsers_fail_closed_on_encoding_identity_or_schedule_drift() { + let (owner, protocol, _) = checked_in_reviewed_protocol(); + + let mut noncanonical = D004_PRE_01_OWNER_RECORD.to_vec(); + noncanonical.push(b'\n'); + assert_eq!( + parse_owner_protocol_record(&noncanonical) + .expect_err("owner transport whitespace") + .kind, + ReviewedProtocolErrorKind::NonCanonical + ); + + let substituted_revision = std::str::from_utf8(D004_PRE_01_OWNER_RECORD) + .expect("owner UTF-8") + .replace(AUTHORIZATION_SUBJECT_REVISION, &"0".repeat(40)); + assert_eq!( + parse_owner_protocol_record(substituted_revision.as_bytes()) + .expect_err("authorization revision substitution") + .kind, + ReviewedProtocolErrorKind::DigestMismatch + ); + + let reopened_gap = std::str::from_utf8(REVIEWED_PROTOCOL) + .expect("protocol UTF-8") + .replace("\"protocol_gaps\":[]", "\"protocol_gaps\":[\"reopened\"]"); + assert_eq!( + parse_reviewed_protocol(reopened_gap.as_bytes(), &owner) + .expect_err("reviewed gap drift") + .kind, + ReviewedProtocolErrorKind::DigestMismatch + ); + + let reordered_plan = std::str::from_utf8(REVIEWED_REPLAY_PLAN) + .expect("plan UTF-8") + .replacen("\"execution_ordinal\":1", "\"execution_ordinal\":2", 1); + assert_eq!( + parse_reviewed_replay_plan(reordered_plan.as_bytes(), &owner, &protocol) + .expect_err("schedule substitution") + .kind, + ReviewedProtocolErrorKind::DigestMismatch + ); + + assert_eq!( + parse_owner_protocol_record(b"{\"x\":1,\"x\":2}") + .expect_err("duplicate owner key") + .kind, + ReviewedProtocolErrorKind::Json(JsonErrorKind::DuplicateKey) + ); +} + +#[test] +fn reviewed_result_descriptor_is_closed_zero_state_and_bound_to_protocol_and_plan() { + let (_, protocol, plan) = checked_in_reviewed_protocol(); + let bytes = canonical_reviewed_result_contract_descriptor_bytes(&protocol, &plan); + let descriptor = parse_reviewed_result_contract_descriptor(&bytes, &protocol, &plan) + .expect("reviewed result descriptor"); + assert_eq!(descriptor.canonical_bytes(), bytes); + assert_eq!(descriptor.digest_hex().len(), 64); + assert_eq!(descriptor.result_record_count(), 0); + assert!(!descriptor.execution_authorized()); + + let value = strict_json::parse(&bytes).expect("descriptor JSON"); + let root = json_object(&value); + assert_eq!(root.get("epoch"), Some(&JsonValue::Null)); + assert_eq!( + root.get("protocol_raw_sha256").and_then(JsonValue::as_str), + Some(REVIEWED_PROTOCOL_RAW_SHA256) + ); + assert_eq!( + root.get("replay_plan_raw_sha256") + .and_then(JsonValue::as_str), + Some(REVIEWED_REPLAY_PLAN_RAW_SHA256) + ); + assert!(json_array(root.get("result_records").expect("result records")).is_empty()); + + let mut populated = value.clone(); + json_array_mut( + json_object_mut(&mut populated) + .get_mut("result_records") + .expect("result records"), + ) + .push(JsonValue::Object(BTreeMap::new())); + assert_eq!( + parse_reviewed_result_contract_descriptor( + &strict_json::canonical_bytes(&populated), + &protocol, + &plan, + ) + .expect_err("premature result record") + .kind, + ReviewedResultContractErrorKind::SchemaMismatch + ); + + let mut noncanonical = bytes; + noncanonical.push(b'\n'); + assert_eq!( + parse_reviewed_result_contract_descriptor(&noncanonical, &protocol, &plan) + .expect_err("descriptor transport whitespace") + .kind, + ReviewedResultContractErrorKind::NonCanonical + ); +} + +fn reviewed_repetition_records() -> Vec { + (1..=REQUIRED_REPETITIONS_PER_SLOT) + .map(|repetition| RepetitionRecordSummary { + logical_slot_ordinal: 1, + candidate: CandidateId::Rel, + case: CaseId::Sc01, + repetition, + independently_passed: true, + deterministic_fields_sha256: "a".repeat(64), + stdout_bytes: 1_024, + stderr_bytes: 0, + wall_milliseconds: 1_000 + u64::try_from(repetition).expect("repetition"), + peak_memory_bytes: 16_384 * u64::try_from(repetition).expect("repetition"), + temp_storage_bytes: 4_096 * u64::try_from(repetition).expect("repetition"), + }) + .collect() +} + +#[test] +fn repetition_closure_requires_three_independent_equal_passes_but_allows_bounded_resource_variance() +{ + let canonical = reviewed_repetition_records(); + let closure = validate_repetition_closure(&canonical).expect("three-repeat closure"); + assert_eq!(closure.logical_slot_ordinal(), 1); + assert_eq!(closure.candidate(), CandidateId::Rel); + assert_eq!(closure.case(), CaseId::Sc01); + assert_eq!(closure.deterministic_fields_sha256(), "a".repeat(64)); + + let mut missing = reviewed_repetition_records(); + missing.pop(); + assert_eq!( + validate_repetition_closure(&missing) + .expect_err("missing repetition") + .kind, + RepetitionClosureErrorKind::Cardinality + ); + + let mut reordered = reviewed_repetition_records(); + reordered.swap(0, 1); + assert_eq!( + validate_repetition_closure(&reordered) + .expect_err("reordered repetitions") + .kind, + RepetitionClosureErrorKind::RepetitionOrder + ); + + let mut cross_slot = reviewed_repetition_records(); + cross_slot[1].candidate = CandidateId::Uni; + assert_eq!( + validate_repetition_closure(&cross_slot) + .expect_err("cross-slot repetition") + .kind, + RepetitionClosureErrorKind::CoordinateMismatch + ); + + let mut substituted_schedule_coordinate = reviewed_repetition_records(); + for record in &mut substituted_schedule_coordinate { + record.candidate = CandidateId::Uni; + record.case = CaseId::Sc05; + } + assert_eq!( + validate_repetition_closure(&substituted_schedule_coordinate) + .expect_err("coordinate substituted against reviewed schedule") + .kind, + RepetitionClosureErrorKind::CoordinateMismatch + ); + + let mut failed = reviewed_repetition_records(); + failed[2].independently_passed = false; + assert_eq!( + validate_repetition_closure(&failed) + .expect_err("one failed repetition") + .kind, + RepetitionClosureErrorKind::IndependentFailure + ); + + for mutate in [ + |records: &mut Vec| { + records[1].deterministic_fields_sha256 = "b".repeat(64); + }, + |records: &mut Vec| { + records[1].stdout_bytes += 1; + }, + ] { + let mut unequal = reviewed_repetition_records(); + mutate(&mut unequal); + assert_eq!( + validate_repetition_closure(&unequal) + .expect_err("deterministic variance") + .kind, + RepetitionClosureErrorKind::DeterministicMismatch + ); + } + + let mut invalid_digest = reviewed_repetition_records(); + invalid_digest[0].deterministic_fields_sha256 = "A".repeat(64); + assert_eq!( + validate_repetition_closure(&invalid_digest) + .expect_err("non-lowercase digest") + .kind, + RepetitionClosureErrorKind::InvalidDigest + ); + + let mut over_limit = reviewed_repetition_records(); + over_limit[1].wall_milliseconds = + u64::try_from(BUDGETS.case_wall_seconds).expect("seconds") * 1_000 + 1; + assert_eq!( + validate_repetition_closure(&over_limit) + .expect_err("resource ceiling") + .kind, + RepetitionClosureErrorKind::ResourceLimit + ); + + let mut overflow = reviewed_repetition_records(); + for record in &mut overflow { + record.stdout_bytes = u64::MAX; + record.stderr_bytes = 1; + } + assert_eq!( + validate_repetition_closure(&overflow) + .expect_err("output checked-add overflow") + .kind, + RepetitionClosureErrorKind::OutputSizeOverflow + ); +} + +#[test] +fn d004_research_tree_preserves_v05_inputs_and_exact_reviewed_protocol_overlay() { let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../../research/decisions/D-004"); let observed = fs::read_dir(&root) .expect("D-004 research directory") .map(|entry| { let entry = entry.expect("research entry"); - assert!(entry.file_type().expect("entry type").is_file()); + ( + entry + .file_name() + .into_string() + .expect("UTF-8 research filename"), + entry.file_type().expect("entry type").is_dir(), + ) + }) + .collect::>(); + assert_eq!( + observed, + BTreeSet::from([ + ("README.md".to_owned(), false), + ( + "d004-v0.2-cross-cutting-fixture-proposals.json".to_owned(), + false + ), + ("d004-v0.2-named-mutations.json".to_owned(), false), + ( + "d004-v0.3-cross-cutting-executable-fixtures.json".to_owned(), + false + ), + ("d004-v0.4-case-subjects.json".to_owned(), false), + ("d004-v0.5-draft-packet.json".to_owned(), false), + ("d004-v0.5-candidate-mappings.json".to_owned(), false), + ("d004-v0.6".to_owned(), true), + ]) + ); + let protocol_root = root.join("d004-v0.6/protocol"); + let protocol_files = fs::read_dir(protocol_root) + .expect("reviewed protocol directory") + .map(|entry| { + let entry = entry.expect("protocol entry"); + assert!(entry.file_type().expect("protocol entry type").is_file()); entry .file_name() .into_string() - .expect("UTF-8 research filename") + .expect("UTF-8 protocol file") }) .collect::>(); assert_eq!( - observed, + protocol_files, BTreeSet::from([ - "README.md".to_owned(), - "d004-v0.2-cross-cutting-fixture-proposals.json".to_owned(), - "d004-v0.2-named-mutations.json".to_owned(), - "d004-v0.3-cross-cutting-executable-fixtures.json".to_owned(), - "d004-v0.4-case-subjects.json".to_owned(), - "d004-v0.5-draft-packet.json".to_owned(), - "d004-v0.5-candidate-mappings.json".to_owned(), + "d004-pre-01-owner-record.json".to_owned(), + "reviewed-protocol.json".to_owned(), + "reviewed-replay-plan.json".to_owned(), ]) ); - for forbidden in [ - "results", - "review", - "reviews", - "decision", - "epoch", - "candidates", - ] { - assert!(!observed.iter().any(|name| name.contains(forbidden))); + for forbidden in ["results", "evidence", "candidates", "epoch.json"] { + assert!(!protocol_files.iter().any(|name| name.contains(forbidden))); } } diff --git a/compiler/crates/orange-compiler/tests/d004_support/reviewed_protocol.rs b/compiler/crates/orange-compiler/tests/d004_support/reviewed_protocol.rs new file mode 100644 index 0000000..70a099f --- /dev/null +++ b/compiler/crates/orange-compiler/tests/d004_support/reviewed_protocol.rs @@ -0,0 +1,1011 @@ +use std::collections::BTreeMap; + +use super::candidate_mappings::{ + CANDIDATE_MAPPING_CATALOG_CANONICAL_SHA256, CANDIDATE_MAPPING_CATALOG_PATH, + CANDIDATE_MAPPING_CATALOG_RAW_SHA256, +}; +use super::case_subjects::{ + CASE_SUBJECT_CATALOG_CANONICAL_SHA256, CASE_SUBJECT_CATALOG_PATH, + CASE_SUBJECT_CATALOG_RAW_SHA256, +}; +use super::domain::BUDGETS; +use super::fixtures::{ + FIXTURE_CATALOG_CANONICAL_SHA256, FIXTURE_CATALOG_PATH, FIXTURE_CATALOG_RAW_SHA256, +}; +use super::packet::{CROSS_CUTTING_FIXTURE_PROPOSAL_MANIFEST_SHA256, MUTATION_MANIFEST_SHA256}; +use super::schedule::{ + REQUIRED_EXECUTION_RECORDS, REQUIRED_REPETITIONS_PER_SLOT, ReviewedExecution, + repetition_major_execution_schedule, +}; +use super::sha256; +use super::strict_json::{self, JsonErrorKind, JsonValue}; + +pub(crate) const OWNER_RECORD_PATH: &str = + "research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json"; +pub(crate) const OWNER_RECORD_RAW_SHA256: &str = + "cbdfa3e07245a6843100a6b17860ea5dcec39f7f341b194faeee91e2ae585f3c"; +pub(crate) const OWNER_RECORD_CANONICAL_IDENTITY_SHA256: &str = + "587c3ad11bf6e0d3dddc02cd7ba53896f54f8e08ec59ed1ece286e13fe9b0c9d"; +pub(crate) const REVIEWED_PROTOCOL_PATH: &str = + "research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json"; +pub(crate) const REVIEWED_PROTOCOL_RAW_SHA256: &str = + "1111889b47edf24e88926bf8fa6770cf84ebcd1abb1d7dc2687dc42e0135fb53"; +pub(crate) const REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256: &str = + "c67c17bdf68eb0619ec7698dd2807912251a0556931fa79b6838a9d5c6a9bd98"; +pub(crate) const REVIEWED_REPLAY_PLAN_CANONICAL_IDENTITY_SHA256: &str = + "a18084768cd05f6fcffdea724e330c0c81c5caac7816213156f4f9967fc5cb1b"; +pub(crate) const REVIEWED_REPLAY_PLAN_RAW_SHA256: &str = + "45632f796c7c08d26e668b277ccaff5679ccb82857732c3b8beead66198a3eb7"; + +pub(crate) const AUTHORIZATION_SUBJECT_REVISION: &str = "7d09a27369649855ce987c76315271b0d34a20ef"; +pub(crate) const DRAFT_PACKET_PATH: &str = "research/decisions/D-004/d004-v0.5-draft-packet.json"; +pub(crate) const DRAFT_PACKET_CANONICAL_SHA256: &str = + "b6df1a38f8a1eb6a80a8864324c21a81cb292d4c48e1981b4547bad41933b340"; +pub(crate) const DRAFT_PACKET_RAW_SHA256: &str = + "ec3a0a593d1dab7a6ace874dae4fd03c1ae0656cf301897ccabf51cb109c4009"; + +pub(crate) const EXECUTION_IDENTITY_PREIMAGE_FIELDS: [&str; 21] = [ + "schema_version", + "suite_version", + "epoch", + "packet_sha256", + "replay_plan_sha256", + "execution_ordinal", + "repetition", + "logical_slot_ordinal", + "round", + "position", + "candidate", + "case", + "input_manifest_sha256", + "model_sha256", + "tool_sha256", + "dependency_manifest_sha256", + "environment_sha256", + "candidate_graph_sha256", + "sr_map_sha256", + "semantic_endpoint_sha256", + "parameter_model_sha256", +]; + +pub(crate) const DETERMINISTIC_EQUALITY_FIELDS: [&str; 10] = [ + "digest_bound_inputs_graph_map_model_tool_dependencies_environment_and_argv", + "execution_state", + "log_manifest_stdout_and_stderr_bytes_lengths_and_digests", + "normalized_observations", + "premises_assumptions_trusted_components_and_unsupported_features", + "candidate_graph", + "sr_conformance_map", + "case_verdict", + "byte_manifest", + "replay_expected_output_manifest_sha256", +]; + +pub(crate) const VARIABLE_RESOURCE_FIELDS: [&str; 3] = [ + "measured_resources.wall_milliseconds", + "measured_resources.peak_memory_bytes", + "measured_resources.temp_storage_bytes", +]; + +pub(crate) const FORBIDDEN_AGGREGATION: [&str; 6] = [ + "warmup", + "retry_substitution", + "voting", + "averaging", + "best_of", + "statistical_confidence", +]; + +pub(crate) const EPOCH_FREEZE_BLOCKERS: [&str; 9] = [ + "candidate adapter implementations and closed request and response schemas absent", + "candidate semantic models endpoint inventories and parameter bindings absent", + "exact executable tool and transitive dependency manifests absent", + "exact deterministic environment and ordered input manifests absent", + "enforcing isolation launcher cache reset and cleanup verification absent", + "output normalizer payload validator and bounded resource meter absent", + "populated result repetition-closure correction and evidence-archive parsers absent", + "exact execution-subject revision and owner freeze record absent", + "frozen epoch packet replay-plan identity and scheduled-execution digests absent", +]; + +const OWNER_ROOT_FIELDS: [&str; 20] = [ + "accepted_on", + "accepted_subject", + "authority", + "authorization_subject_revision", + "decision_id", + "decision_status", + "delegated_technical_judgment", + "implementation_authority", + "implementation_closure_status", + "known_risks", + "nonclaims", + "record_id", + "record_disposition", + "revisit_triggers", + "review_kind", + "review_subjects", + "schema_version", + "source_direction", + "structured_disposition", + "validation", +]; +const PROTOCOL_ROOT_FIELDS: [&str; 21] = [ + "base_suite_version", + "bindings", + "conclusion", + "correction_policy", + "epoch", + "epoch_freeze_blockers", + "epoch_status", + "execution", + "execution_authorized", + "fixture_class_dispositions", + "implementation_closure_status", + "mapping_disposition", + "nonclaims", + "owner_protocol_review", + "physical_execution_order", + "protocol_gaps", + "protocol_version", + "replay_contract", + "schema_version", + "selection", + "status", +]; +const PLAN_ROOT_FIELDS: [&str; 17] = [ + "base_packet", + "epoch", + "execution_identity_preimage_fields", + "execution_identity_schema", + "execution_identity_status", + "implementation_closure_status", + "logical_schedule", + "nonclaims", + "owner_record", + "physical_execution_count", + "physical_order", + "protocol", + "repetitions_per_slot", + "schedule", + "schema_version", + "status", + "suite_version", +]; +const SCHEDULE_FIELDS: [&str; 7] = [ + "candidate", + "case", + "execution_ordinal", + "logical_slot_ordinal", + "position", + "repetition", + "round", +]; +const BINDING_FIELDS: [&str; 3] = ["canonical_sha256", "path", "raw_sha256"]; + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) enum ReviewedProtocolErrorKind { + Json(JsonErrorKind), + NonCanonical, + DigestMismatch, + MissingField, + UnknownField, + InvalidValue, + BindingMismatch, + ScheduleMismatch, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct ReviewedProtocolError { + pub(crate) kind: ReviewedProtocolErrorKind, + pub(crate) path: String, +} + +impl ReviewedProtocolError { + fn new(kind: ReviewedProtocolErrorKind, path: impl Into) -> Self { + Self { + kind, + path: path.into(), + } + } +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct OwnerProtocolRecord { + value: JsonValue, + canonical: Vec, +} + +impl OwnerProtocolRecord { + pub(crate) fn value(&self) -> &JsonValue { + &self.value + } + + pub(crate) fn canonical_bytes(&self) -> &[u8] { + &self.canonical + } + + pub(crate) fn digest_hex(&self) -> String { + sha256::hex(&sha256::digest(&self.canonical)) + } +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct ReviewedProtocol { + value: JsonValue, + canonical: Vec, +} + +impl ReviewedProtocol { + pub(crate) fn value(&self) -> &JsonValue { + &self.value + } + + pub(crate) fn canonical_bytes(&self) -> &[u8] { + &self.canonical + } + + pub(crate) fn digest_hex(&self) -> String { + sha256::hex(&sha256::digest(&self.canonical)) + } + + pub(crate) const fn execution_authorized(&self) -> bool { + false + } + + pub(crate) const fn replay_repetitions(&self) -> usize { + REQUIRED_REPETITIONS_PER_SLOT + } +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct ReviewedReplayPlan { + value: JsonValue, + canonical: Vec, + schedule: Vec, +} + +impl ReviewedReplayPlan { + pub(crate) fn value(&self) -> &JsonValue { + &self.value + } + + pub(crate) fn canonical_bytes(&self) -> &[u8] { + &self.canonical + } + + pub(crate) fn digest_hex(&self) -> String { + sha256::hex(&sha256::digest(&self.canonical)) + } + + pub(crate) fn schedule(&self) -> &[ReviewedExecution] { + &self.schedule + } +} + +pub(crate) fn parse_owner_protocol_record( + source: &[u8], +) -> Result { + let (value, canonical) = parse_exact_document( + source, + OWNER_RECORD_CANONICAL_IDENTITY_SHA256, + OWNER_RECORD_RAW_SHA256, + "$/owner", + )?; + let root = require_object(&value, "$/owner")?; + exact_fields(root, &OWNER_ROOT_FIELDS, "$/owner")?; + require_exact_string( + root, + "schema_version", + "d004-owner-protocol-record-v0.1", + "$/owner", + )?; + require_exact_string(root, "record_id", "D004-PRE-01", "$/owner")?; + require_exact_string(root, "accepted_subject", "D004-PRE-01", "$/owner")?; + require_exact_string(root, "decision_id", "D-004", "$/owner")?; + require_exact_string(root, "decision_status", "proposed", "$/owner")?; + require_exact_string(root, "record_disposition", "accepted", "$/owner")?; + require_exact_string( + root, + "implementation_closure_status", + "provisional_pending_exact_merged_revision", + "$/owner", + )?; + require_exact_string( + root, + "authorization_subject_revision", + AUTHORIZATION_SUBJECT_REVISION, + "$/owner", + )?; + require_exact_bool(root, "delegated_technical_judgment", true, "$/owner")?; + + let authority = require_object_field(root, "authority", "$/owner")?; + exact_fields( + authority, + &["independent_review", "review_authority", "review_label"], + "$/owner/authority", + )?; + require_exact_string( + authority, + "review_authority", + "Orange Project Owner", + "$/owner/authority", + )?; + require_exact_string( + authority, + "review_label", + "solo-reviewed", + "$/owner/authority", + )?; + require_exact_string( + authority, + "independent_review", + "unavailable", + "$/owner/authority", + )?; + + let subjects = require_object_field(root, "review_subjects", "$/owner")?; + exact_fields( + subjects, + &[ + "candidate_mappings", + "case_subjects", + "cross_cutting_executable_fixtures", + "cross_cutting_fixture_proposals", + "decision_suite", + "draft_packet", + "named_mutations", + "result_contract_descriptor", + ], + "$/owner/review_subjects", + )?; + require_binding( + subjects, + "candidate_mappings", + CANDIDATE_MAPPING_CATALOG_PATH, + CANDIDATE_MAPPING_CATALOG_RAW_SHA256, + CANDIDATE_MAPPING_CATALOG_CANONICAL_SHA256, + "$/owner/review_subjects", + )?; + require_binding( + subjects, + "case_subjects", + CASE_SUBJECT_CATALOG_PATH, + CASE_SUBJECT_CATALOG_RAW_SHA256, + CASE_SUBJECT_CATALOG_CANONICAL_SHA256, + "$/owner/review_subjects", + )?; + require_binding( + subjects, + "cross_cutting_executable_fixtures", + FIXTURE_CATALOG_PATH, + FIXTURE_CATALOG_RAW_SHA256, + FIXTURE_CATALOG_CANONICAL_SHA256, + "$/owner/review_subjects", + )?; + require_binding( + subjects, + "cross_cutting_fixture_proposals", + "research/decisions/D-004/d004-v0.2-cross-cutting-fixture-proposals.json", + "d3d58cbeb0d2a90987680cd00bc70caf53518be730a71d0d55ba2a7b50544481", + CROSS_CUTTING_FIXTURE_PROPOSAL_MANIFEST_SHA256, + "$/owner/review_subjects", + )?; + require_binding( + subjects, + "draft_packet", + DRAFT_PACKET_PATH, + DRAFT_PACKET_RAW_SHA256, + DRAFT_PACKET_CANONICAL_SHA256, + "$/owner/review_subjects", + )?; + require_binding( + subjects, + "named_mutations", + "research/decisions/D-004/d004-v0.2-named-mutations.json", + "1d46d6d66c0704fcaa462c625dcac2e72150497bb075322c5e076ea42898be54", + MUTATION_MANIFEST_SHA256, + "$/owner/review_subjects", + )?; + + let disposition = require_object_field(root, "structured_disposition", "$/owner")?; + validate_mapping_disposition( + disposition, + "mapping_review", + "$/owner/structured_disposition", + )?; + validate_fixture_dispositions( + disposition, + "fixture_class_reviews", + "$/owner/structured_disposition", + )?; + let replay = require_object_field( + disposition, + "replay_policy", + "$/owner/structured_disposition", + )?; + validate_replay_policy( + replay, + "$/owner/structured_disposition/replay_policy", + false, + )?; + + Ok(OwnerProtocolRecord { value, canonical }) +} + +pub(crate) fn parse_reviewed_protocol( + source: &[u8], + owner: &OwnerProtocolRecord, +) -> Result { + if owner.digest_hex() != OWNER_RECORD_CANONICAL_IDENTITY_SHA256 { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::BindingMismatch, + "$/bindings/owner_record/raw_sha256", + )); + } + let (value, canonical) = parse_exact_document( + source, + REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256, + REVIEWED_PROTOCOL_RAW_SHA256, + "$/protocol", + )?; + let root = require_object(&value, "$/protocol")?; + exact_fields(root, &PROTOCOL_ROOT_FIELDS, "$/protocol")?; + require_exact_string( + root, + "schema_version", + "d004-reviewed-protocol-tranche-v0.1", + "$/protocol", + )?; + require_exact_string(root, "status", "reviewed_not_executable", "$/protocol")?; + require_exact_string( + root, + "implementation_closure_status", + "provisional_pending_exact_merged_revision", + "$/protocol", + )?; + require_exact_string(root, "owner_protocol_review", "solo-reviewed", "$/protocol")?; + require_null(root, "epoch", "$/protocol")?; + require_exact_string(root, "epoch_status", "unfrozen", "$/protocol")?; + require_exact_bool(root, "execution_authorized", false, "$/protocol")?; + require_null(root, "selection", "$/protocol")?; + require_null(root, "conclusion", "$/protocol")?; + require_exact_empty_array(root, "protocol_gaps", "$/protocol")?; + require_exact_strings( + root, + "epoch_freeze_blockers", + &EPOCH_FREEZE_BLOCKERS, + "$/protocol", + )?; + + let bindings = require_object_field(root, "bindings", "$/protocol")?; + require_binding( + bindings, + "owner_record", + OWNER_RECORD_PATH, + OWNER_RECORD_RAW_SHA256, + OWNER_RECORD_CANONICAL_IDENTITY_SHA256, + "$/protocol/bindings", + )?; + require_binding( + bindings, + "draft_packet", + DRAFT_PACKET_PATH, + DRAFT_PACKET_RAW_SHA256, + DRAFT_PACKET_CANONICAL_SHA256, + "$/protocol/bindings", + )?; + require_binding( + bindings, + "candidate_mappings", + CANDIDATE_MAPPING_CATALOG_PATH, + CANDIDATE_MAPPING_CATALOG_RAW_SHA256, + CANDIDATE_MAPPING_CATALOG_CANONICAL_SHA256, + "$/protocol/bindings", + )?; + require_binding( + bindings, + "case_subjects", + CASE_SUBJECT_CATALOG_PATH, + CASE_SUBJECT_CATALOG_RAW_SHA256, + CASE_SUBJECT_CATALOG_CANONICAL_SHA256, + "$/protocol/bindings", + )?; + require_binding( + bindings, + "cross_cutting_executable_fixtures", + FIXTURE_CATALOG_PATH, + FIXTURE_CATALOG_RAW_SHA256, + FIXTURE_CATALOG_CANONICAL_SHA256, + "$/protocol/bindings", + )?; + + validate_mapping_disposition(root, "mapping_disposition", "$/protocol")?; + validate_fixture_dispositions(root, "fixture_class_dispositions", "$/protocol")?; + let replay = require_object_field(root, "replay_contract", "$/protocol")?; + validate_replay_policy(replay, "$/protocol/replay_contract", true)?; + + let execution = require_object_field(root, "execution", "$/protocol")?; + for (field, expected) in [ + ("required_candidate_cases", 25), + ("required_execution_records", REQUIRED_EXECUTION_RECORDS), + ("result_record_count", 0), + ("completed_candidate_cases", 0), + ("complete_candidates", 0), + ("complete_cross_candidate_cases", 0), + ] { + require_exact_usize(execution, field, expected, "$/protocol/execution")?; + } + require_exact_string(execution, "evidence_status", "none", "$/protocol/execution")?; + + Ok(ReviewedProtocol { value, canonical }) +} + +pub(crate) fn parse_reviewed_replay_plan( + source: &[u8], + owner: &OwnerProtocolRecord, + protocol: &ReviewedProtocol, +) -> Result { + if owner.digest_hex() != OWNER_RECORD_CANONICAL_IDENTITY_SHA256 + || protocol.digest_hex() != REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256 + { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::BindingMismatch, + "$/plan/bindings", + )); + } + let (value, canonical) = parse_exact_document( + source, + REVIEWED_REPLAY_PLAN_CANONICAL_IDENTITY_SHA256, + REVIEWED_REPLAY_PLAN_RAW_SHA256, + "$/plan", + )?; + let root = require_object(&value, "$/plan")?; + exact_fields(root, &PLAN_ROOT_FIELDS, "$/plan")?; + require_exact_string(root, "schema_version", "d004-replay-plan-v0.1", "$/plan")?; + require_exact_string(root, "status", "reviewed_uninstantiated", "$/plan")?; + require_exact_string( + root, + "implementation_closure_status", + "provisional_pending_exact_merged_revision", + "$/plan", + )?; + require_null(root, "epoch", "$/plan")?; + require_exact_usize( + root, + "physical_execution_count", + REQUIRED_EXECUTION_RECORDS, + "$/plan", + )?; + require_exact_usize( + root, + "repetitions_per_slot", + REQUIRED_REPETITIONS_PER_SLOT, + "$/plan", + )?; + require_exact_string( + root, + "physical_order", + "repetition_major_then_latin_slot_ordinal", + "$/plan", + )?; + require_exact_strings( + root, + "execution_identity_preimage_fields", + &EXECUTION_IDENTITY_PREIMAGE_FIELDS, + "$/plan", + )?; + require_binding( + root, + "owner_record", + OWNER_RECORD_PATH, + OWNER_RECORD_RAW_SHA256, + OWNER_RECORD_CANONICAL_IDENTITY_SHA256, + "$/plan", + )?; + require_binding( + root, + "protocol", + REVIEWED_PROTOCOL_PATH, + REVIEWED_PROTOCOL_RAW_SHA256, + REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256, + "$/plan", + )?; + require_binding( + root, + "base_packet", + DRAFT_PACKET_PATH, + DRAFT_PACKET_RAW_SHA256, + DRAFT_PACKET_CANONICAL_SHA256, + "$/plan", + )?; + + let expected = repetition_major_execution_schedule(); + let observed = require_array_field(root, "schedule", "$/plan")?; + if observed.len() != expected.len() { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::ScheduleMismatch, + "$/plan/schedule", + )); + } + for (index, (record, expected)) in observed.iter().zip(&expected).enumerate() { + validate_schedule_record(record, *expected, index)?; + } + + Ok(ReviewedReplayPlan { + value, + canonical, + schedule: expected, + }) +} + +fn validate_schedule_record( + value: &JsonValue, + expected: ReviewedExecution, + index: usize, +) -> Result<(), ReviewedProtocolError> { + let path = format!("$/plan/schedule/{index}"); + let record = require_object(value, &path)?; + exact_fields(record, &SCHEDULE_FIELDS, &path)?; + for (field, value) in [ + ("execution_ordinal", expected.execution_ordinal), + ("repetition", expected.repetition), + ("logical_slot_ordinal", expected.logical_slot_ordinal), + ("round", expected.round), + ("position", expected.position), + ] { + require_exact_usize(record, field, value, &path)?; + } + require_exact_string(record, "candidate", expected.candidate.as_str(), &path)?; + require_exact_string(record, "case", expected.case.as_str(), &path)?; + Ok(()) +} + +fn validate_mapping_disposition( + parent: &BTreeMap, + field: &str, + parent_path: &str, +) -> Result<(), ReviewedProtocolError> { + let mapping = require_object_field(parent, field, parent_path)?; + let path = format!("{parent_path}/{field}"); + for (name, expected) in [ + ("candidate_graph_count", 5), + ("mapping_row_count", 70), + ("relationship_count", 14), + ] { + require_exact_usize(mapping, name, expected, &path)?; + } + require_exact_string( + mapping, + "status", + "reviewed_symmetric_falsifiable_test_hypotheses", + &path, + )?; + require_exact_string(mapping, "semantic_status", "unaccepted", &path)?; + require_exact_string(mapping, "capability_credit", "none", &path)?; + require_exact_string(mapping, "evidence_credit", "none", &path)?; + require_null(mapping, "selection", &path)?; + Ok(()) +} + +fn validate_fixture_dispositions( + parent: &BTreeMap, + field: &str, + parent_path: &str, +) -> Result<(), ReviewedProtocolError> { + let path = format!("{parent_path}/{field}"); + let rows = require_array_field(parent, field, parent_path)?; + let expected = [ + ("ambiguity", 5), + ("missing-edge", 14), + ("identity-substitution", 13), + ("unsupported", 5), + ("resource-exhaustion", 5), + ]; + if rows.len() != expected.len() { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + path, + )); + } + for (index, (row, (class, count))) in rows.iter().zip(expected).enumerate() { + let row_path = format!("{path}/{index}"); + let row = require_object(row, &row_path)?; + exact_fields( + row, + &[ + "capability_credit", + "class", + "scope", + "status", + "subject_count", + ], + &row_path, + )?; + require_exact_string(row, "class", class, &row_path)?; + require_exact_usize(row, "subject_count", count, &row_path)?; + require_exact_string(row, "status", "reviewed_sufficient", &row_path)?; + require_exact_string(row, "scope", "bounded_suite_coverage_only", &row_path)?; + require_exact_string(row, "capability_credit", "none", &row_path)?; + } + Ok(()) +} + +fn validate_replay_policy( + replay: &BTreeMap, + path: &str, + full_contract: bool, +) -> Result<(), ReviewedProtocolError> { + for (field, expected) in [ + ("base_candidate_case_slots", 25), + ("repetitions_per_slot", REQUIRED_REPETITIONS_PER_SLOT), + ("required_execution_records", REQUIRED_EXECUTION_RECORDS), + ] { + require_exact_usize(replay, field, expected, path)?; + } + require_exact_string( + replay, + "physical_order", + "repetition_major_then_latin_slot_ordinal", + path, + )?; + require_exact_string( + replay, + "cache", + "fresh_empty_candidate_specific_per_execution", + path, + )?; + require_exact_strings( + replay, + "forbidden_aggregation", + &FORBIDDEN_AGGREGATION, + path, + )?; + if full_contract { + require_exact_strings( + replay, + "execution_identity_preimage_fields", + &EXECUTION_IDENTITY_PREIMAGE_FIELDS, + path, + )?; + let mut equality = DETERMINISTIC_EQUALITY_FIELDS.to_vec(); + equality.push("measured_resources_stdout_bytes_and_stderr_bytes"); + require_exact_strings(replay, "deterministic_equality_fields", &equality, path)?; + require_exact_strings( + replay, + "variable_fields_within_frozen_bounds", + &VARIABLE_RESOURCE_FIELDS, + path, + )?; + } else { + require_exact_bool(replay, "deterministic_equality_required", true, path)?; + require_exact_bool(replay, "independent_pass_required", true, path)?; + } + Ok(()) +} + +fn parse_exact_document( + source: &[u8], + expected_canonical_sha256: &str, + expected_raw_sha256: &str, + path: &str, +) -> Result<(JsonValue, Vec), ReviewedProtocolError> { + let value = strict_json::parse(source).map_err(|error| { + ReviewedProtocolError::new( + ReviewedProtocolErrorKind::Json(error.kind), + format!