From 258cc1ec96d952d2b28570c4b4fb243bb3e10e45 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 19:22:11 -0400 Subject: [PATCH 1/3] docs/plans: graph-port Plan A revision 12 (two A-1 scopes after the 41fe7fe review; per-class staged rule; TCB digest and absent-digest fixes required) --- docs/plans/graph-port-A-shadow-2026-09-03.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index 27d3281b..8ead025c 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 11, 2026-09-05. Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 12, 2026-09-05. The A-1/A-2 build at exact head 41fe7fe (three commits on `plan-a-shadow-a1a2-20260905`, SHADOW-ONLY) was reviewed clause by clause (run 20260905-190906-plan-a-a1a2-review-r2, REVIEW.md sha256 01c768fb1523b0c7…): A-1 is accepted at FIXTURE scope only and recorded NOT MET at LIVE scope (the build ingests staged reports, tables with sidecars and its own cohort manifest, not the other declared classes), A-2 is accepted with the totality of `decode_lane`/`reconstruct_T` carried as an open verification item; this revision makes the two A-1 scopes explicit in A1 and §4, replaces the global path-fragment blacklist with a per-class staged rule in §5 (the blacklist would refuse two declared classes outright), and adds two required fixes for the next slice (the TCB digest in every run artifact's banner; an absent declared digest fails rather than passes). A-3 does not start before this revision is agreed. Revision 11: Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -15,7 +15,7 @@ OUT (Plan B, gated separately with Plan A's evidence): any harvest cutover or au ## 3. Decisions adopted by this plan -A1. Source model. Every declared, pinned source class is ingested: stable canonical staged report bytes (the only admissible form of a lane report — never raw lane `.out` or worktree outputs), briefs, ledger and library versions, rubric notes, PDFs, artifact JSONs and commit-pinned board ruling bytes, each hashed by name, bytes and size. The staged-bytes restriction applies to lane-report alternatives only; omitting any other declared source class fails A-1. No kernel calls an engine. Deterministic post-lane transformations are kernels; transport and seal checks are gate-role kernels that own at least one column read by the release. Determinism is a dynamics-side rule enforced by review and by the parity harness, not by the executor. +A1. Source model. Every declared, pinned source class is ingested: stable canonical staged report bytes (the only admissible form of a lane report — never raw lane `.out` or worktree outputs), briefs, ledger and library versions, rubric notes, PDFs, artifact JSONs and commit-pinned board ruling bytes, each hashed by name, bytes and size. The staged-bytes restriction applies to lane-report alternatives only; omitting any other declared source class fails A-1 at LIVE scope. A-1 is accepted in two named scopes and any acceptance states which: FIXTURE scope — every class the frozen cohort manifest declares is ingested and re-hashes to the record (met at 41fe7fe: 11 sources, tri-checked); LIVE scope — every class this paragraph names is ingested from the live cohort (not met at 41fe7fe; the build discloses the exclusion). The ingester must accept every declared class: a class-agnostic path-fragment blacklist that refuses briefs because they live under `thu-briefs/` or `opus-scratch/` is a defect, not a guard. No kernel calls an engine. Deterministic post-lane transformations are kernels; transport and seal checks are gate-role kernels that own at least one column read by the release. Determinism is a dynamics-side rule enforced by review and by the parity harness, not by the executor. A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is PolicyEngine/microcosm commit `b55a583f078b3d182c65980f24a4d5a119f169bc` ("Authenticate candidate payload identities and bound local transport reads", 2026-09-05 15:22 EDT), which the Microcosm US session froze for its interface check. Publication state at pinning: that commit is a strict descendant of `origin/main` `c1b8324183819cf91511c002bf724a2676524e87` and was not yet on any remote branch, so build agents read it from the local object store and its first appearance on a remote is a recorded event, not a pin change. The previous pin, `6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6` (pre-#847), lacked `SourceCodecRegistry.register_bytes`, the `raw-bytes-v1` reader, and the typed `ArtifactType`/`ArtifactInput`/`ArtifactOutput` edges (all present at `b55a583f` in `packages/microcosm-graph/src/microcosm/graph/codecs.py` and `decl.py`); moving to `b55a583f` is a new TCB under this same paragraph's rule, and no Plan-A result exists yet to rerun. The memo confirms the ENGINEERING interface only: it approves no attestation, hermeticity, or source/scientific authority, and the §5 do-not on declaring `Tolerance` or entrants (#847) is unchanged. After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. When execution runs in a hermetic image (A2a(i), first alternative), the complete image identity (the image digest and the digests of every layer actually loaded) and the exact allowed semantic-environment values (the environment and input allowlist as resolved, including interpreter flags, locale, timezone and hash-seed settings) are TCB components: the attester records them, recomputes them before any cache lookup, and treats a change to any of them exactly as it treats a toolchain change — the populated old namespace is rejected before any cache read and a new namespace is derived. When the alternative closure approach is used instead, the hashed closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is the TCB component in the same way. In neither case may two images or two environment resolutions share a cache namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun. @@ -43,7 +43,7 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run): | Step | What | Owner | Accepted when | |---|---|---|---| -| A-1 | Store, codec registry, TCB attester and toolchain bundle, ingestion of the cohort manifest's sources and of every post-H delta | build agents; this session reviews | every ingested source re-hashes to the SHA cited in the campaign record; canonical paths and storage identities preserved; no Plan-A write to e8-ops, verified by attribution audit; only stable canonical staged bytes ingested; the attester passes against the recorded commit and toolchain digests and its recomputed digest namespaces the store and appears as a source in every node key and in every run and report; restore-and-rehash drill passed from a clean store | +| A-1 | Store, codec registry, TCB attester and toolchain bundle, ingestion of the cohort manifest's sources and of every post-H delta | build agents; this session reviews | every ingested source re-hashes to the SHA cited in the campaign record; canonical paths and storage identities preserved; no Plan-A write to e8-ops, verified by attribution audit; only stable canonical staged bytes ingested; the attester passes against the recorded commit and toolchain digests and its recomputed digest namespaces the store and appears as a source in every node key and in every run and report; restore-and-rehash drill passed from a clean store; the attested TCB digest is printed in the banner of every committed run artifact; a source whose declared digest is absent FAILS the re-hash check rather than passing it; the acceptance names its scope (fixture or live) | | A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles. BLOCKING TOPOLOGY (pinned executor): a failed string verdict does not block downstream execution by itself — `_blocked_by` blocks only consumers of an unavailable typed artifact and descendants of an execution-unreached node — so wherever execution MUST stop after a gate fails, that gate emits a typed `ArtifactOutput` that every kernel required to stop consumes as an `ArtifactInput` (transport gate → reconstruct_T and seal gate; seal gate → RELEASE), in addition to its owned string columns; owned-column dependencies alone never carry a stop. The frozen expected-state vocabulary distinguishes EXECUTED-FAILED (the gate ran and persisted its failed string outcome; its typed artifact is unavailable) from UNREACHED (a node blocked by an unavailable artifact or by an unreached ancestor); RELEASE must be UNREACHED, never executed with an evidence-tier failure, whenever the seal gate failed, even when its required decision is supplied | build agents; this session reviews | for every cohort document and every mutation and recovery case, the frozen fixture declares its EXPECTED STATE per node — executed, refused (typed refusal before any kernel runs, as when a required source is missing: executor.py:1922–1924), or unreached (a dependent of a failed gate) — and the assertions are scoped to it: for fixtures whose expected state is executed, cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes, and the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; for refusal fixtures, both cold runs and the warm run produce the identical typed refusal code before any kernel executes and store nothing; for executed-failed/unreached fixtures, the gate's failed string outcome is persisted