From d38056d3d46f5f9b0022e2d49643750851fecfbd Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 16:01:30 -0400 Subject: [PATCH 1/7] docs/plans: graph-port Plan A revision 5 (folds gate 20260905-154850 round 2: image identity and environment values in the TCB; latency per event class) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer) on revision 4 requested two changes. This revision folds both: the hermetic-image alternative binds the complete image identity and the resolved semantic-environment values into the TCB with old-namespace rejection before any cache read (A2, A2a), and the H2 latency population is defined per event class with an explicit timestamp source, harvest-to-shadow-complete kept separately for harvest events (§4). No scope change; shadow-only and nonauthority as before. Co-Authored-By: Claude Fable 5.1 --- docs/plans/graph-port-A-shadow-2026-09-03.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index a258db12..e679d3aa 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 4, 2026-09-04. Gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. This revision awaits Max's decision on how it is approved (a third gate, or his own approval for shadow-only work with the residual findings logged). Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 5, 2026-09-05. Third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer) opened on revision 4; its round 2 requested two changes, both folded here: (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -17,9 +17,9 @@ OUT (Plan B, gated separately with Plan A's evidence): any harvest cutover or au A1. Source model. Every declared, pinned source class is ingested: stable canonical staged report bytes (the only admissible form of a lane report — never raw lane `.out` or worktree outputs), briefs, ledger and library versions, rubric notes, PDFs, artifact JSONs and commit-pinned board ruling bytes, each hashed by name, bytes and size. The staged-bytes restriction applies to lane-report alternatives only; omitting any other declared source class fails A-1. No kernel calls an engine. Deterministic post-lane transformations are kernels; transport and seal checks are gate-role kernels that own at least one column read by the release. Determinism is a dynamics-side rule enforced by review and by the parity harness, not by the executor. -A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is `microcosm` `origin/main` at commit 6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6 (pre-#847). After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun. +A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is `microcosm` `origin/main` at commit 6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6 (pre-#847). After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. When execution runs in a hermetic image (A2a(i), first alternative), the complete image identity (the image digest and the digests of every layer actually loaded) and the exact allowed semantic-environment values (the environment and input allowlist as resolved, including interpreter flags, locale, timezone and hash-seed settings) are TCB components: the attester records them, recomputes them before any cache lookup, and treats a change to any of them exactly as it treats a toolchain change — the populated old namespace is rejected before any cache read and a new namespace is derived. When the alternative closure approach is used instead, the hashed closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is the TCB component in the same way. In neither case may two images or two environment resolutions share a cache namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun. -A2a. Evidence-grade closure (carried to Plan B; a Plan A prerequisite for the word "evidence"). No shadow result is certification evidence until: (i) execution runs in a read-only hermetic image with an environment and input allowlist, or the complete loaded closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is hashed and traced, undeclared filesystem, clock, randomness and network inputs are denied, and the closure is verified again after execution; (ii) an independently trusted, gate-owned recomputation of raw bundle, run and report bytes exists outside the attester, with tamper tests for every TCB component against a populated old namespace proving rejection before any cache read. Until then Plan A outputs are labelled SHADOW-ONLY, NOT EVIDENCE. +A2a. Evidence-grade closure (carried to Plan B; a Plan A prerequisite for the word "evidence"). No shadow result is certification evidence until: (i) execution runs in a read-only hermetic image with an environment and input allowlist whose image identity (image and loaded-layer digests) and resolved allowlist values are bound into the TCB per A2, or the complete loaded closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is hashed and traced, undeclared filesystem, clock, randomness and network inputs are denied, and the closure is verified again after execution; (ii) an independently trusted, gate-owned recomputation of raw bundle, run and report bytes exists outside the attester, with tamper tests for every TCB component against a populated old namespace proving rejection before any cache read. Until then Plan A outputs are labelled SHADOW-ONLY, NOT EVIDENCE. A3. No authority. Every shadow manifest is NONAUTHORITY. Decision records are nonselecting provenance; nothing in Plan A selects an active record, cites a manifest on the board, or retires or rewrites any record. The bespoke harvest remains the sole authority throughout. @@ -29,7 +29,7 @@ A5. Capacity. Build agents run on Claude capacity separate from the campaign's l ## 4. Sequence and acceptance -States. Two acceptance states are distinct: EVIDENCE-COMPLETE (every cohort document and event has a shadow result under the A-2 contract) and PARITY-PASS (zero governing discrepancies). Any governing residue makes the parity verdict FAIL for the cohort; A-5 labels such a cohort as failed parity, never as positive evidence. H2 stopping rule (frozen before A-3 starts): A-3 runs for at least 7 calendar days and until at least 12 live events spanning every event class that occurs in that window (harvest, seal, void/repair, supersession or replication if any occur) have been shadowed; H2 may not be chosen retroactively; the latency population is every live event's harvest-to-shadow-complete interval, with failures, retries, residues and censored runs reported separately and never dropped. +States. Two acceptance states are distinct: EVIDENCE-COMPLETE (every cohort document and event has a shadow result under the A-2 contract) and PARITY-PASS (zero governing discrepancies). Any governing residue makes the parity verdict FAIL for the cohort; A-5 labels such a cohort as failed parity, never as positive evidence. H2 stopping rule (frozen before A-3 starts): A-3 runs for at least 7 calendar days and until at least 12 live events spanning every event class that occurs in that window (harvest, seal, void/repair, supersession or replication if any occur) have been shadowed; H2 may not be chosen retroactively; the latency population is defined per event class: for harvest events, harvest-to-shadow-complete (start = the canonical staged report's commit-pinned board timestamp); for seal, void, repair, supersession and replication events, event-to-shadow-complete (start = the commit-pinned timestamp of the board ruling or event line that creates the event, never