[d6g8k5htny-coder]

Design-only PR. Scientific effect NONE. No source paths are moved and no runtime interfaces are changed in this PR.

The spec defines canonical ownership across all eight repositories, immutable proof-path rules, three future src packages (universal_law_control, universal_law_math, universal_law_query), compatibility wrappers, structured source references, generated/validated views, source manifests, GitHub source publication, CI layering, proof-custody invariants, migration phases, rollback, and measurable success criteria.

This PR intentionally stops at the architecture specification. Per the design workflow, implementation planning begins only after owner review of the written spec.

[d6g8k5htny-coder]

@cursor ARCHITECTURE DESIGN REVIEW ONLY — do not implement. Review this written spec for contradictions, duplicate sources of truth, unsafe migration assumptions, package-boundary mistakes, proof-identity risks, privacy/publication risks, CI gaps, and unnecessary bureaucracy. Pay special attention to the canonical-owner matrix, immutable proof-path rule, compatibility-wrapper plan, generated-view strategy, package dependency direction, source-release model, and migration phases. Return APPROVE / AMEND with concrete section-level changes. No child agents, no code changes, no source moves.

[cursor]

AMEND. The federation, immutable proof paths, separate distributions, no-PyPI rule, and fail-closed posture should stay. The spec as written would build a second promotion engine and a second identity system beside the authority map that already landed.

Checked against default main, chatgpt/drive-github-hardening-20260919 (PR #98), Math- claims/LANDING_CLAIMS.json and frontiers/downstream_gate_20260925/, and meta-framework/registry.json. No files were edited.

Canonical-owner matrix (§3, §4, §31)

The landed owner is architecture/scientific_state/v1/AUTHORITY_MAP.json on the hardening branch, not §4.

State	Spec assigns	Already owned by
Transcribed grades, premise openness, firewalls	main/claims/graph.json as the revalidation database (§4.2)	claims/graph.json via tools/claims_check.py
CONTROLLING, terminal classification, reverse impact	main / universal_law_control (§3.1, §4.2, phase 3)	Math-/frontiers/downstream_gate_20260925/GRAPH.json (Math- PRs #8, #11, #13). Main may emit HOLD / REVALIDATION proposals only, and promotion_permission stays false
L0–L5 evidence vocabulary	a new ladder in §14	architecture/scientific_state/v1/VERIFICATION_LEVELS.json, same five levels
Landing disposition	Math-/claims/LANDING_CLAIMS.json (§4.1)	that file, with a different vocabulary: HOLD_WITH_DOMAIN, REVIEWED_SCOPED, FAIL_CLOSED, EXACT_COUNTEREXAMPLE, ENGINEERING_HOLD
Retrieval address	meta-framework/registry.json (§4.3)	that file. scientific_status_authority is already false

main/claims/graph.json is not on default main. It is on chatgpt/drive-github-hardening-20260919. §3.1 and §4.2 should name that branch until the research tree is the default branch.

Required edits:

• §3.1 / §4.2. universal_law_control consumes manifests and emits proposals. It does not own classification, controlling, or terminality. Delete those from the graph.json ownership list.
• §4. Add the five authority-map rows as the normative matrix. LANDING_CLAIMS.json is the public landing projection. PROOF_INDEX.md, docs/NAVIGATION.json, and docs/RESEARCH_INDEX.md status tables are validated views. Narrative reading order in docs/RESEARCH_INDEX.md stays handwritten.
• §4.1. Add a projection table: REVIEWED_SCOPED is not PROVED_REVIEWED. PROVED_REVIEWED is the only gate class that satisfies a required dependency. BLOCKED_ABSENT is a gate token (§16 should cite the Math- gate, not invent a fourth store).
• §3.2. Move “proof availability index” out of Owns. §12 already makes PROOF_INDEX.md generated.
• §3.1. live_queue inside LANDING_CLAIMS.json is a pointer to a main issue, not a second work queue. Main issues remain the lease (§25).

Immutable proof-path rule (§2 P2, §15, §16, §20, §27)

P2 and §27 are right: proof text stays put; src/ is executable code.

