diff --git a/.claude/board/BREADCRUMBS.md b/.claude/board/BREADCRUMBS.md index 52b5745ac..039df3b43 100644 --- a/.claude/board/BREADCRUMBS.md +++ b/.claude/board/BREADCRUMBS.md @@ -41,6 +41,25 @@ Coordination happens in Linear (`CC: Thread` label `Breadcrumb`, milestone ## Crumbs +### BC-2026-10-23-13 — a replay receipt is sealed before landing, and its witness is issued only by the write path +**Observation:** D-TGB-4's receipt is built and sealed at stage time; a +landing is accepted only with a `CommitWitness` that `VersionStore::commit_cycle` +alone produces, and its absence refuses with `Refusal::NoCommitWitness`. The +module states that the receipt proves replay equals the original run, not that +the derivation is admissible; that promotion is D-TGB-7's. Same three parts as +trail T-ADMISSION: built before (sealed receipt), witness with an issuer +(the cycle commit), refused promotion (replay → proof). +**Receipt:** `crates/thought-git-probe/src/receipt.rs` on main `8f610a85` +(module doc, `pub struct CommitWitness`, `Refusal::NoCommitWitness`); lance-graph #1674, #1684; GPT /05 three-artifact +note (EXO-50, `session_019fbZ92dFKQ5BJHrA3YcH9A/007`). +**Rhymes-with:** BC-2026-10-23-8, BC-2026-10-23-9 (draft #1730) +**Cluster:** RHYME (trail T-ADMISSION, Linear EXO-135) +**Correction (2026-10-23, operator):** the witness is not issued by the write +path. It is the lane dimension: identical NodeGuids across lanes give a +vertical read of which thoughts wrote a node. The probe's `CommitWitness` +restates that read as a lab stand-in. The issuer question raised on EXO-135 +(component or version) is answered: neither, it is the lane. + ### Trail T-ADMISSION — what may be built before execution, under what witness, and what may never be promoted from it? Six crumbs (BC-2026-10-23-7 … -12) from six sources: a decision record, two probe reviews, a co-research map and two plan rows. @@ -179,3 +198,17 @@ under every operation it assumes; otherwise snap (lossy, P-S2), extend the carrier (K3, Bag multiplicity) or refuse (`Complement` under K3, `BagNeedsMultiplicity`). Scope limiter from BC-2026-10-23-6: closure decides correctness, not cost. Proposed regrade RHYME → NAMED left to the trail owner. + + +**Evidence appended 2026-10-23 (session_019fbZ92dFKQ5BJHrA3YcH9A):** BC-4 is +a near-counterexample to the word "closed". A Distinct carrier IS closed under +join (a set joined with a set is a set), yet the Bag answer is wrong; K3 is the +same: {T, F} is closed under ∧ ∨ ¬, the failure is that NULL has no image in +it. Candidate refinement, HYPOTHESIS, not adopted: the condition is that the +map from the true domain into the carrier commutes with the operation and with +the measure read at the end (`h(a ⊕ b) = h(a) ⊕' h(b)`, abstract-interpretation +soundness); closure of the carrier is necessary, not sufficient. Cheap test it +implies: the one-step commutation defect rate (P-S2: 100% / 88.9% of bound +pairs outside support) should predict k-step agreement without running k hops. +**Kill for the refinement:** a case where the map commutes at one step and the +k-step composition still fails. diff --git a/.claude/board/FRUITS.md b/.claude/board/FRUITS.md index e5a6f235c..363be4170 100644 --- a/.claude/board/FRUITS.md +++ b/.claude/board/FRUITS.md @@ -4,7 +4,7 @@ Generated by `.claude/tools/fruits_index.py --write`. Do not hand-edit: add or change a `**Fruit:**` line on the ledger row and regenerate. CI fails when this file is stale. -Open: 14. Closed: 0. +Open: 21. Closed: 