a harvest timestamp of the document concerned, which may predate the event or, for a voided attempt, not exist); shadow-complete is the timestamp of the shadow run's report write. Each class is reported as its own population; harvest-to-shadow-complete is retained separately for harvest events and is never pooled with the other classes; failures, retries, residues and censored runs are reported separately and never dropped. Cohort definition and closing census. At an exact immutable board commit/event H, freeze a content-hashed occurrence manifest listing every document, attempt, canonical staged report, repair, full source digest/path/storage identity, and disposition, each with an immutable coordinate and identity. A-4 covers every event at or before H; A-3 covers every canonical harvest, seal, void, repair, supersession, and replication event after H through a closing coordinate H2, each assigned the same immutable coordinate/identity scheme. At H2, produce a second occurrence manifest in the same schema, re-enumerate the authoritative record, and require multiset equality with explicit missing/duplicate detection. Every post-H source delta passes the same A-1/A4 ingestion checks as the initial cohort. Boundary, duplicate, outage and omitted-event cases are tested against the census. From 3d355f252b559bad738bdc93e7aef8c6db75e9f8 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 16:06:19 -0400 Subject: [PATCH 2/7] docs/plans: graph-port Plan A revision 6 (folds gate round 3: per-event-type applicability map and explicit absence semantics for the legacy comparison) Round 3 of gate 20260905-154850-plan-5cfd8532 found that the universal legacy comparison demanded a canonical report and T bytes for every event although voided attempts may never have produced either. Revision 6 adds a frozen applicability map per event class, an ABSENT-BY-DISPOSITION marker that satisfies A-2 and counts toward EVIDENCE-COMPLETE where the map permits it, a MISSING REQUIRED EVIDENCE failure where it does not, and fixtures for both cases. No scope change. Co-Authored-By: Claude Fable 5.1 --- docs/plans/graph-port-A-shadow-2026-09-03.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index e679d3aa..6642c8e4 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 5, 2026-09-05. Third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer) opened on revision 4; its round 2 requested two changes, both folded here: (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 6, 2026-09-05. Third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer) opened on revision 4; its round 2 requested two changes and its round 3 one more, all folded here: (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -29,21 +29,21 @@ A5. Capacity. Build agents run on Claude capacity separate from the campaign's l ## 4. Sequence and acceptance -States. Two acceptance states are distinct: EVIDENCE-COMPLETE (every cohort document and event has a shadow result under the A-2 contract) and PARITY-PASS (zero governing discrepancies). Any governing residue makes the parity verdict FAIL for the cohort; A-5 labels such a cohort as failed parity, never as positive evidence. H2 stopping rule (frozen before A-3 starts): A-3 runs for at least 7 calendar days and until at least 12 live events spanning every event class that occurs in that window (harvest, seal, void/repair, supersession or replication if any occur) have been shadowed; H2 may not be chosen retroactively; the latency population is defined per event class: for harvest events, harvest-to-shadow-complete (start = the canonical staged report's commit-pinned board timestamp); for seal, void, repair, supersession and replication events, event-to-shadow-complete (start = the commit-pinned timestamp of the board ruling or event line that creates the event, never a harvest timestamp of the document concerned, which may predate the event or, for a voided attempt, not exist); shadow-complete is the timestamp of the shadow run's report write. Each class is reported as its own population; harvest-to-shadow-complete is retained separately for harvest events and is never pooled with the other classes; failures, retries, residues and censored runs are reported separately and never dropped. +States. Two acceptance states are distinct: EVIDENCE-COMPLETE (every cohort document and event has a shadow result under the A-2 contract, where a result for an event whose class carries no canonical report or T bytes is complete when its disposition schema declares those fields ABSENT-BY-DISPOSITION) and PARITY-PASS (zero governing discrepancies). Any governing residue makes the parity verdict FAIL for the cohort; A-5 labels such a cohort as failed parity, never as positive evidence. H2 stopping rule (frozen before A-3 starts): A-3 runs for at least 7 calendar days and until at least 12 live events spanning every event class that occurs in that window (harvest, seal, void/repair, supersession or replication if any occur) have been shadowed; H2 may not be chosen retroactively; the latency population is defined per event class: for harvest events, harvest-to-shadow-complete (start = the canonical staged report's commit-pinned board timestamp); for seal, void, repair, supersession and replication events, event-to-shadow-complete (start = the commit-pinned timestamp of the board ruling or event line that creates the event, never a harvest timestamp of the document concerned, which may predate the event or, for a voided attempt, not exist); shadow-complete is the timestamp of the shadow run's report write. Each class is reported as its own population; harvest-to-shadow-complete is retained separately for harvest events and is never pooled with the other classes; failures, retries, residues and censored runs are reported separately and never dropped. Cohort definition and closing census. At an exact immutable board commit/event H, freeze a content-hashed occurrence manifest listing every document, attempt, canonical staged report, repair, full source digest/path/storage identity, and disposition, each with an immutable coordinate and identity. A-4 covers every event at or before H; A-3 covers every canonical harvest, seal, void, repair, supersession, and replication event after H through a closing coordinate H2, each assigned the same immutable coordinate/identity scheme. At H2, produce a second occurrence manifest in the same schema, re-enumerate the authoritative record, and require multiset equality with explicit missing/duplicate detection. Every post-H source delta passes the same A-1/A4 ingestion checks as the initial cohort. Boundary, duplicate, outage and omitted-event cases are tested against the census. Frozen oracles (recorded in the toolchain bundle before any acceptance run): -- Legacy schema: for every cohort document and event, the closed set of legacy fields compared exactly against the pinned canonical report and T bytes: ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its complete evidence, seal outcome and its complete evidence, reconstructed T bytes, T row count and T digest. Missing or extra fields fail. +- Legacy schema: for every cohort document and event, the closed set of legacy fields compared exactly against the pinned canonical report and T bytes: ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its complete evidence, seal outcome and its complete evidence, reconstructed T bytes, T row count and T digest. Missing or extra fields fail. APPLICABILITY