Conversation
fda7320 to
84246b4
Compare
|
History cleanup completed and force-pushed at
|
|
Updated this PR through
|
4dc4088 to
b690f7e
Compare
Prepare deterministic seven-experiment synthetic input and independently recompute all fourteen component summaries and invalid-run bounds in R. Freeze source-provenance and write-once receipt logic before producing any qualification receipt; no original pilot is admitted.
Retain the exact-source independent-R synthetic receipt and verify it in the routine statistics gate. Reject forged receipt provenance and keep original pilot admission explicitly separate.
Add a bounded Unix-socket signer protocol and six-domain registry adapter for the Mode R separation work. Child-process tests cover identity, signatures, malformed frames, private sockets, and signer failure; selected-topology qualification remains open.
Exercise the production SQLite writer through six process-separated signers and show that a signer crash rejects the next turn without a partial ledger or channel commit. This remains a disposable component test, not selected Mode R qualification.
Run each ephemeral signing domain in its own mounted-socket container for the bounded Mode R reference, verify live container/network/mount identities, and preserve the open selected-topology gate. Correct PID-namespace assumptions before admitting the transport.
Refuse dirty qualification sources, capture the four-track signer-container result once before cleanup, and retain minimal failure accounting. Historical runs without this terminal remain unchanged and unpromoted.
Bind the four original Mode R reference bundles to their terminal receipt and source revision with independent TypeScript and Rust verification. Preserve the bounded claim and current manuscript status.
Record the clean four-track execution and independent bundle audit without promoting the bounded reference to selected Mode R or a behavioral result. Add a clean-checkout receipt check and update the runbook.
Specify the selected process, network, key, and call boundaries and test the fail-closed distinction from the current adapter-host reference. Keep B12 and behavioral readiness open.
Limit the Gateway and affect protocol to the six asynchronous Evidence Writer operations they actually use, and exercise accepted/rejected turns through a port with no registration, read, checkpoint, or anchor capability. This prepares but does not claim process isolation.
Refuse later Gateway and Controller work when a writer reply may have been lost, and reject recovered channel or affect events without completed turn records. Keep the remote-writer journal and selected Mode R topology explicitly open.
Persist hash-only intent before evidence writes and confirmed response after them. Refuse unresolved sends after restart and retain B12 runtime integration as an open gate.
Route the in-process Gateway through the durable journal and refuse restart after an unconfirmed send, even without a signed event. Keep selected remote topology and resource qualification open.
Extend the independent reference audit with a fixed mode for the v0.1.216 journal replay, including paired write intents and measured storage. Keep the historical audit mode and receipt unchanged.
Bind the clean v0.1.216 four-track replay to its original terminal, TS/Rust verification, signer identities, and measured paired write intents. Add a portable checker to the normal repository gate without changing historical evidence.
Give the Gateway the raw sender envelope in the shuffled pre-pass and let it commit invalid submissions. The Controller no longer invokes the carrier module for eligibility. This preserves existing batch behavior while narrowing the control boundary; process separation and Gateway-owned batch state remain future work.
The Controller names scenario turns but the Gateway retains eligible sender envelopes, seals the artifact set, and applies its permutation. Prepared submissions bind the original turn roles, and direct shuffled proposals can no longer replace a batch entry. This is an in-process authority improvement, not selected-topology qualification.
Bind the runtime to the Gateway interface and make batch control, recovery discard, and rejection reset asynchronous. A held-response test protects setup and seal ordering. Frozen historical qualification sources remain unchanged; this is a prerequisite for a later remote boundary, not topology qualification.
Provide a run-bound private Unix-socket endpoint for the Gateway's six writer operations with bounded frames and checked event responses. A distinct-process SQLite fixture demonstrates a committed turn and fail-closed journal behavior after writer death. The live Nursery topology is unchanged; this is a component qualification, not B12 closure.
Validate receiver task actions and append their private intention through the Gateway. Restrict Controller-originated lifecycle ledger drafts to policy checkpoints and run seals, removing the Controller's direct Baby-ledger append call. This narrows source authority without claiming a separated process or selected B12 qualification.
Bind the selected authority-graph amendment to unchanged v1 and specify caller-exclusive writer methods, sockets, and the delayed audit interpreter boundary. Keep B12 open until the topology and evidence are qualified.
Provide the exact prospective Controller method allowlist over a private Unix socket and verify a real writer child, forbidden calls, wrong-run access, retained rows, and malformed-reply rejection. The live Nursery topology remains unchanged and B12 stays open.
Await ledger reads and restrict the interpreter's source-level dependency to ledger reads and audit appends. A held-read test confirms that no append occurs before validation; the live Nursery remains in process and B12 stays open.
Share bounded one-shot RPC transport with the Controller port, then expose only Baby-ledger reads and signed audit appends to the delayed interpreter. A real writer child rejects an early interpretation and forbidden calls; B12 remains open pending selected topology qualification.
Expose only metadata, event, checkpoint, and manifest-insert operations to the Checkpoint caller over a private socket. A real child writer accepts a witness-signed manifest while wrong-run and unrelated calls fail; the live topology remains unqualified.
|
Validation complete on 4442c16: full CI passed (234 files / 2,298 tests), Rust tests/clippy, all receipt audits, and the 1,168-file secret scan. The PR remains unmerged because GitHub currently reports it as UNSTABLE. |
|
H07 update: LV01 five-rejection safety v1 passed in the selected topology. Five ordered trusted-metadata rejections produced one safety pause at turn 4 with clean teardown; its retained-evidence auditor is now CI-enforced. This is safety software qualification only, not a deadline or behavioral result. |
|
Validation complete on |
Preserve the remote boundary method that exhausted a turn-path call without changing the established turn-level timeout classification.
Demonstrate that recurrent actions do not refresh exported policy, preventing a nonexistent policy-sync turn-timeout qualification.
Synchronize the rendered research artifacts and readiness metadata with the current integrity qualification source.
|
Integrity checkpoint: |
Add a recurrent selected-topology fault mode with fresh identities and explicit isolated network bindings.
|
Milestone: LV01 service-fault v3 is now retained as bounded local software qualification. Two fresh selected-topology fault cases passed with post-fault TypeScript/Rust integrity checks and clean teardown; no behavioral finding is claimed. Full local CI at 1cf8530 passed (235 files, 2,300 tests, Rust/Clippy, audits, and secret scan). The PR remains unmerged: GitHub reports UNSTABLE with no remote checks, and the next work is the separately gated detector collector/resource measurement. |
|
Detector milestone: the selected recurrent application controller now has a dedicated observation-capture stage (f35c8cf). It records only real delivered role/turn inputs and topology provenance; labels, probes, restoration comparison, and qualification disposition remain gated in the forthcoming outer collector. No detector or behavioral result is claimed. |
|
Reliability follow-up: e784c15 makes the selected detector observation stage retain a terminal non-result artifact on controller failure before cleanup. Focused stage regression and build pass. This is groundwork for the outer collector, not detector qualification or a research result. |
This branch has not been deployed
1 participant
Current checkpoint
LV01 commitment-window v3 completed as a bounded local selected-topology qualification. The controller was terminated after its durable paired-prediction marker; a replacement controller refused the incomplete prefix with
IncompleteTurnEvidenceError, recorded zero completed turns, and left no containers running. The portable receipt is audited against retained raw evidence.v1 and v2 remain visible failed prospective attempts. This closes one H07 crash-recovery subgate only: no pilot, behavioral result, B12 closure, independent review, or publication claim exists.
Next milestone
Continue the remaining H07 malformed/deadline/safety, detector/fault, and measured full-workload calibration subgates, using fresh identifiers for every execution.