From d648cdfc7c4e3e63ea1af7945cf8cd69ab721d82 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Thu, 30 Jul 2026 05:47:19 +0200 Subject: [PATCH] verify(oci): record the field-found evidence gap + defer P06 to v1.131 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit FV-FALCON-OCI-001 claimed distribution was "validated end-to-end" on v1.127/ v1.128. That evidence was NOT sufficient, and jess proved it in the field: falcon-rate:1.129.0 shipped as a raw core module. My check confirmed the OCI config mediaType — which reads "component" regardless of the payload — so it verified the WRAPPER, not the BYTES. Record it honestly rather than quietly re-verifying: the gap, its root cause (no_std dropped `cabi_realloc`, wit-bindgen-rt only provides it when std is linked; the build failure was then swallowed by `|| true`), and the four strengthenings that close it (#323, #324) — cabi_realloc exported, build failures abort, an 8-byte HEADER assert on every component (verified to REJECT the published 1.129.0 artifact), and by-name artifact selection. This is the release-planning loop working as intended: a field regression re-opens the requirement's verification rather than being patched silently. Also defers SWREQ-FALCON-MATHF32-P06 (Cody-Waite argument reduction) from v1.130 to v1.131 — an explicit, logged scope move, not a silent slip. It is the multi-week proof of the four and is not ready; v1.130 is a fix release that republishes falcon-rate as a real component. rivet validate: PASS. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG --- artifacts/swreq/SWREQ-FALCON-MATHF32-P06.yaml | 2 +- artifacts/verification/FV-FALCON-OCI-001.yaml | 21 +++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/artifacts/swreq/SWREQ-FALCON-MATHF32-P06.yaml b/artifacts/swreq/SWREQ-FALCON-MATHF32-P06.yaml index cac1c30..03b4b83 100644 --- a/artifacts/swreq/SWREQ-FALCON-MATHF32-P06.yaml +++ b/artifacts/swreq/SWREQ-FALCON-MATHF32-P06.yaml @@ -3,7 +3,7 @@ artifacts: type: sw-req title: "MATHF32-P06 — machine-checked Cody-Waite argument-reduction bound → FULL-range sin/cos accuracy" status: proposed - release: falcon-v1.130.0 + release: falcon-v1.131.0 description: > The remaining and HARDEST ingredient: a machine-checked bound on the Cody-Waite argument reduction r = ((x - n*PIO2_HI) - n*PIO2_MID) - diff --git a/artifacts/verification/FV-FALCON-OCI-001.yaml b/artifacts/verification/FV-FALCON-OCI-001.yaml index 52d9c95..13453f4 100644 --- a/artifacts/verification/FV-FALCON-OCI-001.yaml +++ b/artifacts/verification/FV-FALCON-OCI-001.yaml @@ -22,6 +22,27 @@ artifacts: contract (description/license/source/keywords) that wasm.directory renders; the `pulseengine` namespace is live and indexed. + EVIDENCE GAP FOUND IN THE FIELD (v1.130) — the check above was NOT + sufficient. jess pulled falcon-rate:1.129.0 and found a raw CORE MODULE + (header 0061736d01000000), not a component (0061736d0d000100); `meld fuse` + rejects it, so the consumption path stopped at step one. The OCI config + mediaType reads "component" regardless of the payload, so metadata can + never catch this — the original evidence checked the WRAPPER, not the BYTES. + Root cause: the no_std conversion dropped the `cabi_realloc` export that + wit-bindgen-rt supplies only when std is linked + (#[cfg(not(target_env = "p2"))]), so wasm-component-ld could not encode a + component; build-components.sh then SWALLOWED that failure (`|| true`) and + fell back to a pre-componentization artifact. + + STRENGTHENED EVIDENCE (#323, #324): (i) `cabi_realloc` is exported from the + no_std path; (ii) a build failure now aborts the bundle instead of silently + degrading it; (iii) every component's 8-byte HEADER is asserted before it + enters the bundle — verified that the assert REJECTS the published 1.129.0 + artifact and ACCEPTS known-good components; (iv) artifacts are selected by + derived crate name, not `ls *.wasm | head -1`, which could otherwise + publish a different crate's component under the wrong name when + CARGO_TARGET_DIR is shared. Republished correctly in v1.130. + (b) LOWERABLE (no WASI) — the rate component is built `no_std` on the cargo-component path (single-threaded statics replacing thread_local!, lol_alloc global allocator, panic handler), all gated to