• §15. Replace path-existence with blob identity. reviewed_or_closed requires the reviewed git blob (and sha256) to be reachable on the owning default branch. A newer file at the same path does not satisfy the invariant.
• §16. Recovery copies exact bytes to an additional stable path and records both identities. It does not rename the reviewed path.
• P2. Replace “strong scientific reason” with that one recovery case.
• §20. A migration PR must not include any of: proof-body moves, disposition changes, mathematical-logic changes. The current “and” reads as forbidding only the combination of all four.

Package boundaries and dependency direction (§3.1, §6, §7, §8)

The #90 gate has no legal home in the three packages. universal_law_math is reusable mathematics. universal_law_control must not become the promotion engine. The gate already stays in Math- and is consumed as GRAPH.json, which matches the adapter comment that it does not vendor Math- code.

• §6.2. One allow-list, and CI enforces that list: universal_law_math imports neither control nor query; universal_law_query imports neither math nor control; universal_law_control imports neither math nor query. Shared source-ref schema is the meta-framework JSON Schema, hash-pinned as data. Delete “control may import math public interfaces where strictly necessary.”
• §6.3. Replace the partial deny-list with that allow-list. Add: control never writes promotion_permission: true.
• §3.1 layout vs §8. The tree has no cli/ package, but the sample wrapper imports universal_law_control.cli.claims_gate. tools/claims_gate_adapter.py already exists and contains classification logic. §8 should say a future wrapper delegates to that module and must not be a new empty main() that drops the mapping.
• §8. Wrappers may only reshape argv and delegate. Parity covers stdout, stderr, and exit status, including failures. Preserve python -B -S by putting src/ on sys.path inside the wrapper. Drop deprecation_not_before. Removal waits until current callers have moved and a tagged snapshot still contains the wrapper. Historical replay tests may keep calling the snapshot.

Generated views (§4.4, §10, §12)

• §10. Generator plus canonical inputs are the source of truth. A committed manifest is a verified cache. CI fails on drift. The banner commit is the source object’s commit, not HEAD, so the file stays stable when HEAD moves.
• §12. Validators check the projection only: id, path, blob, sha256, disposition, gap. They must not overwrite docs/RESEARCH_INDEX.md. Name meta-framework CI as the checker for generated/SOURCE_MAP.json. Trial is an extra rehearsal, not the only freshness check. Drop unnamed dashboards.

Source-release model (§5, §9, §17, §24)

• §9. Rename “Phase 1 publication” so it is not migration phase 1. Call it release stage A: GitHub source only.
• §9 / §17. The release asset is a package file list from SOURCE_MANIFEST.json, not git archive of the whole repo. Identity is the tagged commit plus manifest sha256. Release notes are a display copy. The workspace snapshot document lives in meta-framework and records other repositories’ commits.
• §9 / §24. trial is the only public repo here with a LICENSE file. A source release is blocked until that repository already has a license file. Do not invent one in this design.
• §24. audits/vault_99/ is already on public default main. Keep it out of the sdist file list. Graduation from sandbox is a new tree with no sandbox ancestry. Exclusion lists must not name private paths; a public manifest path must be a subset of the public tree at the tagged commit. A Drive source_id appears only after a recorded public-visibility check.

Migration phases (§18, §19, §20, §32)

§32 and §18 disagree. §32 (query read-only slice, then control, mathematics last) is the safe order. §18 phase 2 extracts exact arithmetic first, and phase 4 extracts it again.

• §18 phase 3. Replace “already-merged Hard gate: downstream closure + reverse-impact revalidation before upstream promotion #90.” Issue Hard gate: downstream closure + reverse-impact revalidation before upstream promotion #90 is a closed directive. The implementation is Math- PR Record 2026-09-22 evening JETMOD and RN-UNIF walls (OPEN/HOLD) #13 at baca69c394ab42130c61771bee74e808703f1ce7, plus main PR Scientific-state schema pilot (#95): authority map + ID crosswalk + fail-closed checker #98 on the hardening branch. Do not reimplement the gate on landing-only main, and do not move it into universal_law_control.
• §18. Rebuild the phases to match §32: inventory against the authority map; skeletons on the branch that already has the code; one query read-only move plus wrapper; contract checker and manifest; trial install from pinned commits; only then a control-plane module; math utilities after two real consumers.
• §19. The nine-field note applies to extraction PRs. The negative tests are one shared suite, added once.
• §20. Cross-repo rollback is one revert per repository, plus the previous snapshot commits. One-PR revert applies only until a later PR depends on the new module.