("{path}@{}", error.offset), + ) + })?; + let canonical = strict_json::canonical_bytes(&value); + let mut canonical_transport = canonical.clone(); + canonical_transport.push(b'\n'); + if canonical_transport != source { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::NonCanonical, + path, + )); + } + if sha256::hex(&sha256::digest(&canonical)) != expected_canonical_sha256 + || sha256::hex(&sha256::digest(source)) != expected_raw_sha256 + { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::DigestMismatch, + format!("{path}_sha256"), + )); + } + Ok((value, canonical)) +} + +fn require_binding( + parent: &BTreeMap, + field: &str, + path: &str, + raw_sha256: &str, + canonical_sha256: &str, + parent_path: &str, +) -> Result<(), ReviewedProtocolError> { + let binding_path = format!("{parent_path}/{field}"); + let binding = require_object_field(parent, field, parent_path)?; + exact_fields(binding, &BINDING_FIELDS, &binding_path)?; + require_exact_string(binding, "path", path, &binding_path)?; + require_exact_string(binding, "raw_sha256", raw_sha256, &binding_path)?; + require_exact_string(binding, "canonical_sha256", canonical_sha256, &binding_path)?; + Ok(()) +} + +fn require_object<'a>( + value: &'a JsonValue, + path: &str, +) -> Result<&'a BTreeMap, ReviewedProtocolError> { + value + .as_object() + .ok_or_else(|| ReviewedProtocolError::new(ReviewedProtocolErrorKind::InvalidValue, path)) +} + +fn require_object_field<'a>( + object: &'a BTreeMap, + field: &str, + path: &str, +) -> Result<&'a BTreeMap, ReviewedProtocolError> { + require_object( + require_field(object, field, path)?, + &format!("{path}/{field}"), + ) +} + +fn require_array_field<'a>( + object: &'a BTreeMap, + field: &str, + path: &str, +) -> Result<&'a [JsonValue], ReviewedProtocolError> { + require_field(object, field, path)? + .as_array() + .ok_or_else(|| { + ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + format!("{path}/{field}"), + ) + }) +} + +fn require_field<'a>( + object: &'a BTreeMap, + field: &str, + path: &str, +) -> Result<&'a JsonValue, ReviewedProtocolError> { + object.get(field).ok_or_else(|| { + ReviewedProtocolError::new( + ReviewedProtocolErrorKind::MissingField, + format!("{path}/{field}"), + ) + }) +} + +fn exact_fields( + object: &BTreeMap, + expected: &[&str], + path: &str, +) -> Result<(), ReviewedProtocolError> { + if let Some(field) = object + .keys() + .find(|field| !expected.contains(&field.as_str())) + { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::UnknownField, + format!("{path}/{field}"), + )); + } + for field in expected { + if !object.contains_key(*field) { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::MissingField, + format!("{path}/{field}"), + )); + } + } + Ok(()) +} + +fn require_exact_string( + object: &BTreeMap, + field: &str, + expected: &str, + path: &str, +) -> Result<(), ReviewedProtocolError> { + if require_field(object, field, path)?.as_str() != Some(expected) { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + format!("{path}/{field}"), + )); + } + Ok(()) +} + +fn require_exact_usize( + object: &BTreeMap, + field: &str, + expected: usize, + path: &str, +) -> Result<(), ReviewedProtocolError> { + let observed = require_field(object, field, path)?.as_integer(); + if observed.and_then(|value| usize::try_from(value).ok()) != Some(expected) { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + format!("{path}/{field}"), + )); + } + Ok(()) +} + +fn require_exact_bool( + object: &BTreeMap, + field: &str, + expected: bool, + path: &str, +) -> Result<(), ReviewedProtocolError> { + if require_field(object, field, path)? != &JsonValue::Bool(expected) { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + format!("{path}/{field}"), + )); + } + Ok(()) +} + +fn require_null( + object: &BTreeMap, + field: &str, + path: &str, +) -> Result<(), ReviewedProtocolError> { + if require_field(object, field, path)? != &JsonValue::Null { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + format!("{path}/{field}"), + )); + } + Ok(()) +} + +fn require_exact_empty_array( + object: &BTreeMap, + field: &str, + path: &str, +) -> Result<(), ReviewedProtocolError> { + if !require_array_field(object, field, path)?.is_empty() { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + format!("{path}/{field}"), + )); + } + Ok(()) +} + +fn require_exact_strings( + object: &BTreeMap, + field: &str, + expected: &[&str], + path: &str, +) -> Result<(), ReviewedProtocolError> { + let observed = require_array_field(object, field, path)?; + if observed.len() != expected.len() + || observed + .iter() + .zip(expected) + .any(|(observed, expected)| observed.as_str() != Some(*expected)) + { + return Err(ReviewedProtocolError::new( + ReviewedProtocolErrorKind::InvalidValue, + format!("{path}/{field}"), + )); + } + Ok(()) +} + +pub(crate) fn resource_ceilings() -> (u64, u64, u64, u64) { + ( + u64::try_from(BUDGETS.case_wall_seconds).expect("bounded seconds") * 1_000, + BUDGETS.case_peak_memory_bytes, + BUDGETS.case_temp_storage_bytes, + BUDGETS.case_output_bytes, + ) +} diff --git a/compiler/crates/orange-compiler/tests/d004_support/reviewed_result_contract.rs b/compiler/crates/orange-compiler/tests/d004_support/reviewed_result_contract.rs new file mode 100644 index 0000000..90886b2 --- /dev/null +++ b/compiler/crates/orange-compiler/tests/d004_support/reviewed_result_contract.rs @@ -0,0 +1,346 @@ +use super::domain::{CandidateId, CaseId, REQUIRED_CANDIDATE_CASES}; +use super::reviewed_protocol::{ + DETERMINISTIC_EQUALITY_FIELDS, EPOCH_FREEZE_BLOCKERS, EXECUTION_IDENTITY_PREIMAGE_FIELDS, + REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256, REVIEWED_PROTOCOL_RAW_SHA256, + REVIEWED_REPLAY_PLAN_CANONICAL_IDENTITY_SHA256, REVIEWED_REPLAY_PLAN_RAW_SHA256, + ReviewedProtocol, ReviewedReplayPlan, VARIABLE_RESOURCE_FIELDS, resource_ceilings, +}; +use super::schedule::{ + REQUIRED_EXECUTION_RECORDS, REQUIRED_REPETITIONS_PER_SLOT, latin_base_schedule, +}; +use super::sha256; +use super::strict_json::{self, JsonErrorKind, JsonValue}; + +pub(crate) const REVIEWED_RESULT_CONTRACT_SCHEMA_VERSION: &str = + "d004-reviewed-result-contract-descriptor-v0.1"; + +pub(crate) const REVIEWED_RESULT_CONTRACT_NONCLAIMS: [&str; 8] = [ + "reviewed schema only; no populated result record exists", + "no candidate adapter process or tool invoked", + "no D-004 evidence epoch frozen or candidate execution authorized", + "no candidate graph or SR mapping accepted as Orange semantics", + "no semantic-strata candidate selected preferred or accepted", + "no D-004 disposition accepted", + "no S3b implementation authorized", + "no roadmap gate or readiness movement", +]; + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct RepetitionRecordSummary { + pub(crate) logical_slot_ordinal: usize, + pub(crate) candidate: CandidateId, + pub(crate) case: CaseId, + pub(crate) repetition: usize, + pub(crate) independently_passed: bool, + /// Digest of the closed deterministic-equality projection enumerated by + /// `DETERMINISTIC_EQUALITY_FIELDS`, including stdout/stderr identities. + pub(crate) deterministic_fields_sha256: String, + pub(crate) stdout_bytes: u64, + pub(crate) stderr_bytes: u64, + pub(crate) wall_milliseconds: u64, + pub(crate) peak_memory_bytes: u64, + pub(crate) temp_storage_bytes: u64, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) enum RepetitionClosureErrorKind { + Cardinality, + RepetitionOrder, + CoordinateMismatch, + InvalidDigest, + IndependentFailure, + DeterministicMismatch, + ResourceLimit, + OutputSizeOverflow, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct RepetitionClosureError { + pub(crate) kind: RepetitionClosureErrorKind, + pub(crate) path: String, +} + +impl RepetitionClosureError { + fn new(kind: RepetitionClosureErrorKind, path: impl Into) -> Self { + Self { + kind, + path: path.into(), + } + } +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct RepetitionClosure { + logical_slot_ordinal: usize, + candidate: CandidateId, + case: CaseId, + deterministic_fields_sha256: String, +} + +impl RepetitionClosure { + pub(crate) const fn logical_slot_ordinal(&self) -> usize { + self.logical_slot_ordinal + } + + pub(crate) const fn candidate(&self) -> CandidateId { + self.candidate + } + + pub(crate) const fn case(&self) -> CaseId { + self.case + } + + pub(crate) fn deterministic_fields_sha256(&self) -> &str { + &self.deterministic_fields_sha256 + } +} + +pub(crate) fn validate_repetition_closure( + records: &[RepetitionRecordSummary], +) -> Result { + if records.len() != REQUIRED_REPETITIONS_PER_SLOT { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::Cardinality, + "$/repetitions", + )); + } + let first = &records[0]; + if !(1..=REQUIRED_CANDIDATE_CASES).contains(&first.logical_slot_ordinal) { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::CoordinateMismatch, + "$/repetitions/0/logical_slot_ordinal", + )); + } + let expected_slot = &latin_base_schedule()[first.logical_slot_ordinal - 1]; + if first.candidate != expected_slot.candidate || first.case != expected_slot.case { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::CoordinateMismatch, + "$/repetitions/0/scheduled_coordinate", + )); + } + let (max_wall_milliseconds, max_peak_memory, max_temp_storage, max_output) = + resource_ceilings(); + for (index, record) in records.iter().enumerate() { + let path = format!("$/repetitions/{index}"); + if record.repetition != index + 1 { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::RepetitionOrder, + format!("{path}/repetition"), + )); + } + if record.logical_slot_ordinal != first.logical_slot_ordinal + || record.candidate != first.candidate + || record.case != first.case + { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::CoordinateMismatch, + path, + )); + } + if !is_sha256_hex(&record.deterministic_fields_sha256) { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::InvalidDigest, + format!("{path}/deterministic_fields_sha256"), + )); + } + if !record.independently_passed { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::IndependentFailure, + format!("{path}/independently_passed"), + )); + } + if record.deterministic_fields_sha256 != first.deterministic_fields_sha256 + || record.stdout_bytes != first.stdout_bytes + || record.stderr_bytes != first.stderr_bytes + { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::DeterministicMismatch, + path, + )); + } + let output_bytes = record + .stdout_bytes + .checked_add(record.stderr_bytes) + .ok_or_else(|| { + RepetitionClosureError::new( + RepetitionClosureErrorKind::OutputSizeOverflow, + format!("{path}/measured_resources"), + ) + })?; + if record.wall_milliseconds > max_wall_milliseconds + || record.peak_memory_bytes > max_peak_memory + || record.temp_storage_bytes > max_temp_storage + || output_bytes > max_output + { + return Err(RepetitionClosureError::new( + RepetitionClosureErrorKind::ResourceLimit, + format!("{path}/measured_resources"), + )); + } + } + Ok(RepetitionClosure { + logical_slot_ordinal: first.logical_slot_ordinal, + candidate: first.candidate, + case: first.case, + deterministic_fields_sha256: first.deterministic_fields_sha256.clone(), + }) +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) enum ReviewedResultContractErrorKind { + Json(JsonErrorKind), + NonCanonical, + SchemaMismatch, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct ReviewedResultContractError { + pub(crate) kind: ReviewedResultContractErrorKind, + pub(crate) path: String, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub(crate) struct ReviewedResultContractDescriptor { + canonical: Vec, +} + +impl ReviewedResultContractDescriptor { + pub(crate) fn canonical_bytes(&self) -> &[u8] { + &self.canonical + } + + pub(crate) fn digest_hex(&self) -> String { + sha256::hex(&sha256::digest(&self.canonical)) + } + + pub(crate) const fn result_record_count(&self) -> usize { + 0 + } + + pub(crate) const fn execution_authorized(&self) -> bool { + false + } +} + +pub(crate) fn canonical_reviewed_result_contract_descriptor_bytes( + protocol: &ReviewedProtocol, + plan: &ReviewedReplayPlan, +) -> Vec { + strict_json::canonical_bytes(&descriptor_value(protocol, plan)) +} + +pub(crate) fn parse_reviewed_result_contract_descriptor( + source: &[u8], + protocol: &ReviewedProtocol, + plan: &ReviewedReplayPlan, +) -> Result { + let value = strict_json::parse(source).map_err(|error| ReviewedResultContractError { + kind: ReviewedResultContractErrorKind::Json(error.kind), + path: format!("$/descriptor@{}", error.offset), + })?; + if strict_json::canonical_bytes(&value) != source { + return Err(ReviewedResultContractError { + kind: ReviewedResultContractErrorKind::NonCanonical, + path: "$/descriptor".to_owned(), + }); + } + if value != descriptor_value(protocol, plan) { + return Err(ReviewedResultContractError { + kind: ReviewedResultContractErrorKind::SchemaMismatch, + path: "$/descriptor".to_owned(), + }); + } + Ok(ReviewedResultContractDescriptor { + canonical: source.to_vec(), + }) +} + +fn descriptor_value(protocol: &ReviewedProtocol, plan: &ReviewedReplayPlan) -> JsonValue { + assert_eq!( + protocol.digest_hex(), + REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256 + ); + assert_eq!( + plan.digest_hex(), + REVIEWED_REPLAY_PLAN_CANONICAL_IDENTITY_SHA256 + ); + let mut equality_fields = DETERMINISTIC_EQUALITY_FIELDS.to_vec(); + equality_fields.push("measured_resources_stdout_bytes_and_stderr_bytes"); + strict_json::object([ + string_entry("schema_version", REVIEWED_RESULT_CONTRACT_SCHEMA_VERSION), + string_entry("status", "reviewed_schema_not_executable"), + ("epoch".to_owned(), JsonValue::Null), + string_entry("epoch_status", "unfrozen"), + string_entry("owner_protocol_review", "solo-reviewed"), + string_entry("protocol_raw_sha256", REVIEWED_PROTOCOL_RAW_SHA256), + string_entry( + "protocol_canonical_identity_sha256", + REVIEWED_PROTOCOL_CANONICAL_IDENTITY_SHA256, + ), + string_entry("replay_plan_raw_sha256", REVIEWED_REPLAY_PLAN_RAW_SHA256), + usize_entry("base_candidate_case_slots", REQUIRED_CANDIDATE_CASES), + usize_entry("repetitions_per_slot", REQUIRED_REPETITIONS_PER_SLOT), + usize_entry("required_execution_records", REQUIRED_EXECUTION_RECORDS), + string_entry("physical_order", "repetition_major_then_latin_slot_ordinal"), + strings_entry( + "execution_identity_preimage_fields", + &EXECUTION_IDENTITY_PREIMAGE_FIELDS, + ), + ( + "deterministic_equality_fields".to_owned(), + strict_json::strings(equality_fields), + ), + strings_entry( + "variable_fields_within_frozen_bounds", + &VARIABLE_RESOURCE_FIELDS, + ), + string_entry( + "slot_pass_rule", + "all_three_repetitions_independently_pass_and_all_deterministic_fields_equal", + ), + string_entry( + "failure_rule", + "missing_invalid_non_successful_or_inconsistent_repetition_fails_candidate_case", + ), + strings_entry("epoch_freeze_blockers", &EPOCH_FREEZE_BLOCKERS), + ( + "current_state".to_owned(), + strict_json::object([ + usize_entry("result_record_count", 0), + usize_entry("completed_candidate_cases", 0), + string_entry("evidence_status", "none"), + ("selection".to_owned(), JsonValue::Null), + ("conclusion".to_owned(), JsonValue::Null), + ("execution_authorized".to_owned(), JsonValue::Bool(false)), + ]), + ), + ("result_records".to_owned(), JsonValue::Array(Vec::new())), + strings_entry("nonclaims", &REVIEWED_RESULT_CONTRACT_NONCLAIMS), + ]) +} + +fn is_sha256_hex(value: &str) -> bool { + value.len() == 64 + && value + .as_bytes() + .iter() + .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(byte)) +} + +fn string_entry(key: &str, value: &str) -> (String, JsonValue) { + (key.to_owned(), JsonValue::String(value.to_owned())) +} + +fn strings_entry( + key: &str, + values: &'static [&'static str; N], +) -> (String, JsonValue) { + (key.to_owned(), strict_json::strings(*values)) +} + +fn usize_entry(key: &str, value: usize) -> (String, JsonValue) { + ( + key.to_owned(), + JsonValue::Integer(i64::try_from(value).expect("bounded reviewed-protocol integer")), + ) +} diff --git a/compiler/crates/orange-compiler/tests/d004_support/runner.rs b/compiler/crates/orange-compiler/tests/d004_support/runner.rs index e8cafc6..92443ae 100644 --- a/compiler/crates/orange-compiler/tests/d004_support/runner.rs +++ b/compiler/crates/orange-compiler/tests/d004_support/runner.rs @@ -3,8 +3,8 @@ use std::collections::BTreeMap; use super::candidate_mappings::{CandidateMappingErrorKind, parse_candidate_mapping_catalog}; use super::case_subjects::{CaseSubjectErrorKind, parse_case_subject_catalog}; use super::domain::{ - CANDIDATES, CASES, CandidateId, CaseId, INPUT_BINDING_COUNT, INPUT_BINDINGS, InputBindingId, - NONCLAIMS, REQUIRED_CANDIDATE_CASES, + CandidateId, CaseId, INPUT_BINDING_COUNT, INPUT_BINDINGS, InputBindingId, NONCLAIMS, + REQUIRED_CANDIDATE_CASES, }; use super::fixtures::{FixtureErrorKind, parse_fixture_catalog}; use super::packet::{ @@ -16,18 +16,11 @@ use super::packet::{ mutation_manifest_digest_hex, parse_cross_cutting_fixture_proposal_manifest, parse_mutation_manifest, }; +pub(crate) use super::schedule::PlannedExecution; +use super::schedule::latin_base_schedule; use super::sha256; use super::strict_json::{self, JsonValue}; -#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] -pub(crate) struct PlannedExecution { - pub(crate) ordinal: usize, - pub(crate) round: usize, - pub(crate) position: usize, - pub(crate) candidate: CandidateId, - pub(crate) case: CaseId, -} - #[derive(Clone, Copy, Debug, Eq, PartialEq)] pub(crate) struct ReplayInputs<'a> { bytes: [&'a [u8]; INPUT_BINDING_COUNT], @@ -248,20 +241,7 @@ pub(crate) fn prepare_replay( }); } - let mut schedule = Vec::with_capacity(REQUIRED_CANDIDATE_CASES); - for round in 0..CANDIDATES.len() { - for position in 0..CANDIDATES.len() { - let candidate = CANDIDATES[(round + position) % CANDIDATES.len()]; - let case = CASES[(2 * round + position) % CASES.len()]; - schedule.push(PlannedExecution { - ordinal: schedule.len() + 1, - round: round + 1, - position: position + 1, - candidate, - case, - }); - } - } + let schedule = latin_base_schedule(); Ok(ReplayPlan { packet_sha256: packet.digest_hex(), schedule, diff --git a/compiler/crates/orange-compiler/tests/d004_support/schedule.rs b/compiler/crates/orange-compiler/tests/d004_support/schedule.rs new file mode 100644 index 0000000..c9cae19 --- /dev/null +++ b/compiler/crates/orange-compiler/tests/d004_support/schedule.rs @@ -0,0 +1,76 @@ +use super::domain::{CANDIDATES, CASES, CandidateId, CaseId, REQUIRED_CANDIDATE_CASES}; + +pub(crate) const REQUIRED_REPETITIONS_PER_SLOT: usize = 3; +pub(crate) const REQUIRED_EXECUTION_RECORDS: usize = + REQUIRED_CANDIDATE_CASES * REQUIRED_REPETITIONS_PER_SLOT; + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub(crate) struct PlannedExecution { + pub(crate) ordinal: usize, + pub(crate) round: usize, + pub(crate) position: usize, + pub(crate) candidate: CandidateId, + pub(crate) case: CaseId, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub(crate) struct ReviewedExecution { + pub(crate) execution_ordinal: usize, + pub(crate) repetition: usize, + pub(crate) logical_slot_ordinal: usize, + pub(crate) round: usize, + pub(crate) position: usize, + pub(crate) candidate: CandidateId, + pub(crate) case: CaseId, +} + +impl ReviewedExecution { + pub(crate) const fn logical_slot(self) -> PlannedExecution { + PlannedExecution { + ordinal: self.logical_slot_ordinal, + round: self.round, + position: self.position, + candidate: self.candidate, + case: self.case, + } + } +} + +/// The reviewed 5-by-5 balanced Latin identity schedule inherited byte-for-byte +/// from the v0.5 draft laboratory. +pub(crate) fn latin_base_schedule() -> Vec { + let mut schedule = Vec::with_capacity(REQUIRED_CANDIDATE_CASES); + for round in 0..CANDIDATES.len() { + for position in 0..CANDIDATES.len() { + schedule.push(PlannedExecution { + ordinal: schedule.len() + 1, + round: round + 1, + position: position + 1, + candidate: CANDIDATES[(round + position) % CANDIDATES.len()], + case: CASES[(2 * round + position) % CASES.len()], + }); + } + } + schedule +} + +/// Expands the logical schedule in the reviewed physical order: one complete +/// Latin traversal for repetition one, then repetitions two and three. +pub(crate) fn repetition_major_execution_schedule() -> Vec { + let logical = latin_base_schedule(); + let mut schedule = Vec::with_capacity(REQUIRED_EXECUTION_RECORDS); + for repetition in 1..=REQUIRED_REPETITIONS_PER_SLOT { + for slot in &logical { + schedule.push(ReviewedExecution { + execution_ordinal: schedule.len() + 1, + repetition, + logical_slot_ordinal: slot.ordinal, + round: slot.round, + position: slot.position, + candidate: slot.candidate, + case: slot.case, + }); + } + } + schedule +} diff --git a/compiler/crates/orange-compiler/tests/d009_decision_suite.rs b/compiler/crates/orange-compiler/tests/d009_decision_suite.rs index e9a3156..8e997ba 100644 --- a/compiler/crates/orange-compiler/tests/d009_decision_suite.rs +++ b/compiler/crates/orange-compiler/tests/d009_decision_suite.rs @@ -41,8 +41,8 @@ const CASE_INPUT_INDEX: &[u8] = const SOLVER_TRUST_SUITE: &[u8] = include_bytes!("../../../../docs/SOLVER_TRUST_DECISION_SUITE.md"); const PACKET_CANONICAL_SHA256: &str = - "fa1411c83fdb6b57b8100f296ca904d88155ad6aa57bd7f48af62ae90c9ead31"; -const PACKET_RAW_SHA256: &str = "c0ad0227f1f374da8796c6db4866188213be53bd904bbf22b141ee1de6e57171"; + "f95adf14aebe4232b7ca59b7a33302522901571416f4d182a1239a6f3504e0be"; +const PACKET_RAW_SHA256: &str = "d16f3f325e372e76e39eaa69d1d8183506a268d99502f6786b840816abf42a14"; const INDEX_RAW_SHA256: &str = "c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859"; fn checked_in_replay_inputs() -> ReplayInputs<'static> { diff --git a/compiler/crates/orange-compiler/tests/d009_support/domain.rs b/compiler/crates/orange-compiler/tests/d009_support/domain.rs index eb7de27..f9e8f49 100644 --- a/compiler/crates/orange-compiler/tests/d009_support/domain.rs +++ b/compiler/crates/orange-compiler/tests/d009_support/domain.rs @@ -320,7 +320,7 @@ pub(crate) const SEMANTIC_BINDINGS: [SemanticBinding; SEMANTIC_BINDING_COUNT] = section_end_heading: None, section_start_heading: None, normalization: SEMANTIC_NORMALIZATION, - normalized_sha256: "c38f7b1d3b3f733a628e0618124e290648298eea8dab2ef89f81c597eb68d177", + normalized_sha256: "c65d91e5566f72114a71739efa8ca300feea24f0f2312e902d06fd9172fa0628", }, SemanticBinding { id: SemanticBindingId::DecisionRegisterD009, @@ -338,7 +338,7 @@ pub(crate) const SEMANTIC_BINDINGS: [SemanticBinding; SEMANTIC_BINDING_COUNT] = section_end_heading: None, section_start_heading: None, normalization: SEMANTIC_NORMALIZATION, - normalized_sha256: "c92c6657068d3a71b8ccb184b408020f5cd44971286b2743e1e4d55dd67125e6", + normalized_sha256: "85480fb2764ae7bb98acd08590bb49116f5bb8cf62bebdee509aadbf1e22e6ea", }, SemanticBinding { id: SemanticBindingId::RoadmapS4, diff --git a/compiler/crates/orange-compiler/tests/d010_decision_suite.rs b/compiler/crates/orange-compiler/tests/d010_decision_suite.rs index 0969161..5e89c94 100644 --- a/compiler/crates/orange-compiler/tests/d010_decision_suite.rs +++ b/compiler/crates/orange-compiler/tests/d010_decision_suite.rs @@ -37,8 +37,8 @@ const COMPILER_STRATEGY_SUITE: &[u8] = include_bytes!("../../../../docs/COMPILER_STRATEGY_DECISION_SUITE.md"); const PACKET_CANONICAL_SHA256: &str = - "ae6c8fc6e433d3cbb895aebf95667711d442efa348e241c0059e72a489bcac9b"; -const PACKET_RAW_SHA256: &str = "647ed6e554a0440c7345e52ff8263aba9d2cb19e444e5956203595c0461d6f6e"; + "14962f66ada4ca34e18e5711b0993da3868f139bf39cfd50e37433b56ca68304"; +const PACKET_RAW_SHA256: &str = "67b0d49b3cd085130328670d4df229372ee4cf906e3e55abe12dcf91534d52aa"; const INDEX_RAW_SHA256: &str = "e9f59e86dff6219474d244ff01a98c75b7b17c65f1f91506d483a57e95e33670"; const SUITE_RAW_SHA256: &str = "5d36f1faeda027b9784846af0aa742339c6b821f39b72a8ca067a90c41a46c73"; diff --git a/compiler/crates/orange-compiler/tests/d010_support/packet.rs b/compiler/crates/orange-compiler/tests/d010_support/packet.rs index 3621aec..84af8d8 100644 --- a/compiler/crates/orange-compiler/tests/d010_support/packet.rs +++ b/compiler/crates/orange-compiler/tests/d010_support/packet.rs @@ -64,7 +64,7 @@ const SEMANTIC_BINDING_NAMES: [&str; 10] = [ ]; const PACKET_CANONICAL_SHA256: &str = - "ae6c8fc6e433d3cbb895aebf95667711d442efa348e241c0059e72a489bcac9b"; + "14962f66ada4ca34e18e5711b0993da3868f139bf39cfd50e37433b56ca68304"; pub(crate) const CASE_INPUT_INDEX_CANONICAL_SHA256: &str = "4c8b0547a8f3bd380f4569008c8728014bb1d8718a5bfe17402bd03866560209"; diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index ee94351..577b0bb 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -27,23 +27,36 @@ unratified, and open architecture choices continue to gate only the component or claim that depends on them. -The D-004 pre-epoch laboratory now byte-materializes exactly 73 -candidate-neutral suite-only subjects as `draft_unreviewed_input_only`: five -positive case subjects, all 26 named mutations, 14 missing-edge subjects, 13 -identity-substitution subjects, and five each for ambiguity, unsupported -behavior, and domain exhaustion. They are fixed inputs for later symmetric -comparison, not members of the accepted language or Core family. All five -class sufficiency reviews and freeze blockers plus replay repetitions remain -unresolved. D-003 is accepted at exact -revision `a82a5cec2ee4359dc2fe66171f17c93146747333`; D-004 owner review is -`none`, the D-004 -epoch is unfrozen, and a separate authenticated input-only catalog contains -five unreviewed structural candidate graph proposals and 70 unresolved SR -mapping rows. Those hypotheses create no adapter, execution, evidence, review, -freeze, selection, conclusion, or readiness credit. Integrity parsing and -structural oracles ratify no semantic boundary. D-004 remains at 0/25 and Orange -at 3/10 binary gate closure (30%); that mechanical score is not release -readiness. +The immutable D-004 v0.5 review subject byte-materializes exactly 73 candidate- +neutral suite-only subjects: five positive cases, all 26 named mutations, 14 +missing-edge subjects, 13 identity-substitution subjects, and five each for +ambiguity, unsupported behavior, and domain exhaustion. Its bound +[`SEMANTIC_STRATA_DECISION_SUITE.md`](SEMANTIC_STRATA_DECISION_SUITE.md) bytes +and historical `draft_unreviewed_input_only` fields remain unchanged. + +On 2026-07-26 the owner accepted D004-PRE-01 as `solo-reviewed` at exact +review-subject revision `7d09a27369649855ce987c76315271b0d34a20ef`. +The `d004-v0.6-reviewed-protocol` overlay finds the five fixture classes +sufficient only for bounded suite coverage (5 ambiguity, 14 missing-edge, 13 +identity-substitution, 5 unsupported, and 5 resource-exhaustion) and reviews +all five candidate graphs and 70 SR rows only as symmetric, falsifiable test +hypotheses. They are not accepted Orange semantics and create no capability or +evidence credit. + +That acceptance covers the immutable review subjects. The resulting overlay's +implementation closure remains `provisional_pending_exact_merged_revision` +until its validated bytes are available at an exact merged revision. + +The reviewed replay plan assigns three deterministic repetitions to each of 25 +candidate-case units, or 75 planned executions, but remains uninstantiated. +Candidate adapters, executable manifests, enforcing isolation, result parsers, +an exact execution-subject revision, and a separate owner freeze record remain +absent. The epoch is null and unfrozen, execution is unauthorized, evidence is +zero completed of 25 required units and 0 of 75 result records, and selection +and conclusion remain null. Integrity parsing and structural oracles ratify no +semantic boundary. D-004 remains proposed, S3b remains blocked, and Orange +remains at 3 of 10 binary gate closure (30%); that mechanical score is not +release readiness. D-010 also remains unresolved. Compiler descriptions below are candidate requirements and claim-boundary obligations, not a selected backend, pass diff --git a/docs/ASSURANCE.md b/docs/ASSURANCE.md index 927b8e7..9d6edb8 100644 --- a/docs/ASSURANCE.md +++ b/docs/ASSURANCE.md @@ -38,22 +38,33 @@ PR #9 merged the S3a implementation and normative records as commit implementation evidence, not proof of semantic soundness or a stable public compatibility promise. -The D-004 input-only laboratory byte-materializes exactly 73 candidate-neutral -suite-only subjects as `draft_unreviewed_input_only`: five positive case -subjects, all 26 named mutations, 14 missing-edge subjects, 13 -identity-substitution subjects, and five each for ambiguity, unsupported -behavior, and domain exhaustion. All five class sufficiency reviews and freeze -blockers, plus replay repetitions, remain unresolved. D-003 is accepted at exact revision -`a82a5cec2ee4359dc2fe66171f17c93146747333`; D-004 owner protocol review is -`none`, the D-004 -epoch is unfrozen, and execution remains 0/25. A separate authenticated -input-only catalog contains five unreviewed candidate graph hypotheses and 70 -unresolved relationship mappings, with no adapters, observations, evidence, -selection, or conclusion. Canonical parsing, digest checks, and structural -integrity oracles over opaque suite-only models are not candidate executions -and establish no Orange semantics, proof, leakage, target, cryptographic, or -readiness assurance. Orange's binary gate-closure score remains 3/10 (30%); -that mechanical score is not release readiness. +The immutable D-004 v0.5 review subject byte-materializes exactly 73 candidate- +neutral suite-only subjects and binds the exact historical +[`SEMANTIC_STRATA_DECISION_SUITE.md`](SEMANTIC_STRATA_DECISION_SUITE.md) bytes. +Its `draft_unreviewed_input_only` fields remain unchanged. On 2026-07-26 the +owner accepted D004-PRE-01 as `solo-reviewed` at exact review-subject revision +`7d09a27369649855ce987c76315271b0d34a20ef`. The successor +`d004-v0.6-reviewed-protocol` finds 5 ambiguity, 14 missing-edge, 13 identity- +substitution, 5 unsupported, and 5 resource-exhaustion subjects