0. ## discovery torque @@ -16,13 +16,17 @@ Open: 14. Closed: 0. | tier | row | status | ledger | |---|---|---|---| +| High-signal | 2026-10-23 — One replay that checks proof, receipt and commit witness together | Open. | `IDEAS.md` | +| High-signal | 2026-10-23 — OGAR #357's first kill test (TLAC-P01) is now buildable from real guards | Open. | `IDEAS.md` | | High-signal | 2026-10-23 — The five unrun D-DRMC probes: X6, X7, X8, X16, X18 | Open | `IDEAS.md` | +| Low-hanging | 2026-10-23 — The MeTTa four-binding case can run against the D-MPS-9 oracle | Open. | `IDEAS.md` | | Heavy | 2026-10-23 — A certified-compiler boundary for DR64: typed relational statements, egglog laws with checked proofs, a lowering check | Open | `IDEAS.md` | ## engineering debt | tier | row | status | ledger | |---|---|---|---| +| Low-hanging | TD-CE64-W-SLOT-DOC-SAYS-NO-ANCHOR — `edge.rs` still documents W = 0 as "no corpus anchor" (2026-10-23) — OPEN | OPEN. **Basis:** VERIFIED-IN-CODE (`edge.rs:944` on main `8f610a85`). | `TECH_DEBT.md` | | Low-hanging | TD-STATUS-BOARD-ROWS-MISSING-FOR-OCT-PLANS-1 (2026-10-23) — OPEN | — | `TECH_DEBT.md` | ## blocker @@ -36,6 +40,9 @@ Open: 14. Closed: 0. | High-signal | ISS-D-CGW-4-PROMOTION-GATE — the counterfactual verdict is computed but promotes nothing (2026-10-23) | OPEN. **Basis:** VERIFIED-IN-CODE (`crates/lance-graph-planner/src/pearl.rs:259-263` `counterfactual_verdict` calls `Reaction::verdict`; callers found only in `pearl.rs` tests `:747-815`; STATUS_BOARD row D-CGW-4 Queued). | `ISSUES.md` | | High-signal | ISS-DURABLEREF-THOUGHTCOMMITID — the two identity types four plans depend on do not exist (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (`DurableRef` and `ThoughtCommitId` appear in `crates/` only in doc comments, `mork-pathmap-probe/src/rmap.rs:70` and `:690`). | `ISSUES.md` | | High-signal | ISS-BF16-POLYFILL-PER-ELEMENT-ALLOC — ndarray's BF16 16×16 polyfill allocates per output element (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (`ndarray/src/simd_ops.rs`, `bf16_tile_gemm_16x16`) and MEASURED (D-RMAP-2 §5a: a 256 × 256 `A·A` takes about 19 ms, about 0.9 GMAC/s, on an AVX-512 host without AMX or `avx512_bf16`). | `ISSUES.md` | +| Low-hanging | ISS-CAUSAL-EDGE-CARRIES-SEVEN-PRE-EXISTING-CLIPPY-FINDINGS (2026-08-22) — OPEN | — | `ISSUES.md` | +| Heavy | ISS-ORDER-AND-CODEBOOK-WITNESS-HAS-NO-CONTRACT-TYPE — seven open items wait on one witness nobody owns (2026-10-23) — OPEN | OPEN (reframed, see correction). **Basis:** VERIFIED-IN-CODE | `ISSUES.md` | +| Heavy | ISS-ADMISSION-B-CALL-SITE-CLASSIFICATION-NOT-STARTED — Semijoin, EqU32Via and Gather are unclassified, and no owner is named (2026-10-23) — OPEN | OPEN (operator decision on ownership). **Basis:** VERIFIED-IN-CODE | `ISSUES.md` | | Heavy | ISS-RECURSION-DRIVER — no lawful (co-addressed, non-gather) recursion driver exists (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (`STATUS_BOARD.md` D-RA-4 row: "VIOLATION — GATHER. DO NOT BUILD"). | `ISSUES.md` | | Heavy | ISS-RETRACTION-PROVENANCE — per-derived-cell provenance for selective retraction is undecided (2026-10-20) | OPEN. **Basis:** VERIFIED-IN-CODE (no source bitset or read-provenance plane in `crates/`). | `ISSUES.md` | | Heavy | ISS-GATHER-HOP-1616 — the merged `OutgoingHop` reads positions taken from another lane's values (2026-10-19) | BLOCKED (quarantined). GATHER-DECISION recorded 2026-10-20 (`entries/2026-10-20-six-decisions.md` §1): `OutgoingHop` stays quarantined; it closes only