From d66cb0b11fdb0c069dff1aa7ce33032bca47528c Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Wed, 21 Oct 2026 15:08:02 +0200 Subject: [PATCH 1/3] docs(plan): capstone QR64/QR256 relational ABI via ClassView and ISA/PartOf rails --- .../d-qr-abi-classview-rails-capstone-v1.md | 94 +++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 .claude/plans/d-qr-abi-classview-rails-capstone-v1.md diff --git a/.claude/plans/d-qr-abi-classview-rails-capstone-v1.md b/.claude/plans/d-qr-abi-classview-rails-capstone-v1.md new file mode 100644 index 000000000..7d39c3d60 --- /dev/null +++ b/.claude/plans/d-qr-abi-classview-rails-capstone-v1.md @@ -0,0 +1,94 @@ +# D-QR-ABI-0: ClassView/WideFieldMask-backed QR64/QR256 relational register capstone + +**Date:** 2026-10-21 · **Status:** CAPSTONE PROPOSAL, four independent consumer probes, NO production code or ABI ratification · **Rust:** 1.99. +**Motivation:** Replace handrolled domain-specific edge constructors with *derived relationships* from existing schema, mapping, identity, and algebra contracts. This is not a new graph engine. +**Prerequisites:** [#1659 physical borrowed ordinal/prefetch lab](https://github.com/AdaWorldAPI/lance-graph/pull/1659); [#1660 algebra/replay and QR research](https://github.com/AdaWorldAPI/lance-graph/pull/1660); [#1659→#1660 PowerShell positional mapping](https://github.com/AdaWorldAPI/lance-graph/blob/research/qr256-elimination-rotation-20261021/.claude/plans/qr256-powershell-ordinal-polyfill-bridge-v1.md); [EXO-119](https://linear.app/exo-red/issue/EXO-119); [EXO-120](https://linear.app/exo-red/issue/EXO-120). + +## 1. The architectural law to test + +A derived edge is admitted when its predicate, roles, coordinate identities, authority, source versions and algebraic laws are **declared and independently witnessed**. For `Member(User,Group) ∘ Grant(Group,Role)`, `UserRole(u,r) := EXISTS g, Member(u,g) AND Grant(g,r)`; an emitted `UserRoleEdge` object is optional. No premise => no claim. TRUE, FALSE and UNKNOWN/unobserved must remain distinguishable in the result contract. + +```text +existing ClassView + (Wide)FieldMask + ontology/OGAR predicate and codebooks + -> Quack bind once (source class/field/ordinals, identity, scope, version) + -> #1659 borrowed ordered lane / off+pos / optional prefetch + -> typed local QR64/QR256 Boolean register, OR/AND via existing mask-risc/ndarray + -> Count/Exists as folds; Rows as explicitly demanded borrowed lens + -> #1660 cold derivation DAG + BEFORE/AFTER and actual dirty + -> any persistent edge/write ONLY at a separately authorized materialization terminal +``` + +**A mask is structural geometry, not epistemic truth.** `ClassView::fields(ClassId)` identifies an append-only ordered field basis; `FieldMask` marks positions 0..63 and stays `Copy`; `WideFieldMask` adds optional higher positions, with `Small(u64)` allocation-free below 64, borrowed `words()`/`canonical_words()` and in-place folds. These masks neither prove a relation exists nor grant read/write permission. Per-consumer `ClassId` and codebook identities require explicit schema/identity witnesses, not a guessed integer match. `WideFieldMask`'s per-position setter uses `u8`, so the first experiments stay at most 256 field-position IDs; `full_for` supports wider counts but that does not make 16-bit field ordinals automatically addressable. + +## 2. Reuse the existing horizontal ISA/PART_OF rails + +The physical [`FacetCascade`](https://github.com/AdaWorldAPI/lance-graph/blob/main/crates/lance-graph-contract/src/facet.rs) is **16 bytes**: `facet_classid(4) | 6×(hi:u8, lo:u8) = 12 bytes`. Its bytes are content-blind. The class-conditioned reading may be `(part_of:is_a)`, `(group:member)`, `(column:row)`, or another declared 256:256 palette pair. `hi_chain` and `lo_chain` each offer six ordered u8 references; `FacetTier.lo` is the low byte and `FacetTier.hi` the high byte. The current `hhtl::NiblePath::from_guid_prefix_v3` explicitly routes **both** part_of/high and is_a/low bytes, not just one. + +**Horizontal register candidate:** one declared `8:8` pair selects two local `u8` coordinate codes in a typed 256×256 focus (max 65,536 pair positions). Reuse `FacetCascade`'s already-carved bytes and validated class interpretation for address binding rather than minting a second `EdgeId` encoding. `6×2×8` is a six-level **address/candidate-label budget**, not a representation of arbitrary 256×256 truth; the 8-KiB Boolean QR tile still holds existence bits separately. The 4-byte class prefix also remains separate from `ClassView::ClassId = u16`; do not conflate encodings without a checked adapter. + +**Vertical HHTL16 zipper candidate (operator hypothesis, NOT yet the existing ABI):** + +- ISA zipper: **16 × 8-bit** logical references, a class/subtype axis, like a distinguished-name chain. +- PART_OF zipper: **16 × 8-bit** logical references, an orthogonal containment/location axis. +- This is a proposed *coordinate/view and ancestry scheme*, not a claim that two 16-byte zipper arrays are already packed into one 16-byte `FacetCascade`. The current persistent 6-tier facets and 16-nibble `NiblePath` router are different shapes; the 16-nibble router has **4-bit steps**, while the suggested HHTL16 zipper uses **8-bit steps**. A proof of an injective/resolved mapping is required before promoting a new representation. +- Do not equate `is_a` inheritance with `part_of` transitivity or automatically compose them. Each typed predicate supplies allowed chaining, scope and law; reflexivity, cycles, unknowns and external focus require explicit rules. + +Proposed **view-only** adapters: `FacetCascade → (isa_rail[6], partof_rail[6])`; `(isa_rail, partof_rail) → witnessed LocalSlot8` for a bounded focus; optional `HHTL16ISA/PartOf` expansion must carry omitted/extra path segments and depth/escape evidence. Reject truncated paths and codebook collisions, never silently alias global IDs with 8-bit local slots. + +## 3. Minimal candidate ABI record (illustrative, not committed Rust) + +```text +RelFrame { + class_basis: ClassViewClassId + ordered FieldRefs + WideFieldMask, + axes: typed (SourceKind, TargetKind), relation: PredicateId, + coords: bounded QR64 or QR256 + local/global codebook witnesses, + rails: [(PartOf8, IsA8); 6] | witnessed zipper view (candidate), + borrow: sourceGeneration, sourceOwner, off/pos or direct ordinal lane, + algebra: BoolOrAnd | GF2Xor | I16Wrapping | other exact typed law, + method8: u8, scope: AuthorityWitness, + replay: cold Before/After/Dirty/RuleWitnessIDs +} +``` + +`FieldMask` is **per-instance populated fields** and `WideFieldMask` is the widening companion, not a Boolean adjacency matrix. QR64 = 512 bytes of **truth**; QR256 = 8 KiB of **truth**, plus address map, witness, scratch, dirty and cold replay storage. A single QR tile supports one **typed predicate/axis interpretation**. A method×slot unary register cannot be misread as source×target adjacency. A bank of 256 dense QR256 binary relations would consume **2 MiB** of truth bits, not 8 KiB. + +## 4. Four independent consumer PRs + +| Topic | Repository | Existing seam | First independent oracle | Explicit non-goal | +|---|---|---|---|---| +| SAP/CATS | lance-graph | 23-field `CatsBatch`, Quack `CatsBinder`, `HASH_ORDINALS` 16, `BAPI_ORDINALS` 8 | same exact source hash/BAPI projections, with separate hash-format profiles | No SAP network/writes, no false claim that every 23-field mask needs QR256 | +| IAM/dir-sim | lance-graph | independently ordinalized user/group SoA, `View`, Quack `UserBinder`, nested groups | current `View` membership and RBAC behavior plus scalar multiset oracle | No automatic permission from presence; no live AD/Entra changes | +| HubSPO | HubSPO-rs | `Catalog` Binder/Registrar; `Table::planes`, stable ordinals, owner/version; list masks | existing live/list-mask oracle