sufficient only +for bounded suite coverage. It reviews five candidate graphs and 70 SR mappings +only as symmetric, falsifiable test hypotheses; none is accepted Orange +semantics or evidence of capability. + +The acceptance covers those immutable review subjects. The v0.6 implementation +closure remains `provisional_pending_exact_merged_revision` until the validated +overlay is present at an exact merged revision. + +The reviewed replay plan assigns three deterministic repetitions to each of 25 +candidate-case units, for 75 planned executions with a fresh empty candidate- +specific cache per execution and deterministic equality requirements. It is not +an executable evidence epoch: adapters and executable manifests remain absent, +the epoch is null and unfrozen, execution is unauthorized, and evidence remains +zero completed of 25 required units and 0 of 75 result records. Selection and +conclusion remain null. Canonical parsing, digest checks, and structural oracles +establish no Orange semantics, proof, leakage, target, cryptographic, or +readiness assurance. D-004 remains proposed, S3b remains blocked, and Orange's +binary gate-closure score remains 3 of 10 (30%); that mechanical score is not +release readiness. The D-010 input-only laboratory is planning evidence only. It compares five candidate identities across eight zero-fixture cases and remains at 0/40. It diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md index f476ed3..dd9f40d 100644 --- a/docs/DECISIONS.md +++ b/docs/DECISIONS.md @@ -123,25 +123,39 @@ specified in the [D-004 semantic-strata decision suite](SEMANTIC_STRATA_DECISION_SUITE.md). That Draft protocol records 0/25 required candidate-case executions: 0/5 candidates have complete five-case packets, and 0/5 cases have complete -cross-candidate execution. It selects no stratum and does not authorize S3b. - -Its input-only pre-epoch laboratory now byte-materializes exactly 73 -candidate-neutral suite-only subjects under -`draft_unreviewed_input_only`: five positive case subjects, all 26 named -mutation subjects, 14 missing-edge subjects, 13 identity-substitution subjects, -and five each for ambiguity, unsupported behavior, and domain exhaustion. All -five class sufficiency reviews and freeze blockers remain unresolved, and -replay repetitions remain unresolved and unassigned. Integrity parsing and -structural oracles over those fixed input bytes are not candidate executions -and ratify no Orange semantics. A separate authenticated input-only catalog now -contains five unreviewed structural candidate graph proposals and 70 unresolved -SR mapping rows. D-003 is accepted at exact revision -`a82a5cec2ee4359dc2fe66171f17c93146747333`; the D-004 epoch remains -unfrozen, and D-004 owner protocol review -remains `none`. The mapping hypotheses create no adapter, execution, evidence, -review, freeze, recommendation, selection, or conclusion and supply no roadmap -or readiness credit. Orange's 3/10 (30%) binary gate-closure score remains -unchanged; that mechanical score is not release readiness. +cross-candidate execution. Its exact packet, catalogs, and bound suite-document +bytes are the historical D004-PRE-01 review subjects and remain unchanged. + +The v0.5 laboratory byte-materializes exactly 73 candidate-neutral suite-only +subjects under its historical `draft_unreviewed_input_only` status: five +positive cases, all 26 named mutations, 14 missing-edge subjects, 13 identity- +substitution subjects, and five each for ambiguity, unsupported behavior, and +domain exhaustion. On 2026-07-26 the owner accepted D004-PRE-01 as +`solo-reviewed` at exact review-subject revision +`7d09a27369649855ce987c76315271b0d34a20ef`. The successor +`d004-v0.6-reviewed-protocol` finds the five fixture classes reviewed and +sufficient only for bounded suite coverage: 5 ambiguity, 14 missing-edge, 13 +identity-substitution, 5 unsupported, and 5 resource-exhaustion. It reviews all +five candidate graphs and 70 SR mappings only as symmetric, falsifiable test +hypotheses; none is accepted Orange semantics or establishes capability. + +That acceptance covers the immutable review subjects, not a revision that +already contained the successor overlay. The v0.6 implementation closure stays +`provisional_pending_exact_merged_revision` until the validated bytes are +available at an exact merged revision. + +The reviewed replay plan assigns exactly three deterministic repetitions to +each of the 25 candidate-case units, for 75 planned executions. Every execution +requires a fresh empty candidate-specific cache and equality of the specified +deterministic fields. The plan remains uninstantiated: adapters, executable +manifests, enforcing isolation, result parsers, an exact execution-subject +revision, and a separate owner freeze record are absent. The D-004 epoch is null +and unfrozen, execution is unauthorized, evidence remains zero completed of 25 +required units and 0 of 75 result records, and selection and conclusion remain +null. Integrity parsing and structural oracles ratify no Orange semantics. +D-004 remains proposed, S3b remains blocked, and Orange's 3-of-10 (30%) binary +gate-closure score remains unchanged; that mechanical score is not release +readiness. ## D-005 — Public assurance model diff --git a/docs/GATE0_TRACEABILITY.md b/docs/GATE0_TRACEABILITY.md index 3e28dc9..033c54b 100644 --- a/docs/GATE0_TRACEABILITY.md +++ b/docs/GATE0_TRACEABILITY.md @@ -144,21 +144,29 @@ The preserved Gate 0 closure ledger was: | F-13 | NIST ACVP-compatible vector exchange and standards provenance metadata | W5 and W7; standards working group and Cryptography Review Board | F-12; D-005 claim model; D-014 package/evidence model; D-015 corpus; D-016 validation/certification posture; source-rights decision under D-018 | `N/C/A/X`: clause- and errata-linked provenance records, exact source/vector digests and rights, ACVP adapters, round-trip cases, external status records, and laboratory evidence when claimed | Every admitted source and vector has stable identity, digest, locator, rights, and review; adapter round trips preserve the applicable schema and semantics; Gate 4 vectors pass; public wording never calls local replay an ACVP/CAVP certificate or Orange FIPS validated | `proposed`; `blocked` | Gate 4 | `mapped` | | F-14 | Reproducible, signed releases for supported hosts | W6 and W7; Release Engineering, PSIRT, and Assurance and TCB Board | All preceding features; D-008 implementation languages; D-011 host/target envelope; D-014 package model; D-019 release authority; D-020 supply-chain target; D-021 bootstrap policy; D-022 funded support policy | `N/M/C/A/X/O`: hermetic build closure, two independent rebuild attestations, signatures and transparency records, SBOM/CBOM, provenance and proof bundles, audits, and release/revocation/recovery drills | At Gate 7 two independently administered builders reproduce each supported artifact; network-disabled build and offline verification bind source, claims, SBOM/CBOM, provenance, proofs, and signatures; all stop-ship findings are closed; rollback, freeze, compromise, revocation, and disaster-recovery drills pass with multi-role sign-off | `proposed`; `blocked` | Gate 7 | `mapped` | -D-004 input materialization is separate from feature or gate completion. -Exactly 73 candidate-neutral suite-only subjects are byte-materialized as -`draft_unreviewed_input_only`: five positive case subjects, all 26 named -mutations, 14 missing-edge subjects, 13 identity-substitution subjects, and five -each for ambiguity, unsupported behavior, and domain exhaustion. All five -class sufficiency reviews and freeze blockers plus replay repetitions remain -unresolved. D-003 candidate PF-01 is accepted through OEP-0004 at exact -revision `a82a5cec2ee4359dc2fe66171f17c93146747333`. D-004 owner review is -`none`, the D-004 epoch is unfrozen, and five unreviewed input-only candidate -graph hypotheses with 70 unresolved relationship mappings exist without -adapters, observations, evidence, selection, or conclusion. -Integrity parsing and structural oracles over opaque suite-only models are not -candidate executions and satisfy none of the F-01, F-03, F-04, or F-06 exit -evidence. D-004 remains at 0/25 and S3 remains open. The binary gate-closure -score remains 3/10 (30%); that mechanical score is not release readiness. +D-004 protocol review remains separate from feature or gate completion. Its +immutable v0.5 review subject contains exactly 73 candidate-neutral suite-only +subjects and the exact bound semantic-strata suite bytes; the historical +`draft_unreviewed_input_only` fields remain unchanged. On 2026-07-26 the owner +accepted D004-PRE-01 as `solo-reviewed` at exact review-subject revision +`7d09a27369649855ce987c76315271b0d34a20ef`. + +That acceptance covers the immutable review subjects. The successor overlay's +implementation closure remains `provisional_pending_exact_merged_revision` +until its validated bytes are available at an exact merged revision. + +The successor `d004-v0.6-reviewed-protocol` finds 5 ambiguity, 14 missing-edge, +13 identity-substitution, 5 unsupported, and 5 resource-exhaustion subjects +sufficient only for bounded suite coverage. Its five candidate graphs and 70 +SR mappings are reviewed only as symmetric, falsifiable test hypotheses, not +accepted semantics or capability evidence. The reviewed replay plan assigns +three deterministic repetitions to each of 25 candidate-case units, for 75 +planned executions, but remains uninstantiated. The epoch is null and unfrozen, +execution is unauthorized, and evidence is zero completed of 25 required units +and 0 of 75 result records. Integrity parsing and structural oracles satisfy +none of the F-01, F-03, F-04, or F-06 exit evidence. D-004 remains proposed, +S3 remains incomplete, S3b remains blocked, and the binary gate-closure score remains 3 of 10 +(30%); that mechanical score is not release readiness. D-010 candidate identity is separate from feature completion. Its two direct-native candidates, versioned Jasmin boundary, portable C11 boundary, and diff --git a/docs/RESEARCH.md b/docs/RESEARCH.md index 20ffbb7..2936069 100644 --- a/docs/RESEARCH.md +++ b/docs/RESEARCH.md @@ -161,21 +161,29 @@ control branches or addresses. Probabilistic sampling must not appear in a pure deterministic specification. Vector intrinsics must name their target feature and semantics. These are separate strata with checked crossings. -The D-004 pre-epoch corpus now byte-materializes exactly 73 candidate-neutral -suite-only subjects as `draft_unreviewed_input_only`: five positive case -subjects, all 26 named mutations, 14 missing-edge subjects, 13 -identity-substitution subjects, and five each for ambiguity, unsupported -behavior, and domain exhaustion. These are fixed research inputs, not Orange -syntax or semantics. Every class sufficiency review and freeze blocker plus -replay repetitions remains unresolved. D-003 candidate PF-01 is accepted -through OEP-0004 at exact revision -`a82a5cec2ee4359dc2fe66171f17c93146747333`. With D-004 owner review -`none`, an unfrozen D-004 epoch, five unreviewed input-only candidate graph -hypotheses with 70 unresolved relationship mappings, and no candidate adapters, -integrity parsing and structural oracles create no candidate execution, -evidence, selection, conclusion, or readiness credit. D-004 remains at 0/25. -Orange's binary gate-closure score remains 3/10 (30%); that mechanical score is -not release readiness. +The immutable D-004 v0.5 review subject byte-materializes exactly 73 candidate- +neutral suite-only subjects and binds the exact historical semantic-strata suite +bytes. Its `draft_unreviewed_input_only` fields remain unchanged; those inputs +are research models, not Orange syntax or semantics. On 2026-07-26 the owner +accepted D004-PRE-01 as `solo-reviewed` at exact review-subject revision +`7d09a27369649855ce987c76315271b0d34a20ef`. + +That acceptance covers the immutable review subjects. The resulting v0.6 +implementation closure remains `provisional_pending_exact_merged_revision` +until the validated overlay is available at an exact merged revision. + +The successor `d004-v0.6-reviewed-protocol` finds 5 ambiguity, 14 missing-edge, +13 identity-substitution, 5 unsupported, and 5 resource-exhaustion subjects +sufficient only for bounded suite coverage. It reviews five candidate graphs +and 70 SR mappings only as symmetric, falsifiable test hypotheses; none is +accepted Orange semantics or capability evidence. The reviewed replay plan +assigns three deterministic repetitions to each of 25 candidate-case units, for +75 planned executions, but candidate adapters and executable manifests remain +absent. The epoch is null and unfrozen, execution is unauthorized, evidence is +zero completed of 25 required units and 0 of 75 result records, and selection +and conclusion remain null. D-004 remains proposed, S3b remains blocked, and +Orange's binary gate-closure score remains 3 of 10 (30%); that mechanical score +is not release readiness. ### 4.5 End-to-end proof still needs interoperability diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 7f6b8c3..f21b4f5 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -381,21 +381,29 @@ The accepted define the owner-executable records and research that may run ahead. Explicit acceptance on 2026-07-26 and Accepted OEP-0004 bind D-003 candidate PF-01 to exact revision `a82a5cec2ee4359dc2fe66171f17c93146747333`, but they do not -accept D-004 or authorize S3b. The D-004 input-only pre-epoch laboratory binds -exactly 73 candidate-neutral suite-only subjects as -`draft_unreviewed_input_only`: five positive case subjects, all 26 named -mutation subjects, 14 missing-edge subjects, 13 identity-substitution subjects, -and five each for ambiguity, unsupported behavior, and domain exhaustion. -Sufficiency review and the freeze blocker for every cross-cutting class remain -unresolved, as do replay repetitions. D-003 is accepted at exact -revision `a82a5cec2ee4359dc2fe66171f17c93146747333`; D-004 owner protocol -review is `none`; the D-004 -epoch is unfrozen. A separate authenticated input-only catalog contains five -unreviewed structural candidate graph proposals and 70 unresolved SR mapping -rows. Those hypotheses create no adapter, execution, evidence, review, freeze, -result, selection, conclusion, or readiness credit. Integrity parsing and -structural oracles ratify no semantics; the laboratory remains at 0/25, S3 -remains open, and Orange remains 30% complete by binary gate closure. +accept D-004 or authorize S3b. The immutable D-004 v0.5 review subject binds +exactly 73 candidate-neutral suite-only subjects and the exact historical suite +bytes; its `draft_unreviewed_input_only` fields remain unchanged. On 2026-07-26 +the owner accepted D004-PRE-01 as `solo-reviewed` at exact review-subject +revision `7d09a27369649855ce987c76315271b0d34a20ef`. + +That acceptance covers the immutable review subjects. The successor overlay's +implementation closure remains `provisional_pending_exact_merged_revision` +until its validated bytes are available at an exact merged revision. + +The successor `d004-v0.6-reviewed-protocol` finds 5 ambiguity, 14 missing-edge, +13 identity-substitution, 5 unsupported, and 5 resource-exhaustion subjects +sufficient only for bounded suite coverage. It reviews all five candidate +graphs and 70 SR mappings only as symmetric, falsifiable test hypotheses, not +accepted Orange semantics or capability evidence. The reviewed replay plan +assigns three deterministic repetitions to each of 25 candidate-case units, for +75 planned executions. It remains uninstantiated: candidate adapters, +executable manifests, enforcing isolation, result parsers, an exact execution- +subject revision, and a separate owner freeze record are absent. The epoch is +null and unfrozen, execution is unauthorized, evidence is zero completed of 25 +required units and 0 of 75 result records, and selection and conclusion remain +null. D-004 remains proposed, S3 remains incomplete, S3b remains blocked, and +Orange remains 30% complete by its unchanged 3-of-10 binary gate-closure score. ## 7. Quality and claim metrics diff --git a/docs/security/THREAT_MODEL.md b/docs/security/THREAT_MODEL.md index 7e9d637..4123a58 100644 --- a/docs/security/THREAT_MODEL.md +++ b/docs/security/THREAT_MODEL.md @@ -70,21 +70,29 @@ compiler, leakage, package, release, and update boundaries. Those future threats are recorded now as design requirements, not as claims that mitigations have been implemented. -The D-004 pre-epoch laboratory byte-materializes exactly 73 candidate-neutral -suite-only subjects as `draft_unreviewed_input_only`: five positive case -subjects, all 26 named mutations, 14 missing-edge subjects, 13 -identity-substitution subjects, and five each for ambiguity, unsupported -behavior, and domain exhaustion. The bytes are fixed research inputs: bounded +The immutable D-004 v0.5 review subject byte-materializes exactly 73 candidate- +neutral suite-only subjects and binds the exact historical semantic-strata suite +bytes. Its `draft_unreviewed_input_only` fields remain unchanged. Bounded integrity parsing and structural oracles do not execute a candidate or ratify -Orange semantics. All five class sufficiency reviews and freeze blockers plus -replay repetitions remain unresolved. D-003 candidate PF-01 is accepted through -OEP-0004 at exact revision `a82a5cec2ee4359dc2fe66171f17c93146747333`. -D-004 owner review is `none`, the D-004 epoch is unfrozen, and execution remains -0/25. A separate authenticated input-only catalog contains five unreviewed -candidate graph hypotheses and 70 unresolved relationship mappings, with no -adapters, observations, evidence, selection, or conclusion. Materialization -closes no S3 or readiness gate. Orange's binary gate-closure score remains 3/10 -(30%); that mechanical score is not release readiness. +Orange semantics. On 2026-07-26 the owner accepted D004-PRE-01 as +`solo-reviewed` at exact review-subject revision +`7d09a27369649855ce987c76315271b0d34a20ef`. + +That acceptance covers the immutable review subjects. The resulting v0.6 +implementation closure remains `provisional_pending_exact_merged_revision` +until the validated overlay is available at an exact merged revision. + +The `d004-v0.6-reviewed-protocol` overlay finds the five fixture classes +sufficient only for bounded suite coverage (5 ambiguity, 14 missing-edge, 13 +identity-substitution, 5 unsupported, and 5 resource-exhaustion). Its five +candidate graphs and 70 SR mappings are reviewed only as symmetric, falsifiable +test hypotheses, not accepted Orange semantics or capability evidence. The +reviewed replay plan assigns three deterministic repetitions to each of 25 +candidate-case units, for 75 planned executions, but remains uninstantiated. +The epoch is null and unfrozen, execution is unauthorized, and evidence is zero +completed of 25 required units and 0 of 75 result records. D-004 remains +proposed, S3b remains blocked, and Orange's binary gate-closure score remains 3 +of 10 (30%); that mechanical score is not release readiness. The D-010 laboratory currently binds only five candidate identities and eight zero-fixture case blockers, for 0/40 execution. It executes no compiler or tool, @@ -245,7 +253,7 @@ that the owner holds all roles and that independent ownership is unavailable. | CMP-002 | Foundation policy and evidence records | Historical Gate 0 inputs plus current solo-bootstrap records | Planning, decisions, threat/control records, provisional schemas, and conformance fixtures. Historical Gate 0 material is retained as an input under the current capability-local model. See [`README.md`](../../README.md), [`docs/DECISIONS.md`](../DECISIONS.md), and [`schemas/README.md`](../../schemas/README.md). | | CMP-003 | Repository CI | Current on `main` with exact acceptance and post-acceptance evidence | Repository-owned policy, dependency-review, link, workflow-metadata-audit, and Scorecard workflows are under [`.github/workflows/`](../../.github/workflows/). PR #9 and exact merged revision `6c0bd3021cf2df603e08808e4660724ca1e2b2a5` retain the accepted S3a evidence. The later PR #11 head passed Required CI `29292600483`, Dependency Review `29292600471`, and CodeQL `29292598799`; exact merged revision `23352bcde976b86890db28ea4d375a31e6354bca` passed push Required CI `29292740885`, Workflow Online Audit `29292740874`, External Links `29292740884`, Scorecard `29292740941`, and dynamic CodeQL `29292740478`. Required CI covered policy `0.2.6`, 92 Rust tests including the documentation test, 103 Python tests, and zero foundation-validator findings. Ruleset `18810248` requires the exact Required CI and Dependency Review app-bound contexts. These executions do not demonstrate semantic soundness, vulnerability absence, independent review, scheduled or manual-dispatch event behavior, or refreshed hosted settings. | | CMP-004 | Orange driver and language services | S3a current on `main` | Rust source map, byte spans, lexer, bounded parser, syntax tree, diagnostics, and `orangec check`/`eval`/`lex`. The merged implementation includes declaration-kind namespace checks, exact `Int`/`Word[8]` typed literals, noncanonical Typed Reference Core construction, and deterministic evaluation; no calls, operators, typed `impl`, LSP, proof, refinement, or code generation exists. | -| CMP-005 | Orange semantic and evidence system | Future beyond current S3a, with input-only D-004 research bytes | Planned canonical Core family, claims, Proof IR, proof search, and authoritative offline checker. The Typed Reference Core in CMP-004 has no canonical encoding, proof identity, or relationship to this future family. D-004 carries exactly 73 `draft_unreviewed_input_only` suite-only subjects and 70 unreviewed candidate-by-relationship mapping hypotheses, but no accepted semantics or mapping, adapter, execution, or evidence. | +| CMP-005 | Orange semantic and evidence system | Future beyond current S3a, with reviewed-not-executable D-004 research inputs | Planned canonical Core family, claims, Proof IR, proof search, and authoritative offline checker. The Typed Reference Core in CMP-004 has no canonical encoding, proof identity, or relationship to this future family. D004-PRE-01 reviews the immutable 73-subject v0.5 corpus as sufficient only for bounded suite coverage and the five graphs/70 mappings only as symmetric, falsifiable test hypotheses. The v0.6 plan remains unfrozen and unauthorized at 0/25 units and 0/75 result records; it supplies no accepted semantics, mapping conformance, adapter, execution, or evidence. | | CMP-006 | Orange compiler and output boundary | Future | Five D-010 candidates are under input-only comparison: two direct-native paths, versioned Jasmin, portable C11, and versioned LLVM IR. No strategy, lowering, code-generation stage, external compiler, target, artifact, or evidence exists. | | CMP-007 | Package, registry, build, and release system | Future | Planned immutable dependency resolution, registry, hermetic builds, provenance, signing, publication, updates, and recovery. No implementation exists. | | CMP-008 | Standards and cryptography corpus | Future | Planned standards/errata provenance, vectors, packages, proofs, tests, and external-validation records. No implementation exists. | @@ -349,7 +357,7 @@ compliance evidence. | CTL-019 | GitHub CodeQL default setup analyzes the current Actions, Python, and Rust surfaces and preserves alert lifecycle state | PR #11 CodeQL `29292598799` succeeded before merge, and dynamic CodeQL `29292740478` succeeded at exact revision `23352bcde976b86890db28ea4d375a31e6354bca`. Actions `1474500928`=`0/23`, Python `1474500920`=`0/50`, and Rust `1474500915`=`0/27`, all without analysis warnings. The open alert readback contained only Scorecard posture alerts #4-#10 and no open CodeQL alerts. | Coverage is limited to the named revision, languages, configured rules, queries, and platform executions. Zero configured-query results and no open CodeQL alerts do not prove vulnerability absence. No CodeQL threshold or independent analysis exists. | | CTL-020 | The dependency-free Rust compiler frontend forbids unsafe code; caps source bytes, tokens, syntax nodes, parser events, emitted diagnostics, and recovery depth; sanitizes diagnostic control text; and exercises source, span, lexer, parser, diagnostic, and CLI behavior with malformed-input, Unicode, line-ending, resource, repeatability, and exact external black-box conformance tests. | Policy `0.2.6`, 92 Rust tests including the documentation test, 103 Python tests, parser source, exact budget bindings, and the external corpus were recorded at subject revision `23352bcde976b86890db28ea4d375a31e6354bca`; PR Required CI `29292600483` and post-merge Required CI `29292740885` succeeded with zero foundation-validator findings | Tests do not establish parser correctness, semantic soundness, proof, code-generation, cryptographic, leakage, or production correctness; the Rust toolchain, host, algorithmic behavior inside the budgets, and sole-owner review remain trusted or residual risks. | | CTL-021 | D-026, Accepted OEP-0003, and [`SEMANTICS_2026.md`](../SEMANTICS_2026.md) constrain S3a to same-kind namespace uniqueness, exact contextual `Int`/`Word[8]` typed literals, fail-closed semantic/Core/integer/evaluation budgets, a noncanonical source-ordered Typed Reference Core, and deterministic compiler-phase-transactional evaluation output. Compiler-phase errors precede emission, while detected transport failures return failure; an unretractable prefix already accepted by the output stream is a failed, nonaccepted result. | Accepted implementation evidence remains bound to exact merged revision `6c0bd3021cf2df603e08808e4660724ca1e2b2a5`. Later exact revision `23352bcde976b86890db28ea4d375a31e6354bca` adds the external black-box corpus and draft D-003/D-004 research protocols; policy `0.2.6`, 92 Rust tests including the documentation test, 103 Python tests, and zero foundation-validator findings passed PR Required CI `29292600483`, followed by post-merge Required CI `29292740885`. | Shared specification/implementation mistakes, integer decoding and formatting defects, allocation or host failure within budgets, and sole-owner review remain. The later evidence does not alter S3a acceptance, accept D-003/D-004, authorize S3b, or establish semantic proof, independent review, refinement, code generation, leakage, ABI, cryptographic correctness, external certification, or product-release readiness. | -| CTL-022 | The D-004 input-only laboratory content-identifies exactly 73 candidate-neutral suite-only subjects and five unreviewed graph proposals with 70 candidate-by-relationship mapping rows, and permits only bounded canonical parsing, digest checks, and structural integrity-oracle evaluation. No candidate adapter or execution exists. | Current pre-epoch input materialization only; `draft_unreviewed_input_only`, owner review `none`, epoch unfrozen, and 0/25 candidate-case executions | Integrity checks can detect malformed or substituted repository inputs but prove neither fixture sufficiency nor semantic correctness. Shared modeling mistakes, parser/oracle defects, sole-owner bias, and future adapter behavior remain; no observation, evidence, selection, S3 closure, or readiness credit follows. | +| CTL-022 | The D-004 laboratory preserves the immutable v0.5 review subject and overlays the D004-PRE-01 `solo-reviewed` fixture, mapping-hypothesis, and three-repetition policy without changing historical bytes. It permits only bounded canonical parsing, digest checks, structural integrity-oracle evaluation, and reviewed schedule construction. | Owner direction bound to review-subject revision `7d09a27369649855ce987c76315271b0d34a20ef`; reviewed-not-executable v0.6 implementation closure remains provisional pending an exact merged revision; epoch null and unfrozen, execution unauthorized, 0/25 candidate-case units, and 0/75 result records | Integrity checks and protocol review can establish input identity, bounded suite-coverage sufficiency, and symmetric test intent, but not semantic correctness or candidate capability. Shared modeling mistakes, parser/oracle defects, sole-owner bias, absent adapters/isolation/manifests, and future execution behavior remain; no observation, evidence, selection, S3 closure, or readiness credit follows. | ## Entry points and attack surfaces diff --git a/policy/README.md b/policy/README.md index 33a7f8c..442c4a4 100644 --- a/policy/README.md +++ b/policy/README.md @@ -223,11 +223,10 @@ a shutdown retry. The tree remains closed by default. Permanent files and conformance instances use an exact static inventory; correctly named OEP and ADR records may be added outside it and receive structural validation. The admitted `research` tree is -likewise exact. It contains the non-product, draft-unfrozen D-004 input packet, -named-mutation manifest, five-positive/26-mutation case-subject catalog, -unreviewed cross-cutting fixture-proposal manifest, and 42-subject -executable-input catalog, plus the five-graph/70-row unreviewed candidate-mapping -catalog; the D-005 execution packet and historical +likewise exact. It contains the immutable non-product D-004 v0.5 input packet, +manifests, subject catalogs, and five-graph/70-row mapping catalog plus the +separate reviewed-not-executable v0.6 owner record, protocol, and replay plan; +the D-005 execution packet and historical v0.1 negative corpus; and the input-only D-006, D-009, and D-010 packets and case indexes. Every D-006, D-009, and D-010 case row has zero executable fixtures, unresolved coverage, and an active freeze blocker. Their laboratories may @@ -240,32 +239,45 @@ missing-edge, 13 identity-substitution, and five each for ambiguity, unsupported behavior, and domain exhaustion. Its separate canonical catalog, together with the case-subject catalog's five positive and 26 named-mutation subjects, byte-materializes exactly 73 candidate-neutral suite-only inputs as -`draft_unreviewed_input_only`. Their closed parsers, digest checks, and bounded -structural integrity oracles create no candidate observation or evidence, -verify no replay ceiling, and do not treat candidate-adapter failure as an -expected unsupported observation. All five class sufficiency reviews and -freeze blockers remain unresolved; replay repetitions remain unassigned; and -the D-004 inventory freezes no evidence epoch. Its separate authenticated -input-only mapping catalog contains five unreviewed structural candidate graph -proposals and 70 unresolved SR mapping rows. Those hypotheses create no adapter, -execution, evidence, review, freeze, selection, or readiness credit. Its -protected Rust laboratory +the immutable v0.5 `draft_unreviewed_input_only` review subject. Its exact +bound suite document is immutable for the same reason. Their closed parsers, +digest checks, and bounded structural integrity oracles create no candidate +observation or evidence, verify no replay ceiling, and do not treat candidate- +adapter failure as an expected unsupported observation. + +At exact review-subject revision +`7d09a27369649855ce987c76315271b0d34a20ef`, D004-PRE-01 was accepted as +`solo-reviewed`. The v0.6 overlay finds 5 ambiguity, 14 missing-edge, 13 +identity-substitution, 5 unsupported, and 5 resource-exhaustion subjects +sufficient only for bounded suite coverage. It reviews all five candidate +graphs and 70 SR mapping rows only as symmetric, falsifiable test hypotheses; +they remain unaccepted as Orange semantics and create no capability or evidence +credit. Its protected Rust laboratory also generates and strictly re-parses a closed, in-memory future result/replay descriptor. The descriptor derives an exact 73-row observation oracle from the authenticated case and cross-cutting subject catalogs, binds the exact 26-mutation inventory and 25-slot identity plan, and enumerates all 31 top-level future case-record fields plus their nested shapes. Its 10-field scheduled-slot -preimage contract creates no concrete preimage or digest before the epoch, -packet identity, and replay-plan identity are frozen. The descriptor also closes -digest joins, checked resource and SR-dependent verdict rules, replay failure -states, and empty result, observation, verdict, review, and evidence -collections. It exposes no launcher, adapter, or persistence API; owner -protocol review remains `none`, execution remains 0/25, and both -`roadmap_gate_credit` and `readiness_credit` remain `none`. D-003 candidate PF-01 is -accepted through OEP-0004 at exact revision -`a82a5cec2ee4359dc2fe66171f17c93146747333`, while D-004 owner protocol review -remains `none`. None of these input inventories contains a candidate -result, accepted D-004 decision, or release evidence. D-005's protected Rust +preimage contract creates no concrete scheduled-execution digest before the +epoch, packet identity, and executable manifests are frozen. The reviewed plan +assigns exactly three deterministic repetitions to each of 25 candidate-case +units, for 75 planned executions in repetition-major order, with a fresh empty +candidate-specific cache per execution and deterministic equality requirements. +The acceptance covers the immutable review subjects; because it preceded the +v0.6 implementation's commit identity, implementation closure remains +`provisional_pending_exact_merged_revision` until an exact merged revision is +recorded. +The descriptor also closes digest joins, checked resource and SR-dependent +verdict rules, replay failure states, and empty result, observation, verdict, +review, and evidence collections. + +The reviewed protocol exposes no launcher, adapter, or persistence API. Its +epoch is null and unfrozen, execution is unauthorized, evidence remains zero +completed of 25 required units and 0 of 75 result records, and both +`roadmap_gate_credit` and `readiness_credit` remain `none`. None of these +inventories contains a candidate result, accepted D-004 decision, or release +evidence; D-004 remains proposed, S3b remains blocked, and the 3-of-10 (30%) +binary gate-closure score is unchanged. D-005's protected Rust laboratory may construct canonical adapter requests and validate synthetic captured transport envelopes, enumerate the exact 192 in-memory transport identities, and bind a closed diff --git a/policy/gate0-repository-policy.json b/policy/gate0-repository-policy.json index d460c11..5056bb5 100644 --- a/policy/gate0-repository-policy.json +++ b/policy/gate0-repository-policy.json @@ -1,5 +1,5 @@ { - "policy_version": "0.2.121", + "policy_version": "0.2.122", "repository": "chasebryan/orange", "stage": "solo-bootstrap", "status": "enforced", @@ -162,7 +162,10 @@ "compiler/crates/orange-compiler/tests/d004_support/fixtures.rs", "compiler/crates/orange-compiler/tests/d004_support/packet.rs", "compiler/crates/orange-compiler/tests/d004_support/result_contract.rs", + "compiler/crates/orange-compiler/tests/d004_support/reviewed_protocol.rs", + "compiler/crates/orange-compiler/tests/d004_support/reviewed_result_contract.rs", "compiler/crates/orange-compiler/tests/d004_support/runner.rs", + "compiler/crates/orange-compiler/tests/d004_support/schedule.rs", "compiler/crates/orange-compiler/tests/d005_decision_suite.rs", "compiler/crates/orange-compiler/tests/d005_support/adapter.rs", "compiler/crates/orange-compiler/tests/d005_support/capture.rs", @@ -243,6 +246,9 @@ "research/decisions/D-004/d004-v0.4-case-subjects.json", "research/decisions/D-004/d004-v0.5-candidate-mappings.json", "research/decisions/D-004/d004-v0.5-draft-packet.json", + "research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json", + "research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json", + "research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json", "research/decisions/D-005/README.md", "research/decisions/D-005/d005-v0.1/epochs/0001/protocol/epoch.json", "research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json", @@ -273,8 +279,10 @@ "scripts/ci/install-actionlint", "scripts/ci/install-lychee", "tools/d004_candidate_mappings.py", + "tools/d004_reviewed_protocol.py", "tools/fs_sandbox.c", "tools/tests/test_d004_draft_packet.py", + "tools/tests/test_d004_reviewed_protocol.py", "tools/tests/test_d005_draft_packet.py", "tools/tests/test_d006_draft_packet.py", "tools/tests/test_d009_draft_packet.py", @@ -341,7 +349,7 @@ "assets/brand/README.md": "546dc8bf2c68eacf452641fb19ef591d41228dcec43d4c028a5758ab9d9a2f82", "assets/brand/manifest.json": "776173a6e2cab2f5840a5f5b882f131ee34ce1ed10a50658717361267e5d93e4", "compiler/.gitignore": "306fd52e74fca6746e12acc750f232de15e71da917756a1270d74c91f5eb7368", - "compiler/crates/orange-compiler/tests/d004_decision_suite.rs": "a521e0fa6670ad9bbf7cc617e7c2ffac68dc8f8c3051175b16a4b5a53ee1b585", + "compiler/crates/orange-compiler/tests/d004_decision_suite.rs": "b2edbdd5b40a93d754d2def1bd7dff494a478459b055ff9f16e8c0c416011c47", "compiler/crates/orange-compiler/tests/d004_support/candidate_mappings.rs": "bb6c76ca7cc754f4af28ef04bbe84cc327b2e805d3750f525e3ff8afcd0401cc", "compiler/crates/orange-compiler/tests/d004_support/case_subjects.rs": "08f2e65cd060dd1422ff1f7cae41c84463708155e1f362bd41040b4f90f9b854", "compiler/crates/orange-compiler/tests/d004_support/cases.rs": "aebeb6d46a9f30f456232b3d13da6763bb84849c5c962c7d3026777de8d4b879", @@ -349,7 +357,10 @@ "compiler/crates/orange-compiler/tests/d004_support/fixtures.rs": "02efc270829d981bb30b461bb3ed48800e1d2e6df2877a9fb31df363789ae5a5", "compiler/crates/orange-compiler/tests/d004_support/packet.rs": "1f588626268a5f08e612fa2a158c0570db97ce3a448efff55edbb18293d69c44", "compiler/crates/orange-compiler/tests/d004_support/result_contract.rs": "f3fdb4187fa9dffb23e849208da20f112aba764cfa85df80ae578754f3c9c97a", - "compiler/crates/orange-compiler/tests/d004_support/runner.rs": "b2c3be1a4221e8fcb9abe9622105c972edf431021012b9fb24ebc9b20818c3b3", + "compiler/crates/orange-compiler/tests/d004_support/reviewed_protocol.rs": "57550ac165eafae42a265ed664424deb6ac8331732b2c84c55e893812fcf4af3", + "compiler/crates/orange-compiler/tests/d004_support/reviewed_result_contract.rs": "ab250ed97bf63481c2bd5fc325273a0bfa7beee24a6b9901772700dec37d7eb8", + "compiler/crates/orange-compiler/tests/d004_support/runner.rs": "280e59cb24563ad36b632e5dc21d013e3901ef8c3e1ffa2fb19d7742cc3e285b", + "compiler/crates/orange-compiler/tests/d004_support/schedule.rs": "67a3a580c5b596f150c68d2f91041d97bffe20ce3ce3e8b5d157024fd329e235", "compiler/crates/orange-compiler/tests/d005_decision_suite.rs": "a9b5a2208fcf911b19bc92902083d597564041d9cfebdb851386fb90ffcd3c20", "compiler/crates/orange-compiler/tests/d005_support/adapter.rs": "4825755b5fe852357c700670f317fb09c01bb432bcd42b0cf22c535160f3d172", "compiler/crates/orange-compiler/tests/d005_support/capture.rs": "4d2564a3cd196c7af2bc232d9435b62951126c491778052b1950fbf3c62a08ef", @@ -363,13 +374,13 @@ "compiler/crates/orange-compiler/tests/d006_support/domain.rs": "3481b3c93f2850ca1e654f98a252c444dad3873438363f121435f7e91a4f73c9", "compiler/crates/orange-compiler/tests/d006_support/packet.rs": "ef7db53a3400784e1c72ed6210a1f22ef02527f825eae804dd857f9c9c773a06", "compiler/crates/orange-compiler/tests/d006_support/runner.rs": "2ff850b72fde81d5a66cc3f58df8d54e642a906c7ccad728db8d0f77b53f72c0", - "compiler/crates/orange-compiler/tests/d009_decision_suite.rs": "4ea48cde731a4ccca7bc7691254ba70b7815fb45dcb60b1e1e951931dd2dc844", - "compiler/crates/orange-compiler/tests/d009_support/domain.rs": "00825848135d5196bb27f2ec6548ecf7cc7d76acae4d2ac9cb12e284e7da2b59", + "compiler/crates/orange-compiler/tests/d009_decision_suite.rs": "af01dd397d481b07304842e07e1b70d50842cbb6d0ca9ab08a0fb25c3e8bca58", + "compiler/crates/orange-compiler/tests/d009_support/domain.rs": "f23cf4c708b32c567fcd2c97302c1c98f0be4b6d1264d5d88b0636356020885b", "compiler/crates/orange-compiler/tests/d009_support/packet.rs": "7dfe8542bdbd50f6111f08a7c1fe7c9fbb8854df87ab2ba5c5e9ec320776b12a", "compiler/crates/orange-compiler/tests/d009_support/runner.rs": "2ff850b72fde81d5a66cc3f58df8d54e642a906c7ccad728db8d0f77b53f72c0", - "compiler/crates/orange-compiler/tests/d010_decision_suite.rs": "f14cccf8c15c200024da8c74911a8377a374f1f5f6780dbfcb122390403e5027", + "compiler/crates/orange-compiler/tests/d010_decision_suite.rs": "553a4daa9a952f9f08bdb00db8905d7386979c33fc1b603e4f85386ae6ae6f1c", "compiler/crates/orange-compiler/tests/d010_support/domain.rs": "e4586e92ab2c2ebc4b1e5d26f40d1e9293a7ab466388239257d9867513b086a6", - "compiler/crates/orange-compiler/tests/d010_support/packet.rs": "845d426a203f37ffc320477fadb55b67995640000bb6a10bbe463736110cdb96", + "compiler/crates/orange-compiler/tests/d010_support/packet.rs": "e29613fc7676ccdd881fd66f2073179a56b05f58edcf6978a40eb41f1f060d27", "compiler/crates/orange-compiler/tests/d010_support/runner.rs": "488a20a53b0e1d3d2ffb7eec2ef5b9759232f93e1b54d54db6f554e2a880a67c", "compiler/crates/orangec/tests/s2_conformance.rs": "61c1f877e91a76706da0ee78e9aa3cb44c519f4d8b5823d1bab998b209981d40", "compiler/crates/orangec/tests/s3a_conformance.rs": "7d25ea303fcb3c1603d60b6cb32d89ae15173cc043b8b695daedb737162b8116", @@ -400,7 +411,7 @@ "conformance/foundation/valid/repository-control-snapshot.json": "c79ed2b11d550573fc39463c27ec8207b3b7811011fe6abb13573651d4c232f3", "conformance/foundation/valid/standards-provenance.json": "1cd82e177baef03e1d3f413c86705b18891239cea413f7881331ee4066daf413", "conformance/foundation/valid/trust-inventory.json": "edb467fb6843713fea4571bacedf27e6b1039f1871ed835bcc0766dfb728542f", - "docs/DECISIONS.md": "dc610d01e7959496daeaac033361fa93f944ad800694c62777152d6c74d7ab02", + "docs/DECISIONS.md": "8aee15b761de4903d7ba343929ea34a69b09261d1c3e12658c1152c4a9af5f2d", "docs/LANGUAGE_2026.md": "35981310cbe1e1ae61c889b4005b2610d0077e6a615a5e032b0ca9a5860b328a", "docs/SEMANTICS_2026.md": "63e14d674eb687f46aa600b36d6d13e3732090d658fb05fd805646b1d469dbdf", "docs/images/README.md": "37e8f88f6ffdc200a43bab0680c42ce7e32e616a3c63c5aa9325537dedd1e1e2", @@ -408,16 +419,19 @@ "docs/operations/GITHUB_CONTROLS.md": "f86bdf0234e9db17256f4be07e20e65a9913de45e96e1fdd55e2c57d056ae94b", "docs/security/OSPS_BASELINE.md": "f912af598fcbe2a76b3b774fab5358b8c63aa68794a209b33f3418e656fdda78", "docs/security/SECRETS_AND_INCIDENTS.md": "93332edb737f84c7a3f74f256b5fb603537bf6f524388f62013140cb9906f6a6", - "docs/security/THREAT_MODEL.md": "48adc94db28c55aac3e261a9286f347c738a26d4ff62b0c51c9b94bf45f5795d", - "policy/README.md": "a62e19660c01ebfd48c9c5f026098971a99d903d3c5b134f5087c17fbbb3a1b8", + "docs/security/THREAT_MODEL.md": "3145c13e35831876b8784a395963d26a5e9fbe63685a37b2c205c39e2f86cceb", + "policy/README.md": "94d9b0e12aac83a477687f0ff30bf5f74b1ce6507c5ad71a8faa7d90b05ed8ff", "policy/makefile-entrypoint-contract-v0.1.json": "370e0954ca798d4ba4eb04d71a223167c530ce5f41c4b5a0ddf7e3a34c0fb19f", - "research/decisions/D-004/README.md": "28d7517cbecf13e086fd972a35b2b497bc745464b4f809faa81fe11a4a343184", + "research/decisions/D-004/README.md": "f39ed15976a3c31ad51d81778afd9594881d81bd29964a09ec0766fa8013d091", "research/decisions/D-004/d004-v0.2-cross-cutting-fixture-proposals.json": "d3d58cbeb0d2a90987680cd00bc70caf53518be730a71d0d55ba2a7b50544481", "research/decisions/D-004/d004-v0.2-named-mutations.json": "1d46d6d66c0704fcaa462c625dcac2e72150497bb075322c5e076ea42898be54", "research/decisions/D-004/d004-v0.3-cross-cutting-executable-fixtures.json": "5fea65960c47818243d41076dd96a6cab2dbd6d4038fd354a3f5ba30a12622ae", "research/decisions/D-004/d004-v0.4-case-subjects.json": "6266b8e38ad1a83fb777278fc0369844749b2915eabb40ba1ddfc9efa7c985f2", "research/decisions/D-004/d004-v0.5-candidate-mappings.json": "70765c64936bbb8aafd6e101fbf20c85396eb722d70e55bb9311d14bfbb15156", "research/decisions/D-004/d004-v0.5-draft-packet.json": "ec3a0a593d1dab7a6ace874dae4fd03c1ae0656cf301897ccabf51cb109c4009", + "research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json": "cbdfa3e07245a6843100a6b17860ea5dcec39f7f341b194faeee91e2ae585f3c", + "research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json": "1111889b47edf24e88926bf8fa6770cf84ebcd1abb1d7dc2687dc42e0135fb53", + "research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json": "45632f796c7c08d26e668b277ccaff5679ccb82857732c3b8beead66198a3eb7", "research/decisions/D-005/README.md": "5e9019c6de9195d9ed47480324869254bc3057cf1e9dc164d7e931aa292bbb7d", "research/decisions/D-005/d005-v0.1/epochs/0001/protocol/epoch.json": "5ea15c4f2e6db865e2be9c9fea2a77465ffcf131abfd8356faa6923b3e1ad46b", "research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json": "c7f059bfe531e123b7b6a395eb99f391b832ea72c0b08f320e73e63cc452b27e", @@ -430,12 +444,12 @@ "research/decisions/D-006/README.md": "9f4fc9e624059d685f2ea042d5bc3e0be7385078a5f11f9eb56c62f3fe64d365", "research/decisions/D-006/d006-v0.2-case-input-index.json": "1aec6a731bef0620c8500120ec8385d584f99a528b4a03c014e8516c55cc8136", "research/decisions/D-006/d006-v0.2-draft-packet.json": "210eccad3a545927301d3cc147fdf918cc432fea65b8d71b79cbefc447e34bff", - "research/decisions/D-009/README.md": "cc8e073718556475853b950d472d30b12186b806b57ccab5dba26f2671e1f940", + "research/decisions/D-009/README.md": "e80c628f5ff0465cacba763782bd7e482c2a8820b86f6a383fecf20d80f63df4", "research/decisions/D-009/d009-v0.1-case-input-index.json": "c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859", - "research/decisions/D-009/d009-v0.1-draft-packet.json": "c0ad0227f1f374da8796c6db4866188213be53bd904bbf22b141ee1de6e57171", - "research/decisions/D-010/README.md": "86d1d351ccb0dfea8f22b67212f2fecfe0e7e2bbc89c62b6d7e57a11ae4cb566", + "research/decisions/D-009/d009-v0.1-draft-packet.json": "d16f3f325e372e76e39eaa69d1d8183506a268d99502f6786b840816abf42a14", + "research/decisions/D-010/README.md": "6240ea65a39053c71684a0bf5b91de0887e66acbde48ba295d57a685ca89cffb", "research/decisions/D-010/d010-v0.1-case-input-index.json": "e9f59e86dff6219474d244ff01a98c75b7b17c65f1f91506d483a57e95e33670", - "research/decisions/D-010/d010-v0.1-draft-packet.json": "647ed6e554a0440c7345e52ff8263aba9d2cb19e444e5956203595c0461d6f6e", + "research/decisions/D-010/d010-v0.1-draft-packet.json": "67b0d49b3cd085130328670d4df229372ee4cf906e3e55abe12dcf91534d52aa", "schemas/README.md": "39a7b91e15a316c1221cfce5082608eb453f20ea58b5e1c5a0cf32a07a81d774", "schemas/gate0/claim-record-v0.1.schema.json": "a287dde9ddf114da30af61d050aa96406f23e480d62e0f796d66943489579131", "schemas/gate0/evidence-manifest-v0.1.schema.json": "987ba1cddb23aaaf67a1234456fbffde8f80d45678b9671b8df97ad256742efd", @@ -447,14 +461,16 @@ "scripts/ci/install-actionlint": "ac2e08280a32b7d213fb3993f43e5f9d9431dc3f960a41dedea551be2d9433b5", "scripts/ci/install-lychee": "21dd0050173bdd6b461ce7893dc4f77f74dde67b051d76697d6e8ec466b6c41f", "tools/d004_candidate_mappings.py": "c273b900963f970ce265b8aa503b47a223c130a74b3026582e7ff891507a8fab", + "tools/d004_reviewed_protocol.py": "18ee7ad6cbf9036ecf66ad09bd3392543db528c70e5d3c8de291328f925f3747", "tools/fs_sandbox.c": "80d94ad673b9d3edf628d98e8e7659da93030a56918cc9c2193ede1fdfb76b66", "tools/tests/test_d004_draft_packet.py": "8d178fd7f8f1604c9ded6a78c37d51a30a274efc206156ac5bd7ea0476b0c124", + "tools/tests/test_d004_reviewed_protocol.py": "344eb250ec4f1c34cc4089ff184499632167d29d9c47c0f2c50d8711ba17c462", "tools/tests/test_d005_draft_packet.py": "657d5bf9468d481be3c4b7ee3143fed2b4a9f1253d21bc35477476e968017b09", "tools/tests/test_d006_draft_packet.py": "a83df729a9fd07ac2e8571731a2f0f5bc1e75db4651f73bbe3d52739f49aacf5", - "tools/tests/test_d009_draft_packet.py": "c2e2634925f3d17771114fce4f1aa823097478b50d8d50004f03aab104bdeaec", - "tools/tests/test_d010_draft_packet.py": "fb6ccb5c9c6d519bd6514aea68d438c3fed3bba6e09a7272b7ac884c14eec005", + "tools/tests/test_d009_draft_packet.py": "75e7e143a38394282cb927ba3f9d2fe22e657dd039ca36ab8d8dc76bfc181135", + "tools/tests/test_d010_draft_packet.py": "45698f5c3addbcabdcd0f37adb1fbf423bce38fd45f9e5824e480071f2073702", "tools/tests/test_validate_foundation.py": "7a5d34d64733d76e24dc2f188413e5b24af0fd94ff1a1afeb0e2581656da5e92", - "tools/tests/test_validate_foundation_hardening.py": "6f9c43092b96b540e5bea47eadfb60b93c3fc337fff3bba7627d9f7ac3925891" + "tools/tests/test_validate_foundation_hardening.py": "ac294801f64d8c1bb1920dd250c030843fececadbdd03fb1474e8a0683d09dbc" }, "executable_paths": [ "scripts/ci/check-external-links", diff --git a/research/decisions/D-004/README.md b/research/decisions/D-004/README.md index cef00ce..ab3bce0 100644 --- a/research/decisions/D-004/README.md +++ b/research/decisions/D-004/README.md @@ -1,7 +1,16 @@ # D-004 pre-epoch decision laboratory -Status: `draft_unfrozen`; no D-004 evidence epoch, protocol review, candidate -execution, result, conclusion, or semantic-strata selection exists here. +Status: `reviewed_not_executable`; D004-PRE-01 is `solo-reviewed`, but no +D-004 evidence epoch, candidate execution, result, conclusion, or +semantic-strata selection exists here. The v0.6 implementation closure is +`provisional_pending_exact_merged_revision`. + +On 2026-07-26 the Orange Project Owner accepted D004-PRE-01 at exact review- +subject revision `7d09a27369649855ce987c76315271b0d34a20ef`. That direction +authorizes the reviewed `d004-v0.6-reviewed-protocol` tranche and work on its +remaining executable-freeze prerequisites. It does not accept D-004, select or +prefer a candidate, freeze or authorize an evidence epoch, authorize S3b, or +change roadmap, release, or readiness status. On 2026-07-26 the owner accepted D-003 candidate PF-01. Accepted OEP-0004 binds that disposition to exact revision @@ -9,9 +18,20 @@ that disposition to exact revision it as `accepted_exact_revision_oep_closure` without inferring any D-004 disposition. -This exact seven-file inventory is an input-only D-004 laboratory: +The v0.5 packet, catalogs, manifests, and the exact bytes of +[`SEMANTIC_STRATA_DECISION_SUITE.md`](../../../docs/SEMANTIC_STRATA_DECISION_SUITE.md) +at the review-subject revision are immutable historical review subjects. Their +embedded `draft_unreviewed_input_only`, unresolved, and +`owner_protocol_review: none` fields describe that v0.5 snapshot and are not +rewritten. The v0.6 +protocol records the later owner disposition as a content-addressed overlay. +Because the direction preceded that overlay's commit identity, its implementation +closure remains provisional until the validated bytes are available at an exact +merged revision. + +The v0.5 input-only laboratory consists of: -- `d004-v0.5-draft-packet.json` is the only current packet; +- `d004-v0.5-draft-packet.json` is the immutable base packet; - `d004-v0.2-named-mutations.json` preserves the 26 named mutation definitions; - `d004-v0.4-case-subjects.json` byte-materializes the five positive and 26 @@ -23,7 +43,31 @@ This exact seven-file inventory is an input-only D-004 laboratory: - `d004-v0.5-candidate-mappings.json` carries five unreviewed structural candidate graph proposals and 70 unresolved SR mapping rows as authenticated input-only data under schema `d004-candidate-mapping-catalog-v0.1`; and -- this README states the lifecycle and non-claim boundary. +- this README states the current lifecycle and non-claim boundary. + +The successor tranche adds exactly three reviewed, uninstantiated protocol +artifacts under `d004-v0.6/protocol/`: + +- `d004-pre-01-owner-record.json` records the `solo-reviewed` owner direction + and exact review subjects; +- `reviewed-protocol.json` closes the seven protocol-review gaps while retaining + an unfrozen null epoch and zero evidence; and +- `reviewed-replay-plan.json` expands the 25 logical candidate-case units into + the reviewed repetition-major order of 75 planned executions without + assigning an epoch, packet identity, executable manifests, or result credit. + +Their raw-file/canonical-subject SHA-256 pairs are: + +- owner record: + `cbdfa3e07245a6843100a6b17860ea5dcec39f7f341b194faeee91e2ae585f3c` / + `587c3ad11bf6e0d3dddc02cd7ba53896f54f8e08ec59ed1ece286e13fe9b0c9d`; +- reviewed protocol: + `1111889b47edf24e88926bf8fa6770cf84ebcd1abb1d7dc2687dc42e0135fb53` / + `c67c17bdf68eb0619ec7698dd2807912251a0556931fa79b6838a9d5c6a9bd98`; + and +- reviewed replay plan: + `45632f796c7c08d26e668b277ccaff5679ccb82857732c3b8beead66198a3eb7` / + `a18084768cd05f6fcffdea724e330c0c81c5caac7816213156f4f9967fc5cb1b`. The v0.5 packet binds 23 exact raw inputs: the current suite, product-form packet, accepted S2 and S3a premises, journey identities, S3a conformance @@ -67,18 +111,20 @@ adapter, process, tool, compiler path, or network. Suite-domain unsupported is not candidate-adapter inability, and suite-domain exhaustion does not exercise a replay ceiling. -All 73 case and cross-cutting subjects are now materialized as candidate-neutral -suite-only inputs. Sufficiency review remains unresolved separately for -ambiguity, missing-edge, identity-substitution, unsupported, and -resource-exhaustion fixtures. Replay repetitions also remain unresolved. All -five cross-cutting classes therefore remain freeze blockers despite their -materialized bytes. - -The candidate-mapping catalog adds one unreviewed structural graph proposal for -each of the five candidates and one unresolved row for every candidate and -SR-01-through-SR-14 pair, for 70 rows total. Authentication establishes only -the identity and closed structure of these input hypotheses. No adapter, -execution, evidence, review, freeze, selection, or readiness credit follows. +All 73 case and cross-cutting subjects remain candidate-neutral suite-only +inputs. D004-PRE-01 finds the 5 ambiguity, 14 missing-edge, 13 identity- +substitution, 5 unsupported, and 5 resource-exhaustion subjects reviewed and +sufficient solely for bounded suite coverage. This disposition creates no +candidate capability or evidence credit and does not turn their historical +source catalogs into accepted Orange semantics. + +The candidate-mapping catalog contains one historical structural graph proposal +for each of the five candidates and one row for every candidate and +SR-01-through-SR-14 pair, for 70 rows total. D004-PRE-01 reviews all five graphs +and 70 rows only as symmetric, falsifiable test hypotheses. Their semantic +status remains unaccepted and conformance remains unresolved until execution; +no adapter, execution, evidence, freeze, selection, or readiness credit +follows. Its catalog-subject SHA-256 is `e3b790857ee21a0c651995919aaadb9bf59b05367a8dce99bab6afb6e7d2543f`; its canonical SHA-256 is @@ -94,19 +140,25 @@ mapping catalog into five exact graph/map identity rows; future result fields must resolve those catalogs and cannot broaden their outcomes. It also defines a 10-field scheduled-slot preimage contract and necessary-and-sufficient verdict conditions, including checked resource bounds and SR dependency joins. The -25-slot identity plan exists, but no concrete slot preimage or digest is -available until the epoch, packet identity, and replay-plan identity are frozen. -This synthetic -contract accepts no populated records, launches no process or adapter, and -persists nothing. It approves no schema, assigns no replay cardinality, and -does not ratify the separate mapping proposals or supply an adapter. Its epoch -remains null and unfrozen, owner protocol review remains `none`, execution -remains 0/25 with evidence `none`, and selection and conclusion remain null. It -creates no execution or evidence; both `roadmap_gate_credit` and -`readiness_credit` remain `none`. - -The deterministic 5-candidate by 5-case Latin schedule is still only an -identity plan. Canonical execution remains 0/25, complete candidates remain -0/5, complete cross-candidate cases remain 0/5, evidence is `none`, and both -selection and conclusion are null. These files do not accept D-004, freeze an -epoch, authorize S3b, close a roadmap gate, or change Orange's readiness. +25-slot identity plan exists. The reviewed replay policy now requires exactly +three deterministic repetitions per unit, a fresh empty candidate-specific +cache per execution, and equality of the specified deterministic fields. The +reviewed replay plan therefore contains 75 ordered but uninstantiated execution +rows. No concrete scheduled-execution digest is available until an epoch, +packet identity, and executable manifests are frozen. This synthetic contract +accepts no populated records, launches no process or adapter, and persists +nothing. Its epoch remains null and unfrozen, execution is unauthorized, +execution evidence remains 0 completed of 25 required candidate-case units and +0 of 75 result records, and selection and conclusion remain null. Both +`roadmap_gate_credit` and `readiness_credit` remain `none`. + +The deterministic 5-candidate by 5-case Latin schedule and its three reviewed +repetitions remain a plan, not an executable epoch. Candidate adapters, closed +request and response schemas, semantic endpoints, parameter bindings, exact +tools and transitive dependencies, deterministic environment and input +manifests, an enforcing isolation launcher, normalization and resource +measurement, result/evidence parsers, an exact execution-subject revision, and +a separate owner freeze record remain absent. Canonical evidence remains +0/25/0: zero completed candidate-case units, 25 required units, and zero result +records. D-004 remains proposed, S3b remains blocked, and Orange's binary +gate-closure score remains 3 of 10 (30%). diff --git a/research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json b/research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json new file mode 100644 index 0000000..26eee9c --- /dev/null +++ b/research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json @@ -0,0 +1 @@ +{"accepted_on":"2026-07-26","accepted_subject":"D004-PRE-01","authority":{"independent_review":"unavailable","review_authority":"Orange Project Owner","review_label":"solo-reviewed"},"authorization_subject_revision":"7d09a27369649855ce987c76315271b0d34a20ef","decision_id":"D-004","decision_status":"proposed","delegated_technical_judgment":true,"implementation_authority":"reviewed_protocol_and_executable_freeze_prerequisite_work_only","implementation_closure_status":"provisional_pending_exact_merged_revision","known_risks":["solo review may retain owner or delegated technical judgment error","bounded fixture sufficiency may not survive executable adapter or semantic-model construction","the content-addressed reviewed overlay is not yet bound to an exact merged implementation revision"],"nonclaims":["no D-004 evidence epoch frozen or candidate execution authorized","no D-004 semantic-strata candidate selected or preferred","no candidate graph or SR mapping accepted as Orange semantics","no D-004 disposition accepted","no S3b implementation authorized","no execution evidence or candidate capability credit created","no exact-revision implementation closure recorded","no roadmap gate, release-readiness, or version-readiness movement"],"record_disposition":"accepted","record_id":"D004-PRE-01","review_kind":"pre_epoch_protocol","review_subjects":{"candidate_mappings":{"canonical_sha256":"c967d7db8ea5049da054129367ec61cd80d729b8ce8cd34c95a76e42c67c97b8","path":"research/decisions/D-004/d004-v0.5-candidate-mappings.json","raw_sha256":"70765c64936bbb8aafd6e101fbf20c85396eb722d70e55bb9311d14bfbb15156"},"case_subjects":{"canonical_sha256":"5b9e734b6bad7913072e87adb29c58547d67bdcb46af942eb6bbc79d0e68166e","path":"research/decisions/D-004/d004-v0.4-case-subjects.json","raw_sha256":"6266b8e38ad1a83fb777278fc0369844749b2915eabb40ba1ddfc9efa7c985f2"},"cross_cutting_executable_fixtures":{"canonical_sha256":"0516a84260bcc4d8ebb64e0cd3416deb5c43a86b7f5cd882ca757c924e575767","path":"research/decisions/D-004/d004-v0.3-cross-cutting-executable-fixtures.json","raw_sha256":"5fea65960c47818243d41076dd96a6cab2dbd6d4038fd354a3f5ba30a12622ae"},"cross_cutting_fixture_proposals":{"canonical_sha256":"85407a4a43b5a6bf450ea905fe858482f2f79abb4cbe8ee8690bddc1753d0912","path":"research/decisions/D-004/d004-v0.2-cross-cutting-fixture-proposals.json","raw_sha256":"d3d58cbeb0d2a90987680cd00bc70caf53518be730a71d0d55ba2a7b50544481"},"decision_suite":{"path":"docs/SEMANTIC_STRATA_DECISION_SUITE.md","raw_sha256":"64abe8290955f889e28f8bb9ce7653a26ef71a624286aef900d4dbfc3b7eb117"},"draft_packet":{"canonical_sha256":"b6df1a38f8a1eb6a80a8864324c21a81cb292d4c48e1981b4547bad41933b340","path":"research/decisions/D-004/d004-v0.5-draft-packet.json","raw_sha256":"ec3a0a593d1dab7a6ace874dae4fd03c1ae0656cf301897ccabf51cb109c4009"},"named_mutations":{"canonical_sha256":"970999d998cdc202a6caa4e2f798017416c88211a5b6b8508132a07cc9080c0c","path":"research/decisions/D-004/d004-v0.2-named-mutations.json","raw_sha256":"1d46d6d66c0704fcaa462c625dcac2e72150497bb075322c5e076ea42898be54"},"result_contract_descriptor":{"generated_descriptor_sha256":"58773e8ce29e8726a8a85203ff7e2a4b1a03f8c02bfbcd7f6056f34fe53a2f29","path":"compiler/crates/orange-compiler/tests/d004_support/result_contract.rs","raw_sha256":"f3fdb4187fa9dffb23e849208da20f112aba764cfa85df80ae578754f3c9c97a"}},"revisit_triggers":["any bound review subject or protocol rule changes","an executable D-004 epoch freeze is proposed","independent review becomes available","a fixture contradiction mapping error or replay-schedule defect is discovered","the reviewed overlay is available at an exact merged revision for implementation closure"],"schema_version":"d004-owner-protocol-record-v0.1","source_direction":"Accept D004-PRE-01. - you will need to make best decisions for this. this is beyond my range of