MAP (frozen with the schema): each event class declares which legacy fields apply. Harvest, seal, repair and replication events with a payload apply every field. A voided attempt, a supersession, or any event whose canonical record never produced a report or T bytes applies none of the report/T-derived fields; for such an event the comparison is over its per-event-type disposition schema, and each inapplicable field is present with the single marker ABSENT-BY-DISPOSITION and the disposition identity that explains it. EXPECTED ABSENCE (the marker where the applicability map permits it) satisfies A-2; MISSING REQUIRED EVIDENCE (a field the map requires that is absent, or a marker where the map does not permit it) fails. Fixtures: a voided attempt with no canonical report or T payload must pass with the marker; a harvest event lacking its pinned report must fail. - Graph oracle: a separately frozen schema for graph-only fields: node keys, exact gate IDs and order, ancestry, tier/outcome mapping and required evidence fields. Missing or extra evidence fields fail. - Mutation manifest: each source digest, exact semantic mutation or omission, and expected row/field/verdict or typed-refusal code. Key changes alone never count. A governing mutant with unchanged semantics fails; a decoy mutation changes identities but leaves semantic rows, verdicts and evidence unchanged apart from provenance. Mutant kernels that ignore a governing source or consume a decoy must make the harness fail. -- Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, plus wrong-disposition, wrong-ruling, wrong-supersedes and wrong-replica fixtures that must fail. +- Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, its entry in the applicability map above, plus wrong-disposition, wrong-ruling, wrong-supersedes, wrong-replica and wrong-absence (marker where a payload is required, or payload where the map declares absence) fixtures that must fail. - Recovery/failure matrix: recovery passes only when commit-pinned ruling bytes and redundant serialization/cross-receipts uniquely authenticate the reconstruction; raw bytes, reconstructed bytes, proof and ruling are persisted. Every historical positive recovery is tested, and for each, removal or substitution of every individual proof element must persist a gate failure. Named negative fixtures with stable typed refusal codes cover malformed, truncated, noncanonical, wrong-sentinel, wrong-count, wrong-digest, stale, swapped, conflicting and ambiguous evidence; none may certify or pass. | Step | What | Owner | Accepted when | |---|---|---|---| | A-1 | Store, codec registry, TCB attester and toolchain bundle, ingestion of the cohort manifest's sources and of every post-H delta | build agents; this session reviews | every ingested source re-hashes to the SHA cited in the campaign record; canonical paths and storage identities preserved; no Plan-A write to e8-ops, verified by attribution audit; only stable canonical staged bytes ingested; the attester passes against the recorded commit and toolchain digests and its recomputed digest namespaces the store and appears as a source in every node key and in every run and report; restore-and-rehash drill passed from a clean store | -| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles | build agents; this session reviews | for every cohort document and every mutation and recovery case: cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes; the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; legacy-schema comparison exact for every document and event; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | +| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles | build agents; this session reviews | for every cohort document and every mutation and recovery case: cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes; the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | | A-3 | Shadow every canonical harvest, seal, void, repair, supersession and replication event after H through H2, beside the bespoke harvest, with no effect on it | orchestrator dispatch unchanged; build agents run the shadow | every post-H event is shadowed under the A-2 contract; shadow latency recorded; zero governing discrepancies, or the document is listed as a residue with its discrepancy class; no typed exceptions exist in Plan A | | A-4 | Shadow backfill of every event at or before H, including every void, supersession and replication disposition, each derived from the commit-pinned ruling bytes as a source and reported, not selected | build agents | per-document parity report under the A-2 contract; residue list; for doc_058 the report shows both 38eea5db57118df598e2f2ea1d68466df58d9e1ff1615de38d36c4609da2fef3 (board-ratified) and b3a36967ffdc934521c5459f7bf71b46cb5741f2a089a4a89b5d8d750de89fc8 (preserved superseded) with their board rulings, without choosing | | A-5 | Closing census, parity report and Plan B proposal | this session | evidence-complete and parity states reported separately; A-1 through A-4 accepted under one TCB; the H2 census shows multiset equality with the authoritative record; the report records both occurrence-manifest digests (H and H2), the TCB and toolchain digests, per-document comparison results, residue classes, measured shadow latency and the store inventory; mixed-TCB results are rejected; Plan B is proposed only with that evidence attached | From 55da6668b2fce5f7d2d35930807a11b23a0d9010 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 16:09:50 -0400 Subject: [PATCH 3/7] docs/plans: graph-port Plan A revision 7 (folds gate round 4: applicability per report-derived and T-derived axis; report-bearing void fixture) Round 4 of gate 20260905-154850-plan-5cfd8532 found the revision-6 applicability map all-or-nothing: an attempt voided after its canonical report but before its T had no rule preserving the report comparison. Revision 7 partitions the legacy fields into report-derived and T-derived axes, declares applicability per axis from the authoritative disposition, keeps the report comparison for report-bearing voids, and adds the fixtures. No scope change. Co-Authored-By: Claude Fable 5.1 --- docs/plans/graph-port-A-shadow-2026-09-03.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index 6642c8e4..cc8fb483 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 6, 2026-09-05. Third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer) opened on revision 4; its round 2 requested two changes and its round 3 one more, all folded here: (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 7, 2026-09-05. Third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer) opened on revision 4; its rounds 2, 3 and 4 requested changes, all folded here: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -34,10 +34,10 @@ States. Two acceptance states are distinct: EVIDENCE-COMPLETE (every cohort docu Cohort definition and closing census. At an exact immutable board commit/event H, freeze a content-hashed occurrence manifest listing every document, attempt, canonical staged report, repair, full source digest/path/storage identity, and disposition, each with an immutable coordinate and identity. A-4 covers every event at or before H; A-3 covers every canonical harvest, seal, void, repair, supersession, and replication event after H through a closing coordinate H2, each assigned the same immutable coordinate/identity scheme. At H2, produce a second occurrence manifest in the same schema, re-enumerate