Self-hosting phase 3: the executable-specs rewrite — 27 bound points, 51 Specs ready, and the first concept-doc dissolutions

[darko-mijic]

What this is

Phase 2 ended with a named backlog: the tests-to-executable-specs rewrite ("the big one"), readiness maturation of a corpus sitting honestly at 51 defined, and the first per-doc concept deletions under the dissolution decision. This phase is that backlog executed. The Protocol's own laws now verify themselves the way the product says laws should be verified: authored example Specs binding points in their parents' example spaces, generated contracts, and test handlers earning has-verifier in the graph — not a green runner merely claiming it. On that verification layer, readiness matured from 7 ready / 51 defined to 51 ready / 36 defined with zero decorative promotions, and the first two concept docs — 02 — Core Model and 03 — The One Graph — were deleted, their semantic contracts fully carried by the Specs that dissolved them.

The phase ran as six sequential sessions (S1–S6) on plan 20 (plans/20-self-hosting-phase-3.md, now ✅ EXECUTED), each closing on a fully green twelve-leg npm run check. It was closed by an archived adversarial review (reviews/09) whose central method was mutation testing rather than code reading, and — because this branch ran autonomously — a second, independent four-dimension review before this PR, whose accepted findings are already fixed on the branch.

What landed

Fifteen laws became bound executable points — 27 new example Specs. Three conversion tranches (the whole validation family in S1; the extraction, model, and carrier cheap wins in S2; three previously uncovered engine areas in S3) plus two more laws the readiness sweep converted on law-shape in S4. Each point is an immediate gwt example bound through a generated step contract to a specTest anchor, so spec-side drift is a compile error and the verifies edge carries the anchored claim. The corpus now holds 29 bound points (these 27 plus the two phase-2 tracers) across five bound suites. Worlds are built to the phase's own discipline — construct the state so the law under test is the only thing that can refuse — and they run real seams: validateGraph, parseSlots, discoverFiles, generateContracts, planExample/runExamplePlan, and full temp-dir extractions with symlinked builder modules.

Two new Specs and three enrichments carried laws nothing held. spec:extraction.example-runner (the runner core: authored step order, one handler per repeated step, the red step that names itself in the Spec's own words) and spec:carrier.slot-notation (the four slot forms and the refused guess) are new, each bound by its own impl: anchor. spec:extraction.executable-contracts, spec:carrier.envelope-contract, and spec:carrier.prose-ownership-rule were enriched from stubs into acceptance-grade Specs before any promotion touched them. The corpus grew 58 → 87 Specs.

Readiness matured only where a verifier honestly landed. The distribution moved in four steps, each riding its own wave's verifiers (24/45 → 34/41 → 44/40 → 51/36), and every one of the 51 ready Specs carries has-verifier in the graph. Just as deliberate: the S4 sweep dispositioned all 40 then-defined Specs per-Spec and recorded 36 honest refusals with named reasons — the epic, all 21 decision Specs, and every Spec whose only available verifier would have been decorative (whole-pipeline worlds, measured-evidence claims, the clean-room rebuild that is the close's own proof). implemented ∧ ¬ready stays a drift alarm precisely because nobody inflated ready.

Two concept docs deleted, three kept — on per-doc audits, not a purge. Five audits to the plan's template, judged over the regenerated Design Review under the dissolution decision's criterion (one uncarried law blocks deletion). 02-core-model.md and 03-the-one-graph.md were fully carried and deleted, with the D1/D2 registry rows re-pointed at their carrying Specs and a two-form reference sweep (backticked and bare citation spellings) re-run to zero hits. 05, 06, and 07 stay, with twelve precise gaps recorded as future corpus work instead of papered over — notably 07, whose "superseded" docket row turned out on honest reading to be a doc-repair note, not a deletion warrant. The per-doc audit beat the bulk prediction in both directions: the doc predicted easiest to delete survived, and 03 — predicted blocked — turned out fully carried.

The adversarial close mutation-tested the phase's central claim. reviews/09 broke a sandbox copy of the engine one law at a time — 37 mutations — and re-ran the new points after each: 26 of 27 went red for the law they name, and the 27th (the concreteness point, P-1) was restructured so the law under test is the only gate that can fire, then re-probed both ways. Four majors, no blockers, all fifteen findings dispositioned in the archived table. Two majors closed the honest way — by making the graded verdicts true: the ready-rung floor clauses and the reserved-namespace set (with the doc: deferral stated as a deferral) now live in the Specs that were credited with carrying them.