knowledge.","structured_disposition":{"fixture_class_reviews":[{"capability_credit":"none","class":"ambiguity","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":5},{"capability_credit":"none","class":"missing-edge","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":14},{"capability_credit":"none","class":"identity-substitution","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":13},{"capability_credit":"none","class":"unsupported","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":5},{"capability_credit":"none","class":"resource-exhaustion","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":5}],"mapping_review":{"candidate_graph_count":5,"capability_credit":"none","evidence_credit":"none","mapping_row_count":70,"relationship_count":14,"selection":null,"semantic_status":"unaccepted","status":"reviewed_symmetric_falsifiable_test_hypotheses"},"replay_policy":{"base_candidate_case_slots":25,"cache":"fresh_empty_candidate_specific_per_execution","deterministic_equality_required":true,"forbidden_aggregation":["warmup","retry_substitution","voting","averaging","best_of","statistical_confidence"],"independent_pass_required":true,"measured_resource_variance":"permitted_only_within_frozen_bounds","physical_order":"repetition_major_then_latin_slot_ordinal","repetitions_per_slot":3,"required_execution_records":75}},"validation":{"fixture_adequacy_criteria":[{"basis":"one candidate-neutral ambiguity subject for each of five semantic cases","class":"ambiguity","residual_risk":"does_not_establish_candidate_disambiguation_behavior"},{"basis":"one missing-edge subject for each of fourteen required relationships","class":"missing-edge","residual_risk":"does_not_establish_adapter_edge_detection"},{"basis":"thirteen candidate-neutral subjects spanning the catalogued identity-substitution inventory","class":"identity-substitution","residual_risk":"does_not_establish_identity_validation_behavior"},{"basis":"one candidate-neutral unsupported subject for each of five semantic cases","class":"unsupported","residual_risk":"does_not_establish_adapter_support"},{"basis":"one candidate-neutral structural resource-exhaustion subject for each of five semantic cases","class":"resource-exhaustion","residual_risk":"does_not_exercise_replay_resource_ceiling"}],"implementation_checks":{"required":["strict_python_protocol_validator","rust_d004_decision_suite","foundation_policy_and_full_check","exact_head_hosted_checks","postmerge_hosted_checks"],"status":"pending_exact_merged_revision_closure"},"mapping_hypothesis_checks":["five distinct candidate graphs are present","each graph contains exactly one SR row for each of fourteen required relationships","all seventy rows remain unaccepted hypothesis-only inputs","no candidate receives asymmetric capability or evidence credit"],"replay_policy_checks":["the reviewed plan statically contains three complete repetition-major traversals of the Latin schedule","slot closure requires all three repetitions to independently pass with deterministic-field equality","the policy permits only frozen bounded resource measurements to vary","warmup retry substitution voting averaging best-of and statistical claims are forbidden"],"review_subject_bindings":"exact_content_identified"}} diff --git a/research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json b/research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json new file mode 100644 index 0000000..346fdea --- /dev/null +++ b/research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json @@ -0,0 +1 @@ +{"base_suite_version":"d004-v0.5-draft","bindings":{"candidate_mappings":{"canonical_sha256":"c967d7db8ea5049da054129367ec61cd80d729b8ce8cd34c95a76e42c67c97b8","path":"research/decisions/D-004/d004-v0.5-candidate-mappings.json","raw_sha256":"70765c64936bbb8aafd6e101fbf20c85396eb722d70e55bb9311d14bfbb15156"},"case_subjects":{"canonical_sha256":"5b9e734b6bad7913072e87adb29c58547d67bdcb46af942eb6bbc79d0e68166e","path":"research/decisions/D-004/d004-v0.4-case-subjects.json","raw_sha256":"6266b8e38ad1a83fb777278fc0369844749b2915eabb40ba1ddfc9efa7c985f2"},"cross_cutting_executable_fixtures":{"canonical_sha256":"0516a84260bcc4d8ebb64e0cd3416deb5c43a86b7f5cd882ca757c924e575767","path":"research/decisions/D-004/d004-v0.3-cross-cutting-executable-fixtures.json","raw_sha256":"5fea65960c47818243d41076dd96a6cab2dbd6d4038fd354a3f5ba30a12622ae"},"cross_cutting_fixture_proposals":{"canonical_sha256":"85407a4a43b5a6bf450ea905fe858482f2f79abb4cbe8ee8690bddc1753d0912","path":"research/decisions/D-004/d004-v0.2-cross-cutting-fixture-proposals.json","raw_sha256":"d3d58cbeb0d2a90987680cd00bc70caf53518be730a71d0d55ba2a7b50544481"},"draft_packet":{"canonical_sha256":"b6df1a38f8a1eb6a80a8864324c21a81cb292d4c48e1981b4547bad41933b340","path":"research/decisions/D-004/d004-v0.5-draft-packet.json","raw_sha256":"ec3a0a593d1dab7a6ace874dae4fd03c1ae0656cf301897ccabf51cb109c4009"},"owner_record":{"canonical_sha256":"587c3ad11bf6e0d3dddc02cd7ba53896f54f8e08ec59ed1ece286e13fe9b0c9d","path":"research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json","raw_sha256":"cbdfa3e07245a6843100a6b17860ea5dcec39f7f341b194faeee91e2ae585f3c"}},"conclusion":null,"correction_policy":{"candidate_correction_window_owner_hours":4,"candidate_local_change":"one_linked_correction_revision_after_complete_first_candidate_packet","correction_record_id_pattern":"D004-COR--01","forbidden":["broadening_expected_states","reclassifying_replay_failure_as_domain_unsupported_or_exhausted","changing_an_oracle","hiding_or_replacing_prior_logs","introducing_undeclared_dependencies","second_correction_window"],"max_candidate_corrections":1,"prior_records":"retained_immutable","rerun_scope":"all_five_candidate_cases_times_three_repetitions","shared_change":"new_epoch_for_all_candidates","shared_runner_or_environment_defect":"invalidate_entire_epoch"},"epoch":null,"epoch_freeze_blockers":["candidate adapter implementations and closed request and response schemas absent","candidate semantic models endpoint inventories and parameter bindings absent","exact executable tool and transitive dependency manifests absent","exact deterministic environment and ordered input manifests absent","enforcing isolation launcher cache reset and cleanup verification absent","output normalizer payload validator and bounded resource meter absent","populated result repetition-closure correction and evidence-archive parsers absent","exact execution-subject revision and owner freeze record absent","frozen epoch packet replay-plan identity and scheduled-execution digests absent"],"epoch_status":"unfrozen","execution":{"complete_candidates":0,"complete_cross_candidate_cases":0,"completed_candidate_cases":0,"evidence_status":"none","required_candidate_cases":25,"required_execution_records":75,"result_record_count":0},"execution_authorized":false,"fixture_class_dispositions":[{"capability_credit":"none","class":"ambiguity","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":5},{"capability_credit":"none","class":"missing-edge","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":14},{"capability_credit":"none","class":"identity-substitution","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":13},{"capability_credit":"none","class":"unsupported","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":5},{"capability_credit":"none","class":"resource-exhaustion","scope":"bounded_suite_coverage_only","status":"reviewed_sufficient","subject_count":5}],"implementation_closure_status":"provisional_pending_exact_merged_revision","mapping_disposition":{"candidate_graph_count":5,"capability_credit":"none","conformance_state":"unresolved_until_execution","evidence_credit":"none","mapping_row_count":70,"relationship_count":14,"selection":null,"semantic_status":"unaccepted","status":"reviewed_symmetric_falsifiable_test_hypotheses"},"nonclaims":["review closes protocol-review gaps only and creates no execution evidence","no D-004 evidence epoch frozen or candidate execution authorized","no candidate graph or SR mapping accepted as Orange semantics","no semantic-strata candidate selected preferred or accepted","no D-004 disposition accepted","no S3b implementation authorized","no independent review claimed","reviewed overlay implementation closure remains provisional until an exact merged revision","no roadmap gate or readiness movement"],"owner_protocol_review":"solo-reviewed","physical_execution_order":"repetition_major_then_latin_slot_ordinal","protocol_gaps":[],"protocol_version":"d004-v0.6-reviewed-protocol","replay_contract":{"base_candidate_case_slots":25,"cache":"fresh_empty_candidate_specific_per_execution","deterministic_equality_fields":["digest_bound_inputs_graph_map_model_tool_dependencies_environment_and_argv","execution_state","log_manifest_stdout_and_stderr_bytes_lengths_and_digests","normalized_observations","premises_assumptions_trusted_components_and_unsupported_features","candidate_graph","sr_conformance_map","case_verdict","byte_manifest","replay_expected_output_manifest_sha256","measured_resources_stdout_bytes_and_stderr_bytes"],"diagnostic_metadata_excluded_from_semantic_payload":["pid","timestamp","absolute_temporary_path","host_scheduling_data"],"execution_identity_preimage_fields":["schema_version","suite_version","epoch","packet_sha256","replay_plan_sha256","execution_ordinal","repetition","logical_slot_ordinal","round","position","candidate","case","input_manifest_sha256","model_sha256","tool_sha256","dependency_manifest_sha256","environment_sha256","candidate_graph_sha256","sr_map_sha256","semantic_endpoint_sha256","parameter_model_sha256"],"failure_rule":"missing_invalid_non_successful_or_inconsistent_repetition_fails_candidate_case","forbidden_aggregation":["warmup","retry_substitution","voting","averaging","best_of","statistical_confidence"],"logical_schedule":"balanced_latin_5x5_v0.5","network":"denied","physical_order":"repetition_major_then_latin_slot_ordinal","repetitions_per_slot":3,"required_execution_records":75,"slot_pass_rule":"all_three_repetitions_independently_pass_and_all_deterministic_fields_equal","variable_fields_within_frozen_bounds":["measured_resources.wall_milliseconds","measured_resources.peak_memory_bytes","measured_resources.temp_storage_bytes"]},"schema_version":"d004-reviewed-protocol-tranche-v0.1","selection":null,"status":"reviewed_not_executable"} diff --git a/research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json b/research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json new file mode 100644 index 0000000..c6f3600 --- /dev/null +++ b/research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json @@ -0,0 +1 @@ +{"base_packet":{"canonical_sha256":"b6df1a38f8a1eb6a80a8864324c21a81cb292d4c48e1981b4547bad41933b340","path":"research/decisions/D-004/d004-v0.5-draft-packet.json","raw_sha256":"ec3a0a593d1dab7a6ace874dae4fd03c1ae0656cf301897ccabf51cb109c4009"},"epoch":null,"execution_identity_preimage_fields":["schema_version","suite_version","epoch","packet_sha256","replay_plan_sha256","execution_ordinal","repetition","logical_slot_ordinal","round","position","candidate","case","input_manifest_sha256","model_sha256","tool_sha256","dependency_manifest_sha256","environment_sha256","candidate_graph_sha256","sr_map_sha256","semantic_endpoint_sha256","parameter_model_sha256"],"execution_identity_schema":"d004-scheduled-execution-identity-v0.1","execution_identity_status":"unavailable_until_frozen_epoch_packet_plan_and_manifests","implementation_closure_status":"provisional_pending_exact_merged_revision","logical_schedule":"balanced_latin_5x5_v0.5","nonclaims":["reviewed schedule identities are not candidate executions or evidence","no epoch packet replay identity or scheduled-execution digest exists","no D-004 semantic-strata candidate selected preferred or accepted","no D-004 disposition accepted","no S3b implementation authorized","reviewed overlay implementation closure remains provisional until an exact merged revision","no roadmap gate or readiness movement"],"owner_record":{"canonical_sha256":"587c3ad11bf6e0d3dddc02cd7ba53896f54f8e08ec59ed1ece286e13fe9b0c9d","path":"research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json","raw_sha256":"cbdfa3e07245a6843100a6b17860ea5dcec39f7f341b194faeee91e2ae585f3c"},"physical_execution_count":75,"physical_order":"repetition_major_then_latin_slot_ordinal","protocol":{"canonical_sha256":"c67c17bdf68eb0619ec7698dd2807912251a0556931fa79b6838a9d5c6a9bd98","path":"research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json","raw_sha256":"1111889b47edf24e88926bf8fa6770cf84ebcd1abb1d7dc2687dc42e0135fb53"},"repetitions_per_slot":3,"schedule":[{"candidate":"ST-REL","case":"SC-01","execution_ordinal":1,"logical_slot_ordinal":1,"position":1,"repetition":1,"round":1},{"candidate":"ST-UNI","case":"SC-02","execution_ordinal":2,"logical_slot_ordinal":2,"position":2,"repetition":1,"round":1},{"candidate":"ST-DUAL","case":"SC-03","execution_ordinal":3,"logical_slot_ordinal":3,"position":3,"repetition":1,"round":1},{"candidate":"ST-MIRROR","case":"SC-04","execution_ordinal":4,"logical_slot_ordinal":4,"position":4,"repetition":1,"round":1},{"candidate":"ST-HOST","case":"SC-05","execution_ordinal":5,"logical_slot_ordinal":5,"position":5,"repetition":1,"round":1},{"candidate":"ST-UNI","case":"SC-03","execution_ordinal":6,"logical_slot_ordinal":6,"position":1,"repetition":1,"round":2},{"candidate":"ST-DUAL","case":"SC-04","execution_ordinal":7,"logical_slot_ordinal":7,"position":2,"repetition":1,"round":2},{"candidate":"ST-MIRROR","case":"SC-05","execution_ordinal":8,"logical_slot_ordinal":8,"position":3,"repetition":1,"round":2},{"candidate":"ST-HOST","case":"SC-01","execution_ordinal":9,"logical_slot_ordinal":9,"position":4,"repetition":1,"round":2},{"candidate":"ST-REL","case":"SC-02","execution_ordinal":10,"logical_slot_ordinal":10,"position":5,"repetition":1,"round":2},{"candidate":"ST-DUAL","case":"SC-05","execution_ordinal":11,"logical_slot_ordinal":11,"position":1,"repetition":1,"round":3},{"candidate":"ST-MIRROR","case":"SC-01","execution_ordinal":12,"logical_slot_ordinal":12,"position":2,"repetition":1,"round":3},{"candidate":"ST-HOST","case":"SC-02","execution_ordinal":13,"logical_slot_ordinal":13,"position":3,"repetition":1,"round":3},{"candidate":"ST-REL","case":"SC-03","execution_ordinal":14,"logical_slot_ordinal":14,"position":4,"repetition":1,"round":3},{"candidate":"ST-UNI","case":"SC-04","execution_ordinal":15,"logical_slot_ordinal":15,"position":5,"repetition":1,"round":3},{"candidate":"ST-MIRROR","case":"SC-02","execution_ordinal":16,"logical_slot_ordinal":16,"position":1,"repetition":1,"round":4},{"candidate":"ST-HOST","case":"SC-03","execution_ordinal":17,"logical_slot_ordinal":17,"position":2,"repetition":1,"round":4},{"candidate":"ST-REL","case":"SC-04","execution_ordinal":18,"logical_slot_ordinal":18,"position":3,"repetition":1,"round":4},{"candidate":"ST-UNI","case":"SC-05","execution_ordinal":19,"logical_slot_ordinal":19,"position":4,"repetition":1,"round":4},{"candidate":"ST-DUAL","case":"SC-01","execution_ordinal":20,"logical_slot_ordinal":20,"position":5,"repetition":1,"round":4},{"candidate":"ST-HOST","case":"SC-04","execution_ordinal":21,"logical_slot_ordinal":21,"position":1,"repetition":1,"round":5},{"candidate":"ST-REL","case":"SC-05","execution_ordinal":22,"logical_slot_ordinal":22,"position":2,"repetition":1,"round":5},{"candidate":"ST-UNI","case":"SC-01","execution_ordinal":23,"logical_slot_ordinal":23,"position":3,"repetition":1,"round":5},{"candidate":"ST-DUAL","case":"SC-02","execution_ordinal":24,"logical_slot_ordinal":24,"position":4,"repetition":1,"round":5},{"candidate":"ST-MIRROR","case":"SC-03","execution_ordinal":25,"logical_slot_ordinal":25,"position":5,"repetition":1,"round":5},{"candidate":"ST-REL","case":"SC-01","execution_ordinal":26,"logical_slot_ordinal":1,"position":1,"repetition":2,"round":1},{"candidate":"ST-UNI","case":"SC-02","execution_ordinal":27,"logical_slot_ordinal":2,"position":2,"repetition":2,"round":1},{"candidate":"ST-DUAL","case":"SC-03","execution_ordinal":28,"logical_slot_ordinal":3,"position":3,"repetition":2,"round":1},{"candidate":"ST-MIRROR","case":"SC-04","execution_ordinal":29,"logical_slot_ordinal":4,"position":4,"repetition":2,"round":1},{"candidate":"ST-HOST","case":"SC-05","execution_ordinal":30,"logical_slot_ordinal":5,"position":5,"repetition":2,"round":1},{"candidate":"ST-UNI","case":"SC-03","execution_ordinal":31,"logical_slot_ordinal":6,"position":1,"repetition":2,"round":2},{"candidate":"ST-DUAL","case":"SC-04","execution_ordinal":32,"logical_slot_ordinal":7,"position":2,"repetition":2,"round":2},{"candidate":"ST-MIRROR","case":"SC-05","execution_ordinal":33,"logical_slot_ordinal":8,"position":3,"repetition":2,"round":2},{"candidate":"ST-HOST","case":"SC-01","execution_ordinal":34,"logical_slot_ordinal":9,"position":4,"repetition":2,"round":2},{"candidate":"ST-REL","case":"SC-02","execution_ordinal":35,"logical_slot_ordinal":10,"position":5,"repetition":2,"round":2},{"candidate":"ST-DUAL","case":"SC-05","execution_ordinal":36,"logical_slot_ordinal":11,"position":1,"repetition":2,"round":3},{"candidate":"ST-MIRROR","case":"SC-01","execution_ordinal":37,"logical_slot_ordinal":12,"position":2,"repetition":2,"round":3},{"candidate":"ST-HOST","case":"SC-02","execution_ordinal":38,"logical_slot_ordinal":13,"position":3,"repetition":2,"round":3},{"candidate":"ST-REL","case":"SC-03","execution_ordinal":39,"logical_slot_ordinal":14,"position":4,"repetition":2,"round":3},{"candidate":"ST-UNI","case":"SC-04","execution_ordinal":40,"logical_slot_ordinal":15,"position":5,"repetition":2,"round":3},{"candidate":"ST-MIRROR","case":"SC-02","execution_ordinal":41,"logical_slot_ordinal":16,"position":1,"repetition":2,"round":4},{"candidate":"ST-HOST","case":"SC-03","execution_ordinal":42,"logical_slot_ordinal":17,"position":2,"repetition":2,"round":4},{"candidate":"ST-REL","case":"SC-04","execution_ordinal":43,"logical_slot_ordinal":18,"position":3,"repetition":2,"round":4},{"candidate":"ST-UNI","case":"SC-05","execution_ordinal":44,"logical_slot_ordinal":19,"position":4,"repetition":2,"round":4},{"candidate":"ST-DUAL","case":"SC-01","execution_ordinal":45,"logical_slot_ordinal":20,"position":5,"repetition":2,"round":4},{"candidate":"ST-HOST","case":"SC-04","execution_ordinal":46,"logical_slot_ordinal":21,"position":1,"repetition":2,"round":5},{"candidate":"ST-REL","case":"SC-05","execution_ordinal":47,"logical_slot_ordinal":22,"position":2,"repetition":2,"round":5},{"candidate":"ST-UNI","case":"SC-01","execution_ordinal":48,"logical_slot_ordinal":23,"position":3,"repetition":2,"round":5},{"candidate":"ST-DUAL","case":"SC-02","execution_ordinal":49,"logical_slot_ordinal":24,"position":4,"repetition":2,"round":5},{"candidate":"ST-MIRROR","case":"SC-03","execution_ordinal":50,"logical_slot_ordinal":25,"position":5,"repetition":2,"round":5},{"candidate":"ST-REL","case":"SC-01","execution_ordinal":51,"logical_slot_ordinal":1,"position":1,"repetition":3,"round":1},{"candidate":"ST-UNI","case":"SC-02","execution_ordinal":52,"logical_slot_ordinal":2,"position":2,"repetition":3,"round":1},{"candidate":"ST-DUAL","case":"SC-03","execution_ordinal":53,"logical_slot_ordinal":3,"position":3,"repetition":3,"round":1},{"candidate":"ST-MIRROR","case":"SC-04","execution_ordinal":54,"logical_slot_ordinal":4,"position":4,"repetition":3,"round":1},{"candidate":"ST-HOST","case":"SC-05","execution_ordinal":55,"logical_slot_ordinal":5,"position":5,"repetition":3,"round":1},{"candidate":"ST-UNI","case":"SC-03","execution_ordinal":56,"logical_slot_ordinal":6,"position":1,"repetition":3,"round":2},{"candidate":"ST-DUAL","case":"SC-04","execution_ordinal":57,"logical_slot_ordinal":7,"position":2,"repetition":3,"round":2},{"candidate":"ST-MIRROR","case":"SC-05","execution_ordinal":58,"logical_slot_ordinal":8,"position":3,"repetition":3,"round":2},{"candidate":"ST-HOST","case":"SC-01","execution_ordinal":59,"logical_slot_ordinal":9,"position":4,"repetition":3,"round":2},{"candidate":"ST-REL","case":"SC-02","execution_ordinal":60,"logical_slot_ordinal":10,"position":5,"repetition":3,"round":2},{"candidate":"ST-DUAL","case":"SC-05","execution_ordinal":61,"logical_slot_ordinal":11,"position":1,"repetition":3,"round":3},{"candidate":"ST-MIRROR","case":"SC-01","execution_ordinal":62,"logical_slot_ordinal":12,"position":2,"repetition":3,"round":3},{"candidate":"ST-HOST","case":"SC-02","execution_ordinal":63,"logical_slot_ordinal":13,"position":3,"repetition":3,"round":3},{"candidate":"ST-REL","case":"SC-03","execution_ordinal":64,"logical_slot_ordinal":14,"position":4,"repetition":3,"round":3},{"candidate":"ST-UNI","case":"SC-04","execution_ordinal":65,"logical_slot_ordinal":15,"position":5,"repetition":3,"round":3},{"candidate":"ST-MIRROR","case":"SC-02","execution_ordinal":66,"logical_slot_ordinal":16,"position":1,"repetition":3,"round":4},{"candidate":"ST-HOST","case":"SC-03","execution_ordinal":67,"logical_slot_ordinal":17,"position":2,"repetition":3,"round":4},{"candidate":"ST-REL","case":"SC-04","execution_ordinal":68,"logical_slot_ordinal":18,"position":3,"repetition":3,"round":4},{"candidate":"ST-UNI","case":"SC-05","execution_ordinal":69,"logical_slot_ordinal":19,"position":4,"repetition":3,"round":4},{"candidate":"ST-DUAL","case":"SC-01","execution_ordinal":70,"logical_slot_ordinal":20,"position":5,"repetition":3,"round":4},{"candidate":"ST-HOST","case":"SC-04","execution_ordinal":71,"logical_slot_ordinal":21,"position":1,"repetition":3,"round":5},{"candidate":"ST-REL","case":"SC-05","execution_ordinal":72,"logical_slot_ordinal":22,"position":2,"repetition":3,"round":5},{"candidate":"ST-UNI","case":"SC-01","execution_ordinal":73,"logical_slot_ordinal":23,"position":3,"repetition":3,"round":5},{"candidate":"ST-DUAL","case":"SC-02","execution_ordinal":74,"logical_slot_ordinal":24,"position":4,"repetition":3,"round":5},{"candidate":"ST-MIRROR","case":"SC-03","execution_ordinal":75,"logical_slot_ordinal":25,"position":5,"repetition":3,"round":5}],"schema_version":"d004-replay-plan-v0.1","status":"reviewed_uninstantiated","suite_version":"d004-v0.6-reviewed-protocol"} diff --git a/research/decisions/D-009/README.md b/research/decisions/D-009/README.md index d4ee78a..0c99faa 100644 --- a/research/decisions/D-009/README.md +++ b/research/decisions/D-009/README.md @@ -24,9 +24,9 @@ same candidate order through TC-08. It is a canonical identity serialization, not an authorized physical execution order. The packet's strict canonical JSON SHA-256, excluding its final line feed, is -`fa1411c83fdb6b57b8100f296ca904d88155ad6aa57bd7f48af62ae90c9ead31`; +`f95adf14aebe4232b7ca59b7a33302522901571416f4d182a1239a6f3504e0be`; its raw file SHA-256, including the final line feed, is -`c0ad0227f1f374da8796c6db4866188213be53bd904bbf22b141ee1de6e57171`. +`d16f3f325e372e76e39eaa69d1d8183506a268d99502f6786b840816abf42a14`. Its closed packet schema is `d009-pre-epoch-packet-v0.3`; the suite version remains `d009-v0.1-draft`, and the existing filename is retained as a stable draft locator. diff --git a/research/decisions/D-009/d009-v0.1-draft-packet.json b/research/decisions/D-009/d009-v0.1-draft-packet.json index ce0903e..7a99744 100644 --- a/research/decisions/D-009/d009-v0.1-draft-packet.json +++ b/research/decisions/D-009/d009-v0.1-draft-packet.json @@ -1 +1 @@ -{"atomic_outcome_meanings":{"not_satisfied":"permitted, identity-bound negative evidence establishes that the exact proposition is false or violated within its scope; absence or incompleteness alone is not not_satisfied","satisfied":"the exact proposition has its complete permitted mandatory closure and no valid decisive negative result","unresolved":"the claim is well-formed and within the declared support model, but a required decision remains unknown, incomplete, conflicting, or exhausted","unsupported":"the declared policy or support envelope offers no permitted evaluation or authority path for that exact claim and scope"},"atomic_outcomes":["satisfied","not_satisfied","unresolved","unsupported"],"candidate_states":[{"adapter_status":"absent","candidate":"SP-01","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"SP-02","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"SP-03","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"}],"candidates":[{"id":"SP-01","name":"Checked-artifact portfolio"},{"id":"SP-02","name":"Kernel-only reconstruction"},{"id":"SP-03","name":"Direct trusted-solver authority"}],"case_input_index_sha256":"2e55c671771d5740b0346992c8b86b9cce0571a8fc3e5b745195b0956010470e","cases":["TC-01","TC-02","TC-03","TC-04","TC-05","TC-06","TC-07","TC-08"],"comparative_labels":["checked_artifact_better","kernel_only_better","trusted_solver_better","practically_equivalent","inconclusive"],"conclusion":null,"conclusions":["recommend_checked_artifact","recommend_kernel_only","recommend_trusted_solver","tie","inconclusive"],"dependency_acceptance":{"D-004":false,"D-005":false},"epoch":null,"epoch_status":"unfrozen","execution":{"complete_candidates":0,"complete_cross_candidate_cases":0,"completed_candidate_cases":0,"evidence_status":"none","required_candidate_cases":24},"execution_resource_state":{"case_output_bytes":null,"case_peak_memory_bytes":null,"case_temp_storage_bytes":null,"case_wall_seconds":null,"contract_status":"unassigned_freeze_blocker","host_matrix_status":"unassigned_freeze_blocker","timeout_semantics_status":"unassigned_freeze_blocker"},"hard_gate_count":8,"hard_gate_state_precedence":["unsupported","fail","unresolved","pass"],"hard_gate_states":["pass","fail","unresolved","unsupported"],"independent_review_status":"unavailable","input_bindings":{"case_input_index":{"path":"research/decisions/D-009/d009-v0.1-case-input-index.json","sha256":"c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859"},"solver_trust_suite":{"path":"docs/SOLVER_TRUST_DECISION_SUITE.md","sha256":"a26073e6431fb401af4aac6e57dcdfa76b27fe9451c26fb42595d7de14c2a35b"}},"laboratory_budgets":{"max_json_depth":32,"max_json_nodes":16384,"max_packet_bytes":262144,"max_string_bytes":16384},"metrics":["M-01","M-02","M-03","M-04","M-05","M-06","M-07","M-08","M-09","M-10","M-11","M-12","M-13","M-14","M-15","M-16"],"nonclaims":["no D-004 acceptance inferred","no D-005 acceptance inferred","no D-006 or D-007 acceptance inferred","no solver, proof assistant, certificate checker, adapter, runner, observer, or isolation dependency admitted, acquired, installed, or executed","no candidate-neutral shared input or executable fixture present","no D-009 evidence epoch frozen","no candidate executed and no candidate result recorded","no solver-trust candidate selected or recommended by the laboratory","no proof, certificate, counterexample, theorem, claim, or cache result validated","no solver added to or removed from the logical TCB","no proof-bearing implementation or solver-backed search authorized","no independent review claimed","no roadmap gate or readiness movement"],"owner_protocol_review":"none","owner_scopes":["SR-01","SR-02","SR-03","SR-04","SR-05","SR-06","SR-07","SR-08"],"physical_execution_order":null,"protocol_counts":{"cold_bootstrap_runs":5,"deterministic_profile_runs":3,"maximum_same_owner_reproducibility_level":2,"owner_workspaces":2,"timed_replays_per_case":30,"unmeasured_warmups":1},"protocol_gaps":["D-004 acceptance absent","D-005 acceptance absent","candidate-neutral shared inputs and all eight executable case inventories absent","input-manifest digest unfrozen","execution resource, timeout, host, environment, cache, and network contract unassigned","solver, checker, proof-format, dependency-graph, acquisition, and D-018 admissions absent","candidate adapters, runner, observer, and isolation backend absent","versioned D-009 result and same-owner-replay schema absent","D-006 and D-007 proof/checker interfaces unavailable for downstream conformance","physical execution order, correction window, and materiality bands unassigned","owner protocol review absent"],"schema_version":"d009-pre-epoch-packet-v0.3","selection":null,"semantic_bindings":{"decision_register_d009":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"bc4bf5fd534a61efdd62e16b57633bea1f5ad8f3224555f310911a3ab26bb41a","path":"docs/DECISIONS.md","scope":"markdown_exact_heading_range","section_end_heading":"## D-010 — Compiler strategy","section_start_heading":"## D-009 — Solver trust"},"decision_register_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c38f7b1d3b3f733a628e0618124e290648298eea8dab2ef89f81c597eb68d177","path":"docs/DECISIONS.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c92c6657068d3a71b8ccb184b408020f5cd44971286b2743e1e4d55dd67125e6","path":"docs/ROADMAP.