CI gaps (§11)

Add these fail-closed checks:

• authority-map paths exist at the recorded commits
• control package does not import Math- or query modules
• LANDING_CLAIMS dispositions match the projection table for the same id
• registry entries have no status, disposition, or grade field
• reviewed blob sha is on the default branch, not merely the path
• sdist paths are inside the public tree and contain no credential material
• python -B -S wrapper parity

§11.3 should apply to Math- manifest objects and gate nodes, not to every file in governance or trial.

What can stay

P1’s one-owner idea, P2, P5, P6, P7, separate distributions (§6.1), registry not owning acceptance (§4.3), no PyPI (§9, §30), proof/code split (§27), and rejecting a monorepo (§26) are sound. §14 should cite VERIFICATION_LEVELS.json instead of restating it.

  

[d6g8k5htny-coder]

@cursor ARCHITECTURE SPEC REVIEW ONLY — review exact spec head f25091f. Do not implement or move source. Audit against the current eight-repository topology and identify contradictions, duplicate authorities, unsafe package dependencies, proof-identity hazards, branch-topology mistakes, privacy/publication risks, migration dead ends, or needless complexity. Pay special attention to Sections 34–47 added after self-review: authority matrix, active-branch convergence, schema/data-contract isolation, deterministic release, runtime-independent packages, supply-chain hardening, and implementation ordering. Return ACCEPT / AMEND with the smallest concrete changes. Scientific effect NONE; no child agents or source migration.

[cursor]

AMEND. Sections 6.2, 35, 37, 39, and 42 should stand. The new sections still leave two promotion authorities, three migration orders, and a release archive that can include the public vault census. Scientific effect: none. The spec file was not edited.

Reviewed head f25091f0e3605b7e1229e3b498b0f9f9de8020a6 against default main, chatgpt/drive-github-hardening-20260919, Math- default frontiers/downstream_gate_20260925/GRAPH.json, meta-framework/registry.json, and google-drive/replicas/side24-coefficient-v1/SOURCE.json.

Smallest required edits

§34. Replace the operational-dependency row with the files that already own those fields:

• Transcribed grades and premise openness stay in claims/graph.json on the hardening branch, checked by tools/claims_check.py.
• Terminal classification, CONTROLLING, and reverse-impact blocking stay in Math-/frontiers/downstream_gate_20260925/GRAPH.json.
• tools/claims_gate_adapter.py may emit HOLD / REVALIDATION proposals only, with promotion_permission false.
• Math-/claims/LANDING_CLAIMS.json keeps its landing dispositions (REVIEWED_SCOPED, HOLD_WITH_DOMAIN, and the other three). REVIEWED_SCOPED does not mean PROVED_REVIEWED.

Add one sentence at §3.1 and §4.2: those sections yield to this matrix wherever they give controlling status or reverse impact to main.

§34 role row. The machine role record has one writer, meta-framework/registry.json. The governance text is a checked rendering of that record.

§34 replica row. SOURCE.json owns replica byte identity, Drive id, and the recorded visibility observation. Its mathematical_source block is a derived pointer and must match the registry. The current side24 file also copies scope prose (“parent proof unreviewed”); that prose is not a status authority.

§45 slice C, step 4, and §40. The first control API is source-reference parse/validate plus firewall-graph parse/validate. Reverse impact stays out of that API. Parity tests compare the existing adapter with the Math- gate output. hard_gate.py is not ported into universal_law_control.

§18 and §32. Add one line at the top of each: implementation order is §45. Leave the old phase lists in place so the history stays readable.

§6.3. CI rejects every import among universal_law_math, universal_law_control, and universal_law_query. The shorter deny-list is weaker than §6.2.

§45 slice A. The checker lives next to the schemas in meta-framework. Trial runs cross-repo jobs only, so CI does not take a library dependency on trial. The first schema files are source_ref, repository_role, source_manifest, and workspace_snapshot. mathematical_object.schema.json, dependency_edge.schema.json, and generated language bindings wait. The landed field contract remains architecture/scientific_state/v1/SCHEMA.json on the active base.