identically on both cold runs, its typed artifact is unavailable, every artifact consumer and every descendant of an unreached node is UNREACHED on both (a RELEASE that executes after a seal-gate failure is a topology defect and fails the harness), and the warm run reproduces the same outcome and unreached set from cache without executing the failed gate's dependents; fixtures cover BOTH dependency types — an artifact-consumer blocked by an unavailable artifact, and a descendant blocked by an unreached ancestor — on cold and warm; any fixture whose observed states differ from its frozen expected states fails; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | | A-3 | Shadow every canonical harvest, seal, void, repair, supersession and replication event after H through H2, beside the bespoke harvest, with no effect on it | orchestrator dispatch unchanged; build agents run the shadow | every post-H event is shadowed under the A-2 contract; shadow latency recorded; zero governing discrepancies, or the document is listed as a residue with its discrepancy class; no typed exceptions exist in Plan A | | A-4 | Shadow backfill of every event at or before H, including every void, supersession and replication disposition, each derived from the commit-pinned ruling bytes as a source and reported, not selected | build agents | per-document parity report under the A-2 contract; residue list; for doc_058 the report shows both 38eea5db57118df598e2f2ea1d68466df58d9e1ff1615de38d36c4609da2fef3 (board-ratified) and b3a36967ffdc934521c5459f7bf71b46cb5741f2a089a4a89b5d8d750de89fc8 (preserved superseded) with their board rulings, without choosing | @@ -54,7 +54,7 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run): - Do not cut over, cite a manifest as authority, select an active record, append a pointer index, or retire, rewrite or delete any record. - Do not touch lane briefs, templates, harvest rules, ledger or library folds, `#405`, `e20-amend20`, `docs/design/` or the registry; no Plan-A write to e8-ops. - Do not wrap a lane as a kernel or let any kernel call an engine. -- Do not ingest raw lane `.out` or worktree outputs; only stable canonical staged bytes. +- Do not ingest raw lane `.out` or worktree outputs; only stable canonical staged bytes. This rule is PER CLASS and applies to lane-report alternatives: it must be enforced by the source class of the declaration, never by a global path-fragment blacklist, because briefs and rubric notes — declared classes — live under `thu-briefs/` and `opus-scratch/`. - Do not run any cache lookup before the attester passes; do not reuse cache across TCB namespaces; do not use `resume=forbid` on a shared store; do not aggregate results from different TCBs; do not change any toolchain component without a full rerun. - Do not hand-edit or silently repair a shadow object; only matrix-defined deterministic recovery is allowed. - Do not copy or replicate any source before its access, license, destination, backup, retention, access-control and encryption checks pass. From a4187f2ab68796604ebb8b8e113bfcad688d6ca0 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 20:03:13 -0400 Subject: [PATCH 2/3] Plan A revision 12: kernel totality contract (A2a) from the shadow child's measured counterexamples --- docs/plans/graph-port-A-shadow-2026-09-03.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index 8ead025c..4f5711bf 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 12, 2026-09-05. The A-1/A-2 build at exact head 41fe7fe (three commits on `plan-a-shadow-a1a2-20260905`, SHADOW-ONLY) was reviewed clause by clause (run 20260905-190906-plan-a-a1a2-review-r2, REVIEW.md sha256 01c768fb1523b0c7…): A-1 is accepted at FIXTURE scope only and recorded NOT MET at LIVE scope (the build ingests staged reports, tables with sidecars and its own cohort manifest, not the other declared classes), A-2 is accepted with the totality of `decode_lane`/`reconstruct_T` carried as an open verification item; this revision makes the two A-1 scopes explicit in A1 and §4, replaces the global path-fragment blacklist with a per-class staged rule in §5 (the blacklist would refuse two declared classes outright), and adds two required fixes for the next slice (the TCB digest in every run artifact's banner; an absent declared digest fails rather than passes). A-3 does not start before this revision is agreed. Revision 11: Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 12, 2026-09-05. The A-1/A-2 build at exact head 41fe7fe (three commits on `plan-a-shadow-a1a2-20260905`, SHADOW-ONLY) was reviewed clause by clause (run 20260905-190906-plan-a-a1a2-review-r2, REVIEW.md