by a rewrite as a co-addressed read. Was: BLOCKED (quarantined; waits on GATHER-DECISION). **Basis:** VERIFIED-IN-CODE (`crates/lance-graph-mask-risc/src/graph_hop.rs`: two `MaskOp::Gather` over `frontier[sources[i]]` and `visible[targets[i]]`, then `ScatterOrU32` by `targets[i]`). | `ISSUES.md` | diff --git a/.claude/board/GOLDSTAUB.md b/.claude/board/GOLDSTAUB.md index a28f4102e..66acb5703 100644 --- a/.claude/board/GOLDSTAUB.md +++ b/.claude/board/GOLDSTAUB.md @@ -30,6 +30,20 @@ Each entry: `**Claim:**`, `**Receipt:**`, `**Scope:**`, `**Date:**`. ## Entries +### G-2026-10-23-5 — a stacked PR is finished only when its commits are on main +**Claim:** When PR B is based on PR A's branch and A merges first, merging B +lands B into A's dead branch, not into main. GitHub shows B as "merged" either +way. After merging any stacked PR, check `git log origin/main..origin/` +is empty, or retarget B to main before merging it. +**Receipt:** lance-graph twice in two days: #1694/#1695 merged into a stage +branch and needed #1696 ("land #1694/#1695 catalogue and heritage stages on +main"); #1701-#1704 merged into stage branches and needed #1708 ("land the +stranded D-DRMC stack"). Earlier receipt: lance-graph-java +`ISS-LGJ-STACK-TAIL-STRANDED-MINOR-8` (2026-08-25), where the rule already sits +in that repo's `CLAUDE.md` iron rules. +**Scope:** every stacked PR in every AdaWorldAPI repo. +**Date:** 2026-10-23 + ### G-2026-10-23-4 — count invocation and allocation boundaries before optimizing a fold **Claim:** The mask work inside a fold costs a few nanoseconds; a slow fold usually measures how often execution crosses a boundary per answer (an diff --git a/.claude/board/IDEAS.md b/.claude/board/IDEAS.md index ee3d44e85..c6069f648 100644 --- a/.claude/board/IDEAS.md +++ b/.claude/board/IDEAS.md @@ -87,6 +87,62 @@ Agents filter by `@`-mention or domain to see what's theirs. (Prepend new ideas here with today's date. Format:) +## 2026-10-23 — One replay that checks proof, receipt and commit witness together + +`[P1 @thought-struct-scribe @truth-architect domain:thought-git D-TGB-7 D-RFT-5 D-DRMC]` + +Three artifacts now exist separately (GPT /05 on EXO-50): the Math Foundry +`ReplayCapsule` / DRMC `RecipeCertificate` (a checkable derivation, #1696, +#1708), the D-TGB-4 receipt (#1674) and the `CommitWitness` (#1684). If +`Receipt.program` carried the capsule's program fingerprint, one replay could +check all three: the derivation is certified, the replay equals the original +run, and the landed version contains the thought. **Next probe:** a lab test +in `thought-git-probe` that lands a certified recipe and replays it, with +three disables (wrong fingerprint, stale receipt, missing witness), each +refusing with its own error. **Kill:** the capsule fingerprint cannot be made +stable across a replay without depending on the commit itself. D-RFT-5 is on +hold until the D-RFT ID table is adopted, so this stays lab-only. + +**Correction (2026-10-23, operator):** the "commit witness" here is the CE64 +lane dimension, not the probe's `CommitWitness` struct: NodeGuids are +identical across lanes, so a vertical read of the thought's NodeGuids shows +which lanes wrote them. The probe's third disable becomes "the vertical read +shows a lane other than the thought's own and lane 0". + +**Fruit:** High-signal +**Status:** Open. + +## 2026-10-23 — OGAR #357's first kill test (TLAC-P01) is now buildable from real guards + +`[P1 @layer-boundary-warden @falsifier-auditor domain:iam D-CMR-3 D-TLAC]` + +The test: one `A & !B & C` shape, compiled from IAM, HubSPO and Rubicon +guards, must not conflate class, universe, tenant, generation or authority. +In October all three sources gained real code: OGAR `GroupRolePolicy` (#355), +`SubjectRoles` (#356), D-IAM-3 (#358), and lance-graph's DR256 IAM register +(#1666) plus the shared Kleene model (#1668, #1682, #1687). 