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_s4":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"ef9322f7c23467007a4c6d64411c79ba0f3dae856ed49602d9cecdfc9490b096","path":"docs/ROADMAP.md","scope":"markdown_exact_heading_range","section_end_heading":"### S5 — Compiler IRs and one output path","section_start_heading":"### S4 — Proof and claim boundary"},"solver_trust_suite":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c2838efcc963de22141631d58fae4730c131d47d8ea2e79906cf66d0546032d0","path":"docs/SOLVER_TRUST_DECISION_SUITE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null}},"status":"draft_unfrozen","suite_version":"d009-v0.1-draft"} +{"atomic_outcome_meanings":{"not_satisfied":"permitted, identity-bound negative evidence establishes that the exact proposition is false or violated within its scope; absence or incompleteness alone is not not_satisfied","satisfied":"the exact proposition has its complete permitted mandatory closure and no valid decisive negative result","unresolved":"the claim is well-formed and within the declared support model, but a required decision remains unknown, incomplete, conflicting, or exhausted","unsupported":"the declared policy or support envelope offers no permitted evaluation or authority path for that exact claim and scope"},"atomic_outcomes":["satisfied","not_satisfied","unresolved","unsupported"],"candidate_states":[{"adapter_status":"absent","candidate":"SP-01","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"SP-02","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"SP-03","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"}],"candidates":[{"id":"SP-01","name":"Checked-artifact portfolio"},{"id":"SP-02","name":"Kernel-only reconstruction"},{"id":"SP-03","name":"Direct trusted-solver authority"}],"case_input_index_sha256":"2e55c671771d5740b0346992c8b86b9cce0571a8fc3e5b745195b0956010470e","cases":["TC-01","TC-02","TC-03","TC-04","TC-05","TC-06","TC-07","TC-08"],"comparative_labels":["checked_artifact_better","kernel_only_better","trusted_solver_better","practically_equivalent","inconclusive"],"conclusion":null,"conclusions":["recommend_checked_artifact","recommend_kernel_only","recommend_trusted_solver","tie","inconclusive"],"dependency_acceptance":{"D-004":false,"D-005":false},"epoch":null,"epoch_status":"unfrozen","execution":{"complete_candidates":0,"complete_cross_candidate_cases":0,"completed_candidate_cases":0,"evidence_status":"none","required_candidate_cases":24},"execution_resource_state":{"case_output_bytes":null,"case_peak_memory_bytes":null,"case_temp_storage_bytes":null,"case_wall_seconds":null,"contract_status":"unassigned_freeze_blocker","host_matrix_status":"unassigned_freeze_blocker","timeout_semantics_status":"unassigned_freeze_blocker"},"hard_gate_count":8,"hard_gate_state_precedence":["unsupported","fail","unresolved","pass"],"hard_gate_states":["pass","fail","unresolved","unsupported"],"independent_review_status":"unavailable","input_bindings":{"case_input_index":{"path":"research/decisions/D-009/d009-v0.1-case-input-index.json","sha256":"c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859"},"solver_trust_suite":{"path":"docs/SOLVER_TRUST_DECISION_SUITE.md","sha256":"a26073e6431fb401af4aac6e57dcdfa76b27fe9451c26fb42595d7de14c2a35b"}},"laboratory_budgets":{"max_json_depth":32,"max_json_nodes":16384,"max_packet_bytes":262144,"max_string_bytes":16384},"metrics":["M-01","M-02","M-03","M-04","M-05","M-06","M-07","M-08","M-09","M-10","M-11","M-12","M-13","M-14","M-15","M-16"],"nonclaims":["no D-004 acceptance inferred","no D-005 acceptance inferred","no D-006 or D-007 acceptance inferred","no solver, proof assistant, certificate checker, adapter, runner, observer, or isolation dependency admitted, acquired, installed, or executed","no candidate-neutral shared input or executable fixture present","no D-009 evidence epoch frozen","no candidate executed and no candidate result recorded","no solver-trust candidate selected or recommended by the laboratory","no proof, certificate, counterexample, theorem, claim, or cache result validated","no solver added to or removed from the logical TCB","no proof-bearing implementation or solver-backed search authorized","no independent review claimed","no roadmap gate or readiness movement"],"owner_protocol_review":"none","owner_scopes":["SR-01","SR-02","SR-03","SR-04","SR-05","SR-06","SR-07","SR-08"],"physical_execution_order":null,"protocol_counts":{"cold_bootstrap_runs":5,"deterministic_profile_runs":3,"maximum_same_owner_reproducibility_level":2,"owner_workspaces":2,"timed_replays_per_case":30,"unmeasured_warmups":1},"protocol_gaps":["D-004 acceptance absent","D-005 acceptance absent","candidate-neutral shared inputs and all eight executable case inventories absent","input-manifest digest unfrozen","execution resource, timeout, host, environment, cache, and network contract unassigned","solver, checker, proof-format, dependency-graph, acquisition, and D-018 admissions absent","candidate adapters, runner, observer, and isolation backend absent","versioned D-009 result and same-owner-replay schema absent","D-006 and D-007 proof/checker interfaces unavailable for downstream conformance","physical execution order, correction window, and materiality bands unassigned","owner protocol review absent"],"schema_version":"d009-pre-epoch-packet-v0.3","selection":null,"semantic_bindings":{"decision_register_d009":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"bc4bf5fd534a61efdd62e16b57633bea1f5ad8f3224555f310911a3ab26bb41a","path":"docs/DECISIONS.md","scope":"markdown_exact_heading_range","section_end_heading":"## D-010 — Compiler strategy","section_start_heading":"## D-009 — Solver trust"},"decision_register_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c65d91e5566f72114a71739efa8ca300feea24f0f2312e902d06fd9172fa0628","path":"docs/DECISIONS.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"85480fb2764ae7bb98acd08590bb49116f5bb8cf62bebdee509aadbf1e22e6ea","path":"docs/ROADMAP.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_s4":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"ef9322f7c23467007a4c6d64411c79ba0f3dae856ed49602d9cecdfc9490b096","path":"docs/ROADMAP.md","scope":"markdown_exact_heading_range","section_end_heading":"### S5 — Compiler IRs and one output path","section_start_heading":"### S4 — Proof and claim boundary"},"solver_trust_suite":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c2838efcc963de22141631d58fae4730c131d47d8ea2e79906cf66d0546032d0","path":"docs/SOLVER_TRUST_DECISION_SUITE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null}},"status":"draft_unfrozen","suite_version":"d009-v0.1-draft"} diff --git a/research/decisions/D-010/README.md b/research/decisions/D-010/README.md index 4b03235..8fe836a 100644 --- a/research/decisions/D-010/README.md +++ b/research/decisions/D-010/README.md @@ -26,9 +26,9 @@ candidate order through CC-08. It is a canonical identity serialization, not an authorized physical execution order. The packet's strict canonical JSON SHA-256, excluding its final line feed, is -`ae6c8fc6e433d3cbb895aebf95667711d442efa348e241c0059e72a489bcac9b`; +`14962f66ada4ca34e18e5711b0993da3868f139bf39cfd50e37433b56ca68304`; its raw file SHA-256, including the final line feed, is -`647ed6e554a0440c7345e52ff8263aba9d2cb19e444e5956203595c0461d6f6e`. +`67b0d49b3cd085130328670d4df229372ee4cf906e3e55abe12dcf91534d52aa`. Its closed packet schema is `d010-pre-epoch-packet-v0.1`, and the suite version is `d010-v0.1-draft`. The case-input index's strict canonical JSON SHA-256 is `4c8b0547a8f3bd380f4569008c8728014bb1d8718a5bfe17402bd03866560209`; diff --git a/research/decisions/D-010/d010-v0.1-draft-packet.json b/research/decisions/D-010/d010-v0.1-draft-packet.json index 96dfb37..fc07440 100644 --- a/research/decisions/D-010/d010-v0.1-draft-packet.json +++ b/research/decisions/D-010/d010-v0.1-draft-packet.json @@ -1 +1 @@ -{"atomic_outcome_meanings":{"not_satisfied":"permitted, identity-bound negative evidence establishes that the exact proposition is false or violated within its scope; absence or incompleteness alone is not not_satisfied","satisfied":"the exact proposition has its complete permitted mandatory closure and no valid decisive negative result","unresolved":"the claim is well-formed and within the declared support model, but a required decision remains unknown, incomplete, conflicting, or exhausted","unsupported":"the declared policy or support envelope offers no permitted evaluation or authority path for that exact claim and scope"},"atomic_outcomes":["satisfied","not_satisfied","unresolved","unsupported"],"candidate_states":[{"adapter_status":"absent","candidate":"CP-01","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-02","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-03","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-04","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-05","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"}],"candidates":[{"id":"CP-01","name":"Theorem/certificate hybrid direct-native path"},{"id":"CP-02","name":"Mechanized proof-per-pass direct-native path"},{"id":"CP-03","name":"Versioned Jasmin backend boundary"},{"id":"CP-04","name":"Portable C11 interoperability boundary"},{"id":"CP-05","name":"Versioned LLVM IR interoperability boundary"}],"case_input_index_sha256":"4c8b0547a8f3bd380f4569008c8728014bb1d8718a5bfe17402bd03866560209","cases":["CC-01","CC-02","CC-03","CC-04","CC-05","CC-06","CC-07","CC-08"],"comparative_axes":["AX-01","AX-02","AX-03","AX-04","AX-05","AX-06","AX-07","AX-08","AX-09"],"comparative_labels":["hybrid_direct_native_better","proof_per_pass_direct_native_better","jasmin_backend_better","portable_c11_better","llvm_ir_better","practically_equivalent","inconclusive"],"conclusion":null,"conclusions":["recommend_hybrid_direct_native","recommend_proof_per_pass_direct_native","recommend_jasmin_backend","recommend_portable_c11","recommend_llvm_ir","tie","inconclusive"],"dependency_acceptance":{"D-003":true,"D-004":false,"D-005":false,"D-006":false,"D-009":false},"epoch":null,"epoch_status":"unfrozen","execution":{"complete_candidates":0,"complete_cross_candidate_cases":0,"completed_candidate_cases":0,"evidence_status":"none","required_candidate_cases":40},"execution_resource_state":{"case_output_bytes":null,"case_peak_memory_bytes":null,"case_temp_storage_bytes":null,"case_wall_seconds":null,"contract_status":"unassigned_freeze_blocker","host_matrix_status":"unassigned_freeze_blocker","timeout_semantics_status":"unassigned_freeze_blocker"},"hard_gate_count":8,"hard_gate_state_precedence":["unsupported","fail","unresolved","pass"],"hard_gate_states":["pass","fail","unresolved","unsupported"],"independent_review_status":"unavailable","input_bindings":{"case_input_index":{"path":"research/decisions/D-010/d010-v0.1-case-input-index.json","sha256":"e9f59e86dff6219474d244ff01a98c75b7b17c65f1f91506d483a57e95e33670"},"compiler_strategy_suite":{"path":"docs/COMPILER_STRATEGY_DECISION_SUITE.md","sha256":"5d36f1faeda027b9784846af0aa742339c6b821f39b72a8ca067a90c41a46c73"}},"laboratory_budgets":{"max_json_depth":32,"max_json_nodes":16384,"max_packet_bytes":262144,"max_string_bytes":16384},"metrics":["M-01","M-02","M-03","M-04","M-05","M-06","M-07","M-08","M-09","M-10","M-11","M-12","M-13","M-14","M-15","M-16","M-17","M-18","M-19"],"nonclaims":["D-003 acceptance grants no D-004, D-005, D-006, D-007, D-009, D-010, D-011, D-012, or D-013 acceptance","no compiler, backend, proof assistant, solver, checker, assembler, linker, adapter, runner, observer, emulator, or isolation dependency admitted, acquired, installed, or executed","no executable shared input, candidate mapping, result schema, or physical execution order exists","no evidence epoch, candidate result, selection, or conclusion exists","no source-to-IR, pass, certificate, theorem, leakage, target, ABI, object, wrapper, interoperability, or final-byte proposition validated","no compiler strategy or output path selected, preferred, recommended by these inputs, implemented, or authorized for claim-bearing product work","no claim frontier, logical TCB, target envelope, leakage model, or foreign boundary accepted or changed","no C11 or LLVM artifact inherits a native assurance claim, and neither may borrow evidence from the other","no independent review, reproduction, audit, certification, or external validation claimed","no roadmap gate, S5 closure, release authority, compiler capability, or readiness credit"],"owner_protocol_review":"none","owner_scopes":["CR-01","CR-02","CR-03","CR-04","CR-05","CR-06","CR-07","CR-08","CR-09","CR-10","CR-11"],"physical_execution_order":null,"protocol_counts":{"cold_bootstrap_runs":5,"deterministic_profile_runs":3,"maximum_same_owner_reproducibility_level":2,"owner_workspaces":2,"timed_replays_per_case":30,"unmeasured_warmups":1},"protocol_gaps":["D-004 acceptance absent","D-005 acceptance absent","D-006 acceptance absent","D-009 acceptance absent","candidate-neutral shared inputs and all eight executable case inventories absent","input-manifest digest unfrozen","execution resource, timeout, host, environment, cache, and network contract unassigned","compiler, backend, toolchain, proof, checker, acquisition, and D-018 admissions absent","candidate adapters, runner, observer, emulator, and isolation backend absent","versioned D-010 result and same-owner-replay schema absent","suite-only downstream model fixtures and reference endpoints absent","physical execution order, correction window, and materiality bands unassigned","owner protocol review absent"],"schema_version":"d010-pre-epoch-packet-v0.1","selection":null,"semantic_bindings":{"architecture_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"4c5b30ac62050400550e83e50dd3190ff9d30eaf8590c754d2b873432174b8d7","path":"docs/ARCHITECTURE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"assurance_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"87bbbdaa24ffb0fdae7238b2bc27201052241f66363c3549ba02890f3288090f","path":"docs/ASSURANCE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"compiler_strategy_suite":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"25dfd84dba00743714378585c297ef840f15ac7942921d0080bd7787b49caaf0","path":"docs/COMPILER_STRATEGY_DECISION_SUITE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"decision_register_d010":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"059eaeb8128f58a76d87855951767a1ccc936e847bf090bf4240f18d94281d17","path":"docs/DECISIONS.md","scope":"markdown_exact_heading_range","section_end_heading":"## D-011 — Initial native target envelope","section_start_heading":"## D-010 — Compiler strategy"},"decision_register_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c38f7b1d3b3f733a628e0618124e290648298eea8dab2ef89f81c597eb68d177","path":"docs/DECISIONS.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"research_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"cb40341f074bff28933ce10ae08edf8b0eef3709adb84d85474b3ebccaff8e5f","path":"docs/RESEARCH.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c92c6657068d3a71b8ccb184b408020f5cd44971286b2743e1e4d55dd67125e6","path":"docs/ROADMAP.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_s5":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c407724176ed44756270176818ca9b89dcda2a6a514e4d59bae3054f7def4c28","path":"docs/ROADMAP.md","scope":"markdown_exact_heading_range","section_end_heading":"### S6 — Memory, leakage, ABI, and native targets","section_start_heading":"### S5 — Compiler IRs and one output path"},"threat_model_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"b4be29699ee6e131192777ebc8748b3dd8e113e11e7b09f5d7c2aba11eae3385","path":"docs/security/THREAT_MODEL.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"traceability_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"15b334ea33ad9028c8e27dece8ee6143e8a69ff1825333e0041bf88cdf249e92","path":"docs/GATE0_TRACEABILITY.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null}},"status":"draft_unfrozen","suite_version":"d010-v0.1-draft"} +{"atomic_outcome_meanings":{"not_satisfied":"permitted, identity-bound negative evidence establishes that the exact proposition is false or violated within its scope; absence or incompleteness alone is not not_satisfied","satisfied":"the exact proposition has its complete permitted mandatory closure and no valid decisive negative result","unresolved":"the claim is well-formed and within the declared support model, but a required decision remains unknown, incomplete, conflicting, or exhausted","unsupported":"the declared policy or support envelope offers no permitted evaluation or authority path for that exact claim and scope"},"atomic_outcomes":["satisfied","not_satisfied","unresolved","unsupported"],"candidate_states":[{"adapter_status":"absent","candidate":"CP-01","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-02","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-03","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-04","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"},{"adapter_status":"absent","candidate":"CP-05","dependency_admission_status":"absent","execution_status":"not_performed","implementation_status":"absent"}],"candidates":[{"id":"CP-01","name":"Theorem/certificate hybrid direct-native path"},{"id":"CP-02","name":"Mechanized proof-per-pass direct-native path"},{"id":"CP-03","name":"Versioned Jasmin backend boundary"},{"id":"CP-04","name":"Portable C11 interoperability boundary"},{"id":"CP-05","name":"Versioned LLVM IR interoperability boundary"}],"case_input_index_sha256":"4c8b0547a8f3bd380f4569008c8728014bb1d8718a5bfe17402bd03866560209","cases":["CC-01","CC-02","CC-03","CC-04","CC-05","CC-06","CC-07","CC-08"],"comparative_axes":["AX-01","AX-02","AX-03","AX-04","AX-05","AX-06","AX-07","AX-08","AX-09"],"comparative_labels":["hybrid_direct_native_better","proof_per_pass_direct_native_better","jasmin_backend_better","portable_c11_better","llvm_ir_better","practically_equivalent","inconclusive"],"conclusion":null,"conclusions":["recommend_hybrid_direct_native","recommend_proof_per_pass_direct_native","recommend_jasmin_backend","recommend_portable_c11","recommend_llvm_ir","tie","inconclusive"],"dependency_acceptance":{"D-003":true,"D-004":false,"D-005":false,"D-006":false,"D-009":false},"epoch":null,"epoch_status":"unfrozen","execution":{"complete_candidates":0,"complete_cross_candidate_cases":0,"completed_candidate_cases":0,"evidence_status":"none","required_candidate_cases":40},"execution_resource_state":{"case_output_bytes":null,"case_peak_memory_bytes":null,"case_temp_storage_bytes":null,"case_wall_seconds":null,"contract_status":"unassigned_freeze_blocker","host_matrix_status":"unassigned_freeze_blocker","timeout_semantics_status":"unassigned_freeze_blocker"},"hard_gate_count":8,"hard_gate_state_precedence":["unsupported","fail","unresolved","pass"],"hard_gate_states":["pass","fail","unresolved","unsupported"],"independent_review_status":"unavailable","input_bindings":{"case_input_index":{"path":"research/decisions/D-010/d010-v0.1-case-input-index.json","sha256":"e9f59e86dff6219474d244ff01a98c75b7b17c65f1f91506d483a57e95e33670"},"compiler_strategy_suite":{"path":"docs/COMPILER_STRATEGY_DECISION_SUITE.md","sha256":"5d36f1faeda027b9784846af0aa742339c6b821f39b72a8ca067a90c41a46c73"}},"laboratory_budgets":{"max_json_depth":32,"max_json_nodes":16384,"max_packet_bytes":262144,"max_string_bytes":16384},"metrics":["M-01","M-02","M-03","M-04","M-05","M-06","M-07","M-08","M-09","M-10","M-11","M-12","M-13","M-14","M-15","M-16","M-17","M-18","M-19"],"nonclaims":["D-003 acceptance grants no D-004, D-005, D-006, D-007, D-009, D-010, D-011, D-012, or D-013 acceptance","no compiler, backend, proof assistant, solver, checker, assembler, linker, adapter, runner, observer, emulator, or isolation dependency admitted, acquired, installed, or executed","no executable shared input, candidate mapping, result schema, or physical execution order exists","no evidence epoch, candidate result, selection, or conclusion exists","no source-to-IR, pass, certificate, theorem, leakage, target, ABI, object, wrapper, interoperability, or final-byte proposition validated","no compiler strategy or output path selected, preferred, recommended by these inputs, implemented, or authorized for claim-bearing product work","no claim frontier, logical TCB, target envelope, leakage model, or foreign boundary accepted or changed","no C11 or LLVM artifact inherits a native assurance claim, and neither may borrow evidence from the other","no independent review, reproduction, audit, certification, or external validation claimed","no roadmap gate, S5 closure, release authority, compiler capability, or readiness credit"],"owner_protocol_review":"none","owner_scopes":["CR-01","CR-02","CR-03","CR-04","CR-05","CR-06","CR-07","CR-08","CR-09","CR-10","CR-11"],"physical_execution_order":null,"protocol_counts":{"cold_bootstrap_runs":5,"deterministic_profile_runs":3,"maximum_same_owner_reproducibility_level":2,"owner_workspaces":2,"timed_replays_per_case":30,"unmeasured_warmups":1},"protocol_gaps":["D-004 acceptance absent","D-005 acceptance absent","D-006 acceptance absent","D-009 acceptance absent","candidate-neutral shared inputs and all eight executable case inventories absent","input-manifest digest unfrozen","execution resource, timeout, host, environment, cache, and network contract unassigned","compiler, backend, toolchain, proof, checker, acquisition, and D-018 admissions absent","candidate adapters, runner, observer, emulator, and isolation backend absent","versioned D-010 result and same-owner-replay schema absent","suite-only downstream model fixtures and reference endpoints absent","physical execution order, correction window, and materiality bands unassigned","owner protocol review absent"],"schema_version":"d010-pre-epoch-packet-v0.1","selection":null,"semantic_bindings":{"architecture_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"2941e5768590179bcf6a8f632b2c7b83f2f3270340a50f7b7f3e0e65eae4aedd","path":"docs/ARCHITECTURE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"assurance_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"0d3028096747c54626022aa4e6151349f9649c3263990cbf88e6549de43a9f3d","path":"docs/ASSURANCE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"compiler_strategy_suite":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"25dfd84dba00743714378585c297ef840f15ac7942921d0080bd7787b49caaf0","path":"docs/COMPILER_STRATEGY_DECISION_SUITE.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"decision_register_d010":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"059eaeb8128f58a76d87855951767a1ccc936e847bf090bf4240f18d94281d17","path":"docs/DECISIONS.md","scope":"markdown_exact_heading_range","section_end_heading":"## D-011 — Initial native target envelope","section_start_heading":"## D-010 — Compiler strategy"},"decision_register_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c65d91e5566f72114a71739efa8ca300feea24f0f2312e902d06fd9172fa0628","path":"docs/DECISIONS.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"research_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"f40fc718041748f8cba86dcf79e8bcc9037a146e30bc55d8b546a1a77037e1d4","path":"docs/RESEARCH.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"85480fb2764ae7bb98acd08590bb49116f5bb8cf62bebdee509aadbf1e22e6ea","path":"docs/ROADMAP.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"roadmap_s5":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"c407724176ed44756270176818ca9b89dcda2a6a514e4d59bae3054f7def4c28","path":"docs/ROADMAP.md","scope":"markdown_exact_heading_range","section_end_heading":"### S6 — Memory, leakage, ABI, and native targets","section_start_heading":"### S5 — Compiler IRs and one output path"},"threat_model_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"1e846019d314f903b72d80b816b6f578ff2300374dafd872628efeaced52bb58","path":"docs/security/THREAT_MODEL.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null},"traceability_document":{"normalization":"markdown-prose-lines-exact-v1","normalized_sha256":"6ee1aa32920d0b8e5a9b9396d54e69ec6ccb4485234996263beaefa8dbf602bc","path":"docs/GATE0_TRACEABILITY.md","scope":"whole_document","section_end_heading":null,"section_start_heading":null}},"status":"draft_unfrozen","suite_version":"d010-v0.1-draft"} diff --git a/tools/d004_reviewed_protocol.py b/tools/d004_reviewed_protocol.py new file mode 100644 index 0000000..ec0814a --- /dev/null +++ b/tools/d004_reviewed_protocol.py @@ -0,0 +1,1017 @@ +"""Closed validation for the reviewed, non-executable D-004 v0.6 protocol. + +The helper deliberately has no dependency on :mod:`validate_foundation` so the +foundation validator can load it through its content-identified helper loader. +The supplied validator must expose ``root``, ``_read_repository_bytes``, +``_load_repository_json``, and ``add`` in the same way as ``FoundationValidator``. +""" + +from __future__ import annotations + +from collections import Counter +import hashlib +import json +import re +from pathlib import Path +from typing import Any + + +OWNER_RECORD_PATH = Path( + "research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json" +) +REVIEWED_PROTOCOL_PATH = Path( + "research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json" +) +REVIEWED_REPLAY_PLAN_PATH = Path( + "research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json" +) + +OWNER_RECORD_CANONICAL_SHA256 = ( + "587c3ad11bf6e0d3dddc02cd7ba53896f54f8e08ec59ed1ece286e13fe9b0c9d" +) +OWNER_RECORD_RAW_SHA256 = ( + "cbdfa3e07245a6843100a6b17860ea5dcec39f7f341b194faeee91e2ae585f3c" +) +REVIEWED_PROTOCOL_CANONICAL_SHA256 = ( + "c67c17bdf68eb0619ec7698dd2807912251a0556931fa79b6838a9d5c6a9bd98" +) +REVIEWED_PROTOCOL_RAW_SHA256 = ( + "1111889b47edf24e88926bf8fa6770cf84ebcd1abb1d7dc2687dc42e0135fb53" +) +REVIEWED_REPLAY_PLAN_CANONICAL_SHA256 = ( + "a18084768cd05f6fcffdea724e330c0c81c5caac7816213156f4f9967fc5cb1b" +) +REVIEWED_REPLAY_PLAN_RAW_SHA256 = ( + "45632f796c7c08d26e668b277ccaff5679ccb82857732c3b8beead66198a3eb7" +) + +_OLD_JSON_IDENTITIES = { + "named_mutations": ( + "research/decisions/D-004/d004-v0.2-named-mutations.json", + "970999d998cdc202a6caa4e2f798017416c88211a5b6b8508132a07cc9080c0c", + "1d46d6d66c0704fcaa462c625dcac2e72150497bb075322c5e076ea42898be54", + ), + "cross_cutting_fixture_proposals": ( + "research/decisions/D-004/d004-v0.2-cross-cutting-fixture-proposals.json", + "85407a4a43b5a6bf450ea905fe858482f2f79abb4cbe8ee8690bddc1753d0912", + "d3d58cbeb0d2a90987680cd00bc70caf53518be730a71d0d55ba2a7b50544481", + ), + "cross_cutting_executable_fixtures": ( + "research/decisions/D-004/d004-v0.3-cross-cutting-executable-fixtures.json", + "0516a84260bcc4d8ebb64e0cd3416deb5c43a86b7f5cd882ca757c924e575767", + "5fea65960c47818243d41076dd96a6cab2dbd6d4038fd354a3f5ba30a12622ae", + ), + "case_subjects": ( + "research/decisions/D-004/d004-v0.4-case-subjects.json", + "5b9e734b6bad7913072e87adb29c58547d67bdcb46af942eb6bbc79d0e68166e", + "6266b8e38ad1a83fb777278fc0369844749b2915eabb40ba1ddfc9efa7c985f2", + ), + "candidate_mappings": ( + "research/decisions/D-004/d004-v0.5-candidate-mappings.json", + "c967d7db8ea5049da054129367ec61cd80d729b8ce8cd34c95a76e42c67c97b8", + "70765c64936bbb8aafd6e101fbf20c85396eb722d70e55bb9311d14bfbb15156", + ), + "draft_packet": ( + "research/decisions/D-004/d004-v0.5-draft-packet.json", + "b6df1a38f8a1eb6a80a8864324c21a81cb292d4c48e1981b4547bad41933b340", + "ec3a0a593d1dab7a6ace874dae4fd03c1ae0656cf301897ccabf51cb109c4009", + ), +} + +_DECISION_SUITE_PATH = "docs/SEMANTIC_STRATA_DECISION_SUITE.md" +_DECISION_SUITE_RAW_SHA256 = ( + "64abe8290955f889e28f8bb9ce7653a26ef71a624286aef900d4dbfc3b7eb117" +) +_RESULT_CONTRACT_PATH = ( + "compiler/crates/orange-compiler/tests/d004_support/result_contract.rs" +) +_RESULT_CONTRACT_RAW_SHA256 = ( + "f3fdb4187fa9dffb23e849208da20f112aba764cfa85df80ae578754f3c9c97a" +) +_RESULT_CONTRACT_DESCRIPTOR_SHA256 = ( + "58773e8ce29e8726a8a85203ff7e2a4b1a03f8c02bfbcd7f6056f34fe53a2f29" +) + +_FIXTURE_COUNTS = ( + ("ambiguity", 5), + ("missing-edge", 14), + ("identity-substitution", 13), + ("unsupported", 5), + ("resource-exhaustion", 5), +) + +_FIXTURE_DISPOSITIONS = [ + { + "capability_credit": "none", + "class": fixture_class, + "scope": "bounded_suite_coverage_only", + "status": "reviewed_sufficient", + "subject_count": count, + } + for fixture_class, count in _FIXTURE_COUNTS +] + +_OWNER_MAPPING_DISPOSITION = { + "candidate_graph_count": 5, + "capability_credit": "none", + "evidence_credit": "none", + "mapping_row_count": 70, + "relationship_count": 14, + "selection": None, + "semantic_status": "unaccepted", + "status": "reviewed_symmetric_falsifiable_test_hypotheses", +} + +_PROTOCOL_MAPPING_DISPOSITION = { + **_OWNER_MAPPING_DISPOSITION, + "conformance_state": "unresolved_until_execution", +} + +_FORBIDDEN_AGGREGATION = [ + "warmup", + "retry_substitution", + "voting", + "averaging", + "best_of", + "statistical_confidence", +] + +_OWNER_REPLAY_POLICY = { + "base_candidate_case_slots": 25, + "cache": "fresh_empty_candidate_specific_per_execution", + "deterministic_equality_required": True, + "forbidden_aggregation": _FORBIDDEN_AGGREGATION, + "independent_pass_required": True, + "measured_resource_variance": "permitted_only_within_frozen_bounds", + "physical_order": "repetition_major_then_latin_slot_ordinal", + "repetitions_per_slot": 3, + "required_execution_records": 75, +} + +_EXECUTION_PREIMAGE_FIELDS = [ + "schema_version", + "suite_version", + "epoch", + "packet_sha256", + "replay_plan_sha256", + "execution_ordinal", + "repetition", + "logical_slot_ordinal", + "round", + "position", + "candidate", + "case", + "input_manifest_sha256", + "model_sha256", + "tool_sha256", + "dependency_manifest_sha256", + "environment_sha256", + "candidate_graph_sha256", + "sr_map_sha256", + "semantic_endpoint_sha256", + "parameter_model_sha256", +] + +_DETERMINISTIC_EQUALITY_FIELDS = [ + "digest_bound_inputs_graph_map_model_tool_dependencies_environment_and_argv", + "execution_state", + "log_manifest_stdout_and_stderr_bytes_lengths_and_digests", + "normalized_observations", + "premises_assumptions_trusted_components_and_unsupported_features", + "candidate_graph", + "sr_conformance_map", + "case_verdict", + "byte_manifest", + "replay_expected_output_manifest_sha256", + "measured_resources_stdout_bytes_and_stderr_bytes", +] + +_VARIABLE_FIELDS = [ + "measured_resources.wall_milliseconds", + "measured_resources.peak_memory_bytes", + "measured_resources.temp_storage_bytes", +] + +_DIAGNOSTIC_METADATA = [ + "pid", + "timestamp", + "absolute_temporary_path", + "host_scheduling_data", +] + +_REPLAY_CONTRACT = { + "base_candidate_case_slots": 25, + "cache": "fresh_empty_candidate_specific_per_execution", + "deterministic_equality_fields": _DETERMINISTIC_EQUALITY_FIELDS, + "diagnostic_metadata_excluded_from_semantic_payload": _DIAGNOSTIC_METADATA, + "execution_identity_preimage_fields": _EXECUTION_PREIMAGE_FIELDS, + "failure_rule": ( + "missing_invalid_non_successful_or_inconsistent_repetition_fails_candidate_case" + ), + "forbidden_aggregation": _FORBIDDEN_AGGREGATION, + "logical_schedule": "balanced_latin_5x5_v0.5", + "network": "denied", + "physical_order": "repetition_major_then_latin_slot_ordinal", + "repetitions_per_slot": 3, + "required_execution_records": 75, + "slot_pass_rule": ( + "all_three_repetitions_independently_pass_and_all_deterministic_fields_equal" + ), + "variable_fields_within_frozen_bounds": _VARIABLE_FIELDS, +} + +_CORRECTION_POLICY = { + "candidate_correction_window_owner_hours": 4, + "candidate_local_change": ( + "one_linked_correction_revision_after_complete_first_candidate_packet" + ), + "correction_record_id_pattern": "D004-COR--01", + "forbidden": [ + "broadening_expected_states", + "reclassifying_replay_failure_as_domain_unsupported_or_exhausted", + "changing_an_oracle", + "hiding_or_replacing_prior_logs", + "introducing_undeclared_dependencies", + "second_correction_window", + ], + "max_candidate_corrections": 1, + "prior_records": "retained_immutable", + "rerun_scope": "all_five_candidate_cases_times_three_repetitions", + "shared_change": "new_epoch_for_all_candidates", + "shared_runner_or_environment_defect": "invalidate_entire_epoch", +} + +_EPOCH_FREEZE_BLOCKERS = [ + "candidate adapter implementations and closed request and response schemas absent", + "candidate semantic models endpoint inventories and parameter bindings absent", + "exact executable tool and transitive dependency manifests absent", + "exact deterministic environment and ordered input manifests absent", + "enforcing isolation launcher cache reset and cleanup verification absent", + "output normalizer payload validator and bounded resource meter absent", + "populated result repetition-closure correction and evidence-archive parsers absent", + "exact execution-subject revision and owner freeze record absent", + "frozen epoch packet replay-plan identity and scheduled-execution digests absent", +] + +_OWNER_NONCLAIMS = [ + "no D-004 