the authoritative record, and require multiset equality with explicit missing/duplicate detection. Every post-H source delta passes the same A-1/A4 ingestion checks as the initial cohort. Boundary, duplicate, outage and omitted-event cases are tested against the census. Frozen oracles (recorded in the toolchain bundle before any acceptance run): -- Legacy schema: for every cohort document and event, the closed set of legacy fields compared exactly against the pinned canonical report and T bytes: ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its complete evidence, seal outcome and its complete evidence, reconstructed T bytes, T row count and T digest. Missing or extra fields fail. APPLICABILITY MAP (frozen with the schema): each event class declares which legacy fields apply. Harvest, seal, repair and replication events with a payload apply every field. A voided attempt, a supersession, or any event whose canonical record never produced a report or T bytes applies none of the report/T-derived fields; for such an event the comparison is over its per-event-type disposition schema, and each inapplicable field is present with the single marker ABSENT-BY-DISPOSITION and the disposition identity that explains it. EXPECTED ABSENCE (the marker where the applicability map permits it) satisfies A-2; MISSING REQUIRED EVIDENCE (a field the map requires that is absent, or a marker where the map does not permit it) fails. Fixtures: a voided attempt with no canonical report or T payload must pass with the marker; a harvest event lacking its pinned report must fail. +- Legacy schema: for every cohort document and event, the closed set of legacy fields compared exactly against the pinned canonical report and T bytes: ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its complete evidence, seal outcome and its complete evidence, reconstructed T bytes, T row count and T digest. Missing or extra fields fail. APPLICABILITY MAP (frozen with the schema): the legacy fields are partitioned into two axes — REPORT-DERIVED (ordered decoded rows, row counts, per-frame and stream digests, transport outcome and its evidence, seal outcome and its evidence) and T-DERIVED (reconstructed T bytes, T row count, T digest) — and each event class declares applicability for each axis separately, from the authoritative disposition of the event, never from what happens to be on disk. Harvest, seal, repair and replication events with both payloads apply both axes. An attempt voided, superseded or otherwise closed AFTER its canonical report exists but BEFORE its T was produced applies the report axis in full and marks every T-derived field ABSENT-BY-DISPOSITION; an event whose canonical record never produced a report applies neither axis and marks both. Each inapplicable field is present with the single marker ABSENT-BY-DISPOSITION and the disposition identity that explains it; the comparison for the inapplicable axis is over the per-event-type disposition schema. EXPECTED ABSENCE (the marker exactly where the map permits it, per axis) satisfies A-2; MISSING REQUIRED EVIDENCE (a field an applicable axis requires that is absent or unchecked, or a marker on an axis the map declares applicable) fails, so a report-bearing void can never be declared evidence-complete with its report-derived evidence unchecked. Fixtures: a voided attempt with neither payload passes with both axes marked; a voided attempt with a canonical report and no T passes only if every report-derived field is compared and only the T fields carry the marker, and fails if any report-derived field is absent or marked; a harvest event lacking its pinned report fails. - Graph oracle: a separately frozen schema for graph-only fields: node keys, exact gate IDs and order, ancestry, tier/outcome mapping and required evidence fields. Missing or extra evidence fields fail. - Mutation manifest: each source digest, exact semantic mutation or omission, and expected row/field/verdict or typed-refusal code. Key changes alone never count. A governing mutant with unchanged semantics fails; a decoy mutation changes identities but leaves semantic rows, verdicts and evidence unchanged apart from provenance. Mutant kernels that ignore a governing source or consume a decoy must make the harness fail. -- Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, its entry in the applicability map above, plus wrong-disposition, wrong-ruling, wrong-supersedes, wrong-replica and wrong-absence (marker where a payload is required, or payload where the map declares absence) fixtures that must fail. +- Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, its entry in the applicability map above for each of the two axes, plus wrong-disposition, wrong-ruling, wrong-supersedes, wrong-replica and wrong-absence (a marker on an applicable axis, a payload on an axis the map declares absent, or a report-bearing void whose report axis is marked instead of compared) fixtures that must fail. - Recovery/failure matrix: recovery passes only when commit-pinned ruling bytes and redundant serialization/cross-receipts uniquely authenticate the reconstruction; raw bytes, reconstructed bytes, proof and ruling are persisted. Every historical positive recovery is tested, and for each, removal or substitution of every individual proof element must persist a gate failure. Named negative fixtures with stable typed refusal codes cover malformed, truncated, noncanonical, wrong-sentinel, wrong-count, wrong-digest, stale, swapped, conflicting and ambiguous evidence; none may certify or pass. | Step | What | Owner | Accepted when | From 9cddf59969aa2239f7bf0c5d1e0302ae129bf61b Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 16:27:02 -0400 Subject: [PATCH 4/7] docs/plans: graph-port Plan A revision 8 (TCB pin to microcosm b55a583f; consume the core's store/codec/artifact facilities; string gate outcomes) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Revision 7 was agreed by gate 20260905-154850-plan-5cfd8532. Revision 8 amends the A2 TCB pin from 6022e4f5 (which lacks register_bytes, raw-bytes-v1 and the typed ArtifactType/ArtifactInput/ArtifactOutput edges) to the commit the Microcosm US session froze for its interface check, b55a583f (memo SHA 485ea3d3…, receipt SHA 8d780c99…), recorded as a new TCB with its publication state; binds A-1 to the core's facilities instead of reimplementing them; and adds the string-outcome rule for gate kernels. Submitted to a fresh gate. Co-Authored-By: Claude Fable 5.1 --- docs/plans/graph-port-A-shadow-2026-09-03.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index cc8fb483..05643665 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,10 +1,10 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 7, 2026-09-05. Third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer) opened on revision 4; its rounds 2, 3 and 4 requested changes, all folded here: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 8, 2026-09-05. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope -IN: (a) a content-addressed store outside e8-ops with a codec registry; (b) a trusted-computing-base (TCB) recomputed at preflight, covering the runtime and the whole evidence toolchain, bound into every node key, run and report; (c) read-only ingestion of the campaign's stable canonical staged bytes as NONAUTHORITY source caches; (d) the Q5 harvest/transport subgraph run in SHADOW beside the bespoke harvest; (e) a parity harness with frozen legacy schema, graph oracle, mutation manifest, recovery/failure matrix and named negative fixtures; (f) a shadow backfill of every event in a frozen cohort manifest; (g) a parity report per document and a closing census by multiset equality. +IN: (a) a content-addressed store outside e8-ops, bound to the core's `ContentStore`, `SourceCodecRegistry` (`register_bytes` / `raw-bytes-v1`), `SourceRef`, typed `ArtifactType`/`ArtifactInput`/`ArtifactOutput` edges, `Owned` cells, gate roles and RELEASE `requires_decisions` at the A2 pin — Plan A reimplements none of those facilities and adds only the Q5 kernels, codec mappings, source declarations, the occurrence/document Frame (`EntitySchema(person_entity='occurrence', group_entities=('document',))` with unit weights) and the parity harness; (b) a trusted-computing-base (TCB) recomputed at preflight, covering the runtime and the whole evidence toolchain, bound into every node key, run and report; (c) read-only ingestion of the campaign's stable canonical staged bytes as NONAUTHORITY source caches; (d) the Q5 harvest/transport subgraph run in SHADOW beside the bespoke harvest; (e) a parity harness with frozen legacy schema, graph oracle, mutation manifest, recovery/failure matrix and named negative fixtures; (f) a shadow backfill of every event in a frozen cohort manifest; (g) a parity report per document and a closing census by multiset equality. OUT (Plan B, gated separately with Plan A's evidence): any harvest cutover or authority handoff; any board line, seal record or pointer index that cites a graph manifest; the campaign verifier's trust root and profile; the post-ratification successor DAG; the benefit-level gate; record retirement; any change to lane briefs, templates, harvest rules, ledger or library folds, `#405`, `e20-amend20`, `docs/design/` or the registry. @@ -17,7 +17,7 @@ OUT (Plan B, gated separately with Plan A's evidence): any harvest cutover or au A1. Source model. Every declared, pinned source class is ingested: stable canonical staged report bytes (the only admissible form of a lane report — never raw lane `.out` or worktree outputs), briefs, ledger and library versions, rubric notes, PDFs, artifact JSONs and commit-pinned board ruling bytes, each hashed by name, bytes and size. The staged-bytes restriction applies to lane-report alternatives only; omitting any other declared source class fails A-1. No kernel calls an engine. Deterministic post-lane transformations are kernels; transport and seal checks are gate-role kernels that own at least one column read by the release. Determinism is a dynamics-side rule enforced by review and by the parity harness, not by the executor. -A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is `microcosm` `origin/main` at commit 6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6 (pre-#847). After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. When execution runs in a hermetic image (A2a(i), first alternative), the complete image identity (the image digest and the digests of every layer actually loaded) and the exact allowed semantic-environment values (the environment and input allowlist as resolved, including interpreter flags, locale, timezone and hash-seed settings) are TCB components: the attester records them, recomputes them before any cache lookup, and treats a change to any of them exactly as it treats a toolchain change — the populated old namespace is rejected before any cache read and a new namespace is derived. When the alternative closure approach is used instead, the hashed closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is the TCB component in the same way. In neither case may two images or two environment resolutions share a cache namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun. +A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is PolicyEngine/microcosm commit `b55a583f078b3d182c65980f24a4d5a119f169bc` ("Authenticate candidate payload identities and bound local transport reads", 2026-09-05 15:22 EDT), which the Microcosm US session froze for its interface check. Publication state at pinning: that commit is a strict descendant of `origin/main` `c1b8324183819cf91511c002bf724a2676524e87` and was not yet on any remote branch, so build agents read it from the local object store and its first appearance on a remote is a recorded event, not a pin change. The previous pin, `6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6` (pre-#847), lacked `SourceCodecRegistry.register_bytes`, the `raw-bytes-v1` reader, and the typed `ArtifactType`/`ArtifactInput`/`ArtifactOutput` edges (all present at `b55a583f` in `packages/microcosm-graph/src/microcosm/graph/codecs.py` and `decl.py`); moving to `b55a583f` is a new TCB under this same paragraph's rule, and no Plan-A result exists yet to rerun. The memo confirms the ENGINEERING interface only: it approves no attestation, hermeticity, or source/scientific authority, and the §5 do-not on declaring `Tolerance` or entrants (#847) is unchanged. After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. When execution runs in a hermetic image (A2a(i), first alternative), the complete image identity (the image digest and the digests of every layer actually loaded) and the exact allowed semantic-environment values (the environment and input allowlist as resolved, including interpreter flags, locale, timezone and hash-seed settings) are TCB components: the attester records them, recomputes them before any cache lookup, and treats a change to any of them exactly as it treats a toolchain change — the populated old namespace is rejected before any cache read and a new namespace is derived. When the alternative closure approach is used instead, the hashed closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is the TCB component in the same way. In neither case may two images or two environment resolutions share a cache namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun. A2a. Evidence-grade closure (carried to Plan B; a Plan A prerequisite for the word "evidence"). No shadow result is certification evidence until: (i) execution runs in a read-only hermetic image with an environment and input allowlist whose image identity (image and loaded-layer digests) and resolved allowlist values are bound into the TCB per A2, or the complete loaded closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is hashed and traced, undeclared filesystem, clock, randomness and network inputs are denied, and the closure is verified again after execution; (ii) an independently trusted, gate-owned recomputation of raw bundle, run and report bytes exists outside the attester, with tamper tests for every TCB component against a populated old namespace proving rejection before any cache read. Until then Plan A outputs are labelled SHADOW-ONLY, NOT EVIDENCE. @@ -38,6 +38,7 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run): - Graph oracle: a separately frozen schema for graph-only fields: node keys, exact gate IDs and order, ancestry, tier/outcome mapping and required evidence fields. Missing or extra evidence fields fail. - Mutation manifest: each source digest, exact semantic mutation or omission, and expected row/field/verdict or typed-refusal code. Key changes alone never count. A governing mutant with unchanged semantics fails; a decoy mutation changes identities but leaves semantic rows, verdicts and evidence unchanged apart from provenance. Mutant kernels that ignore a governing source or consume