0 hits for +`TLAC` in lance-graph crates on main `8f610a85`. **Next probe:** route the +three guards through the contract set algebra (needs D-CMR-3 for the Quack +side, or start with the two that already decide through `set_rules`) and +assert that equal normalized shapes keep distinct bindings. **Kill:** two of +the three guards cannot be expressed in one normalized shape at all. + +**Fruit:** High-signal +**Status:** Open. + +## 2026-10-23 — The MeTTa four-binding case can run against the D-MPS-9 oracle + +`[P2 @falsifier-auditor domain:mork D-MTP-1 D-MPS-9]` + +#1498 asked for a probe of the four-result nondeterministic binding; none +exists (no hit for it in `crates/`). #1690 added a general MORK `query_multi` +oracle (D-MPS-9, MEASURED). **Next probe:** one test comparing the four +bindings, by fold, against that oracle. **Kill:** the oracle returns a +deduplicated set where MeTTa returns a bag. + +**Fruit:** Low-hanging +**Status:** Open. + ## 2026-10-23 — A certified-compiler boundary for DR64: typed relational statements, egglog laws with checked proofs, a lowering check `[P2 domain:dr-math D-DRMC]` diff --git a/.claude/board/ISSUES.md b/.claude/board/ISSUES.md index 076066841..1741d9ac8 100644 --- a/.claude/board/ISSUES.md +++ b/.claude/board/ISSUES.md @@ -1,3 +1,69 @@ +## ISS-ORDER-AND-CODEBOOK-WITNESS-HAS-NO-CONTRACT-TYPE — seven open items wait on one witness nobody owns (2026-10-23) — OPEN + +ADMISSION B (`entries/2026-10-20-six-decisions.md` §1, ruled in +`ISS-ADMISSION-PREP-BINDING`) admits a frozen-codebook lookup or a +version-witnessed key-range seek in preparation, "under the attestation the +plan defines". No contract type carries that attestation. `OrderedLaneWitness` +(contract `ordered_lane.rs`) covers sealed facet lanes only. + +Items that stop at it, each read on main `8f610a85`: +- D-CMR-5: STATUS_BOARD row "BLOCKED: lawful design proposed", a + version-witnessed projection with frozen-codebook endpoints; +- D-RU-6: "slot assignment must be argued as an attested frozen-codebook + lookup under ADMISSION = B"; +- `ISS-WITNESSED-RANGE-DOES-NOT-ATTEST-PLANE-ORDER` (D-DIAMOND-1); +- #1659's failed gate (lanes sealed in key order); +- the DR256 IAM register's codebook witness (#1666, listed open); +- the D-QR plans in #1661/#1662; +- the DRMC frame seal (who issues it, G1) and the Palette256 "attest the + codebook at bind" follow-up. + +Open question: one witness type with two kinds (frozen codebook, sorted key +per sealed version), or two types. See Linear EXO-114 and BREADCRUMBS trail +T-ADMISSION (crumb BC-2026-10-23-13 asks the same question from the issuer +side). + +**Correction (2026-10-23, operator on this session's question):** "no +contract type" is the wrong frame. The witness is the lane dimension of +CE64 (W, bits 53..58): NodeGuids are identical across lanes, so one address +read down through the lanes shows which thoughts wrote to it. A codebook +sealed on main is frozen for a reader when, for every one of its NodeGuids, +only lane 0 holds a value in that reader's merge set; an untouched key range +keeps main's sealed order the same way. That is a