sha256 01c768fb1523b0c7…): A-1 is accepted at FIXTURE scope only and recorded NOT MET at LIVE scope (the build ingests staged reports, tables with sidecars and its own cohort manifest, not the other declared classes), A-2 is accepted for the fixture set, and the totality of `decode_lane`/`reconstruct_T` was then MEASURED by the shadow child at df10c8b (`tests/q5graph/test_kernel_totality.py`, 23 tests): total where the contract holds, an absent source is the declared boundary, and three inputs are neither total nor a typed gate failure — a printed `NaN` in the symbol table (crashes both kernels), a digit run longer than the interpreter's int-conversion limit (raises out of `decode_report`; the limit is an interpreter setting the TCB must pin), and a printed arity above int64 (crashes `decode_lane`; `reconstruct_T` survives the same bytes). This revision makes the typed-failure contract explicit for those inputs (§3 A2a below); this revision makes the two A-1 scopes explicit in A1 and §4, replaces the global path-fragment blacklist with a per-class staged rule in §5 (the blacklist would refuse two declared classes outright), and adds two required fixes for the next slice (the TCB digest in every run artifact's banner; an absent declared digest fails rather than passes). A-3 does not start before this revision is agreed. Revision 11: Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -17,6 +17,8 @@ OUT (Plan B, gated separately with Plan A's evidence): any harvest cutover or au A1. Source model. Every declared, pinned source class is ingested: stable canonical staged report bytes (the only admissible form of a lane report — never raw lane `.out` or worktree outputs), briefs, ledger and library versions, rubric notes, PDFs, artifact JSONs and commit-pinned board ruling bytes, each hashed by name, bytes and size. The staged-bytes restriction applies to lane-report alternatives only; omitting any other declared source class fails A-1 at LIVE scope. A-1 is accepted in two named scopes and any acceptance states which: FIXTURE scope — every class the frozen cohort manifest declares is ingested and re-hashes to the record (met at 41fe7fe: 11 sources, tri-checked); LIVE scope — every class this paragraph names is ingested from the live cohort (not met at 41fe7fe; the build discloses the exclusion). The ingester must accept every declared class: a class-agnostic path-fragment blacklist that refuses briefs because they live under `thu-briefs/` or `opus-scratch/` is a defect, not a guard. No kernel calls an engine. Deterministic post-lane transformations are kernels; transport and seal checks are gate-role kernels that own at least one column read by the release. Determinism is a dynamics-side rule enforced by review and by the parity harness, not by the executor. +A2a. Kernel totality contract. Every dynamics kernel is total over every input the source model admits, or fails through the typed gate failure the plan's blocking topology carries — never through an uncaught interpreter error. Printed `NaN`, digit runs beyond the pinned interpreter limit, and arities beyond int64 are admitted inputs (they occur in lane bytes) and must map to typed failures; the interpreter's int-conversion limit is a TCB component and is pinned in the toolchain bundle. The three counterexamples measured at df10c8b are open A-2 defects until fixed under this contract and re-measured; fixing them changes the toolchain bundle and therefore the TCB namespace, which is expected and must be reported, not hidden. + A2. TCB attestation over the runtime and the evidence toolchain. The gate-recorded pin is PolicyEngine/microcosm commit `b55a583f078b3d182c65980f24a4d5a119f169bc` ("Authenticate candidate payload identities and bound local transport reads", 2026-09-05 15:22 EDT), which the Microcosm US session froze for its interface check. Publication state at pinning: that commit is a strict descendant of `origin/main` `c1b8324183819cf91511c002bf724a2676524e87` and was not yet on any remote branch, so build agents read it from the local object store and its first appearance on a remote is a recorded event, not a pin change. The previous pin, `6022e4f5c8af31d62fddd1c7dbd1ab9eea81b0f6` (pre-#847), lacked `SourceCodecRegistry.register_bytes`, the `raw-bytes-v1` reader, and the typed `ArtifactType`/`ArtifactInput`/`ArtifactOutput` edges (all present at `b55a583f` in `packages/microcosm-graph/src/microcosm/graph/codecs.py` and `decl.py`); moving to `b55a583f` is a new TCB under this same paragraph's rule, and no Plan-A result exists yet to rerun. The memo confirms the ENGINEERING