core/capability/domains.py's DOMAIN_PACKS declares domain -> pack membership
for the capability ledger. Each packs/data/<pack>/manifest.json independently
declares domain_id. Two statements of one fact, and only one direction was
ever checked: domain_contract_predicates P3 validates domain_id -> a known
ledger domain. Nothing validated DOMAIN_PACKS -> the manifest agrees.
P3 passes VACUOUSLY on a manifest with no domain_id at all — the same shape as
its own test_pack_without_contract_reports_absent. So a pack that DOMAIN_PACKS
places in a domain, but whose manifest never says so, is invisible to every
check in the repository.
Measured: 7 of 9 bound, 0 contradictory, 2 absent — en_core_cognition_v1 and
en_core_meta_v1, both placed in philosophy_theology, which is one of the four
bands queued to earn a SERVE license behind R-8. The domain whose license is
next to be earned is the one whose binding exists in only one place.
Why nothing caught it: tests/test_domain_contract_predicates.py exercises
P1-P9 entirely against synthetic tmp_path manifests, never against the real
nine, and is itself in no curated suite. A predicate proven correct on
fabricated input and never run on the real input is this arc's defect class
stated precisely — its success state and "it never ran here" are
indistinguishable.
tests/test_domain_pack_binding.py, registered in smoke (on the gate):
- every pack DOMAIN_PACKS names has a manifest on disk
- a manifest that CONTRADICTS the table always fails
- a manifest with NO domain_id fails unless the pack is in UNBOUND_BASELINE
- the reverse direction: a pack may not self-assign a ledger domain the
table does not grant (clean across all 30 packs today, pinned because a
new manifest copying domain_id from a sibling is the obvious mistake and
would silently widen a licensed domain)
- both directions on the baseline: a pack that gains domain_id must leave it
- the parse is guarded against vacuity (N-1 has produced three false
conclusions in this repo)
- the count is pinned so the gap moving is a reviewed decision
Four sabotages, each observed red, each caught by its intended pin.
PINNED, NOT FIXED, deliberately. Whether en_core_cognition_v1 is a
philosophy_theology domain pack or merely grouped under that domain for ledger
accounting decides what the license actually covers. That is
ratification-adjacent content, not engineering, and it is routed to R-8 /
PR-14 where that band's license is decided. Sealing that ledger without
answering it licenses a domain whose membership is asserted in one place and
denied by silence in the other.
How it was found, recorded because the method is the point. An external
assessment proposed collapsing the pack/domain machinery, stating its method
up front: "I have enough from the directory and CLAIMS.md to reason
seriously." That is the method AGENTS.md protocol rule 1 forbids, and five of
its six proposals are falsified by opening the file — recorded in full in
31-hindrance-audit.md, in short:
- conftest.py "almost certainly" holds suite-membership logic: it holds two
autouse fixtures and two data registries, and its collection hook stamps
markers and never skips. Zero membership logic.
- cli_test.py "almost certainly a nested conditional or a big dict": a flat
dict, 17 keys, zero conditionals in the module body.
- field/algebra/morphology as a peer triad needing a single serve(): 72, 15
and 3 importers respectively, morphology is 97 lines, and no def serve(
exists anywhere in core/, chat/ or generate/.
- the grade space is richer than the serve layer consumes: all 15
EpistemicState members have non-test consumers.
- constraints: blocks in 314 ADRs: that is 314 new places that must be kept
true, inside ratified immutable records, in the repository whose dominant
defect class is records drifting from reality. The existing design puts
the machine-readable half in the checker that reads the ADR, which is
better on purpose.
- a root contracts.toml as "the highest-leverage single change": the
principle is already ADR-0263 Rule 5 and is implemented in the very file
the assessment cites. Centralizing four tables with four authorities adds
a fifth copy that must agree with four generators.
The seam it pointed at was real even though every specific was wrong. Bad
method, useful direction; both halves recorded, and the triage rule earns a
second demonstration — every rejected proposal failed on a file its author did
not open.
AGENTS.md — the standing philosophy revised to eleven, per Shay's review.
- "be quick to be humble" -> "investigate yourself first". Speed is a
consequence of reflex, not a criterion; writing it in makes velocity sound
like the point. Examples replaced with three that are verifiable in-repo:
the H-13 refcount claim, and the two rulings that were about to be
recorded stronger than they were made.
- the defect-class principle gains its prescriptive half as its own
sentence, and gains this commit's instance: a predicate that passes
vacuously on the input it was written for.