The clean-clone proof caught a real gate hole. The close includes a git clone --no-local → npm ci → full npm run check run at the close SHA. Its first run failed at the lint leg and exposed something no developed checkout could: the clean-room contract lint exemption had never been extended past the two bound suites that existed when it was written. Fixed, re-committed, re-cloned green — the clone reproduced the same graph numbers, test counts, and a clean preflight, which is the determinism claim proved rather than asserted.

Nothing weakened along the way. No test file was deleted, no residual suite lost a case, no exact matcher was loosened; the golden oracle grew by transcription only (one non-discriminating bound Then step was removed at S6, on the record). All five syntax watch items closed unfired with reasons — no table sugar, no single-literal vocabulary form, no multi-entry constraint form was ever forced by real material. All eight docket rows carried forward, each with a stated reason instead of rolling silently; two gained substance (the temporal-guard row now names the decision it waits on, and the oracle-granularity row carries the 3,888-line measurement that will justify the session that splits it).

The pre-PR review, closed on the branch

Because the phase ran autonomously, a second independent review preceded this PR — four parallel passes over the full branch: a records-honesty audit that recomputed every headline number from scratch, a repo-wide dangling-reference sweep after the deletions, a spec-quality pass comparing all 27 children word-for-word against their parents' vocabularies and the implementation, and an engine/test diff review.

Verdict: no blockers, no majors. Every claimed figure survived independent recomputation — including the intermediate readiness distribution at each session's commit. The sweep found zero dangling references from the deletions; the only broken links in the repo are two pre-existing clusters already on main (archived plan-18a evidence links and fixture-relative Design Review links). The accepted minors are fixed in the branch's final commit: the split-report example's Intent now names the readiness-floor error its own probe co-trips; the stable-ids law states that path segments admit mixed case (the clause the case-colliding example already depended on); the schema-version literal's second authored home is pinned in the prose-schema audit so a bump names both surfaces; the never-bound builder-trust branch names its regression home; the checkout-v1 README rows for the dissolved docs are re-pointed at the carrying Specs instead of dropped; and a spelling drift is repaired. One naming nit (lookalike-refusal describing silent non-minting) is declined — renaming a landed stable ID for a naming nit works against the stable-ids law itself. One minor (the red-step example's failureLabel binding a when-step text its Givens don't pin) is deferred with its reason recorded: the fix is a vocabulary change that thrashes the golden oracle, which the successor guidance explicitly orders behind the oracle-split session; the point's mutation-sensitivity is already proven.

Verification

• npm run check green on the full twelve-leg chain — in the working checkout throughout all six sessions, and again on a fresh git clone --no-local clone (npm ci, the whole chain) at the close SHA, reproducing identical numbers.
• The self-hosting graph at close: 87 Specs · 1 Pack · 65 anchors → 153 nodes · 294 edges, 0 errors · 0 warnings. Kind mix: 29 example · 21 decision · 14 rule · 12 behavior · 8 model · 1 contract · 1 workflow · 1 constraint.
• Readiness: 51 ready / 36 defined (zero idea/scoped), every ready Spec backed by a resolving verifier in the graph, zero honesty/gaps warnings.
• The suite: 559 tests across 41 files (505 in the parallel pool, 54 in the dedicated CLI process), zero skipped on this platform. The pre-PR audit verified "no assertion deleted" at the diff level: the only removed expect lines are count-literal updates in the golden oracle (58→87, 95→153, 180→294), and modified residual tests changed comments only or got stricter.
• The adversarial review is archived at reviews/09-self-hosting-phase-3-pre-close-review.md with all 15 findings dispositioned; the mutation matrix covered 37 engine mutations against the 27 new points.
• A post-close records amendment (external review feedback) is folded into plan 20 — the example-Spec count precisely stated, ruling 7 narrowed to the guard's enforced law, the tests claim made exact, and the glossary widened on the record where the landed corpus outran it.

A note on ratification, per the plan's own honesty rule: this phase ran autonomously — no live owner gate occurred during execution. The plan's gate ledger records that owner ratification happens at this PR review. Two items deserve a conscious yes: the S5/S6 deletions of 02 and 03 (the audits and reference sweeps are in the plan's §7), and the two lean glossary entries added at the pre-PR review — world and probe — which name vocabulary the 27 bound points and the plan's own rulings already lean on but which had no ratified standing.