interface only: it approves no attestation, hermeticity, or source/scientific authority, and the §5 do-not on declaring `Tolerance` or entrants (#847) is unchanged. After implementation and before any acceptance run, a reviewed evidence-toolchain bundle is frozen and its digests recorded: the attester itself, the ingestion and H/H2 enumeration code, the parity comparator and report generator, the campaign kernels and codecs, and the frozen mutation manifest, graph oracle, recovery/failure matrix and legacy schema bytes. Before any cache lookup, the attester recomputes the TCB from the actually loaded graph/frame/executor files, the registry name-to-loader mapping, kernel and codec files, the interpreter executable/ABI, installed distribution files and the toolchain bundle; it rejects any mismatch with the recorded commit and digests and uses the recomputed digest as the store namespace. When execution runs in a hermetic image (A2a(i), first alternative), the complete image identity (the image digest and the digests of every layer actually loaded) and the exact allowed semantic-environment values (the environment and input allowlist as resolved, including interpreter flags, locale, timezone and hash-seed settings) are TCB components: the attester records them, recomputes them before any cache lookup, and treats a change to any of them exactly as it treats a toolchain change — the populated old namespace is rejected before any cache read and a new namespace is derived. When the alternative closure approach is used instead, the hashed closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is the TCB component in the same way. In neither case may two images or two environment resolutions share a cache namespace. The TCB manifest is a declared source of the CREATE node and of every descendant node, so it enters every key, and its digest is bound into every run and report. Any change to any TCB component invalidates all Plan-A evidence and requires a complete cohort rerun; A-5 rejects mixed-TCB results. Adopting #847 is a new TCB and a full rerun. A2a. Evidence-grade closure (carried to Plan B; a Plan A prerequisite for the word "evidence"). No shadow result is certification evidence until: (i) execution runs in a read-only hermetic image with an environment and input allowlist whose image identity (image and loaded-layer digests) and resolved allowlist values are bound into the TCB per A2, or the complete loaded closure (standard library, transitive native libraries, import hooks and resolution, semantic environment) is hashed and traced, undeclared filesystem, clock, randomness and network inputs are denied, and the closure is verified again after execution; (ii) an independently trusted, gate-owned recomputation of raw bundle, run and report bytes exists outside the attester, with tamper tests for every TCB component against a populated old namespace proving rejection before any cache read. Until then Plan A outputs are labelled SHADOW-ONLY, NOT EVIDENCE. From 8e87633537ded90bdce1f2895be18f6f398bb528 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sat, 5 Sep 2026 20:09:23 -0400 Subject: [PATCH 3/3] Plan A revision 12: A-5 requires A-1 at live scope (gate round-1 finding folded) --- docs/plans/graph-port-A-shadow-2026-09-03.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/plans/graph-port-A-shadow-2026-09-03.md b/docs/plans/graph-port-A-shadow-2026-09-03.md index 4f5711bf..fce3d3fd 100644 --- a/docs/plans/graph-port-A-shadow-2026-09-03.md +++ b/docs/plans/graph-port-A-shadow-2026-09-03.md @@ -1,6 +1,6 @@ # Graph port, Plan A: store, ingestion and the Q5 harvest subgraph in shadow -Status: revision 12, 2026-09-05. The A-1/A-2 build at exact head 41fe7fe (three commits on `plan-a-shadow-a1a2-20260905`, SHADOW-ONLY) was reviewed clause by clause (run 20260905-190906-plan-a-a1a2-review-r2, REVIEW.md sha256 01c768fb1523b0c7…): A-1 is accepted at FIXTURE scope only and recorded NOT MET at LIVE scope (the build ingests staged reports, tables with sidecars and its own cohort manifest, not the other declared classes), A-2 is accepted for the fixture set, and the totality of `decode_lane`/`reconstruct_T` was then MEASURED by the shadow child at df10c8b (`tests/q5graph/test_kernel_totality.py`, 23 tests): total where the contract holds, an absent source is the declared boundary, and three inputs are neither total nor a typed gate failure — a printed `NaN` in the symbol table (crashes both kernels), a digit run longer than the interpreter's int-conversion limit (raises out of `decode_report`; the limit is an interpreter setting the TCB must pin), and