- NEW #2: don't build a ratchet to guard a ratchet. Placed adjacent to
"less is more" and named as its corollary so it does not read as
duplication. The arc paid for it — a membership ratchet needed a
reachability ratchet to mean anything, and what actually shrank the gap
was deleting four suites nobody called.
- NEW #10: a closed issue is not evidence the problem is gone. G-7 was
CLOSED and REOPENED-PARTLY inside one arc; H-13 was closed with a fix that
did not work.
Two review points were already satisfied in the file and are recorded as such
rather than re-applied: the defect-class principle already stood alone on its
first line, and already sat at position 3, not 8. The review was reading a
chat summary, not AGENTS.md — which is, exactly, reviewing the record instead
of the reality.
PR-5 additionally owes one page: an index of which declared tables exist and
what pin makes each true. That is the defensible residue of the contracts.toml
proposal, and explicitly not a fifth copy of four tables.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
Shay adopted twelve rulings, struck two, and ratified the ADR-0252 §5 NO-GO.
For several hours afterwards the packet still said PENDING fourteen times,
while PR-3 and PR-3b had already executed against R-7. That is precisely the
failure this arc is about — a record contradicting reality at a load-bearing
point — committed inside the arc whose subject is that failure, and it was
caught by a question rather than by any instrument. Fixing it is the first
item here; the rest of the commit exists so the same gap cannot reopen by
context loss.
50-rulings.md
All fourteen statuses replaced. Twelve carry RULED <choice> with the date
and the deciding authority; R-10 (discharged before the arc) and R-14
(dissolved by N-9) are struck. An adoption block at the head records the
choices, the strikes, the §5 ratification, and the corrected execution
order, plus which rulings have already executed.
50-execution-plan.md
New §2.1 — the adopted docket. The twelve choices, and the execution order
as a ranked table stating why each item sits where it does. The packet
ordered by register number, which interleaves cheap record repairs with
expensive capability work and puts the two zero-risk ADR amendments last;
the corrected order is by what each item unblocks, cheapest first in tier.
Three things that lived only in conversation are now written down:
- the claims register is HELD, deliberately, with its entry criterion —
G-22 showed CLAIMS.md can publish a superseded digest for two days, and
an index over untrustworthy indexed things is the H-9 pattern;
- gate width is promoted from a parenthetical to PR-4b, sized, with
`teaching` recommended alone and the reason being evidence (G-22) rather
than taste — a parenthetical is how fifteen suites became unreachable
without anyone choosing it;
- Track A's ratification creates an obligation the verdict document cannot
discharge: ADR-0252 §6 retires the surface organs "until the
structure-mapper proves out," names no replacement for the NO-GO branch,
and is an instruction rather than a research note. A live instruction
that can never fire is a dead instrument.
Two places where I was about to state a ruling more strongly than it was
made, corrected rather than smoothed over:
- R-11 B is "measure, then re-ask." It authorizes no gate. It owes a
measurement AND a second ruling, and a ruled-but-inert item looks exactly
like a settled one at a glance.
- R-8 C was recommended "with a floor from A applied to the entailed
capability only" and N was never named. PR-14 must carry a proposed N with
its consequence, or land entailed as explicitly unlicensable-pending-N.
Shipping without a floor would license entailment on nine cases through an
omission — the exact outcome C exists to prevent.
Also: §0 corrected from seven corrections to nine (N-8, N-9 were added
during execution and the heading never moved); definition-of-done item 5
struck, because N-9 killed both its halves — smoke.yml parity is not a goal
under AGENTS.md:280, and "no test file hides in full" is unreachable at 747
files without ceremony that changes nothing about what executes.
30-gap-register.md
G-7's open half is 15, not 19: PR-3b took it there by deletion, which costs
no gate time. Points at PR-4b.
AGENTS.md
Nine standing philosophies under the reasoning protocol, per CLAUDE.md's
rule that governance and memory live here. They are the generalization of
what this arc actually cost: less is more; master the small details and the
large ones do not form; a mechanism whose failure state is indistinguishable
from its success state is not a guarantee; a record that contradicts nothing
beats one that impresses; consecutive unclear problems mean the frame is
wrong, not the fix; be quick to investigate yourself, and record the error
next to the fix rather than overwriting it; volume of work is not a licence
for lower diligence; fix what you find or name why not; let the tree settle,
then run the gate once.
Documentation only — no runtime behavior, no test, no pin changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
Two things, both surfaced by finally being able to run the tree.
## A pre-existing silent red
tests/test_lane_sha_verifier.py::TestExpectedLaneCoverage was RED on clean
main — confirmed by running it in a pristine worktree at origin/main, and the
file is untouched by any of this branch's work. deduction_serve_v1 (ADR-0256)
and curriculum_serve_v1 (ADR-0262) shipped during the generalization arc and
neither was added to EXPECTED_LANES.