and independent **synthetic** association oracle | D-STO-3 association edge lanes are still queued; no fake shipped implementation | +| Stockfish | stockfish-rs | 64×64 butterfly history; HalfKA exact incremental refresh; shakmaty legality | QR64 64×64 move mask vs shakmaty, numeric i16 parity vs current code | NNUE is not a 64×64 Boolean net; never replace Stockfish/shakmaty or i16 with OR/AND | + +These PRs are **draft documentation with preregistered tests**, not claims of implementation. Consumer teams may reject QR entirely if existing direct masks or ordinals are cheaper. + +## 5. Cross-repo proof and cost gates + +**Structural:** class field positions append-only and correctly mapped, `WideFieldMask::Small` path unchanged, >64 fields test promotion, `canonical_words` width normalization. Field presence ≠ relation truth ≠ authorization. + +**Identity:** two independent rows sharing offset 5 but different identity MUST refuse; borrowed `LaneRef` / `ScalarBuffer` payload unchanged; source-specific `off/pos` preserve row order, duplicates and versions. + +**Rail laws:** enumerate 256 u8 values for `hi` and `lo`; verify `u16` pair pack/unpack and LE `FacetTier` parity, six-level priority, class decoding, no missing/invalid identifier alias. Test ancestry prefix/sibling, cycles, cross-focus and differing `part_of` vs `is_a` conclusions. HHTL16 view must return REFUSE/continuation when it cannot represent original evidence. + +**Algebra:** two paths to one target are TRUE under Boolean OR but 0 under GF(2) XOR; bag multiplicity preserved separately; numeric NNUE uses wrapping i16, not Boolean. E-graph equalities do not grant authority. + +**Geometry:** rotation `123/456/789 → 369/258/147` (CCW 90°), four turns recover identity. Matrix rotation is not a valid directed-graph relabel unless explicitly proven. + +**Persistence:** `CandidateDirty`, `ActualDirty = BEFORE XOR AFTER`, `CommittedDirty` and actual store acknowledgement separated. No cross-table foreign-value-driven gather even during preparation under [#1640 ADMISSION B](https://github.com/AdaWorldAPI/lance-graph/pull/1640). Data never committed on an unverified/stale witness. + +**Economics:** benchmark `T_total = T_binding + T_attest + T_indices + T_QRprojection + K*T_fold + T_terminal + T_replay (+ T_commit)`. Report source bytes, cache misses, RSS, tuple allocations, method/DAG nodes, and incremental invalidation. Include direct-mask baseline, QR64, QR256, reused index and no-sharing control. Nanosecond *word fold* and millisecond *whole batch* must not be conflated. + +## 6. Stage plan, decisions and ownership + +1. **CAP-0 map** exact existing `ClassView`, `FacetCascade`, HHTL, Quack binder and #1659 code; classify each consumer as stable/shipped, queued or hypothetical; no duplicate schema vocabulary. +2. **CAP-1 law declaration** formulate typed coordinate/operand agreement, known/unknown semantics and witness validity. Only **paper** ABI until cross-consumer conformance succeeds. +3. **CAP-2 four probes in parallel** consumers use existing oracles and send parity/negative findings to EXO-50. Do not claim other sessions' implementation. +4. **CAP-3 horizontal rail test** `hi:lo` → u8×u8 local coordinates; compare with indexed QR plane. No new EdgeId payload. +5. **CAP-4 vertical zippers** propose 16×8 logical ISA and PART_OF arrays only as independently checked *views*, proving lossless reachability before storage design. +6. **CAP-5 algebra/proof** compare QR Boolean, direct mask, borrowed map, changed versions; optionally attempt bounded egglog and typed GF(2) separately per #1660. +7. **CAP-6 economics/conformance** choose ADOPT/KEEP-DIRECT/REJECT with actual per-consumer cost/line-removal evidence. ClassView field masks + tiny ABI can be promoted only by a separate operator-admission ruling. + +**Open decisions to EXO-50:** which first axis `Source×Target` vs `Method×Slot`; whether horizontal `6×(part_of:is_a)` should remain typed **facets** or become an ISA addressing view; whether two 16-byte HHTL16 zippers are logical views or persisted new encodings; who owns the cross-repository positional-template lens; whether attested sorted write-side indices are permitted under EXO-46/114; consumer permission to prototype independently. This plan asserts **none** as already ratified. + +**Primary anchors:** [`class_view.rs`](https://github.com/AdaWorldAPI/lance-graph/blob/main/crates/lance-graph-contract/src/class_view.rs), [`facet.rs`](https://github.com/AdaWorldAPI/lance-graph/blob/main/crates/lance-graph-contract/src/facet.rs), [`hhtl.rs`](https://github.com/AdaWorldAPI/lance-graph/blob/main/crates/lance-graph-contract/src/hhtl.rs), [`ordered_lane.rs`](https://github.com/AdaWorldAPI/lance-graph/blob/main/crates/lance-graph-contract/src/ordered_lane.rs), [EXO-50](https://linear.app/exo-red/issue/EXO-50), [EXO-119](https://linear.app/exo-red/issue/EXO-119), [EXO-120](https://linear.app/exo-red/issue/EXO-120). From beb2e44749c47af37b60005dd17f33b65c7c141e Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Wed, 21 Oct 2026 15:08:59 +0200 Subject: [PATCH 2/3] docs(qr): d-qr-classview-binding-isa-capstone-v1.md --- .../d-qr-classview-binding-isa-capstone-v1.md | 111 ++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 .claude/plans/d-qr-classview-binding-isa-capstone-v1.md diff --git a/.claude/plans/d-qr-classview-binding-isa-capstone-v1.md b/.claude/plans/d-qr-classview-binding-isa-capstone-v1.md new file mode 100644 index 000000000..88cf69971 --- /dev/null +++ b/.claude/plans/d-qr-classview-binding-isa-capstone-v1.md @@ -0,0 +1,111 @@ +# D-QR-CAP: ClassView / WideFieldMask as a typed relational ISA ground plate + +**Date:** 2026-10-21. **Status:** CAPSTONE PLANNING PR, research only, **no ABI changes or code integration authorized**. **Rust:** 1.99. +**Coordination and ownership:** [EXO-121](https://linear.app/exo-red/issue/EXO-121) and [EXO-50](https://linear.app/exo-red/issue/EXO-50). **Physical and algebraic precursors:** [#1659](https://github.com/AdaWorldAPI/lance-graph/pull/1659), [#1660](https://github.com/AdaWorldAPI/lance-graph/pull/1660), [cross-PR PowerShell ordinal bridge](https://github.com/AdaWorldAPI/lance-graph/blob/research/qr256-elimination-rotation-20261021/.claude/plans/qr256-powershell-ordinal-polyfill-bridge-v1.md), [EXO-119](https://linear.app/exo-red/issue/EXO-119) and [EXO-120](https://linear.app/exo-red/issue/EXO-120). + +## 1. Problem and smallest solution + +Many consumers have meticulous field maps, predicate methods, DTO schemas and ordinal conventions, yet repeatedly handcraft relationship edges and materialized tuples. **Hypothesis:** reuse the existing `ClassView` / `WideFieldMask` bit basis as the **field-selection mapping contract** adjacent to Quack's bind-once numeric boundary; express one *typed* relationship through a borrowed ordinal address view, optionally stage a Boolean QR64/QR256 projection, and use current mask-RISC / ndarray operators. Never require graph objects for an EXISTS/count demand; never stage QR when direct masks are cheaper. + +```text +ClassView + FieldRef positions + structural WideFieldMask + + declared relation predicate / identity / authority + | + Quack Binder + | + Typed QR Binding Witness + | + #1659 borrowed ordered Side/Run / direct LaneRef + | | + direct fold QR64 / QR256 bit plane + \ / + mask-RISC / ndarray Boolean algebra + | + demand-specific Exists / Count / Rows + | + #1660 cold optional law / proof / dirty sidecar + | + independent storage commit (not implied) +``` + +This **ground plate** is a law of *composition given witnessed premises*, not a claim that an ABI proves the sources true. `Valid(A) ∧ Valid(B) ∧ Compatible(A,B) ∧ Law(F) ⇒ Justified(F(A,B))`, relative to version and authority witnesses. + +## 2. Reuse the actual ClassView geometry correctly + +Source of truth: [`crates/lance-graph-contract/src/class_view.rs`](https://github.com/AdaWorldAPI/lance-graph/blob/main/crates/lance-graph-contract/src/class_view.rs). Existing `ClassView` **trait** resolves `fields(ClassId) -> &[FieldRef]`, ordered N3 append-only. Existing `FieldMask(u64)` covers indices 0..63; `WideFieldMask` has a Small(u64) zero-allocation case and allocates a boxed word buffer when positions 64..255 are used. Its `with/has` selectors are `u8`, so current APIs cannot encode more than 256 distinct positions by an unqualified `u8` field index. `WideFieldMask::words()` borrowed view may retain noncanonical width after an in-place fold; `canonical_words()` yields an equal-value width. Mask width must match a declared class field count/basis. + +**Existing ClassView rendering helpers use the legacy `FieldMask`**, including `project`; do not claim that changing `WideFieldMask` automatically widens `ClassView::project`. The lab may read `fields(class)` and use `WideFieldMask` as an **adjacent mapping selector**, without modifying the trait, persistent rows or render surface. + +**Semantic boundary:** a field bit means **populated/selected field**, not user↔group membership, a trust value, an edge, a method body, or permission. Treat structural presence, read authorization, relationship existence, numeric evidence and uncertainty as **separate typed operands**. + +## 3. Candidate register-binding contract (illustrative only) + +```rust +struct QrBinding<'a> { // pseudotype, not code or committed ABI + class_id: ClassId, + field_basis: &'a [FieldRef], // ClassView::fields(class_id) + structural: &'a WideFieldMask, // 0..=255 structural field positions + predicate_id: PredicateId, // separately declared source→target meaning + axes: AxisSignature, // Method×Slot or Source×Target + algebra: AlgebraKind, // BOOL_OR_AND | GF2_XOR | I16_WRAPPING | ... + method: u8, // selector into a VERSIONED operation palette + lanes: BorrowedOrdinalRefs, // preexisting SoA LaneRef/ScalarBuffer, not copied + witness: CoordinateWitness, // class/field/order/identity/authority/version +} +``` + +No new generic AST or crate is demanded at this stage. `ClassId` is a discriminator not a global entity identity; `WideFieldMask` is a presence/selection mask, not the 256×256 bit plane. Any predicate must explicitly name source class, target class, cardinality, direction, set-vs-bag semantics and codebook/source seals. **Only an admitted predicate plus compatible identity can synthesize a derived edge.** + +The PowerShell template `"{0}{1}" -f $laneA[$i],$laneB[$i]` means **compile fixed positional placeholders into borrowed lanes**. No `String`, `Vec` or per-method Rust evaluator in the hot path. For #1659 separate relations, each source uses its **own** `Side::off/pos` and `Run::get` index; equal numeric ordinals across tables do not prove identity. `OrderedLaneWitness` comes from the sealer, never the planner. Respect the [#1640](https://github.com/AdaWorldAPI/lance-graph/pull/1640) ADMISSION B ban on foreign-value-driven cross-table positional gathers even during preparation. + +## 4. Register geometries and algebra + +| Register | Truth matrix bytes | Useful role | Does NOT store | +|---|---:|---|---| +| `QR64` | 64×64/8 = **512 B** | 64×64 legal moves or small bounded binary relation | Stockfish butterfly scores, NNUE weights, full provenance | +| `QR256` | 256×256/8 = **8 KiB** | typed `Method8×Slot8` unary status OR `Source8×Target8` per-predicate adjacency | original SoA payload, index map, full multiset of edges | +| 256 dense **adjacency predicates** | 256×8 KiB = **2 MiB** | upper bound for an eager bank | lazy/borrowed subframes for sparse demand | +| `WideFieldMask` | 8 B until >64 positions | **class field presence/selection**, up to 256 bits via current `u8` selector | graph adjacency | + +For graph composition: +`C[i,j] = OR_k(A[i,k] AND B[k,j])` (existential Boolean semiring). +For GF(2) linear algebra `OR` is **XOR**, which cancels duplicate paths and must not be conflated with graph EXISTS. NNUE needs exact `i16` wrapping/saturating operations as separately defined; a Boolean QR may **select** numeric lanes but cannot replace values. Boolean projection may be lossy for bags, permissions, duplicate evidence, causal interventions and unknown truth values. + +A QR tile is **optional**: direct `FieldMask`, Quack `Filter`, co-addressed bitmap or ordered run seek can be strictly cheaper. Every promoted tile requires a measured amortization benefit. Per-tile 8 KiB claim excludes `present/off/pos` index bytes, Arrow buffer handles, metadata and replay sidecars. + +## 5. Five PRs, independent ownership + +This capstone is **one planning PR**, with four **separate, non-blocking, domain-specific planning/probe PRs**: + +| Topic / issue | Independent draft PR | Entry point / oracle | Acceptance boundary | +|---|---|---|---| +| SAP [EXO-122](https://linear.app/exo-red/issue/EXO-122) | [lance-graph #1661](https://github.com/AdaWorldAPI/lance-graph/pull/1661) | CATS 23-field schema, 16 HASH, 8 BAPI ordinals, existing `edge.rs` | exact mapping/profile parity; no SAP writes | +| IAM [EXO-123](https://linear.app/exo-red/issue/EXO-123) | [lance-graph #1662](https://github.com/AdaWorldAPI/lance-graph/pull/1662) | dir-sim `View`, `UserBinder`, group security/mail closure, role oracle | no false identity/privilege; out-of-focus fallback | +| HubSPO [EXO-124](https://linear.app/exo-red/issue/EXO-124) | [HubSPO-rs #47](https://github.com/AdaWorldAPI/HubSPO-rs/pull/47) | existing `Table::planes`, `Catalog`, list masks; **synthetic** assoc until D-STO-3 | no fake production edge parity; mailbox ownership/version | +| Stockfish [EXO-125](https://linear.app/exo-red/issue/EXO-125) | [stockfish-rs #23](https://github.com/AdaWorldAPI/stockfish-rs/pull/23) | 64×64 butterfly, Shakmaty, incremental HalfKA oracle | QR64 does not replace 16 KiB i16 history / 1024-d accumulator | + +All four remain lab plans until their owning sessions run genuine independent tests; the capstone does not authorize code changes or merge. Reuse [EXO-107](https://linear.app/exo-red/issue/EXO-107) for the missing row lens, [EXO-114](https://linear.app/exo-red/issue/EXO-114) for order witnesses, [EXO-46](https://linear.app/exo-red/issue/EXO-46) for admission, [EXO-86](https://linear.app/exo-red/issue/EXO-86) for contract law ownership. Avoid duplicate execution infrastructure. + +## 6. Milestones / explicit decisions + +**C0 Mapping census:** For each consumer, show its existing `ClassView` or candidate field basis, `FieldMask`/Wide allocation and lane ownership. No speculative ClassId minting. If source lacks real ClassView, use an explicitly **synthetic fixture**. + +**C1 Typed binding proof:** Stable N3 bit positions; `ClassId+schema digest` and field basis; authority scope and version; per-side witnessed source ordinals. Make false identity, incompatible predicate, stale class shape or ACL produce **typed refusal**. + +**C2 Two-axis view:** Start with no QR projection: compare direct source masks. Then optional QR64, QR256, Boolean matmul/ewise/closure backed by existing mask-RISC / ndarray. Count all setup, source bytes, extra memory, cache misses, proof writes and terminal materialization. Gate any ms *hot fold* as failure, not benchmark victory (#1657). + +**C3 Proof and epistemic law:** Link accepted algebraic rewrites to a versioned palette8 rule ID. A `before_root`, derived dirty XOR and `after_root` checker must reconstruct independently; authorization and store ACK are not inferred from mathematical validity. Unknown evidence must not silently become false. + +**C4 Consumer adoption decision:** Receive each topic's ADOPT (with measured win), KEEP-DIRECT, REJECT or DEFER ruling. A universal mandatory QR materializer is a failure mode. If two consumers merely share geometry but not legal semantics, that is a