a printed arity above int64 (crashes `decode_lane`; `reconstruct_T` survives the same bytes). This revision makes the typed-failure contract explicit for those inputs (§3 A2a below); this revision makes the two A-1 scopes explicit in A1 and §4, replaces the global path-fragment blacklist with a per-class staged rule in §5 (the blacklist would refuse two declared classes outright), and adds two required fixes for the next slice (the TCB digest in every run artifact's banner; an absent declared digest fails rather than passes). A-3 does not start before this revision is agreed. Revision 11: Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. +Status: revision 12, 2026-09-05 (gate 20260905-200417-plan-6deac85c round 1 requested one change, folded: A-5 requires A-1 at LIVE scope). The A-1/A-2 build at exact head 41fe7fe (three commits on `plan-a-shadow-a1a2-20260905`, SHADOW-ONLY) was reviewed clause by clause (run 20260905-190906-plan-a-a1a2-review-r2, REVIEW.md sha256 01c768fb1523b0c7…): A-1 is accepted at FIXTURE scope only and recorded NOT MET at LIVE scope (the build ingests staged reports, tables with sidecars and its own cohort manifest, not the other declared classes), A-2 is accepted for the fixture set, and the totality of `decode_lane`/`reconstruct_T` was then MEASURED by the shadow child at df10c8b (`tests/q5graph/test_kernel_totality.py`, 23 tests): total where the contract holds, an absent source is the declared boundary, and three inputs are neither total nor a typed gate failure — a printed `NaN` in the symbol table (crashes both kernels), a digit run longer than the interpreter's int-conversion limit (raises out of `decode_report`; the limit is an interpreter setting the TCB must pin), and a printed arity above int64 (crashes `decode_lane`; `reconstruct_T` survives the same bytes). This revision makes the typed-failure contract explicit for those inputs (§3 A2a below); this revision makes the two A-1 scopes explicit in A1 and §4, replaces the global path-fragment blacklist with a per-class staged rule in §5 (the blacklist would refuse two declared classes outright), and adds two required fixes for the next slice (the TCB digest in every run artifact's banner; an absent declared digest fails rather than passes). A-3 does not start before this revision is agreed. Revision 11: Gate 20260905-164552-plan-b373bd2b round 1 accepted the revision-10 capacity amendment without finding and requested one A-2 topology change, folded here: at the pinned executor a failed string verdict does not by itself block downstream execution (`_blocked_by` blocks only consumers of unavailable typed artifacts and descendants of execution-unreached nodes), so every gate that must stop execution downstream now emits a typed artifact that its dependents consume, the expected-state vocabulary distinguishes EXECUTED-FAILED from UNREACHED, and fixtures cover both dependency types cold and warm. Revision 9 was AGREED by gate 20260905-162709-plan-c185a30c (round 2 approve, 16:34 EDT). Revision 10 amended ONE resource rule and nothing else, at the Microcosm US session's request under Max's steering to maximise parallel work: A5 and the matching §5 do-not now permit the isolated A-1/A-2 engineering lane to be routed upward to Astra on a Codex home when every Claude lane is capped (measured by return code, never by the status table), subject to CEREMONY PRECEDENCE on that home and a recorded window state at dispatch; the Claude path stays the default and is used whenever it is available first. It is submitted to a fresh gate. Earlier: gate 20260905-162709-plan-c185a30c on revision 8 requested three runtime-contract changes, all folded here against the pinned executor: (i) every owned output of a gate-role kernel is a STRING (executor.py:130 rejects any non-string owned output on the exception path, so a mixed string/boolean gate cannot persist failed-gate evidence), with a mixed-output exception fixture that must fail; (ii) RELEASE's `requires_decisions` names DECISIONS supplied at run time (executor.py:219–249), not ancestral gates, so the required decision tuple is frozen and validated independently of the ancestral gate set, with missing- and wrong-decision checks on warm replay; (iii) A-2's execute-cold / hit-warm assertions are scoped per fixture to the frozen expected state (executed, refused, unreached), because a missing required source is rejected before any kernel runs (executor.py:1922–1924) and a gate exception leaves dependents unexecuted. Revision 7 was AGREED by the third gate 20260905-154850-plan-5cfd8532 (Fable main + Astra peer, round 5 approve, 16:12 