What remains for full self-hosting

The thesis has now been applied to the cheap half of itself; what remains is ordered and recorded in plan 20's successor guidance:

1. Split the golden oracle first. test/self-hosting-graph.test.ts stands at 3,888 lines in a single it() with frozen absolute counts — the first failure masks the rest. The recorded ruling: a single-purpose split session (by family or histogram bucket, never one mega-assert) before any new conversion wave thrashes it again. The deferred red-step vocabulary refinement from the pre-PR review rides behind this.
2. The next corpus wave, in gap order. Twelve recorded gaps from the S5 audits, ordered for maximum dissolution pressure: (a) the lower readiness-floor rungs and the per-kind evidence table — the biggest single gap holding 05 in place; (b) the derived-readiness banner law, one gap shared by 05/06/07; (c) the already-implemented-but-uncarried view rules (the implemented view label, the one diagnostic rendering rule, Design Review's wholesale page rewrite). Each Spec authored there is a step toward the remaining three concept docs dissolving on their own audits.
3. The conversion playbook inherits the P-1 lesson. Build worlds where only the named law can refuse; mutation-probe before recording "exercises clause X"; never use absence-of-a-finding-id as the sole discriminator. And one structural hardening: derive the clean-room lint exemption list and vitest-test.mjs's dependency table from one shared constant, or the seventh bound suite will repeat the clean-clone lint surprise.
4. The readiness tail is honest, not lazy. The 36 defined Specs refused promotion for named reasons — mostly whole-pipeline worlds (the CLI pipeline, the reader over a full graph fixture, projection rendering) and the 21 decisions. They mature as the verification layer grows the machinery to make their verifiers non-decorative, not by fiat.
5. The deferred docket tail, each row with its reason on file: the Markdown Pack syntax ruling (the pack manifest absorbed 29 new members as TS with no friction — no caller has forced it); the gen-1 .feature import adapter; the no-reparse read seam; the temporal-guard token assembly; the editor-association gap; control-character latitude; and the separate example-id namespace (29 example Specs authored under the existing convention with zero collisions — a watch, not a want).

https://claude.ai/code/session_01F2XoLBFBJoCBdb4zvoP5X1

Greptile Summary

The PR rewrites self-hosting verification around generated executable-spec contracts.

• Adds 27 bound example Specs and five self-hosting test suites covering validation, extraction, model, carrier, and runner laws.
• Promotes verified Specs to ready, expands the self-hosting pack, and updates generated-contract scheduling and lint configuration.
• Deletes the dissolved core-model and one-graph concept documents and redirects operative references to their carrying Specs.

Confidence Score: 5/5

The PR appears safe to merge; no concrete changed-code defect or security-boundary failure was identified.

The changes cover generated-contract imports, executable-spec scheduling, lint configuration, and concept-document reference redirects.

Files Needing Attention: Generated-contract imports are covered by the updated scheduling and lint configuration, deleted concept-document references are cleanly redirected, and the scanner-reported dynamic test lookup is limited to maintainer-authored closed-union values.

T-Rex Logs

What T-Rex did

• Reviewed the general contract validation, confirming the full captured command output and associated preflight results, including the run directory, exit status, regeneration output, test summaries, graph validation summaries, and a clean semantic diff.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
specs/self-hosting.pack.sdp.ts	Adds the new executable example Specs to the self-hosting aggregate.
test/self-hosting-carrier.test.ts	Adds bound carrier-parity and slot-notation executable examples.
test/self-hosting-extraction.test.ts	Adds bound extraction, contract-generation, schema-version, and runner examples.
test/self-hosting-model.test.ts	Adds bound stable-ID and anchor-trust examples; its dynamic setup selection is constrained to authored closed-union contract values.
test/self-hosting-validators.test.ts	Adds probe-graph executable examples for the validation laws.
vitest-test.mjs	Registers every newly generated-contract-dependent suite in the test preflight and scheduling table.
eslint.config.js	Extends clean-checkout lint handling to all suites whose generated contracts do not yet exist at lint time.
check-carrier-rule.mjs	Repoints the carrier consistency gate from the deleted concept document to the carrying envelope Spec.
check-prose-schema.mjs	Repoints prose and schema consistency checks to the Specs that now carry the dissolved documents' contracts.
docs/concept/02-core-model.md	Deletes the concept document after its operative contracts and references move to authored Specs.
docs/concept/03-the-one-graph.md	Deletes the concept document after graph contracts and operative references move to authored Specs.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Authored parent and example Specs] --> B[Extract one graph]
B --> C[Generate typed step contracts]
C --> D[Bound self-hosting test suites]
D --> E[Run handlers against probe worlds]
E --> F[Verifier anchors in graph]
F --> G[Ready Specs with has-verifier]
B --> H[Validation and projections]

Loading

_{Reviews (1): Last reviewed commit: "docs(specs,tests): land the pre-PR revie..." | Re-trigger Greptile}