a decoy must make the harness fail. - Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, its entry in the applicability map above for each of the two axes, plus wrong-disposition, wrong-ruling, wrong-supersedes, wrong-replica and wrong-absence (a marker on an applicable axis, a payload on an axis the map declares absent, or a report-bearing void whose report axis is marked instead of compared) fixtures that must fail. +- Gate outcome rule (from the interface check): every gate-role kernel owns a STRING outcome column so that the executor's automatic exception-to-failed-gate conversion applies; a boolean or numeric normal-return gate cell is permitted for ordinary decisions but is never the gate's outcome and never a substitute for the string outcome. RELEASE owns exactly one string `tier` column whose value must agree with the executor's ancestral gate derivation, and `requires_decisions` is declared non-empty with the exact named gate set; because the runtime permits an empty default and does not enforce the gate set from a kernel's name, the parity harness checks both explicitly and fails on an empty or wrong set. - Recovery/failure matrix: recovery passes only when commit-pinned ruling bytes and redundant serialization/cross-receipts uniquely authenticate the reconstruction; raw bytes, reconstructed bytes, proof and ruling are persisted. Every historical positive recovery is tested, and for each, removal or substitution of every individual proof element must persist a gate failure. Named negative fixtures with stable typed refusal codes cover malformed, truncated, noncanonical, wrong-sentinel, wrong-count, wrong-digest, stale, swapped, conflicting and ambiguous evidence; none may certify or pass. | Step | What | Owner | Accepted when | From 0eb0f8ba6b6ac6790de92ef6ac6118455418d8dc Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 16:30:40 -0400 Subject: [PATCH 5/7] docs/plans: graph-port Plan A revision 9 (folds gate 20260905-162709 round 1: all-string gate outputs, requires_decisions as a decision-name contract, per-fixture expected states) Three runtime-contract findings against the pinned executor at b55a583f: the exception path rejects any non-string owned output (executor.py:130); requires_decisions is matched against supplied decision names, not gate ancestry (executor.py:219-249); a missing required source is refused before any kernel executes (executor.py:1922-1924). Revision 9 requires all-string owned outputs on gate kernels with a mixed-output fixture, freezes and validates the decision tuple and the gate set independently with warm-replay checks, and scopes A-2's execute/hit assertions to each fixture's frozen expected state (executed, refused, unreached). Co-Authored-By: Claude Fable 5.1 --- docs/plans/graph-port-A-shadow-2026-09-03.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index 05643665..5d148d12 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 8, 2026-09-05. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 9, 2026-09-05. Gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -38,13 +38,13 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run): - Graph oracle: a separately frozen schema for graph-only fields: node keys, exact gate IDs and order, ancestry, tier/outcome mapping and required evidence fields. Missing or extra evidence fields fail. - Mutation manifest: each source digest, exact semantic mutation or omission, and expected row/field/verdict or typed-refusal code. Key changes alone never count. A governing mutant with unchanged semantics fails; a decoy mutation changes identities but leaves semantic rows, verdicts and evidence unchanged apart from provenance. Mutant kernels that ignore a governing source or consume a decoy must make the harness fail. - Per-event-type schemas (carried to Plan B; required before any void, repair, supersession or replication shadow result is called evidence): for each event type, an exact identity, disposition, ruling digest, supersedes edge and replica source/destination with a derivation projection, its entry in the applicability map above for each of the two axes, plus wrong-disposition, wrong-ruling, wrong-supersedes, wrong-replica and wrong-absence (a marker on an applicable axis, a payload on an axis the map declares absent, or a report-bearing void whose report axis is marked instead of compared) fixtures that must fail. -- Gate outcome rule (from the interface check): every gate-role kernel owns a STRING outcome column so that the executor's automatic exception-to-failed-gate conversion applies; a boolean or numeric normal-return gate cell is permitted for ordinary decisions but is never the gate's outcome and never a substitute for the string outcome. RELEASE owns exactly one string `tier` column whose value must agree with the executor's ancestral gate derivation, and `requires_decisions` is declared non-empty with the exact named gate set; because the runtime permits an empty default and does not enforce the gate set from a kernel's name, the parity harness checks both explicitly and fails on an empty or wrong set. +- Gate outcome rule (from the interface check, corrected against the pinned executor): EVERY owned output of a gate-role kernel is a STRING column — the outcome and any check cell alike — because the pinned executor's exception path (executor.py:130) validates every owned output and raises NodeRejected on any non-string one, so a gate that mixes a string outcome with a boolean or numeric cell aborts on an exception without persisting failed-gate evidence. Boolean or numeric owned cells are permitted only on non-gate kernels. Fixture: a gate kernel with a mixed string/boolean output set raising an exception must FAIL the harness (no failed-gate evidence persisted); a gate with all-string outputs raising the same exception must persist the failed-gate outcome. RELEASE owns exactly one string `tier` column whose value must agree with the executor's ancestral gate derivation. `requires_decisions` names DECISIONS supplied at run time (matched by decision name, executor.py:219–249), which is a separate contract from gate ancestry: the plan freezes the required decision tuple (exact names, non-empty) and the expected ancestral gate set independently, and the harness validates both — the tuple against the supplied decisions on cold and on warm replay (a missing or wrongly named decision must leave RELEASE `unreached`, and the fixture decision must yield `pass`), and the gate set against the RELEASE receipt's ancestry; because the runtime permits an empty default tuple and derives ancestry separately, an empty tuple, a tuple of gate IDs, or a wrong gate set each fails the harness explicitly. - Recovery/failure matrix: recovery passes only when commit-pinned ruling bytes and redundant serialization/cross-receipts uniquely authenticate the reconstruction; raw bytes, reconstructed bytes, proof and ruling are persisted. Every historical positive recovery is tested, and for each, removal or substitution of every individual proof element must persist a gate failure. Named negative fixtures with stable typed refusal codes cover malformed, truncated, noncanonical, wrong-sentinel, wrong-count, wrong-digest, stale, swapped, conflicting and ambiguous evidence; none may certify or pass. | Step | What | Owner | Accepted when | |---|---|---|---| | A-1 | Store, codec registry, TCB attester and toolchain bundle, ingestion of the cohort manifest's sources and of every