valid narrower win. + +## 7. Operator questions before production + +1. Approve **ClassView + WideFieldMask** as a *candidate reusable field mapping basis* only, with `ClassView` unchanged in phase 1? +2. First QR binary axes: `Source8×Target8` per predicate, rather than `Method8×Slot8` unary scheduling? Both can exist, but must not be confused. +3. Owner for the tiny PowerShell-style ordinal selector wrapper [EXO-119](https://linear.app/exo-red/issue/EXO-119) and ordered write-path policy [EXO-114](https://linear.app/exo-red/issue/EXO-114)? +4. Authorization to implement a *separate* lab after the docs/probes are reviewed, while #1659/#1660 remain independently owned? +5. Keep the cold Thought Git replay/writeback and all external effects behind their existing approval/commit protocol (recommended yes)? + +**Stop conditions:** no custom edge generator eliminated, any wrong bit, tuple/object materialization in Count/Exists, law mismatch, lost multiplicity, forged identity, stale permission, unadmitted gather, fake NNUE equivalence, wrong checksum or a commit claimed without persistent acknowledgment. + +**Success is smaller architecture, not a larger framework.** From fb4941a7848af5426223b9a60a5a05a5217f08ec Mon Sep 17 00:00:00 2001 From: AdaWorldAPI Date: Wed, 21 Oct 2026 15:09:03 +0200 Subject: [PATCH 3/3] docs(qr): d-qr-capstone-cross-consumer-oracle-matrix-v1.md --- ...apstone-cross-consumer-oracle-matrix-v1.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .claude/plans/d-qr-capstone-cross-consumer-oracle-matrix-v1.md diff --git a/.claude/plans/d-qr-capstone-cross-consumer-oracle-matrix-v1.md b/.claude/plans/d-qr-capstone-cross-consumer-oracle-matrix-v1.md new file mode 100644 index 000000000..f175cff8d --- /dev/null +++ b/.claude/plans/d-qr-capstone-cross-consumer-oracle-matrix-v1.md @@ -0,0 +1,53 @@ +# D-QR-CAP: cross-consumer fixture matrix, independent oracles and evidence ledger + +**Status:** Preregistered research, not run, 2026-10-21. **Owner coordination:** EXO-121 and EXO-50. Rust 1.99. This document is not a benchmark report. + +## Shared minimal fixtures + +- **CLASS BASIS:** `ClassId=7`, append-only fields in an ordered `ClassView::fields(7)` basis. `FieldMask` bits 0/2 present, 1 absent. `WideFieldMask` positions 0/63/64/108 distinguish zero-allocation small from >64 wide; same first 64 positions remain equal. One forked mutable schema changes field position 2 to 1 and must **refuse** the previous witness. +- **BIT-PLANE:** `QR64` 64 rows × one `u64` word, total 512 B; `QR256` 256 rows × four `u64` words, total 8192 B. Axis signatures are `Method×Slot` unary or `Source×Target` adjacency, never cast between them without a typed view. +- **RELATION:** R(u,g) = {(0,3),(1,3),(1,4)} and S(g,r) = {(3,7),(4,7)}. Boolean `UserRole(1,7)=true`, while bag count supports two derivations. XOR parity of two routes is FALSE, so XOR is a required incorrect-semantics negative control. +- **IDENTITY:** two sources both expose numeric ordinal `4` but different global GUIDs; any co-ordinal join that infers equal entity from equal ordinal must refuse. Reassign the same local slot under a different generation; stale view must refuse or recompute. +- **ROTATION:** `123/456/789 -> 369/258/147` as 90° CCW `new[r,c]=old[c,N-1-r]`; four repeated quarter turns return the same original bits. A 90° image turn is not generally a graph-isomorphism relabeling. +- **DIRTY:** two different supporting groups grant the same role; deleting one support leaves the role true. `actual_dirty = before XOR after` is ZERO for the role truth despite changed support. Provenance and commit stamps remain separate. +- **EQUATION:** exact `a=2b,b=2c,z=2a -> z=8c` under declared exact arithmetic; under `u8` saturation or floating reassociation no implicit exact-proof claim. +- **E-CLASS:** 256 shared templates × 4,096 contexts = 1,048,576 *requested* applications. Compare sharing vs independent