EDT; proceed authorized). Revision 8 amends exactly one adopted decision and one rule, on the Microcosm US session's interface-confirmation memo (`~/architecture-reviews/microcosm-20260904/dynamics-q5-current-graph-interface-check.md`, SHA-256 485ea3d327b71d2aa9b7f654f0453cdf65c763821a060dc9415f7be951465d9c; companion receipt SHA-256 8d780c99c401536d52e522dd779e9493a66768a75d341130f2148a4663f7cbed): (A2) the gate-recorded TCB pin moves from microcosm `6022e4f5` to `b55a583f078b3d182c65980f24a4d5a119f169bc`, a NEW TCB, because the A-2 interfaces do not exist at `6022e4f5`; (§1/A-1) the store, codec registry and typed artifact facilities are CONSUMED from the core at that pin, not reimplemented; (§4) gate kernels own a string outcome column. It is submitted to a fresh gate; nothing else moves. Earlier: the third gate's rounds 2, 3 and 4 requested changes, all folded in revisions 5–7: (00, round 4) applicability is declared separately for report-derived and T-derived fields, so an attempt voided after its canonical report but before its T keeps the full report comparison and marks only the T-derived fields ABSENT-BY-DISPOSITION, with a report-bearing-void fixture (§4); (0, round 3) the legacy comparison now carries a per-event-type applicability map with explicit absence semantics — a voided attempt or supersession that never produced a canonical report or T bytes is compared on its disposition schema with those fields marked ABSENT-BY-DISPOSITION, which satisfies A-2 and counts toward EVIDENCE-COMPLETE, while an event whose class requires a payload and lacks one is MISSING REQUIRED EVIDENCE and fails; fixtures cover both (§4); (1) the hermetic-image alternative now binds the complete image identity and the allowed semantic-environment values into the TCB, and any change to either rejects the populated old namespace before any cache read (A2, A2a); (2) the latency population is defined per event class with an explicit timestamp source, and harvest-to-shadow-complete is retained separately for harvest events (§4, H2 stopping rule). Previously: gate 20260903-122500-plan-10bdc7ab (Fable main + Sol peer) reached its four-round cap; round 1 AGREED that the shadow scope confers no authority, and rounds 1, 2 and 4 requested changes on the evidence machinery (round 3 could not dispatch for lack of a codex lane). Every replacement from rounds 1–2 is folded; round 4's six findings are folded below as follows: the three plan-level findings (ingestion contract consistency, evidence-complete vs parity-pass states, a frozen H2 stopping rule) are adopted in full; the three authority-grade findings (hermetic execution closure with denied undeclared I/O, an independently trusted attester with tamper tests before any cache read, per-event-type disposition schemas with wrong-disposition fixtures) are adopted as REQUIREMENTS FOR CALLING ANY SHADOW RESULT EVIDENCE and carried into Plan B, with Plan A explicitly producing no certification evidence until they are met. Revision 4 awaited a decision on how it is approved; under Max's standing instruction to keep independent, gate-respecting work moving, the third gate above is that path, and this revision answers its round 2. Plan A supersedes the scope of `docs/plans/graph-port-2026-09-03.md` revision 3, whose gate (20260903-093201-plan-342fa24d) reached its four-round cap with eight open findings; those findings are carried verbatim into Plan B, which will be gated only once Plan A has produced measured parity evidence. Nothing in Plan A confers authority on any graph artifact. ## 1. Scope @@ -49,7 +49,7 @@ Frozen oracles (recorded in the toolchain bundle before any acceptance run): | A-2 | Q5 harvest/transport subgraph (CREATE occurrence universe with `document` as the group entity and unit weights; `q5.decode_lane@1`; `q5.transport_gate@1`; `q5.reconstruct_T@1` owning digest columns; `q5.seal_gate@1`; `q5.harvest_seal@1` RELEASE with real gate ancestry and nonempty `requires_decisions`) against the frozen oracles. BLOCKING TOPOLOGY (pinned executor): a failed string verdict does not block downstream execution by itself — `_blocked_by` blocks only consumers of an unavailable typed artifact and descendants of an execution-unreached node — so wherever execution MUST stop after a gate fails, that gate emits a typed `ArtifactOutput` that every kernel required to stop consumes as an `ArtifactInput` (transport gate → reconstruct_T and seal gate; seal gate → RELEASE), in addition to its owned string columns; owned-column dependencies alone never carry a stop. The frozen expected-state vocabulary distinguishes EXECUTED-FAILED (the