evidence epoch frozen or candidate execution authorized", + "no D-004 semantic-strata candidate selected or preferred", + "no candidate graph or SR mapping accepted as Orange semantics", + "no D-004 disposition accepted", + "no S3b implementation authorized", + "no execution evidence or candidate capability credit created", + "no exact-revision implementation closure recorded", + "no roadmap gate, release-readiness, or version-readiness movement", +] + +_IMPLEMENTATION_CLOSURE_STATUS = "provisional_pending_exact_merged_revision" + +_OWNER_KNOWN_RISKS = [ + "solo review may retain owner or delegated technical judgment error", + "bounded fixture sufficiency may not survive executable adapter or semantic-model construction", + "the content-addressed reviewed overlay is not yet bound to an exact merged implementation revision", +] + +_OWNER_REVISIT_TRIGGERS = [ + "any bound review subject or protocol rule changes", + "an executable D-004 epoch freeze is proposed", + "independent review becomes available", + "a fixture contradiction mapping error or replay-schedule defect is discovered", + "the reviewed overlay is available at an exact merged revision for implementation closure", +] + +_FIXTURE_REVIEW_BASES = [ + ( + "ambiguity", + "one candidate-neutral ambiguity subject for each of five semantic cases", + "does_not_establish_candidate_disambiguation_behavior", + ), + ( + "missing-edge", + "one missing-edge subject for each of fourteen required relationships", + "does_not_establish_adapter_edge_detection", + ), + ( + "identity-substitution", + "thirteen candidate-neutral subjects spanning the catalogued identity-substitution inventory", + "does_not_establish_identity_validation_behavior", + ), + ( + "unsupported", + "one candidate-neutral unsupported subject for each of five semantic cases", + "does_not_establish_adapter_support", + ), + ( + "resource-exhaustion", + "one candidate-neutral structural resource-exhaustion subject for each of five semantic cases", + "does_not_exercise_replay_resource_ceiling", + ), +] + +_OWNER_VALIDATION = { + "fixture_adequacy_criteria": [ + { + "basis": basis, + "class": fixture_class, + "residual_risk": residual_risk, + } + for fixture_class, basis, residual_risk in _FIXTURE_REVIEW_BASES + ], + "implementation_checks": { + "required": [ + "strict_python_protocol_validator", + "rust_d004_decision_suite", + "foundation_policy_and_full_check", + "exact_head_hosted_checks", + "postmerge_hosted_checks", + ], + "status": "pending_exact_merged_revision_closure", + }, + "mapping_hypothesis_checks": [ + "five distinct candidate graphs are present", + "each graph contains exactly one SR row for each of fourteen required relationships", + "all seventy rows remain unaccepted hypothesis-only inputs", + "no candidate receives asymmetric capability or evidence credit", + ], + "replay_policy_checks": [ + "the reviewed plan statically contains three complete repetition-major traversals of the Latin schedule", + "slot closure requires all three repetitions to independently pass with deterministic-field equality", + "the policy permits only frozen bounded resource measurements to vary", + "warmup retry substitution voting averaging best-of and statistical claims are forbidden", + ], + "review_subject_bindings": "exact_content_identified", +} + +_PROTOCOL_NONCLAIMS = [ + "review closes protocol-review gaps only and creates no execution evidence", + "no D-004 evidence epoch frozen or candidate execution authorized", + "no candidate graph or SR mapping accepted as Orange semantics", + "no semantic-strata candidate selected preferred or accepted", + "no D-004 disposition accepted", + "no S3b implementation authorized", + "no independent review claimed", + "reviewed overlay implementation closure remains provisional until an exact merged revision", + "no roadmap gate or readiness movement", +] + +_REPLAY_NONCLAIMS = [ + "reviewed schedule identities are not candidate executions or evidence", + "no epoch packet replay identity or scheduled-execution digest exists", + "no D-004 semantic-strata candidate selected preferred or accepted", + "no D-004 disposition accepted", + "no S3b implementation authorized", + "reviewed overlay implementation closure remains provisional until an exact merged revision", + "no roadmap gate or readiness movement", +] + + +def _canonical_json_bytes(value: Any) -> bytes: + """Serialize the validator's bounded no-float I-JSON profile canonically.""" + + def serialize(item: Any) -> str: + if item is None: + return "null" + if item is True: + return "true" + if item is False: + return "false" + if isinstance(item, int): + if not -(2**53) + 1 <= item <= 2**53 - 1: + raise ValueError("integer exceeds the I-JSON interoperable range") + return str(item) + if isinstance(item, float): + raise ValueError("floating-point values are forbidden") + if isinstance(item, str): + return json.dumps(item, ensure_ascii=False, separators=(",", ":")) + if isinstance(item, list): + return "[" + ",".join(serialize(child) for child in item) + "]" + if isinstance(item, dict): + if not all(isinstance(key, str) for key in item): + raise TypeError("JSON object names must be strings") + keys = sorted(item, key=lambda key: key.encode("utf-16-be")) + return "{" + ",".join( + f"{serialize(key)}:{serialize(item[key])}" for key in keys + ) + "}" + raise TypeError(f"unsupported JSON value {type(item).__name__}") + + return serialize(value).encode("utf-8") + + +def _json_binding(path: str, canonical_sha256: str, raw_sha256: str) -> dict[str, str]: + return { + "canonical_sha256": canonical_sha256, + "path": path, + "raw_sha256": raw_sha256, + } + + +_OWNER_REVIEW_SUBJECTS = { + name: _json_binding(path, canonical_sha256, raw_sha256) + for name, (path, canonical_sha256, raw_sha256) in _OLD_JSON_IDENTITIES.items() +} +_OWNER_REVIEW_SUBJECTS.update( + { + "decision_suite": { + "path": _DECISION_SUITE_PATH, + "raw_sha256": _DECISION_SUITE_RAW_SHA256, + }, + "result_contract_descriptor": { + "generated_descriptor_sha256": _RESULT_CONTRACT_DESCRIPTOR_SHA256, + "path": _RESULT_CONTRACT_PATH, + "raw_sha256": _RESULT_CONTRACT_RAW_SHA256, + }, + } +) + +_PROTOCOL_BINDINGS = { + name: _OWNER_REVIEW_SUBJECTS[name] + for name in ( + "candidate_mappings", + "case_subjects", + "cross_cutting_executable_fixtures", + "cross_cutting_fixture_proposals", + "draft_packet", + ) +} +_PROTOCOL_BINDINGS["owner_record"] = _json_binding( + OWNER_RECORD_PATH.as_posix(), + OWNER_RECORD_CANONICAL_SHA256, + OWNER_RECORD_RAW_SHA256, +) + +_BASE_PACKET_BINDING = _OWNER_REVIEW_SUBJECTS["draft_packet"] +_OWNER_RECORD_BINDING = _PROTOCOL_BINDINGS["owner_record"] +_PROTOCOL_BINDING = _json_binding( + REVIEWED_PROTOCOL_PATH.as_posix(), + REVIEWED_PROTOCOL_CANONICAL_SHA256, + REVIEWED_PROTOCOL_RAW_SHA256, +) + + +def _expected_schedule() -> list[dict[str, int | str]]: + candidates = ["ST-REL", "ST-UNI", "ST-DUAL", "ST-MIRROR", "ST-HOST"] + cases = ["SC-01", "SC-02", "SC-03", "SC-04", "SC-05"] + logical: list[dict[str, int | str]] = [] + for round_index in range(5): + for position_index in range(5): + logical.append( + { + "candidate": candidates[(round_index + position_index) % 5], + "case": cases[(2 * round_index + position_index) % 5], + "logical_slot_ordinal": len(logical) + 1, + "position": position_index + 1, + "round": round_index + 1, + } + ) + physical: list[dict[str, int | str]] = [] + for repetition in range(1, 4): + for slot in logical: + physical.append( + { + **slot, + "execution_ordinal": len(physical) + 1, + "repetition": repetition, + } + ) + return physical + + +def validate_d004_reviewed_protocol(validator: Any) -> None: + """Validate the exact reviewed D-004 protocol tranche and its immutable base. + + Findings use the ``d004_reviewed_protocol`` prefix. The function returns no + value so it can be called directly from ``FoundationValidator`` later. + """ + + def fail(suffix: str, path: str | Path, message: str) -> None: + validator.add( + f"d004_reviewed_protocol.{suffix}", validator.root / path, message + ) + + def load_reviewed( + relative_path: Path, + label: str, + canonical_sha256: str, + raw_sha256: str, + ) -> Any | None: + path = validator.root / relative_path + raw = validator._read_repository_bytes(path) + if raw is None: + fail(f"{label}_missing", relative_path, "reviewed D-004 JSON is missing") + return None + try: + value = validator._load_repository_json(path) + except (OSError, UnicodeError, ValueError, TypeError) as exc: + fail( + f"{label}_parse", + relative_path, + f"cannot strictly parse duplicate-free reviewed JSON: {exc}", + ) + return None + try: + canonical = _canonical_json_bytes(value) + except (TypeError, ValueError) as exc: + fail( + f"{label}_canonical", + relative_path, + f"reviewed JSON is outside the canonical I-JSON profile: {exc}", + ) + return None + if raw != canonical + b"\n": + fail( + f"{label}_canonical", + relative_path, + "reviewed JSON must be the exact canonical encoding plus one terminal LF", + ) + if ( + hashlib.sha256(canonical).hexdigest() != canonical_sha256 + or hashlib.sha256(raw).hexdigest() != raw_sha256 + ): + fail( + f"{label}_identity", + relative_path, + "reviewed canonical or raw SHA-256 identity drifted", + ) + return value + + owner = load_reviewed( + OWNER_RECORD_PATH, + "owner", + OWNER_RECORD_CANONICAL_SHA256, + OWNER_RECORD_RAW_SHA256, + ) + protocol = load_reviewed( + REVIEWED_PROTOCOL_PATH, + "protocol", + REVIEWED_PROTOCOL_CANONICAL_SHA256, + REVIEWED_PROTOCOL_RAW_SHA256, + ) + replay = load_reviewed( + REVIEWED_REPLAY_PLAN_PATH, + "replay", + REVIEWED_REPLAY_PLAN_CANONICAL_SHA256, + REVIEWED_REPLAY_PLAN_RAW_SHA256, + ) + + old_documents: dict[str, Any] = {} + for name, (path_text, canonical_sha256, raw_sha256) in _OLD_JSON_IDENTITIES.items(): + relative_path = Path(path_text) + path = validator.root / relative_path + raw = validator._read_repository_bytes(path) + if raw is None: + fail("old_input_missing", relative_path, f"immutable {name} input is missing") + continue + try: + value = validator._load_repository_json(path) + canonical = _canonical_json_bytes(value) + except (OSError, UnicodeError, ValueError, TypeError) as exc: + fail( + "old_input_parse", + relative_path, + f"cannot strictly parse immutable {name} input: {exc}", + ) + continue + if raw != canonical + b"\n": + fail( + "old_input_canonical", + relative_path, + f"immutable {name} input lost canonical JSON plus one terminal LF", + ) + if ( + hashlib.sha256(canonical).hexdigest() != canonical_sha256 + or hashlib.sha256(raw).hexdigest() != raw_sha256 + ): + fail( + "old_input_identity", + relative_path, + f"immutable v0.2-v0.5 {name} bytes or digest drifted", + ) + old_documents[name] = value + + for relative_path, expected_sha256, label in ( + (Path(_DECISION_SUITE_PATH), _DECISION_SUITE_RAW_SHA256, "decision suite"), + (Path(_RESULT_CONTRACT_PATH), _RESULT_CONTRACT_RAW_SHA256, "result contract"), + ): + raw = validator._read_repository_bytes(validator.root / relative_path) + if raw is None or hashlib.sha256(raw).hexdigest() != expected_sha256: + fail( + "base_source_identity", + relative_path, + f"exact owner-bound {label} source bytes drifted", + ) + + if not isinstance(owner, dict): + if owner is not None: + fail("owner_schema", OWNER_RECORD_PATH, "owner record root must be an object") + else: + owner_fields = { + "accepted_on", + "accepted_subject", + "authority", + "authorization_subject_revision", + "decision_id", + "decision_status", + "delegated_technical_judgment", + "implementation_authority", + "implementation_closure_status", + "known_risks", + "nonclaims", + "record_id", + "record_disposition", + "revisit_triggers", + "review_kind", + "review_subjects", + "schema_version", + "source_direction", + "structured_disposition", + "validation", + } + if set(owner) != owner_fields: + fail("owner_schema", OWNER_RECORD_PATH, "owner-record fields are not closed") + expected_owner_boundary = { + "accepted_on": "2026-07-26", + "accepted_subject": "D004-PRE-01", + "authority": { + "independent_review": "unavailable", + "review_authority": "Orange Project Owner", + "review_label": "solo-reviewed", + }, + "authorization_subject_revision": ( + "7d09a27369649855ce987c76315271b0d34a20ef" + ), + "decision_id": "D-004", + "decision_status": "proposed", + "delegated_technical_judgment": True, + "implementation_authority": ( + "reviewed_protocol_and_executable_freeze_prerequisite_work_only" + ), + "implementation_closure_status": _IMPLEMENTATION_CLOSURE_STATUS, + "record_id": "D004-PRE-01", + "record_disposition": "accepted", + "review_kind": "pre_epoch_protocol", + "schema_version": "d004-owner-protocol-record-v0.1", + "source_direction": ( + "Accept D004-PRE-01. - you will need to make best decisions for this. " + "this is beyond my range of knowledge." + ), + } + if any(owner.get(key) != value for key, value in expected_owner_boundary.items()): + fail( + "owner_boundary", + OWNER_RECORD_PATH, + "owner authority, disposition, scope, or reviewed revision drifted", + ) + if owner.get("review_subjects") != _OWNER_REVIEW_SUBJECTS: + fail( + "owner_bindings", + OWNER_RECORD_PATH, + "owner record must bind the exact immutable review subjects", + ) + expected_structured_disposition = { + "fixture_class_reviews": _FIXTURE_DISPOSITIONS, + "mapping_review": _OWNER_MAPPING_DISPOSITION, + "replay_policy": _OWNER_REPLAY_POLICY, + } + if owner.get("structured_disposition") != expected_structured_disposition: + fail( + "owner_disposition", + OWNER_RECORD_PATH, + "owner structured disposition must retain fixtures, mapping " + "limits, and replay policy", + ) + if owner.get("nonclaims") != _OWNER_NONCLAIMS: + fail( + "owner_nonclaims", + OWNER_RECORD_PATH, + "owner-record nonclaims were broadened, reordered, or duplicated", + ) + if owner.get("known_risks") != _OWNER_KNOWN_RISKS: + fail( + "owner_known_risks", + OWNER_RECORD_PATH, + "solo-review known risks were weakened, reordered, or omitted", + ) + if owner.get("revisit_triggers") != _OWNER_REVISIT_TRIGGERS: + fail( + "owner_revisit_triggers", + OWNER_RECORD_PATH, + "solo-review revisit triggers were weakened, reordered, or omitted", + ) + if owner.get("validation") != _OWNER_VALIDATION: + fail( + "owner_validation", + OWNER_RECORD_PATH, + "fixture, mapping, replay, or implementation validation basis drifted", + ) + + if not isinstance(protocol, dict): + if protocol is not None: + fail("protocol_schema", REVIEWED_PROTOCOL_PATH, "protocol root must be an object") + else: + protocol_fields = { + "base_suite_version", + "bindings", + "conclusion", + "correction_policy", + "epoch", + "epoch_freeze_blockers", + "epoch_status", + "execution", + "execution_authorized", + "fixture_class_dispositions", + "implementation_closure_status", + "mapping_disposition", + "nonclaims", + "owner_protocol_review", + "physical_execution_order", + "protocol_gaps", + "protocol_version", + "replay_contract", + "schema_version", + "selection", + "status", + } + if set(protocol) != protocol_fields: + fail("protocol_schema", REVIEWED_PROTOCOL_PATH, "protocol fields are not closed") + expected_protocol_boundary = { + "base_suite_version": "d004-v0.5-draft", + "conclusion": None, + "epoch": None, + "epoch_status": "unfrozen", + "execution": { + "complete_candidates": 0, + "complete_cross_candidate_cases": 0, + "completed_candidate_cases": 0, + "evidence_status": "none", + "required_candidate_cases": 25, + "required_execution_records": 75, + "result_record_count": 0, + }, + "execution_authorized": False, + "implementation_closure_status": _IMPLEMENTATION_CLOSURE_STATUS, + "owner_protocol_review": "solo-reviewed", + "physical_execution_order": "repetition_major_then_latin_slot_ordinal", + "protocol_version": "d004-v0.6-reviewed-protocol", + "schema_version": "d004-reviewed-protocol-tranche-v0.1", + "selection": None, + "status": "reviewed_not_executable", + } + if any(protocol.get(key) != value for key, value in expected_protocol_boundary.items()): + fail( + "protocol_boundary", + REVIEWED_PROTOCOL_PATH, + "reviewed protocol weakened its exact unfrozen, zero-evidence boundary", + ) + if protocol.get("bindings") != _PROTOCOL_BINDINGS: + fail( + "protocol_bindings", + REVIEWED_PROTOCOL_PATH, + "reviewed protocol must bind the exact owner record and immutable base inputs", + ) + if protocol.get("fixture_class_dispositions") != _FIXTURE_DISPOSITIONS: + fail( + "fixture_dispositions", + REVIEWED_PROTOCOL_PATH, + "the five ordered fixture dispositions or exact counts drifted", + ) + if protocol.get("mapping_disposition") != _PROTOCOL_MAPPING_DISPOSITION: + fail( + "mapping_limits", + REVIEWED_PROTOCOL_PATH, + "mapping review must remain a 5-by-14, 70-row, zero-credit " + "unresolved hypothesis boundary", + ) + if protocol.get("protocol_gaps") != []: + fail( + "protocol_gaps", + REVIEWED_PROTOCOL_PATH, + "owner review closes protocol gaps exactly; the list must be empty", + ) + blockers = protocol.get("epoch_freeze_blockers") + if blockers != _EPOCH_FREEZE_BLOCKERS or len(set(blockers or [])) != len( + _EPOCH_FREEZE_BLOCKERS + ): + fail( + "epoch_freeze_blockers", + REVIEWED_PROTOCOL_PATH, + "all nonempty, unique executable-freeze blockers must remain exact", + ) + if protocol.get("replay_contract") != _REPLAY_CONTRACT: + fail( + "replay_contract", + REVIEWED_PROTOCOL_PATH, + "repetition equality, variance, isolation, and fail-closed rules drifted", + ) + if protocol.get("correction_policy") != _CORRECTION_POLICY: + fail( + "correction_policy", + REVIEWED_PROTOCOL_PATH, + "one-window correction and full-rerun rules drifted", + ) + if protocol.get("nonclaims") != _PROTOCOL_NONCLAIMS: + fail( + "protocol_nonclaims", + REVIEWED_PROTOCOL_PATH, + "protocol nonclaims were broadened, reordered, or duplicated", + ) + + proposals = old_documents.get("cross_cutting_fixture_proposals") + fixtures = old_documents.get("cross_cutting_executable_fixtures") + if isinstance(proposals, dict) and isinstance(fixtures, dict): + proposal_rows = proposals.get("proposals") + fixture_rows = fixtures.get("fixtures") + proposal_values = proposal_rows if isinstance(proposal_rows, list) else [] + fixture_values = fixture_rows if isinstance(fixture_rows, list) else [] + proposal_counts = Counter( + row.get("class") + for row in proposal_values + if isinstance(row, dict) + ) + fixture_counts = Counter( + row.get("fixture_subject", {}).get("class") + for row in fixture_values + if isinstance(row, dict) and isinstance(row.get("fixture_subject"), dict) + ) + expected_counts = Counter(dict(_FIXTURE_COUNTS)) + if ( + not isinstance(proposal_rows, list) + or not isinstance(fixture_rows, list) + or proposal_counts != expected_counts + or fixture_counts != expected_counts + or sum(fixture_counts.values()) != 42 + ): + fail( + "fixture_inventory", + REVIEWED_PROTOCOL_PATH, + "reviewed fixture counts do not match the exact 42 proposal " + "and executable subjects", + ) + + mappings = old_documents.get("candidate_mappings") + if isinstance(mappings, dict): + subject = mappings.get("catalog_subject") + graph_rows = subject.get("candidate_graphs") if isinstance(subject, dict) else None + mapping_count = 0 + if isinstance(graph_rows, list): + for graph_record in graph_rows: + graph = graph_record.get("graph") if isinstance(graph_record, dict) else None + rows = graph.get("sr_rows") if isinstance(graph, dict) else None + if isinstance(rows, list): + mapping_count += len(rows) + exact_input_boundary = { + "epoch": None, + "evidence_status": "none", + "frozen": False, + "owner_protocol_review": "none", + "status": "draft_unreviewed_input_only", + } + if ( + not isinstance(subject, dict) + or subject.get("candidate_count") != 5 + or subject.get("relationship_count") != 14 + or subject.get("mapping_row_count") != 70 + or not isinstance(graph_rows, list) + or len(graph_rows) != 5 + or mapping_count != 70 + or any(mappings.get(key) != value for key, value in exact_input_boundary.items()) + ): + fail( + "mapping_input_boundary", + REVIEWED_PROTOCOL_PATH, + "reviewed mappings must remain exact unaccepted input-only hypotheses", + ) + + if not isinstance(replay, dict): + if replay is not None: + fail("replay_schema", REVIEWED_REPLAY_PLAN_PATH, "replay-plan root must be an object") + return + + replay_fields = { + "base_packet", + "epoch", + "execution_identity_preimage_fields", + "execution_identity_schema", + "execution_identity_status", + "implementation_closure_status", + "logical_schedule", + "nonclaims", + "owner_record", + "physical_execution_count", + "physical_order", + "protocol", + "repetitions_per_slot", + "schedule", + "schema_version", + "status", + "suite_version", + } + if set(replay) != replay_fields: + fail("replay_schema", REVIEWED_REPLAY_PLAN_PATH, "replay-plan fields are not closed") + expected_replay_boundary = { + "base_packet": _BASE_PACKET_BINDING, + "epoch": None, + "execution_identity_schema": "d004-scheduled-execution-identity-v0.1", + "execution_identity_status": ( + "unavailable_until_frozen_epoch_packet_plan_and_manifests" + ), + "logical_schedule": "balanced_latin_5x5_v0.5", + "implementation_closure_status": _IMPLEMENTATION_CLOSURE_STATUS, + "owner_record": _OWNER_RECORD_BINDING, + "physical_execution_count": 75, + "physical_order": "repetition_major_then_latin_slot_ordinal", + "protocol": _PROTOCOL_BINDING, + "repetitions_per_slot": 3, + "schema_version": "d004-replay-plan-v0.1", + "status": "reviewed_uninstantiated", + "suite_version": "d004-v0.6-reviewed-protocol", + } + if any(replay.get(key) != value for key, value in expected_replay_boundary.items()): + fail( + "replay_boundary", + REVIEWED_REPLAY_PLAN_PATH, + "replay plan bindings or reviewed-uninstantiated boundary drifted", + ) + if replay.get("execution_identity_preimage_fields") != _EXECUTION_PREIMAGE_FIELDS: + fail( + "execution_preimage", + REVIEWED_REPLAY_PLAN_PATH, + "scheduled-execution identity fields or order drifted", + ) + if isinstance(protocol, dict): + protocol_replay = protocol.get("replay_contract") + protocol_preimage = ( + protocol_replay.get("execution_identity_preimage_fields") + if isinstance(protocol_replay, dict) + else None + ) + if replay.get("execution_identity_preimage_fields") != protocol_preimage: + fail( + "execution_preimage_join", + REVIEWED_REPLAY_PLAN_PATH, + "protocol and replay plan disagree on the execution identity preimage", + ) + expected_schedule = _expected_schedule() + if replay.get("schedule") != expected_schedule: + fail( + "schedule", + REVIEWED_REPLAY_PLAN_PATH, + "schedule must be exactly 3 repetitions of the 25-slot balanced Latin order", + ) + else: + rows = replay["schedule"] + row_keys = { + "candidate", + "case", + "execution_ordinal", + "logical_slot_ordinal", + "position", + "repetition", + "round", + } + if ( + any(set(row) != row_keys for row in rows) + or len({row["execution_ordinal"] for row in rows}) != 75 + or Counter((row["candidate"], row["case"]) for row in rows) + != Counter( + { + (candidate, case): 3 + for candidate in ( + "ST-REL", + "ST-UNI", + "ST-DUAL", + "ST-MIRROR", + "ST-HOST", + ) + for case in ("SC-01", "SC-02", "SC-03", "SC-04", "SC-05") + } + ) + ): + fail( + "schedule_closure", + REVIEWED_REPLAY_PLAN_PATH, + "physical schedule is not unique, closed, and three-per-pair", + ) + if replay.get("nonclaims") != _REPLAY_NONCLAIMS: + fail( + "replay_nonclaims", + REVIEWED_REPLAY_PLAN_PATH, + "replay-plan nonclaims were broadened, reordered, or duplicated", + ) + + for artifact, path in ( + (owner, OWNER_RECORD_PATH), + (protocol, REVIEWED_PROTOCOL_PATH), + (replay, REVIEWED_REPLAY_PLAN_PATH), + ): + if not isinstance(artifact, dict): + continue + serialized = _canonical_json_bytes(artifact).decode("utf-8") + if re.search( + r'"(?:observed_state|case_verdict|execution_result|evidence|readiness_credit)"\s*:', + serialized, + ): + fail( + "premature_result", + path, + "reviewed pre-epoch artifacts cannot persist result, evidence, or readiness fields", + ) diff --git a/tools/tests/test_d004_reviewed_protocol.py b/tools/tests/test_d004_reviewed_protocol.py new file mode 100644 index 0000000..67165f1 --- /dev/null +++ b/tools/tests/test_d004_reviewed_protocol.py @@ -0,0 +1,303 @@ +from __future__ import annotations + +import copy +import json +import shutil +import tempfile +import unittest +from pathlib import Path + +from tools.d004_reviewed_protocol import ( + OWNER_RECORD_PATH, + REVIEWED_PROTOCOL_PATH, + REVIEWED_REPLAY_PLAN_PATH, + validate_d004_reviewed_protocol, +) +from tools.validate_foundation import FoundationValidator, canonical_json_bytes, load_json + + +REPOSITORY_ROOT = Path(__file__).resolve().parents[2] +D004_ROOT = Path("research/decisions/D-004") + + +class D004ReviewedProtocolTests(unittest.TestCase): + @staticmethod + def _write_reviewed(path: Path, value: object) -> None: + path.write_bytes(canonical_json_bytes(value) + b"\n") + + def _copy_protocol(self, root: Path) -> None: + shutil.copytree(REPOSITORY_ROOT / D004_ROOT, root / D004_ROOT) + for relative_path in ( + Path("docs/SEMANTIC_STRATA_DECISION_SUITE.md"), + Path("compiler/crates/orange-compiler/tests/d004_support/result_contract.rs"), + ): + target = root / relative_path + target.parent.mkdir(parents=True, exist_ok=True) + shutil.copyfile(REPOSITORY_ROOT / relative_path, target) + + @staticmethod + def _codes(root: Path) -> set[str]: + validator = FoundationValidator(root) + validate_d004_reviewed_protocol(validator) + return { + finding.code + for finding in validator.findings + if finding.code.startswith("d004_reviewed_protocol.") + } + + def _assert_json_mutation( + self, + relative_path: Path, + mutate, + expected_code: str, + ) -> None: + with tempfile.TemporaryDirectory() as directory: + root = Path(directory) + self._copy_protocol(root) + target = root / relative_path + value = load_json(target) + mutate(value) + self._write_reviewed(target, value) + self.assertIn(expected_code, self._codes(root)) + + def test_exact_reviewed_protocol_is_fully_bound(self) -> None: + with tempfile.TemporaryDirectory() as directory: + root = Path(directory) + self._copy_protocol(root) + self.assertEqual(self._codes(root), set()) + + def test_reviewed_json_requires_duplicate_free_canonical_bytes(self) -> None: + with tempfile.TemporaryDirectory() as directory: + root = Path(directory) + self._copy_protocol(root) + target = root / OWNER_RECORD_PATH + source = target.read_bytes() + target.write_bytes(b'{"schema_version":"duplicate",' + source[1:]) + self.assertIn("d004_reviewed_protocol.owner_parse", self._codes(root)) + + with tempfile.TemporaryDirectory() as directory: + root = Path(directory) + self._copy_protocol(root) + target = root / REVIEWED_PROTOCOL_PATH + target.write_bytes(target.read_bytes() + b"\n") + self.assertIn("d004_reviewed_protocol.protocol_canonical", self._codes(root)) + + def test_owner_and_base_bindings_fail_closed(self) -> None: + self._assert_json_mutation( + OWNER_RECORD_PATH, + lambda value: value["review_subjects"]["draft_packet"].__setitem__( + "raw_sha256", "0" * 64 + ), + "d004_reviewed_protocol.owner_bindings", + ) + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["bindings"]["owner_record"].__setitem__( + "canonical_sha256", "0" * 64 + ), + "d004_reviewed_protocol.protocol_bindings", + ) + self._assert_json_mutation( + REVIEWED_REPLAY_PLAN_PATH, + lambda value: value["base_packet"].__setitem__("raw_sha256", "0" * 64), + "d004_reviewed_protocol.replay_boundary", + ) + + def test_five_fixture_dispositions_and_counts_fail_closed(self) -> None: + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["fixture_class_dispositions"][1].__setitem__( + "subject_count", 13 + ), + "d004_reviewed_protocol.fixture_dispositions", + ) + self._assert_json_mutation( + OWNER_RECORD_PATH, + lambda value: value["structured_disposition"]["fixture_class_reviews"].pop(), + "d004_reviewed_protocol.owner_disposition", + ) + + def test_mapping_review_stays_hypothesis_only_and_zero_credit(self) -> None: + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["mapping_disposition"].__setitem__( + "semantic_status", "accepted" + ), + "d004_reviewed_protocol.mapping_limits", + ) + self._assert_json_mutation( + OWNER_RECORD_PATH, + lambda value: value["structured_disposition"]["mapping_review"].__setitem__( + "selection", "ST-REL" + ), + "d004_reviewed_protocol.owner_disposition", + ) + + def test_protocol_gaps_close_but_epoch_blockers_remain(self) -> None: + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["protocol_gaps"].append("adapter missing"), + "d004_reviewed_protocol.protocol_gaps", + ) + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value.__setitem__("epoch_freeze_blockers", []), + "d004_reviewed_protocol.epoch_freeze_blockers", + ) + + def test_repetition_major_latin_schedule_is_exact(self) -> None: + def duplicate_slot(value: dict[str, object]) -> None: + schedule = value["schedule"] + assert isinstance(schedule, list) + schedule[25] = copy.deepcopy(schedule[0]) + + self._assert_json_mutation( + REVIEWED_REPLAY_PLAN_PATH, + duplicate_slot, + "d004_reviewed_protocol.schedule", + ) + self._assert_json_mutation( + REVIEWED_REPLAY_PLAN_PATH, + lambda value: value.__setitem__("repetitions_per_slot", 2), + "d004_reviewed_protocol.replay_boundary", + ) + self._assert_json_mutation( + REVIEWED_REPLAY_PLAN_PATH, + lambda value: value.__setitem__("physical_execution_count", 74), + "d004_reviewed_protocol.replay_boundary", + ) + + def test_execution_preimage_fields_are_exact_and_joined(self) -> None: + self._assert_json_mutation( + REVIEWED_REPLAY_PLAN_PATH, + lambda value: value["execution_identity_preimage_fields"].remove( + "repetition" + ), + "d004_reviewed_protocol.execution_preimage", + ) + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["replay_contract"][ + "execution_identity_preimage_fields" + ].reverse(), + "d004_reviewed_protocol.replay_contract", + ) + + def test_equality_variance_and_correction_rules_fail_closed(self) -> None: + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["replay_contract"][ + "deterministic_equality_fields" + ].remove("execution_state"), + "d004_reviewed_protocol.replay_contract", + ) + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["replay_contract"][ + "variable_fields_within_frozen_bounds" + ].append("case_verdict"), + "d004_reviewed_protocol.replay_contract", + ) + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value["correction_policy"].__setitem__( + "max_candidate_corrections", 2 + ), + "d004_reviewed_protocol.correction_policy", + ) + + def test_all_three_nonclaim_sets_are_closed(self) -> None: + for relative_path, key, code in ( + ( + OWNER_RECORD_PATH, + "nonclaims", + "d004_reviewed_protocol.owner_nonclaims", + ), + ( + REVIEWED_PROTOCOL_PATH, + "nonclaims", + "d004_reviewed_protocol.protocol_nonclaims", + ), + ( + REVIEWED_REPLAY_PLAN_PATH, + "nonclaims", + "d004_reviewed_protocol.replay_nonclaims", + ), + ): + with self.subTest(path=relative_path): + self._assert_json_mutation( + relative_path, + lambda value, key=key: value[key].pop(), + code, + ) + + def test_owner_governance_and_provisional_closure_fail_closed(self) -> None: + self._assert_json_mutation( + OWNER_RECORD_PATH, + lambda value: value.