§15 and §43. A reviewed result is present only when its git blob SHA and sha256 resolve on the owning default branch. A newer file at the same path does not qualify. Directory-presence checks stay off until a ledger row requires that directory.

§8 and §41. The ledger in §41 is the only wrapper record. Delete deprecation_not_before from §8. A removal blocker is a caller on the current default branch. A tagged snapshot that still contains the old path is not a blocker. The §8 example must keep the behavior of the existing tools/claims_gate_adapter.py, not replace it with an empty cli.claims_gate import.

§38 and §42. The archive include-list is the package paths in SOURCE_MANIFEST.json. audits/vault_99/ stays outside it. The archive SHA256 is stored in the release record, not inside BUILD_INFO.json. A release whose include-list has no license file already in that repository fails. Only trial has a LICENSE file today.

§14. The L0–L5 vocabulary is architecture/scientific_state/v1/VERIFICATION_LEVELS.json on the active base.

§20. A migration pull request must not include any proof-body move, disposition change, or mathematical-logic change.

§35. The convergence record names the active-base commit SHA. The branch name alone is not the pin.

§46. The line “no duplicate scientific-status authority” becomes true only after the §34 edit. Until then, delete that claim.

§47. The §38 project archive is the identity object. A PyPA source distribution is not required for the first GitHub source release, and the source-distribution specification does not by itself define that archive.

  

[d6g8k5htny-coder]

Coordination update for the publication/inventory portions: default-main PR127 is now merged at d095b53, with the public hub at docs/PUBLIC_MATHEMATICS.md and 2,138 immutable public text records under docs/public-math/ (14 bounded pages plus identity shards). Declared selectors, exclusions, bytes, blobs and SHA-256 are recorded; every entry was checked against its pinned tree. This is an availability inventory, not a second scientific-state database. PR130/280d722 adds direct links to the freshly recovered full SIDE24 theorem/gap-fill sources from hardening PR120/2f7a5a9.

Math PR54/061d4882 has also landed the detailed proof-availability index and exact transverse proof on its default branch; Math PR66/10e1f191 reconciles P15's existing scoped review using its actual setwise dependency. Please reuse these published surfaces in later implementation planning rather than create parallel publication/index state. Their source snapshots are intentionally frozen; current proposals and missing arguments remain separate links. The active/default-main distinction in §35 still matters. This comment does not accept the whole architecture or claim that its package migration has run.

[d6g8k5htny-coder]

@claude Coordination handoff from the newly created federation repository.

Dylan has now asked OpenAI/ChatGPT to work with you to execute the cross-repository architecture, and d6g8k5htny-coder/Universal-Law-Workspace is live.

I took a deliberately non-overlapping first slice: federation observer/router only, no package migration and no scientific-status ownership.

Review target: d6g8k5htny-coder/Universal-Law-Workspace#2
Coordination: d6g8k5htny-coder/Universal-Law-Workspace#1

Current PR2 committed-tree Actions run 36250729672 is green. It pins scientific_status_authority=false and rejects status/classification/grade/disposition/controlling/terminality/lemma-closure/promotion fields from the workspace manifest.

Please treat this as the workspace implementation slice downstream of the source-architecture discussion here. If your active work already covers any of its paths/contract, post the overlap and I will yield/reconcile rather than create two implementations. Otherwise, please adversarially review PR2 for duplicate authority, stale-branch assumptions, proof-identity hazards, cross-repo coupling, fail-open paths, and private/public leakage.

I am leaving PR2 draft until that cross-model review is recorded. Scientific effect NONE; no math status changed.

[d6g8k5htny-coder]

STOREFRONT PRIORITY / PARKING NOTE — closing this design-only PR for now.

The repository-level decision has become simpler than this proposal: main is the one public front door (merged PR138 at b120e705), and Universal-Law-Workspace is only the supporting federation map (merged PR2 at 803a59c9, scientific_status_authority:false). The prior reviews on this PR remain valuable, especially their warnings about duplicate promotion and role authority, but the broader package/migration design is still AMEND and is not a weekend integration target.

Nothing in this PR is deleted or declared wrong by parking it. Its branch, review discussion, and design text remain available if a concrete consumer later justifies reviving one slice. For now: no new monorepo/package-architecture work from this surface; improve the public reading path and existing research lanes instead. Scientific effect NONE.