gate ran and persisted its failed string outcome; its typed artifact is unavailable) from UNREACHED (a node blocked by an unavailable artifact or by an unreached ancestor); RELEASE must be UNREACHED, never executed with an evidence-tier failure, whenever the seal gate failed, even when its required decision is supplied | build agents; this session reviews | for every cohort document and every mutation and recovery case, the frozen fixture declares its EXPECTED STATE per node — executed, refused (typed refusal before any kernel runs, as when a required source is missing: executor.py:1922–1924), or unreached (a dependent of a failed gate) — and the assertions are scoped to it: for fixtures whose expected state is executed, cold-A and cold-B executions in fresh interpreters on distinct physical, verified-empty stores execute every kernel with hit=false for every node and agree on canonical stored payload bytes and independently recomputed payload hashes, and the unchanged warm run in a fresh interpreter executes zero kernels with hit=true for every node; for refusal fixtures, both cold runs and the warm run produce the identical typed refusal code before any kernel executes and store nothing; for executed-failed/unreached fixtures, the gate's failed string outcome is persisted identically on both cold runs, its typed artifact is unavailable, every artifact consumer and every descendant of an unreached node is UNREACHED on both (a RELEASE that executes after a seal-gate failure is a topology defect and fails the harness), and the warm run reproduces the same outcome and unreached set from cache without executing the failed gate's dependents; fixtures cover BOTH dependency types — an artifact-consumer blocked by an unavailable artifact, and a descendant blocked by an unreached ancestor — on cold and warm; any fixture whose observed states differ from its frozen expected states fails; legacy-schema comparison exact for every document and event under that event class's applicability map, with expected absences carried as ABSENT-BY-DISPOSITION markers and never as missing fields; graph-oracle comparison exact; every mutation-manifest entry and every recovery/failure-matrix entry and negative fixture behaves as frozen; `q5.decode_lane@1` and `q5.reconstruct_T@1` are total over declared bytes or all fallible parsing lives inside gate kernels | | A-3 | Shadow every canonical harvest, seal, void, repair, supersession and replication event after H through H2, beside the bespoke harvest, with no effect on it | orchestrator dispatch unchanged; build agents run the shadow | every post-H event is shadowed under the A-2 contract; shadow latency recorded; zero governing discrepancies, or the document is listed as a residue with its discrepancy class; no typed exceptions exist in Plan A | | A-4 | Shadow backfill of every event at or before H, including every void, supersession and replication disposition, each derived from the commit-pinned ruling bytes as a source and reported, not selected | build agents | per-document parity report under the A-2 contract; residue list; for doc_058 the report shows both 38eea5db57118df598e2f2ea1d68466df58d9e1ff1615de38d36c4609da2fef3 (board-ratified) and b3a36967ffdc934521c5459f7bf71b46cb5741f2a089a4a89b5d8d750de89fc8 (preserved superseded) with their board rulings, without choosing | -| A-5 | Closing census, parity report and Plan B proposal | this session | evidence-complete and parity states reported separately; A-1 through A-4 accepted under one TCB; the H2 census shows multiset equality with the authoritative record; the report records both occurrence-manifest digests (H and H2), the TCB and toolchain digests, per-document comparison results, residue classes, measured shadow latency and the store inventory; mixed-TCB results are rejected; Plan B is proposed only with that evidence attached | +| A-5 | Closing census, parity report and Plan B proposal | this session | evidence-complete and parity states reported separately; A-1 accepted at LIVE scope (a fixture-scope acceptance of A-1 does not satisfy A-5: the closing census cannot show multiset equality with the authoritative record while declared source classes are omitted) and A-2 through A-4 accepted, all under one TCB; the H2 census shows multiset equality with the authoritative record; the report records both occurrence-manifest digests (H and H2), the TCB and toolchain digests, per-document comparison results, residue classes, measured shadow latency and the store inventory; mixed-TCB results are rejected; Plan B is proposed only with that evidence attached | ## 5. Do-nots