post-H delta | build agents; this session reviews | every ingested source re-hashes to the SHA cited in the campaign record; canonical paths and storage identities preserved; no Plan-A write to e8-ops, verified by attribution audit; only stable canonical staged bytes ingested; the attester passes against the recorded commit and toolchain digests and its recomputed digest namespaces the store and appears as a source in every node key and in every run and report; restore-and-rehash drill passed from a clean store | -| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles | build agents; this session reviews | for every cohort document and every mutation and recovery case: cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes; the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | +| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles | build agents; this session reviews | for every cohort document and every mutation and recovery case, the frozen fixture declares its EXPECTED STATE per node — executed, refused (typed refusal before any kernel runs, as when a required source is missing: executor.py:1922–1924), or unreached (a dependent of a failed gate) — and the assertions are scoped to it: for fixtures whose expected state is executed, cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes, and the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; for refusal fixtures, both cold runs and the warm run produce the identical typed refusal code before any kernel executes and store nothing; for unreached fixtures, the gate's failed outcome is persisted identically on both cold runs, its dependents are unreached on both, and the warm run reproduces the same outcome and unreached set from cache without executing the failed gate's dependents; any fixture whose observed states differ from its frozen expected states fails; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | | A-3 | Shadow every canonical harvest, seal, void, repair, supersession and replication event after H through H2, beside the bespoke harvest, with no effect on it | orchestrator dispatch unchanged; build agents run the shadow | every post-H event is shadowed under the A-2 contract; shadow latency recorded; zero governing discrepancies, or the document is listed as a residue with its discrepancy class; no typed exceptions exist in Plan A | | A-4 | Shadow backfill of every event at or before H, including every void, supersession and replication disposition, each derived from the commit-pinned ruling bytes as a source and reported, not selected | build agents | per-document parity report under the A-2 contract; residue list; for doc_058 the report shows both 38eea5db57118df598e2f2ea1d68466df58d9e1ff1615de38d36c4609da2fef3 (board-ratified) and b3a36967ffdc934521c5459f7bf71b46cb5741f2a089a4a89b5d8d750de89fc8 (preserved superseded) with their board rulings, without choosing | | A-5 | Closing census, parity report and Plan B proposal | this session | evidence-complete and parity states reported separately; A-1 through A-4 accepted under one TCB; the H2 census shows multiset equality with the authoritative record; the report records both occurrence-manifest digests (H and H2), the TCB and toolchain digests, per-document comparison results, residue classes, measured shadow latency and the store inventory; mixed-TCB results are rejected; Plan B is proposed only with that evidence attached | From ea067dd0a4bd69498f10a6a20a860b992aea36a9 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 16:45:45 -0400 Subject: [PATCH 6/7] docs/plans: graph-port Plan A revision 10 (capacity amendment: upward-routed A-1/A-2 lane when Claude is capped, under ceremony precedence) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Requested by the Microcosm US session under Max's steering to maximise parallel work. A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to route upward to Astra on a Codex home when every Claude lane is capped by return code, subject to ceremony precedence on that home (no build while an Amendment-20 ceremony step runs there), a recorded window state and routing decision at dispatch, and the Claude path as the default whenever it frees first. No scientific, authority or scope change. Co-Authored-By: Claude Fable 5.1 --- docs/plans/graph-port-A-shadow-2026-09-03.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index 5d148d12..bea420dd 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 9, 2026-09-05. Gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 10, 2026-09-05. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amends ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -25,7 +25,7 @@ A3. No authority. Every shadow manifest is NONAUTHORITY. Decision records are no A4. Storage. Outside e8-ops in a dedicated private location. For every source, before any copy or replica: record access classification, license/replication permission, approved destination and backup owner, repository/binary limits, retention, access controls, and required encryption; do not copy or replicate a source until those checks pass. Copied source payloads are NONAUTHORITY caches preserving canonical paths and storage identities. Inventory source bytes, columns, node-key duplicates, attempts and metadata before choosing Git, Git LFS or private object storage; name the backup owner and off-host replica; clean-store restore-and-rehash drill before acceptance; no capacity ceiling asserted until measured. -A5. Capacity. Build agents run on Claude capacity separate from the campaign's lanes and from the orchestrator's lane, and pause if harvest, A4/C20 or referee capacity is threatened. No codex lane-hours are consumed by Plan A except the gate peer's own review. +A5. Capacity. Build agents run on Claude capacity separate from the campaign's lanes and from the orchestrator's lane, and pause if harvest, A4/C20 or referee capacity is threatened. Codex lane-hours are consumed by Plan A only for (i) the gate peer's own review and (ii) the isolated A-1/A-2 engineering lane when it is routed upward to Astra because every Claude lane is capped — established by a fresh return code from each candidate lane, never by the status table — and then only under CEREMONY PRECEDENCE: no build dispatch on a Codex home while an Amendment-20 ceremony step (A4 freeze or re-freeze, scratch transition, receipt, referee verdict, closure, repin, or the PR #405 gate peer) is running on it, the dispatch records the home, its measured five-hour and weekly window state and the routing decision in the run's ledger entry, and the lane pauses or is not started if a ceremony step needs the home. The Claude path remains the default and is used whenever a Claude lane frees first. The served model and lane are reported in the parity report; a build that ran on Astra is labelled as such and confers nothing. ## 4. Sequence and acceptance @@ -60,7 +60,7 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run): - Do not copy or replicate any source before its access, license, destination, backup, retention, access-control and encryption checks pass. - Do not put the store in e8-ops or rely on `/tmp`. - Do not declare `Tolerance` or entrants (#847) in Plan A. -- Do not consume codex lane-hours for build work; do not run build agents on the orchestrator's lane. +- Do not consume codex lane-hours for build work except the single upward-routed A-1/A-2 lane that A5 permits, and never while a ceremony step is running on that home; do not run build