When a pinned lane drifts, the script prints actual/expected SHAs but
gives no guidance. Authors then have to look up that --update exists
and that CLAIMS.md needs regenerating alongside.
Adds a remediation block printed only on mismatch, listing the most
common drift sources (core/cognition/result.py, chat/runtime.py,
generate/realizer.py, capability registries) and the two commands
needed to re-pin: --update + generate_claims.py.
Why this is the right scope: branch protection now blocks merge on
red lane-shas CI (enabled 2026-05-24), so the remaining gap is
discoverability — telling authors what to do, not enforcing that
they do it. A one-line message change carries that signal without
adding hooks, templates, or infrastructure.
No behavior change on success.
Three lane SHA pins drifted because intentional surface/serialization
changes shipped without re-running scripts/verify_lane_shas.py --update.
Bisect attributing the drift:
- demo_composition + public_demo broke at 5cad0a4 (#118 ADR-0110
mathematics_logic → expert_demo) — the demos enumerate the expert set.
- demo_composition drifted a second time at ab4c7cb (#220 Phase 3
state tagging spine) — additional epistemic fields shifted the surface.
- domain_contract_validation broke at a45eab1 (#219 Phase 2 epistemic
bug repairs) — normative/epistemic field shape changed.
The in-tree canonical report for fabrication_control_summary was also
stale vs. its (correct) pin; refreshed here for byte-alignment.
After this commit: 7/7 lanes match pinned SHAs; verify_lane_shas.py
runs green locally and in CI.
Followup (separate PR): hook/template guard so future PRs that touch
core/cognition/result.py, chat/runtime.py, or capability registries
re-run --update before merge.
Two pre-existing latent issues fixed:
1. discourse_planner flag catalog drift (test_flag_report failure)
On 2026-05-21 the discourse_planner default was flipped to True
after byte-equality verification (per inline comment in
core/config.py:130-138), but the capability flag catalog at
core/capability/reporting.py was not updated — it still claimed
"flag_shipped_default_off". The test
test_flag_report_tracks_default_off_flags_without_enabling_them
correctly caught the inconsistency; it had been failing across
every commit since ADR-0092 first ran the suite.
Fix:
- New "flag_shipped_default_on" state in _FLAG_CATALOG, added
to flag_report() grouped output
- discourse_planner moved from default_off → default_on
- Test renamed to test_flag_report_classification_matches_actual_defaults,
enforces BOTH directions of the contract (catalog claim must
match DEFAULT_CONFIG value)
- New test test_flag_catalog_state_is_consistent_with_default_config
cross-checks every catalog entry against DEFAULT_CONFIG;
catches future drift before it lands
2. public_demo lane SHA shifted every commit
Each commit advances the showcase's generated_at_revision field
(git HEAD SHA). _strip_volatile in the lane runner was stripping
wall-clock and per-run paths but NOT generated_at_revision, so
the byte-equality case's details.sha256 changed with every commit
even when underlying demos produced identical content. That made
the pin a "did this run today" check rather than a "did the code
produce the right artifact" check — exactly the failure mode
the verifier was supposed to prevent.
Fix:
- Add generated_at_revision to _VOLATILE_KEYS in the public_demo
runner. Lane's invariant is "same code → same SHA," not
"same HEAD → same SHA"; HEAD belongs in the showcase output
(operators need it) but not in the lane's equality projection.
- Pin refreshed once to capture the now-commit-independent SHA;
subsequent commits won't shift it unless underlying demo content
actually changes.
After fix:
- Capability tests: 6/6 passing (was 4/5 with discourse_planner failing)
- Lane SHAs: 6/6 match pinned values; public_demo pin will now survive
routine code changes
- Smoke 67/67, cognition eval byte-identical 100/100/100/100
This is the single known pre-existing test failure cleaned up.
Six lanes (reviewer_registry, miner_loop_closure,
domain_contract_validation, fabrication_control_summary,
demo_composition, public_demo) now have CI-enforced SHA-256 pins.
A failing job means a lane's deterministic output changed without
an explicit ADR-tracked pin update.
- new scripts/verify_lane_shas.py: single source of truth
- PINNED_SHAS dict mapping lane_id → 64-char hex SHA
- LANE_SPECS tuple wiring each lane to its runner module + canonical
report path
- accepts_report_flag handles the fabrication_control runner's
different arg shape (--lane-dir not --report)
- verify_all() runs each lane in subprocess isolation (clean Python
state per lane — relevant for adapters that cache pack loads at
module import)
- --update flag refreshes pins after intentional ADR-tracked changes;
diff is the audit trail
- --json flag emits machine-readable report
- exits non-zero on any mismatch
- new .github/workflows/lane-shas.yml:
- triggers on push to main and pull_request to main
- concurrency group cancels in-progress runs on new commits
- Python 3.11 + pip-cached deps + editable install
- runs verify_lane_shas.py; emits JSON report on failure
- 12-minute timeout (lanes take ~30s in practice)
- new tests/test_lane_sha_verifier.py: cheap local-pytest pinning
- every LaneSpec has a corresponding PINNED_SHAS entry
- no orphan pins without a LaneSpec
- every pin is a 64-char hex SHA-256
- every runner module path exists on disk
- canonical report paths are under repo root
- all six expected lanes (ADR-0092/0093/0095/0096/0098/0099) covered;
ADR-0094 and ADR-0097 are schema/ratification only, intentionally
excluded from EXPECTED_LANES
- 6 tests run in <100ms — catches drift before CI
- evals/public_demo/results/v1_dev.json: refreshed to match the new
pin (21751aaf..) — earlier pin was generated under slightly different
runner argparse defaults; --update produced the canonical bytes
Local verifier: 6/6 lanes match pinned SHAs. Smoke 67/67. Lane SHAs:
reviewer_registry 681a2aab..
miner_loop_closure 9f071733..
domain_contract_validation f9c06cde..
fabrication_control_summary 01e1b6b7..
demo_composition 27d83824..
public_demo 21751aaf..
