Authenticate elder third-order mutant reports with the legacy JSON replay

.github/workflows/elder-third-order.yml

@@ -1,11 +1,18 @@
 name: Elder third-order exact controls
 
+# The pull_request paths after tests/test_legacy_workflow_triggers.py are the bound merged sources
+# (consumed in SOURCES.json) and the pinned unmerged dependencies.
 'on':
   pull_request:
     paths:
       - 'frontiers/elder_third_order_20261001/**'
       - '.github/workflows/elder-third-order.yml'
-      # bound merged sources (consumed in SOURCES.json) and the pinned unmerged dependencies
+      - 'tools/legacy_json_replay.py'
+      - 'tools/legacy_json_contracts.json'
+      - 'tests/test_legacy_json_workflows.py'
+      - 'tools/**'
+      - 'tools.py'
+      - 'tests/test_legacy_workflow_triggers.py'
       - 'frontiers/three_fronts_20260924/LIFETIME_REMAINDER.md'
       - 'imports/lifetime_parent_20260925/UNIFORM_MATRIX_CAP_AND_LIFETIME.md'
       - 'imports/lifetime_parent_20260925/ERRATUM_CONGRUENCE.md'
@@ -35,6 +42,17 @@ jobs:
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: '3.11.16'
+      - name: Check legacy import-resolution trigger coverage
+        run: |
+          python -B -S tests/test_legacy_workflow_triggers.py
+          python -B -O -S tests/test_legacy_workflow_triggers.py
+      - name: Exercise the complete shell rejection contract in both modes
+        env:
+          LEGACY_TEST_FAMILY: 'elder-third-order'
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python -B -S tests/test_legacy_json_workflows.py
+          python -B -O -S tests/test_legacy_json_workflows.py
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -140,19 +158,8 @@ jobs:
                   now = current(entry) if kind == 'consumed_unmerged' else None
                   print(json.dumps({kind + '_bound': entry['path'], 'git_blob': entry['git_blob'], 'head': entry['head'],
                                     'via': where, 'current_ref_checked': now}))
-          script = str(root / 'e3_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in manifest['mutants']:
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+          from tools.legacy_json_replay import replay
+          replay('elder-third-order', root)
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/full-regression-suite.yml

@@ -29,7 +29,7 @@ concurrency:
 jobs:
   full-suite:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:

reviews/elder_third_order_workflow_repair_20261021/SCOPE.md

@@ -0,0 +1,144 @@
+# Elder third-order wrapper: authenticate the intended rejection
+
+Dylan Roy — delegated AI engineering. Actual author: Anthropic Claude, session
+`session_015wNj8LPTKXsaT68G3DgPPh` (C8), stage `E3-WRAPPER-REPAIR-C8-20261021`,
+pickup Math-#322/6326697003; Dylan approved this repair and its draft PR in the
+author's session. Scientific effect NONE; shared-account organizational credit 0.
+Author-side implementation only. A separate nonauthor engineering review and a
+separate integrator are required. Because this changes a workflow, a merge also
+needs Dylan's decision for this pull request. No mathematical acceptance or proof
+correction is asserted.
+
+## Finding and exact source
+
+The finding is the elder-third-order case of AUD-LEGACY-MUTANT-01 (#322). It was
+established by another session's full-shell diagnostic, Math-#322/6325841078
+(OpenAI GPT-6 Astra Pro), which this repair credits. The complete wrapper
+accepted an unrelated crash or a silent exit 1 at every M1–M8 stage in both
+modes, wrong mutant output, unexpected stderr, baseline stderr and an M9 with
+the wrong streams. The baseline kept only the child's stdout, and every mutant
+and M9 kept only its exit status. The checker itself was not reported to crash,
+and no theorem is refuted by a wrapper defect.
+
+| Object | Identity |
+|---|---|
+| Base, Math- `main` | `180d6406b0a51b268a152241a70bde6a1b39a142` |
+| Workflow before this change | blob `f5a06fcef3c20239a64b86b27370c3daa7c37a52` |
+| `e3_check.py` (unchanged) | blob `b5f04a87f2d2984280bf394bd4e5f3db560e1b33`, 31,425 B |
+| `RESULTS.json` (unchanged) | 3,533 B, SHA-256 `3390d0fc2fd74138fb34b6d5447c7d56191ffc4257fe9ba3985786d1ab661fb1` |
+
+The workflow blob is the diagnostic's `f247407330dd068880bc68f66520f95d8fee2296`
+plus only the `setup-python` pin update of `2c041de` (24 October). The checker,
+`RESULTS.json` and `SOURCES.json` are byte-identical at the reference file's
+`source_cut` (`b25cac0b`) and at the base.
+
+## Repair and preservation
+
+Six files: the workflow, `tools/legacy_json_replay.py` (one inventory row and the
+docstring's family count), `tools/legacy_json_contracts.json` (one new family and
+one provenance sentence), `tests/test_legacy_json_workflows.py`,
+`tests/test_legacy_workflow_triggers.py` (one family row) and this note. A second
+commit changes two more, `.github/workflows/full-regression-suite.yml` and
+`tests/test_full_suite_routing.py`, for the budget described under "Full-suite
+budget".
+
+The workflow now calls the existing `replay()` that far-elder, local-pairing and
+c6-cluster already use, instead of its own exit-only loop. It gains the same two
+earlier steps those workflows run: the trigger-coverage test, and the complete
+shell rejection contract for its own family, both in both Python modes. It also
+gains the same trigger paths. The comment that sat inside the path list moved
+above `'on':` with the same meaning, because the trigger test's path reader
+accepts only plain quoted rows.
+
+Unchanged:
+- the whole source-verification block that runs before any child: packet
+  membership and file identities, the tree-bound merged sources, and the
+  API-bound unmerged sources with their drift gate;
+- the action pins, read-only permissions, `persist-credentials: false`,
+  Python 3.11.16, the 10-minute job budget and the 600-second child budget;
+- the terminal NONE/false record and the final `git diff --exit-code`;
+- every packet file (`e3_check.py`, `PROOF.md`, `RESULTS.json`, `SOURCES.json`,
+  `README.md`) and the other three families' reference entries.
+
+## The contract
+
+The references are complete reports measured from the unchanged CLI, never
+outputs learned from the invocation under test.
+
+- **Baseline:** exit 0, empty stderr, and stdout byte-identical to `RESULTS.json`.
+- **M1–M8:** exit 1, empty stderr, and one strict JSON object structurally equal
+  to the measured report: the same keys, types, values and list order.
+- **M9:** exit 2, empty stdout, and stderr exactly `unknown mutant label\n`, which
+  is the checker's own message for an unknown label.
+
+The references were measured under CPython 3.11.15 in both modes, twice, with
+identical bytes each time. Each report fails exactly the check whose source branch
+the mutant changes, and every other check is byte-identical to the baseline's:
+
+| Mutant | Failing check |
+|---|---|
+| M1, M8 | `X1_exponent_ledger` |
+| M2 | `X3_margins` |
+| M3 | `X4_decision_1d` |
+| M4 | `X5_weighted_taylor` |
+| M5 | `X6_lemma_S` |
+| M6 | `X8_lemma_S_prime_algebra` |
+| M7 | `X9_lemma_H_exact_form` |
+
+That is an observation, not a rule. The protocol compares whole reports, so it
+assumes no exactly-one-failed-check rule.
+
+## Execution and non-vacuous regressions
+
+All of the following ran locally on CPython 3.11.15 at the base above.
+
+- **Real checker:** `replay('elder-third-order', …)` on the actual packet gave
+  20/20 `protocol_ok`: the baseline, M1–M8 and M9 in both modes.
+- **Trigger test:** OK in both modes.
+- **Shell rejection contract for this family** (`LEGACY_TEST_FAMILY=elder-third-order`):
+  15 tests OK in both modes, about 42 seconds each.
+- **RED control:** the same tests, with `LEGACY_SOURCE_ROOT` set to the unchanged
+  `main`, give 72 false acceptances:
+
+  | Test | False acceptances |
+  |---|---|
+  | crashes | 16 |
+  | silent exits | 16 |
+  | wrong reasons | 16 |
+  | JSON-contract faults | 18 |
+  | unknown-label diagnostics | 4 |
+  | baseline stderr | 2 |
+
+  The valid inventory, wrong exits, source guards and exact baseline bytes were
+  already enforced before this change, and those tests pass there too.
+- **Budget:** past hosted runs of this workflow took about 3 to 5.5 minutes. The
+  two new steps add about 1.5 minutes locally.
+
+## Full-suite budget
+
+The repository-wide regression suite (`full-regression-suite.yml`) runs every
+family in `tests/test_legacy_json_workflows.py`, so it now also runs this
+family's shell rejection contract. On this PR's first head, `31c43861`, the
+suite was cancelled at its 30-minute job budget (run 40357960816), still inside
+the optimized pass.
+
+- Before this change, successful hosted runs on 24 and 25 October took 17.5 to
+  27.7 minutes, as little as 2.3 minutes under the budget.
+- The added family costs about 1 min 51 s across both modes. That is the
+  dedicated hosted job's contract step, on the same head.
+
+The second commit raises the budget to 45 minutes, as `e01e346` raised it from
+20 to 30 when added tests outgrew it. It moves the exact pins in
+`tests/test_full_suite_routing.py` with it: the current budget is exactly 45, and
+0, 20, 30, 44, 46, 360 and a quoted `'45'` are all rejected. The historical
+reconstruction still restores 20 and authenticates the original digest. The
+suite's commands, triggers and steps are unchanged.
+
+## Limits
+
+- The local interpreter is 3.11.15, not the hosted 3.11.16. The hosted run is the
+  qualifying execution.
+- The synthetic fixture exercises the source-verification block with empty
+  unmerged-source lists. The API-bound dependency path runs only in the real
+  hosted job.
+- This repairs one wrapper. Other wrappers named in #322 keep their own stages.

tests/test_full_suite_routing.py

@@ -255,12 +255,12 @@ def reconstruct_original_central(text):
     """Historical central workflow at 49fb197c / blob ea291276, authenticated.
 