agents on the orchestrator's lane. - Do not widen any Opus role beyond Max's cited authorization without a completed digest-bound calibration report. - Do not call any shadow result evidence, or use it in any Plan B argument, before A2a and the per-event-type schemas are met. - Do not choose H2 retroactively or shorten the live window below the frozen rule. From 0e8ed8087ed00e3972d56ad1f48220da07fc2f0b Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 16:50:38 -0400 Subject: [PATCH 7/7] docs/plans: graph-port Plan A revision 11 (folds gate 20260905-164552 round 1: blocking artifact edges, executed-failed vs unreached, both dependency-type fixtures) At the pinned executor a failed string verdict does not block downstream execution; only an unavailable typed artifact or an unreached ancestor does (_blocked_by). Revision 11 requires every gate that must stop execution to emit a typed artifact its dependents consume (transport gate -> reconstruct_T and seal gate; seal gate -> RELEASE), distinguishes EXECUTED-FAILED from UNREACHED in the frozen expected states, forbids a RELEASE that executes after a seal-gate failure, and requires cold/warm fixtures for both dependency types. The revision-10 capacity amendment drew no finding and is unchanged. Co-Authored-By: Claude Fable 5.1 --- docs/plans/graph-port-A-shadow-2026-09-03.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index bea420dd..27d3281b 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 10, 2026-09-05. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amends ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 11, 2026-09-05. Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -44,7 +44,7 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run): | Step | What | Owner | Accepted when | |---|---|---|---| | A-1 | Store, codec registry, TCB attester and toolchain bundle, ingestion of the cohort manifest's sources and of every post-H delta | build agents; this session reviews | every ingested source re-hashes to the SHA cited in the campaign record; canonical paths and storage identities preserved; no Plan-A write to e8-ops, verified by attribution audit; only stable canonical staged bytes ingested; the attester passes against the recorded commit and toolchain digests and its recomputed digest namespaces the store and appears as a source in every node key and in every run and report; restore-and-rehash drill passed from a clean store | -| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles | build agents; this session reviews | for every cohort document and every mutation and recovery case, the frozen fixture declares its EXPECTED STATE per node — executed, refused (typed refusal before any kernel runs, as when a required source is missing: executor.py:1922–1924), or unreached (a dependent of a failed gate) — and the assertions are scoped to it: for fixtures whose expected state is executed, cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes, and the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; for refusal fixtures, both cold runs and the warm run produce the identical typed refusal code before any kernel executes and store nothing; for unreached fixtures, the gate's failed outcome is persisted identically on both cold runs, its dependents are unreached on both, and the warm run reproduces the same outcome and unreached set from cache without executing the failed gate's dependents; any fixture whose observed states differ from its frozen expected states fails; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | +| A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles. BLOCKING TOPOLOGY (pinned executor): a failed string verdict does not block downstream execution by itself — `_blocked_by` blocks only consumers of an unavailable typed artifact and descendants of an execution-unreached node — so wherever execution MUST stop after a gate fails, that gate emits a typed `ArtifactOutput` that every kernel required to stop consumes as an `ArtifactInput` (transport gate → reconstruct_T and seal gate; seal gate → RELEASE), in addition to its owned string columns; owned-column dependencies alone never carry a stop. The frozen expected-state vocabulary distinguishes EXECUTED-FAILED (the gate ran and persisted its failed string outcome; its typed artifact is unavailable) from UNREACHED (a node blocked by an unavailable artifact or by an unreached ancestor); RELEASE must be UNREACHED, never executed with an evidence-tier failure, whenever the seal gate failed, even when its required decision is supplied | build agents; this session reviews | for every cohort document and every mutation and recovery case, the frozen fixture declares its EXPECTED STATE per node — executed, refused (typed refusal before any kernel runs, as when a required source is missing: executor.py:1922–1924), or unreached (a dependent of a failed gate) — and the assertions are scoped to it: for fixtures whose expected state is executed, cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes, and the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; for refusal fixtures, both cold runs and the warm run produce the identical typed refusal code before any kernel executes and store nothing; for executed-failed/unreached fixtures, the gate's failed string outcome is persisted identically on both cold runs, its typed artifact is unavailable, every artifact consumer and every descendant of an unreached node is UNREACHED on both (a RELEASE that executes after a seal-gate failure is a topology defect and fails the harness), and the warm run reproduces the same outcome and unreached set from cache without executing the failed gate's dependents; fixtures cover BOTH dependency types — an artifact-consumer blocked by an unavailable artifact, and a descendant blocked by an unreached ancestor — on cold and warm; any fixture whose observed states differ from its frozen expected states fails; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | | A-3 | Shadow every canonical harvest, seal, void, repair, supersession and replication event after H through H2, beside the bespoke harvest, with no effect on it | orchestrator dispatch unchanged; build agents run the shadow | every post-H event is shadowed under the A-2 contract; shadow latency recorded; zero governing discrepancies, or the document is listed as a residue with its discrepancy class; no typed exceptions exist in Plan A | | A-4 | Shadow backfill of every event at or before H, including every void, supersession and replication disposition, each derived from the commit-pinned ruling bytes as a source and reported, not selected | build agents | per-document parity report under the A-2 contract; residue list; for doc_058 the report shows both 38eea5db57118df598e2f2ea1d68466df58d9e1ff1615de38d36c4609da2fef3 (board-ratified) and b3a36967ffdc934521c5459f7bf71b46cb5741f2a089a4a89b5d8d750de89fc8 (preserved superseded) with their board rulings, without choosing | | A-5 | Closing census, parity report and Plan B proposal | this session | evidence-complete and parity states reported separately; A-1 through A-4 accepted under one TCB; the H2 census shows multiset equality with the authoritative record; the report records both occurrence-manifest digests (H and H2), the TCB and toolchain digests, per-document comparison results, residue classes, measured shadow latency and the store inventory; mixed-TCB results are rejected; Plan B is proposed only with that evidence attached |