expressions; CSE must not promise information-theoretic compression of arbitrary results. +- **QUANTUM NEGATIVE:** reversible GF(2) steps can invert when schedule recorded, but lossy Boolean `OR` and existential projection require before-support witnesses; nothing here implies quantum compute or speedup. + +## Cross-consumer tests + +| Axis | SAP #1661 / EXO-122 | dir-sim #1662 / EXO-123 | HubSPO #47 / EXO-124 | stockfish-rs #23 / EXO-125 | +|---|---|---|---|---| +| Mapping ground truth | CATS `FIELDS[23]`, `HASH_ORDINALS[16]`, `BAPI_ORDINALS[8]` | `UserBinder`, group/security chains | `Catalog`, `Table::planes`, owner | `ButterflyHistory` from×to, `feature::make_index` | +| Scalar oracle | existing hash/BAPI and direct Quack | `View`/actors + multiset oracle | existing list filter; synthetic assoc oracle | Shakmaty move generator, independent network refresh | +| Field basis | present vs null; 23-field small | class and attribute key basis; unknown separate | ClassView skins where actually present; synthetic if missing | candidate *geometric analog*; no existing Stockfish ClassView | +| QR role | optional Boolean field/record projection | membership × group × role existence | optional contact-company and list participation | legal move occupancy 512 B QR64 | +| Strong negative | wrong hash/BAPI position, Unicode/decimal | false SID/mail inheritance, 257th focus escape | stale mailbox owner, D-STO-3 not yet shipped | promotion collision from/to, illegal chess symmetry | +| Memory/gate | no row/DTO copy until wire sink | borrowed snapshots/delta, no access bypass | borrowed lanes, no tombstone resurrection | i16 history not converted to bool or FP | +| Cold proof | map/profile/version | group witnesses + snapshot | mailbox+list label+version | feature index/net version + exact delta | +| No-op twin | same generated hash | delete one of two witnesses | unrelated property batch | quiet move whose QR occupancy stays same | + +## Metric schema (MANDATORY per candidate) + +```text +Source commit, source generation, schema/class/field-basis seal, +ClassView/WideFieldMask width, auth/tenant, algebra kind, axis kind, +number of logical requests, number of distinct normalized expressions, +number of borrowed source rows and source bytes, +T_bind, T_order_attest, T_index, T_QR_materialize, T_hot_fold, T_terminal, T_proof_verify, T_writeback, +RSS_peak, QR_bytes, map_bytes, proof_bytes, allocation_count, cache misses where measurable, +oracle parity/refusal, disable red/green, result: ADOPT | KEEP_DIRECT | REJECT | DEFER. +``` + +Separate per-operation **nanosecond/µs** hot fold gate from whole 1,048,576-op job runtime. Compare SIMD and scalar exact oracles only when they do not share the same implementation under test. A cross-table value-directed gather is not admitted even if the test produces the right answer. + +## Handoff / ownership + +- CAP [EXO-121](https://linear.app/exo-red/issue/EXO-121): [capstone plan](d-qr-classview-binding-isa-capstone-v1.md), shared ABI contract and decision log. +- SAP [EXO-122](https://linear.app/exo-red/issue/EXO-122): [lance-graph #1661](https://github.com/AdaWorldAPI/lance-graph/pull/1661). +- IAM [EXO-123](https://linear.app/exo-red/issue/EXO-123): [lance-graph #1662](https://github.com/AdaWorldAPI/lance-graph/pull/1662). +- HubSPO [EXO-124](https://linear.app/exo-red/issue/EXO-124): [HubSPO-rs #47](https://github.com/AdaWorldAPI/HubSPO-rs/pull/47). +- Stockfish [EXO-125](https://linear.app/exo-red/issue/EXO-125): [stockfish-rs #23](https://github.com/AdaWorldAPI/stockfish-rs/pull/23). +- Existing physical/logic work stays with [#1659](https://github.com/AdaWorldAPI/lance-graph/pull/1659) and [#1660](https://github.com/AdaWorldAPI/lance-graph/pull/1660); coordinate over [EXO-50](https://linear.app/exo-red/issue/EXO-50), NOT by overwriting other sessions' branches. + +**No result is marked MEASURED merely by opening a plan or obtaining CI green.**