fold over existing presence +bits, not a new type. Still open: (a) whether a projection built in +preparation (D-CMR-5) must repeat the vertical read at use time, or pin its +merge set; (b) whether #1659's ordered-lane gate is the same property. + +**Correction (2026-10-23, same day, from EXO-114):** the vertical read covers +the frozen codebook fully, but a sorted key only halfway. It shows the rows +are untouched since sealing; it cannot show they were sealed in key order. +Lance keeps no physical order (fragments in write order, `order_by` is +scan-time), so a seek or range still needs the order attest EXO-114 describes: +O(1) or an O(n) check minted once per sealed version. Sorted key = vertical +read (untouched) + per-version order attest (sorted when sealed). (b) above is +that second half. + +**Fruit:** Heavy +**Status:** OPEN (reframed, see correction). **Basis:** VERIFIED-IN-CODE +(STATUS_BOARD rows D-CMR-5, D-RU-6; `ordered_lane.rs`); witness reading per +`entries/2026-10-20-d-tga-slot-axis-witness-pointer.md`. + +## ISS-ADMISSION-B-CALL-SITE-CLASSIFICATION-NOT-STARTED — Semijoin, EqU32Via and Gather are unclassified, and no owner is named (2026-10-23) — OPEN + +#1640 ruled ADMISSION B but nothing classified the call sites it governs. +On main `8f610a85`: `Filter::Semijoin` is defined in +`crates/lance-graph-quack/src/lib.rs:387`; `EqU32Via` appears in +`crepe-plan-probe/src/{native,mork_api}.rs` and +`r2il-mask-abi-probe/tests/row_bridge.rs`; the gather hop sits behind an +opt-in feature (6791e4ac). STATUS_BOARD carries 0 rows for ADMISSION, +ACTION-GATE, FLOAT-REFS, WIRE-50 or O30. NOT IN subqueries, anti-joins and any +gather in the DR math stack wait on the classification. Who owns it is an +operator decision (raised on EXO-50 by session 01G22 /036). + +**Fruit:** Heavy +**Status:** OPEN (operator decision on ownership). **Basis:** VERIFIED-IN-CODE +(paths above); STATUS_BOARD census. + ## ISS-SIX-DECISIONS-NOT-EXECUTED-ACTION-GATE — `commit` still fails open where the decision says fail closed (2026-10-23) **Status:** OPEN. **Basis:** VERIFIED-IN-CODE (`crates/lance-graph-contract/src/action.rs:266` `pub fn commit`, `:328` `pub fn commit_via`; read at `main` `19c1324a`). @@ -2637,6 +2703,8 @@ workspace job that runs on every PR. (a) is preferable: it closes two issues with one edge instead of adding a gate around an unused artifact. ## ISS-CAUSAL-EDGE-CARRIES-SEVEN-PRE-EXISTING-CLIPPY-FINDINGS (2026-08-22) — OPEN +**Fruit:** Low-hanging + `crates/causal-edge` is workspace-EXCLUDED but a path-dep of `lance-graph`, `lance-graph-planner`, `cognitive-shader-driver` and `sigma-tier-router`, so its LIB compiles inside gated builds while its TESTS ran nowhere but on a diff --git a/.claude/board/TECH_DEBT.md b/.claude/board/TECH_DEBT.md index b39bae3c5..007227d03 100644 --- a/.claude/board/TECH_DEBT.md +++ b/.claude/board/TECH_DEBT.md @@ -1,3 +1,13 @@ +## TD-CE64-W-SLOT-DOC-SAYS-NO-ANCHOR — `edge.rs` still documents W = 0 as "no corpus anchor" (2026-10-23) — OPEN + +`crates/causal-edge/src/edge.rs:944`: "Witness corpus root handle (6-bit, +0..=63). 0 = no corpus anchor." The 2026-10-21 decision (#1597) reads W = 0 as +main and 1..63 as a thought-git slot, which is why `execute` writing W = 0 is +correct. The doc contradicts the decision. Linear EXO-65. + +**Fruit:** Low-hanging +**Status:** OPEN. **Basis:** VERIFIED-IN-CODE (`edge.rs:944` on main `8f610a85`). + ## TD-STATUS-BOARD-ROWS-MISSING-FOR-OCT-PLANS-1 (2026-10-23) — OPEN **Fruit:** Low-hanging