__setitem__("decision_status", "accepted"), + "d004_reviewed_protocol.owner_boundary", + ) + self._assert_json_mutation( + OWNER_RECORD_PATH, + lambda value: value["known_risks"].pop(), + "d004_reviewed_protocol.owner_known_risks", + ) + self._assert_json_mutation( + OWNER_RECORD_PATH, + lambda value: value["revisit_triggers"].pop(), + "d004_reviewed_protocol.owner_revisit_triggers", + ) + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value.__setitem__( + "implementation_closure_status", "closed" + ), + "d004_reviewed_protocol.protocol_boundary", + ) + + def test_old_v02_through_v05_bytes_are_immutable(self) -> None: + immutable_inputs = ( + "d004-v0.2-named-mutations.json", + "d004-v0.2-cross-cutting-fixture-proposals.json", + "d004-v0.3-cross-cutting-executable-fixtures.json", + "d004-v0.4-case-subjects.json", + "d004-v0.5-candidate-mappings.json", + "d004-v0.5-draft-packet.json", + ) + for name in immutable_inputs: + with self.subTest(name=name), tempfile.TemporaryDirectory() as directory: + root = Path(directory) + self._copy_protocol(root) + target = root / D004_ROOT / name + target.write_bytes(target.read_bytes().rstrip(b"\n") + b" \n") + codes = self._codes(root) + self.assertIn("d004_reviewed_protocol.old_input_canonical", codes) + self.assertIn("d004_reviewed_protocol.old_input_identity", codes) + + with tempfile.TemporaryDirectory() as directory: + root = Path(directory) + self._copy_protocol(root) + target = root / "docs/SEMANTIC_STRATA_DECISION_SUITE.md" + target.write_text( + target.read_text(encoding="utf-8") + "\n", + encoding="utf-8", + ) + self.assertIn( + "d004_reviewed_protocol.base_source_identity", self._codes(root) + ) + + def test_unknown_and_premature_result_fields_fail_closed(self) -> None: + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value.__setitem__("unknown", True), + "d004_reviewed_protocol.protocol_schema", + ) + self._assert_json_mutation( + REVIEWED_PROTOCOL_PATH, + lambda value: value.__setitem__("case_verdict", "pass"), + "d004_reviewed_protocol.premature_result", + ) + + +if __name__ == "__main__": + unittest.main() diff --git a/tools/tests/test_d009_draft_packet.py b/tools/tests/test_d009_draft_packet.py index 81178b3..98aacd4 100644 --- a/tools/tests/test_d009_draft_packet.py +++ b/tools/tests/test_d009_draft_packet.py @@ -26,8 +26,8 @@ SUITE_PATH = Path("docs/SOLVER_TRUST_DECISION_SUITE.md") DECISIONS_PATH = Path("docs/DECISIONS.md") ROADMAP_PATH = Path("docs/ROADMAP.md") -PACKET_CANONICAL_SHA256 = "fa1411c83fdb6b57b8100f296ca904d88155ad6aa57bd7f48af62ae90c9ead31" -PACKET_RAW_SHA256 = "c0ad0227f1f374da8796c6db4866188213be53bd904bbf22b141ee1de6e57171" +PACKET_CANONICAL_SHA256 = "f95adf14aebe4232b7ca59b7a33302522901571416f4d182a1239a6f3504e0be" +PACKET_RAW_SHA256 = "d16f3f325e372e76e39eaa69d1d8183506a268d99502f6786b840816abf42a14" INDEX_CANONICAL_SHA256 = "2e55c671771d5740b0346992c8b86b9cce0571a8fc3e5b745195b0956010470e" INDEX_RAW_SHA256 = "c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859" SUITE_RAW_SHA256 = "a26073e6431fb401af4aac6e57dcdfa76b27fe9451c26fb42595d7de14c2a35b" @@ -186,7 +186,7 @@ def test_canonical_pre_epoch_lab_is_exact_and_records_no_execution(self) -> None "decision_register_document": { "normalization": "markdown-prose-lines-exact-v1", "normalized_sha256": ( - "c38f7b1d3b3f733a628e0618124e290648298eea8dab2ef89f81c597eb68d177" + "c65d91e5566f72114a71739efa8ca300feea24f0f2312e902d06fd9172fa0628" ), "path": "docs/DECISIONS.md", "scope": "whole_document", @@ -206,7 +206,7 @@ def test_canonical_pre_epoch_lab_is_exact_and_records_no_execution(self) -> None "roadmap_document": { "normalization": "markdown-prose-lines-exact-v1", "normalized_sha256": ( - "c92c6657068d3a71b8ccb184b408020f5cd44971286b2743e1e4d55dd67125e6" + "85480fb2764ae7bb98acd08590bb49116f5bb8cf62bebdee509aadbf1e22e6ea" ), "path": "docs/ROADMAP.md", "scope": "whole_document", diff --git a/tools/tests/test_d010_draft_packet.py b/tools/tests/test_d010_draft_packet.py index e1c4aa9..ccb325e 100644 --- a/tools/tests/test_d010_draft_packet.py +++ b/tools/tests/test_d010_draft_packet.py @@ -22,10 +22,10 @@ INDEX_PATH = RESEARCH_ROOT / "d010-v0.1-case-input-index.json" SUITE_PATH = Path("docs/COMPILER_STRATEGY_DECISION_SUITE.md") PACKET_CANONICAL_SHA256 = ( - "ae6c8fc6e433d3cbb895aebf95667711d442efa348e241c0059e72a489bcac9b" + "14962f66ada4ca34e18e5711b0993da3868f139bf39cfd50e37433b56ca68304" ) PACKET_RAW_SHA256 = ( - "647ed6e554a0440c7345e52ff8263aba9d2cb19e444e5956203595c0461d6f6e" + "67b0d49b3cd085130328670d4df229372ee4cf906e3e55abe12dcf91534d52aa" ) INDEX_CANONICAL_SHA256 = ( "4c8b0547a8f3bd380f4569008c8728014bb1d8718a5bfe17402bd03866560209" diff --git a/tools/tests/test_validate_foundation_hardening.py b/tools/tests/test_validate_foundation_hardening.py index 6a949f7..7e6f612 100644 --- a/tools/tests/test_validate_foundation_hardening.py +++ b/tools/tests/test_validate_foundation_hardening.py @@ -5527,10 +5527,10 @@ def test_semantic_strata_register_cannot_add_conflicting_execution_baseline(self shutil.copyfile(source_root / "docs/DECISIONS.md", decisions) text = decisions.read_text(encoding="utf-8") mutated = text.replace( - "cross-candidate execution. It selects no stratum and", - "cross-candidate execution.\n\n" + "bytes are the historical D004-PRE-01 review subjects and remain unchanged.", + "bytes are the historical D004-PRE-01 review subjects and remain unchanged.\n\n" "That Draft protocol records 25/25 required candidate-case " - "executions.\n\nIt selects no stratum and", + "executions.", 1, ) self.assertNotEqual(mutated, text) diff --git a/tools/validate_foundation.py b/tools/validate_foundation.py index 15483d9..48f3d4f 100755 --- a/tools/validate_foundation.py +++ b/tools/validate_foundation.py @@ -62,6 +62,47 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: _validate_d004_result_contract_source_helper, ) = _load_d004_helper_functions() +_D004_REVIEWED_PROTOCOL_HELPER_RAW_SHA256 = ( + "18ee7ad6cbf9036ecf66ad09bd3392543db528c70e5d3c8de291328f925f3747" +) + + +def _load_d004_reviewed_protocol_helper() -> Any: + validator_path = Path(__file__).resolve(strict=True) + helper_entry = validator_path.with_name("d004_reviewed_protocol.py") + if helper_entry.is_symlink(): + raise RuntimeError("D-004 reviewed-protocol helper must not be a symbolic link") + helper_path = helper_entry.resolve(strict=True) + if helper_path.parent != validator_path.parent: + raise RuntimeError( + "D-004 reviewed-protocol helper must resolve beside the foundation validator" + ) + if not helper_path.is_file() or helper_path.stat().st_nlink != 1: + raise RuntimeError( + "D-004 reviewed-protocol helper must be one regular single-link file" + ) + if ( + hashlib.sha256(helper_path.read_bytes()).hexdigest() + != _D004_REVIEWED_PROTOCOL_HELPER_RAW_SHA256 + ): + raise RuntimeError("D-004 reviewed-protocol helper raw SHA-256 identity drifted") + specification = importlib.util.spec_from_file_location( + "_orange_d004_reviewed_protocol", helper_path + ) + if specification is None or specification.loader is None: + raise RuntimeError("cannot create the closed D-004 reviewed-protocol import") + module = importlib.util.module_from_spec(specification) + specification.loader.exec_module(module) + validator = getattr(module, "validate_d004_reviewed_protocol", None) + if not callable(validator): + raise RuntimeError( + "D-004 reviewed-protocol helper does not expose its exact validator surface" + ) + return validator + + +_validate_d004_reviewed_protocol_helper = _load_d004_reviewed_protocol_helper() + POLICY_PATH = Path("policy/gate0-repository-policy.json") MAKEFILE_CONTRACT_PATH = Path("policy/makefile-entrypoint-contract-v0.1.json") @@ -247,7 +288,10 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: compiler/crates/orange-compiler/tests/d004_support/fixtures.rs compiler/crates/orange-compiler/tests/d004_support/packet.rs compiler/crates/orange-compiler/tests/d004_support/result_contract.rs +compiler/crates/orange-compiler/tests/d004_support/reviewed_protocol.rs +compiler/crates/orange-compiler/tests/d004_support/reviewed_result_contract.rs compiler/crates/orange-compiler/tests/d004_support/runner.rs +compiler/crates/orange-compiler/tests/d004_support/schedule.rs compiler/crates/orange-compiler/tests/d005_decision_suite.rs compiler/crates/orange-compiler/tests/d005_support/adapter.rs compiler/crates/orange-compiler/tests/d005_support/capture.rs @@ -348,6 +392,9 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: research/decisions/D-004/d004-v0.4-case-subjects.json research/decisions/D-004/d004-v0.5-candidate-mappings.json research/decisions/D-004/d004-v0.5-draft-packet.json +research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json +research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json +research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json research/decisions/D-005/README.md research/decisions/D-005/d005-v0.1/epochs/0001/protocol/epoch.json research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json @@ -377,8 +424,10 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: scripts/ci/install-actionlint scripts/ci/install-lychee tools/d004_candidate_mappings.py +tools/d004_reviewed_protocol.py tools/fs_sandbox.c tools/tests/test_d004_draft_packet.py +tools/tests/test_d004_reviewed_protocol.py tools/tests/test_d005_draft_packet.py tools/tests/test_d006_draft_packet.py tools/tests/test_d009_draft_packet.py @@ -559,7 +608,7 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: comment_summary_in_pr: never warn_only: false """ -_PHD = "5540723b4351b3a952c83faca3c34cd5e6260d8405837c27a8072e29c97e9817" +_PHD = "891a530086fa81a5bcc92de944b007f215a1f384d24aeed13cf44bf92291c638" _CR = ( "run: /usr/bin/env -u BASH_ENV -u ENV -u GNUMAKEFLAGS -u MAKEFLAGS -u MAKEFILES " "-u MAKEOVERRIDES -u MFLAGS /usr/bin/make --no-builtin-rules --no-builtin-variables check-compiler" @@ -918,8 +967,8 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: _D010_PACKET = _D010_ROOT + "d010-v0.1-draft-packet.json" _D010_INDEX = _D010_ROOT + "d010-v0.1-case-input-index.json" _D010_SUITE = "docs/COMPILER_STRATEGY_DECISION_SUITE.md" -_D010_PACKET_CANONICAL_SHA256 = "ae6c8fc6e433d3cbb895aebf95667711d442efa348e241c0059e72a489bcac9b" -_D010_PACKET_RAW_SHA256 = "647ed6e554a0440c7345e52ff8263aba9d2cb19e444e5956203595c0461d6f6e" +_D010_PACKET_CANONICAL_SHA256 = "14962f66ada4ca34e18e5711b0993da3868f139bf39cfd50e37433b56ca68304" +_D010_PACKET_RAW_SHA256 = "67b0d49b3cd085130328670d4df229372ee4cf906e3e55abe12dcf91534d52aa" _D010_INDEX_CANONICAL_SHA256 = "4c8b0547a8f3bd380f4569008c8728014bb1d8718a5bfe17402bd03866560209" _D010_INDEX_RAW_SHA256 = "e9f59e86dff6219474d244ff01a98c75b7b17c65f1f91506d483a57e95e33670" _D010_SUITE_RAW_SHA256 = "5d36f1faeda027b9784846af0aa742339c6b821f39b72a8ca067a90c41a46c73" @@ -950,7 +999,34 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: _D004_SUITE_RAW_SHA256 = ( "64abe8290955f889e28f8bb9ce7653a26ef71a624286aef900d4dbfc3b7eb117" ) -DECISION_LABORATORY_SPECS = {'d005': {'finding_prefix': 'd005_packet', 'research_root': 'research/decisions/D-005/', 'inventory': frozenset(('research/decisions/D-005/' + name for name in 'README.md d005-v0.1/epochs/0001/protocol/epoch.json d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json d005-v0.1/epochs/0001/shared-inputs/checked-test-masks-failed-kernel-proof.json d005-v0.1/epochs/0001/shared-inputs/legacy-v0.1-mutations.json d005-v0.1/epochs/0001/shared-inputs/owner-test-as-external-validation.json d005-v0.1/epochs/0001/shared-inputs/satisfied-target-leakage-with-unresolved-contexts.json d005-v0.1/epochs/0001/shared-inputs/subject-reuse-original.json d005-v0.1/epochs/0001/shared-inputs/substituted-subject-reuses-evidence.json'.split())), 'premature': ('research/decisions/D-005/d005-v0.1/epochs/0001/', '(?:^|/)(?:candidates|cross-candidate|same-owner-replays|owner-reviews|decision)(?:/|$)', 'premature_results'), 'json_identities': (('research/decisions/D-005/d005-v0.1/epochs/0001/protocol/epoch.json', '', 'missing', '731428229b4f77cd7e684e2a5cae51bdfd277898aaab60852b843d3183dbc194', '5ea15c4f2e6db865e2be9c9fea2a77465ffcf131abfd8356faa6923b3e1ad46b', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/legacy-v0.1-mutations.json', 'legacy_', 'legacy_missing', '8c51fe8c337564cf5925c16c127aa440eab2a25bc8ae1ad6dba7b4f11c3e6cbf', '2bae9af1e102fe4a9233c78599a3b14a7ca1796f0c0fdfaa17539a998ff01b4d', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json', 'legacy_', 'legacy_missing', 'cf513a32f23e4cace22f123f1e14a87f3cb656b6753e7c3a8ca4ee85781d5531', 'c7f059bfe531e123b7b6a395eb99f391b832ea72c0b08f320e73e63cc452b27e', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-masks-failed-kernel-proof.json', 'legacy_', 'legacy_missing', '35b08f290a5615bedc7391900201df36d18606d78ae1868a746403d83181c8df', 'ae7bc9a88680bd3fa08c1f34b9fb558de1833f5c2cd710d3d423ed35873bedad', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/satisfied-target-leakage-with-unresolved-contexts.json', 'legacy_', 'legacy_missing', '9a3c267a92c689fc92ba1d05e792260317a7343345f7e35edadd99cd623e7a9d', '6d39a9ae51fa8c88789977a849129013f2fc23651c8939180e4c578dd017fc39', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/owner-test-as-external-validation.json', 'legacy_', 'legacy_missing', '75b77808aae7831567265f6650f827c90f25d15b75fa76cd33dc9a377a2dfd4e', '795ca7571d0e9df9f88ab7a2a8cad201c5e45bdb36206f3df12e7adf2098f9a5', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/substituted-subject-reuses-evidence.json', 'legacy_', 'legacy_missing', '96b931de6f468349f706ffa5952b944ac45308f688f67f8737e9a9e88a91dd98', '5d1c3d90962ec5d21d3e0053e1e4b45f525db97abebda6e4ad85eb5c41333900', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/subject-reuse-original.json', 'legacy_', 'legacy_missing', 'e1828b5c7b3bb31d6344bdc4de0507ea8347ddea0c2518366bfe49207ebef1e3', 'ae981e5a6e74620117c96c720affe1f7f05f0000ef9029cbb2143a8b9119fab9', False)), 'raw_bindings': (('docs/PUBLIC_ASSURANCE_MODEL_DECISION_SUITE.md', 'e906ec0de790f5ed3b4e4fcb87bc550a7a2048ec5c16b100e58cf1a13a27b18f'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/legacy-v0.1-mutations.json', '2bae9af1e102fe4a9233c78599a3b14a7ca1796f0c0fdfaa17539a998ff01b4d'), ('schemas/gate0/claim-record-v0.1.schema.json', 'a287dde9ddf114da30af61d050aa96406f23e480d62e0f796d66943489579131'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json', 'c7f059bfe531e123b7b6a395eb99f391b832ea72c0b08f320e73e63cc452b27e'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-masks-failed-kernel-proof.json', 'ae7bc9a88680bd3fa08c1f34b9fb558de1833f5c2cd710d3d423ed35873bedad'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/satisfied-target-leakage-with-unresolved-contexts.json', '6d39a9ae51fa8c88789977a849129013f2fc23651c8939180e4c578dd017fc39'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/owner-test-as-external-validation.json', '795ca7571d0e9df9f88ab7a2a8cad201c5e45bdb36206f3df12e7adf2098f9a5'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/substituted-subject-reuses-evidence.json', '5d1c3d90962ec5d21d3e0053e1e4b45f525db97abebda6e4ad85eb5c41333900'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/subject-reuse-original.json', 'ae981e5a6e74620117c96c720affe1f7f05f0000ef9029cbb2143a8b9119fab9')), 'schema_compatibility': ('schemas/gate0/claim-record-v0.1.schema.json', 'research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs', ('checked-test-as-functional-refinement.json', 'checked-test-masks-failed-kernel-proof.json', 'satisfied-target-leakage-with-unresolved-contexts.json', 'owner-test-as-external-validation.json', 'substituted-subject-reuses-evidence.json'))}, 'd006': {'finding_prefix': 'd006_packet', 'research_root': 'research/decisions/D-006/', 'inventory': frozenset(('research/decisions/D-006/' + name for name in 'README.md d006-v0.2-case-input-index.json d006-v0.2-draft-packet.json'.split())), 'premature': ('research/decisions/D-006/', '(?:^|[/_.-])(?:epochs?|candidates?|results?|replays?|reviews?|decisions?)(?:$|[/_.-])', 'premature_artifact'), 'json_identities': (('research/decisions/D-006/d006-v0.2-draft-packet.json', '', 'parse', 'b56ad768c4584bdd00da4d4e85af642757b877dd5dc5ae438560ba4a486d9d21', '210eccad3a545927301d3cc147fdf918cc432fea65b8d71b79cbefc447e34bff', True), ('research/decisions/D-006/d006-v0.2-case-input-index.json', 'index_', 'index_parse', '1118fe42a6d7111f50e40a88f0fe7b7fe4b9248b9335e0643b200fa983294ca0', '1aec6a731bef0620c8500120ec8385d584f99a528b4a03c014e8516c55cc8136', True)), 'raw_bindings': (('research/decisions/D-006/d006-v0.2-case-input-index.json', '1aec6a731bef0620c8500120ec8385d584f99a528b4a03c014e8516c55cc8136'), ('docs/PROOF_FOUNDATION_DECISION_SUITE.md', '6b1aa32784dd31d40bdaca4c6f3b62b8721a909ab3415051aa5a8e7994f0254b')), 'schema_compatibility': None}, 'd009': {'finding_prefix': 'd009_packet', 'research_root': 'research/decisions/D-009/', 'inventory': frozenset(('research/decisions/D-009/' + name for name in 'README.md d009-v0.1-case-input-index.json d009-v0.1-draft-packet.json'.split())), 'premature': ('research/decisions/D-009/', '(?:^|[/_.-])(?:epochs?|candidates?|results?|replays?|reviews?|decisions?)(?:$|[/_.-])', 'premature_artifact'), 'json_identities': (('research/decisions/D-009/d009-v0.1-draft-packet.json', '', 'parse', 'fa1411c83fdb6b57b8100f296ca904d88155ad6aa57bd7f48af62ae90c9ead31', 'c0ad0227f1f374da8796c6db4866188213be53bd904bbf22b141ee1de6e57171', True), ('research/decisions/D-009/d009-v0.1-case-input-index.json', 'index_', 'index_parse', '2e55c671771d5740b0346992c8b86b9cce0571a8fc3e5b745195b0956010470e', 'c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859', True)), 'raw_bindings': (('research/decisions/D-009/d009-v0.1-case-input-index.json', 'c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859'), ('docs/SOLVER_TRUST_DECISION_SUITE.md', 'a26073e6431fb401af4aac6e57dcdfa76b27fe9451c26fb42595d7de14c2a35b')), 'schema_compatibility': None}, 'd010': {'finding_prefix': 'd010_packet', 'research_root': _D010_ROOT, 'inventory': frozenset((_D010_ROOT + name for name in 'README.md d010-v0.1-case-input-index.json d010-v0.1-draft-packet.json'.split())), 'premature': (_D010_ROOT, '(?:^|[/_.-])(?:epochs?|candidates?|results?|replays?|reviews?|decisions?)(?:$|[/_.-])', 'premature_artifact'), 'json_identities': ((_D010_PACKET, '', 'parse', _D010_PACKET_CANONICAL_SHA256, _D010_PACKET_RAW_SHA256, True), (_D010_INDEX, 'index_', 'index_parse', _D010_INDEX_CANONICAL_SHA256, _D010_INDEX_RAW_SHA256, True)), 'raw_bindings': ((_D010_INDEX, _D010_INDEX_RAW_SHA256), (_D010_SUITE, _D010_SUITE_RAW_SHA256)), 'schema_compatibility': None}} +_D004_OWNER_RECORD = ( + "research/decisions/D-004/d004-v0.6/protocol/d004-pre-01-owner-record.json" +) +_D004_OWNER_RECORD_CANONICAL_SHA256 = ( + "587c3ad11bf6e0d3dddc02cd7ba53896f54f8e08ec59ed1ece286e13fe9b0c9d" +) +_D004_OWNER_RECORD_RAW_SHA256 = ( + "cbdfa3e07245a6843100a6b17860ea5dcec39f7f341b194faeee91e2ae585f3c" +) +_D004_REVIEWED_PROTOCOL = ( + "research/decisions/D-004/d004-v0.6/protocol/reviewed-protocol.json" +) +_D004_REVIEWED_PROTOCOL_CANONICAL_SHA256 = ( + "c67c17bdf68eb0619ec7698dd2807912251a0556931fa79b6838a9d5c6a9bd98" +) +_D004_REVIEWED_PROTOCOL_RAW_SHA256 = ( + "1111889b47edf24e88926bf8fa6770cf84ebcd1abb1d7dc2687dc42e0135fb53" +) +_D004_REVIEWED_REPLAY_PLAN = ( + "research/decisions/D-004/d004-v0.6/protocol/reviewed-replay-plan.json" +) +_D004_REVIEWED_REPLAY_PLAN_CANONICAL_SHA256 = ( + "a18084768cd05f6fcffdea724e330c0c81c5caac7816213156f4f9967fc5cb1b" +) +_D004_REVIEWED_REPLAY_PLAN_RAW_SHA256 = ( + "45632f796c7c08d26e668b277ccaff5679ccb82857732c3b8beead66198a3eb7" +) +DECISION_LABORATORY_SPECS = {'d005': {'finding_prefix': 'd005_packet', 'research_root': 'research/decisions/D-005/', 'inventory': frozenset(('research/decisions/D-005/' + name for name in 'README.md d005-v0.1/epochs/0001/protocol/epoch.json d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json d005-v0.1/epochs/0001/shared-inputs/checked-test-masks-failed-kernel-proof.json d005-v0.1/epochs/0001/shared-inputs/legacy-v0.1-mutations.json d005-v0.1/epochs/0001/shared-inputs/owner-test-as-external-validation.json d005-v0.1/epochs/0001/shared-inputs/satisfied-target-leakage-with-unresolved-contexts.json d005-v0.1/epochs/0001/shared-inputs/subject-reuse-original.json d005-v0.1/epochs/0001/shared-inputs/substituted-subject-reuses-evidence.json'.split())), 'premature': ('research/decisions/D-005/d005-v0.1/epochs/0001/', '(?:^|/)(?:candidates|cross-candidate|same-owner-replays|owner-reviews|decision)(?:/|$)', 'premature_results'), 'json_identities': (('research/decisions/D-005/d005-v0.1/epochs/0001/protocol/epoch.json', '', 'missing', '731428229b4f77cd7e684e2a5cae51bdfd277898aaab60852b843d3183dbc194', '5ea15c4f2e6db865e2be9c9fea2a77465ffcf131abfd8356faa6923b3e1ad46b', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/legacy-v0.1-mutations.json', 'legacy_', 'legacy_missing', '8c51fe8c337564cf5925c16c127aa440eab2a25bc8ae1ad6dba7b4f11c3e6cbf', '2bae9af1e102fe4a9233c78599a3b14a7ca1796f0c0fdfaa17539a998ff01b4d', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json', 'legacy_', 'legacy_missing', 'cf513a32f23e4cace22f123f1e14a87f3cb656b6753e7c3a8ca4ee85781d5531', 'c7f059bfe531e123b7b6a395eb99f391b832ea72c0b08f320e73e63cc452b27e', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-masks-failed-kernel-proof.json', 'legacy_', 'legacy_missing', '35b08f290a5615bedc7391900201df36d18606d78ae1868a746403d83181c8df', 'ae7bc9a88680bd3fa08c1f34b9fb558de1833f5c2cd710d3d423ed35873bedad', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/satisfied-target-leakage-with-unresolved-contexts.json', 'legacy_', 'legacy_missing', '9a3c267a92c689fc92ba1d05e792260317a7343345f7e35edadd99cd623e7a9d', '6d39a9ae51fa8c88789977a849129013f2fc23651c8939180e4c578dd017fc39', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/owner-test-as-external-validation.json', 'legacy_', 'legacy_missing', '75b77808aae7831567265f6650f827c90f25d15b75fa76cd33dc9a377a2dfd4e', '795ca7571d0e9df9f88ab7a2a8cad201c5e45bdb36206f3df12e7adf2098f9a5', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/substituted-subject-reuses-evidence.json', 'legacy_', 'legacy_missing', '96b931de6f468349f706ffa5952b944ac45308f688f67f8737e9a9e88a91dd98', '5d1c3d90962ec5d21d3e0053e1e4b45f525db97abebda6e4ad85eb5c41333900', False), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/subject-reuse-original.json', 'legacy_', 'legacy_missing', 'e1828b5c7b3bb31d6344bdc4de0507ea8347ddea0c2518366bfe49207ebef1e3', 'ae981e5a6e74620117c96c720affe1f7f05f0000ef9029cbb2143a8b9119fab9', False)), 'raw_bindings': (('docs/PUBLIC_ASSURANCE_MODEL_DECISION_SUITE.md', 'e906ec0de790f5ed3b4e4fcb87bc550a7a2048ec5c16b100e58cf1a13a27b18f'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/legacy-v0.1-mutations.json', '2bae9af1e102fe4a9233c78599a3b14a7ca1796f0c0fdfaa17539a998ff01b4d'), ('schemas/gate0/claim-record-v0.1.schema.json', 'a287dde9ddf114da30af61d050aa96406f23e480d62e0f796d66943489579131'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-as-functional-refinement.json', 'c7f059bfe531e123b7b6a395eb99f391b832ea72c0b08f320e73e63cc452b27e'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/checked-test-masks-failed-kernel-proof.json', 'ae7bc9a88680bd3fa08c1f34b9fb558de1833f5c2cd710d3d423ed35873bedad'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/satisfied-target-leakage-with-unresolved-contexts.json', '6d39a9ae51fa8c88789977a849129013f2fc23651c8939180e4c578dd017fc39'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/owner-test-as-external-validation.json', '795ca7571d0e9df9f88ab7a2a8cad201c5e45bdb36206f3df12e7adf2098f9a5'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/substituted-subject-reuses-evidence.json', '5d1c3d90962ec5d21d3e0053e1e4b45f525db97abebda6e4ad85eb5c41333900'), ('research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs/subject-reuse-original.json', 'ae981e5a6e74620117c96c720affe1f7f05f0000ef9029cbb2143a8b9119fab9')), 'schema_compatibility': ('schemas/gate0/claim-record-v0.1.schema.json', 'research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs', ('checked-test-as-functional-refinement.json', 'checked-test-masks-failed-kernel-proof.json', 'satisfied-target-leakage-with-unresolved-contexts.json', 'owner-test-as-external-validation.json', 'substituted-subject-reuses-evidence.json'))}, 'd006': {'finding_prefix': 'd006_packet', 'research_root': 'research/decisions/D-006/', 'inventory': frozenset(('research/decisions/D-006/' + name for name in 'README.md d006-v0.2-case-input-index.json d006-v0.2-draft-packet.json'.split())), 'premature': ('research/decisions/D-006/', '(?:^|[/_.-])(?:epochs?|candidates?|results?|replays?|reviews?|decisions?)(?:$|[/_.-])', 'premature_artifact'), 'json_identities': (('research/decisions/D-006/d006-v0.2-draft-packet.json', '', 'parse', 'b56ad768c4584bdd00da4d4e85af642757b877dd5dc5ae438560ba4a486d9d21', '210eccad3a545927301d3cc147fdf918cc432fea65b8d71b79cbefc447e34bff', True), ('research/decisions/D-006/d006-v0.2-case-input-index.json', 'index_', 'index_parse', '1118fe42a6d7111f50e40a88f0fe7b7fe4b9248b9335e0643b200fa983294ca0', '1aec6a731bef0620c8500120ec8385d584f99a528b4a03c014e8516c55cc8136', True)), 'raw_bindings': (('research/decisions/D-006/d006-v0.2-case-input-index.json', '1aec6a731bef0620c8500120ec8385d584f99a528b4a03c014e8516c55cc8136'), ('docs/PROOF_FOUNDATION_DECISION_SUITE.md', '6b1aa32784dd31d40bdaca4c6f3b62b8721a909ab3415051aa5a8e7994f0254b')), 'schema_compatibility': None}, 'd009': {'finding_prefix': 'd009_packet', 'research_root': 'research/decisions/D-009/', 'inventory': frozenset(('research/decisions/D-009/' + name for name in 'README.md d009-v0.1-case-input-index.json d009-v0.1-draft-packet.json'.split())), 'premature': ('research/decisions/D-009/', '(?:^|[/_.-])(?:epochs?|candidates?|results?|replays?|reviews?|decisions?)(?:$|[/_.-])', 'premature_artifact'), 'json_identities': (('research/decisions/D-009/d009-v0.1-draft-packet.json', '', 'parse', 'f95adf14aebe4232b7ca59b7a33302522901571416f4d182a1239a6f3504e0be', 'd16f3f325e372e76e39eaa69d1d8183506a268d99502f6786b840816abf42a14', True), ('research/decisions/D-009/d009-v0.1-case-input-index.json', 'index_', 'index_parse', '2e55c671771d5740b0346992c8b86b9cce0571a8fc3e5b745195b0956010470e', 'c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859', True)), 'raw_bindings': (('research/decisions/D-009/d009-v0.1-case-input-index.json', 'c5298d625f5392de2774ffb861fe1dc1701b379ebd385cde0584a8cbcd249859'), ('docs/SOLVER_TRUST_DECISION_SUITE.md', 'a26073e6431fb401af4aac6e57dcdfa76b27fe9451c26fb42595d7de14c2a35b')), 'schema_compatibility': None}, 'd010': {'finding_prefix': 'd010_packet', 'research_root': _D010_ROOT, 'inventory': frozenset((_D010_ROOT + name for name in 'README.md d010-v0.1-case-input-index.json d010-v0.1-draft-packet.json'.split())), 'premature': (_D010_ROOT, '(?:^|[/_.-])(?:epochs?|candidates?|results?|replays?|reviews?|decisions?)(?:$|[/_.-])', 'premature_artifact'), 'json_identities': ((_D010_PACKET, '', 'parse', _D010_PACKET_CANONICAL_SHA256, _D010_PACKET_RAW_SHA256, True), (_D010_INDEX, 'index_', 'index_parse', _D010_INDEX_CANONICAL_SHA256, _D010_INDEX_RAW_SHA256, True)), 'raw_bindings': ((_D010_INDEX, _D010_INDEX_RAW_SHA256), (_D010_SUITE, _D010_SUITE_RAW_SHA256)), 'schema_compatibility': None}} DECISION_LABORATORY_SPECS["d004"] = { "finding_prefix": "d004_packet", "research_root": "research/decisions/D-004/", @@ -963,11 +1039,14 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: "research/decisions/D-004/d004-v0.4-case-subjects.json", _D004_CANDIDATE_MAPPING_CATALOG, "research/decisions/D-004/d004-v0.5-draft-packet.json", + _D004_OWNER_RECORD, + _D004_REVIEWED_PROTOCOL, + _D004_REVIEWED_REPLAY_PLAN, } ), "premature": ( "research/decisions/D-004/", - r"(?:^|[/_.-])(?:results?|reviews?|decisions?|epochs?)(?:$|[/_.-])", + r"(?:^|[/_.-])(?:results?|evidence|epochs?|owner-reviews|decisions?)(?:$|[/_.-])", "premature_artifact", ), "json_identities": ( @@ -1019,6 +1098,30 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: _D004_CANDIDATE_MAPPING_CATALOG_RAW_SHA256, True, ), + ( + _D004_OWNER_RECORD, + "owner_record_", + "owner_record_missing", + _D004_OWNER_RECORD_CANONICAL_SHA256, + _D004_OWNER_RECORD_RAW_SHA256, + True, + ), + ( + _D004_REVIEWED_PROTOCOL, + "reviewed_protocol_", + "reviewed_protocol_missing", + _D004_REVIEWED_PROTOCOL_CANONICAL_SHA256, + _D004_REVIEWED_PROTOCOL_RAW_SHA256, + True, + ), + ( + _D004_REVIEWED_REPLAY_PLAN, + "reviewed_replay_plan_", + "reviewed_replay_plan_missing", + _D004_REVIEWED_REPLAY_PLAN_CANONICAL_SHA256, + _D004_REVIEWED_REPLAY_PLAN_RAW_SHA256, + True, + ), ), "raw_bindings": ( ("docs/LANGUAGE_2026.md", "35981310cbe1e1ae61c889b4005b2610d0077e6a615a5e032b0ca9a5860b328a"), @@ -1048,6 +1151,13 @@ def _load_d004_helper_functions() -> tuple[Any, Any]: "schema_compatibility": None, } DECISION_LABORATORY_INVARIANTS = {'research/decisions/D-004/': (6, 23, True, None), 'research/decisions/D-005/': (8, 9, False, ('schemas/gate0/claim-record-v0.1.schema.json', 'research/decisions/D-005/d005-v0.1/epochs/0001/shared-inputs', ('checked-test-as-functional-refinement.json', 'checked-test-masks-failed-kernel-proof.json', 'satisfied-target-leakage-with-unresolved-contexts.json', 'owner-test-as-external-validation.json', 'substituted-subject-reuses-evidence.json'))), 'research/decisions/D-006/': (2, 2, True, None), 'research/decisions/D-009/': (2, 2, True, None), 'research/decisions/D-010/': (2, 2, True, None)} +DECISION_LABORATORY_INVARIANTS["research/decisions/D-004/"] = ( + 9, + 23, + True, + None, +) + _ATOMIC_OUTCOMES = ( "satisfied", "not_satisfied", @@ -4921,7 +5031,7 @@ def fail(suffix: str, path: str | Path, message: str) -> None: for path in self.repository_files: value = relative(path, self.root) if value.startswith(str(scan_root)) and pattern.search(value[len(str(scan_root)):].lower()): - fail(str(premature_code), path, 'input-only decision research cannot contain premature execution, result, replay, review, epoch, or decision artifacts') + fail(str(premature_code), path, 'decision research contains an artifact forbidden by its closed lifecycle') declared_bindings: set[tuple[str, str]] = set() identity_closure_valid = True @@ -5030,6 +5140,7 @@ def _validate_d004_result_contract_source(self) -> None: def _validate_d004_draft_packet(self) -> None: self._validate_d004_candidate_mapping_catalog() self._validate_d004_result_contract_source() + _validate_d004_reviewed_protocol_helper(self) self._validate_decision_laboratory("d004") packet_path = self.root / "research/decisions/D-004/d004-v0.5-draft-packet.json" catalog_path = self.root / "research/decisions/D-004/d004-v0.4-case-subjects.json"