     Remove only the approved concurrency insertion, restore the historical
-    20-minute budget from the current 30-minute budget, restore the historical
+    20-minute budget from the current 45-minute budget, restore the historical
     setup-python pin, then revert only the suite body. The result must hash to
     the unchanged historical digest.
     """
     text = strip_concurrency_insertion(text)
-    text = mutate(text, '\n    timeout-minutes: 30\n', '\n    timeout-minutes: 20\n')
+    text = mutate(text, '\n    timeout-minutes: 45\n', '\n    timeout-minutes: 20\n')
     text = mutate(text, CURRENT_SETUP_PYTHON, HISTORICAL_SETUP_PYTHON)
     block = named(parse(text)[1], REGRESSION)['run']
     rendered = lambda body: ''.join('          ' + line + '\n'
@@ -623,7 +623,7 @@ def violations(workflow, text):
     if bind != central_bind:
         problems.append('tested-commit binding step differs from the central workflow')
     if workflow == CENTRAL:
-        if job['id'] != 'full-suite' or job.get('timeout-minutes') != '30':
+        if job['id'] != 'full-suite' or job.get('timeout-minutes') != '45':
             problems.append('central job id/budget changed')
         if names != [BIND, REGRESSION, CONFIRM]:
             problems.append('central step order changed: ' + repr(names))
@@ -786,7 +786,7 @@ def test_historical_bytes_outside_insertion_are_authenticated(self):
         central = source(CENTRAL)
         self.assertEqual(reconstruct_original_central(central), self.original_central())
         for old, new in (('# This check is not required', '# This check is now required'),
-                         ('    timeout-minutes: 30\n', '    timeout-minutes: 31\n'),
+                         ('    timeout-minutes: 45\n', '    timeout-minutes: 46\n'),
                          ('permissions:\n  contents: read\n\nconcurrency:',
                           'permissions:\n  contents: read\n\n\nconcurrency:'),
                          (CONCURRENCY_INSERTION + 'jobs:\n', CONCURRENCY_INSERTION + '\njobs:\n'),
@@ -798,20 +798,20 @@ def test_historical_bytes_outside_insertion_are_authenticated(self):
 
     def test_current_and_historical_budgets_have_separate_exact_contracts(self):
         central = source(CENTRAL)
-        self.assertEqual(parse(central)[1]['timeout-minutes'], '30')
+        self.assertEqual(parse(central)[1]['timeout-minutes'], '45')
         original = self.original_central()
         self.assertEqual(parse(original)[1]['timeout-minutes'], '20')
-        for budget in ('0', '20', '29', '31', '360', "'30'"):
+        for budget in ('0', '20', '30', '44', '46', '360', "'45'"):
             with self.subTest(budget=budget):
-                changed = mutate(central, '    timeout-minutes: 30\n',
+                changed = mutate(central, '    timeout-minutes: 45\n',
                                  '    timeout-minutes: ' + budget + '\n')
                 self.assertIn('central job id/budget changed', violations(CENTRAL, changed))
                 with self.assertRaises((ValueError, AssertionError)):
                     reconstruct_original_central(changed)
-        relocated = mutate(central, '\n    timeout-minutes: 30\n',
+        relocated = mutate(central, '\n    timeout-minutes: 45\n',
                            '\n    timeout-minutes: 20\n')
         relocated = mutate(relocated, '          log_dir="$(mktemp -d)"\n',
-                           '          #    timeout-minutes: 30\n'
+                           '          #    timeout-minutes: 45\n'
                            '          log_dir="$(mktemp -d)"\n')
         self.assertEqual(parse(relocated)[1]['timeout-minutes'], '20')
         self.assertIn('central job id/budget changed', violations(CENTRAL, relocated))
@@ -1220,7 +1220,7 @@ def test_meaningful_negatives_are_detected(self):
             'central gains a condition': (CENTRAL, central, '      - name: Full repository regression suite in both Python modes\n',
                                           '      - name: Full repository regression suite in both Python modes\n'
                                           "        if: github.event_name == 'workflow_dispatch'\n"),
-            'central continue-on-error': (CENTRAL, central, '    timeout-minutes: 30\n', '    timeout-minutes: 30\n    continue-on-error: true\n'),
+            'central continue-on-error': (CENTRAL, central, '    timeout-minutes: 45\n', '    timeout-minutes: 45\n    continue-on-error: true\n'),
             'central unbinds commit': (CENTRAL, central, '          if [ "$checked_out" != "$TESTED_SHA" ]; then\n',
                                        '          if false; then\n'),
         }