The roster's `extra` assertion is a deliberate tripwire: a new lane is supposed
to fail it once so an author acknowledges the addition. Nobody did, and nothing
caught it, because that file is in neither `smoke` nor `deductive` — no local
gate and no CI job runs it. Same silent-red family as the exact-tuple pin S5
found in passing, and as the register-axis e2e tests that sat red for two days.
This commit is the acknowledgement the tripwire was asking for.
That it took running the full tree to find is the argument for the rest of this
commit.
## scripts/ci/local-ci.sh
AGENTS.md says the merge bar IS the local run. There was no single entry point
for it, and on any host without Python 3.12.13 exactly there was no local run
at all: pyproject pins requires-python == "3.12.13", so uv sync --locked fails
outright and every gate becomes unrunnable.
sh scripts/ci/local-ci.sh --tier smoke|gate|full
`gate` is the three pre-push steps; `full` is the whole tree in parallel. Suite
membership is read from core/cli_test.py::TEST_SUITES through the CLI and never
restated, so this runner cannot drift from the hook the way smoke.yml drifted
from the local list.
Interpreter contract, deliberately fail-closed: the pinned interpreter is
CANONICAL, and the runner refuses on anything else with instructions.
--allow-interpreter-fallback opts into any 3.12.x and stamps every run
NON-CANONICAL. Same discipline as ratified_ledger's missing_ok and the MLX
skip path: a degraded mode is legitimate, a degraded mode reporting itself as
the real thing is not.
Evidence recorded in the script header so the flag is not cargo-culted: the
committed-SHA / trace_hash / content_sha256 / lane-SHA pin set (119 tests) was
run on 3.12.11 and 118 passed, the one failure being the stale roster above,
which fails on 3.12.13 too. That is evidence the exact pin is not load-bearing
for bit-exactness — it is NOT a ruling that it should be relaxed. Relaxing it
is a reproducibility decision and belongs to a human.
## Observed, not fixed
Something in the suite writes a real proposal artifact into
teaching/proposals/derived_close_facts/ instead of a tmp_path. The three test
files that name that sink all override it correctly, so the leak is elsewhere —
likely an idle_tick/contemplation path exercising DEFAULT_SINK. Untracked
residue, removed here, flagged for follow-up. Notable because it is only
visible now that the parents[3] bug is fixed and the sink resolves inside the
repo.
[Verification]: gate tier via the new runner — smoke 236, warmed_session 10,
deductive 285, all passed, correctly stamped NON-CANONICAL. Fail-closed path
verified (exit 3 with instructions). lane_sha_verifier 6 passed. Full tests/
tree in progress at 63% with 0 failures at time of commit.
NON-CANONICAL: Python 3.12.11, not the pinned 3.12.13. Not merge evidence.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FduW6Krm3PPQv3P5iwBYtx
Weekly-audit 2026-07-22 closeout — T13 decision (3) CI gate + T11 execution.
- scripts/hooks/pre-push + install.sh: a core.hooksPath pre-push gate that runs
the smoke suite PLUS the warmed_session consistency lane pin — the T13
telemetry-consistency regression class that smoke does NOT cover. The full
~12k fast-lane stays async CI by design; the gate is deliberately targeted so
it blocks the regression class without gridlocking pushes. Fail-closed on
empty stdin; skips deletion-only pushes; emergency bypass git push --no-verify.
- scripts/ops/reset_candidate_corpus_t11_20260722.py: provenance record of the
T11 live-store reset. The 465 discovery candidates predated the #100
isolation fix and carried no per-record test/prod discriminator, so a surgical
quarantine was impossible; ruling was to clear (not asterisk). Executed as an
ADR-0219 atomic generation reset (empty candidate ledger, keep=1) — candidates
465 -> 0, turn_count 14990 and identity lineage preserved, tainted generations
GC'd. Data lives in gitignored engine_state/; this script is the audit trail.
- AGENTS.md: document the automated pre-push gate under the Local-First CI
Validation Protocol.
- weekly-audit ledger: T10 merged (#100), T11 ruled+executed, T13 (2) hedge-arm
ruling + (3) pre-push gate recorded.
[Verification]: smoke 180 passed (132.9s) + warmed_session lane 10 passed
(140.5s), exit 0 — worktree core-wt-infra @ base 9a428d84.
Complete remaining W5/post-pivot backlog without Docker CI: INV-21 allowlist
dedup, -n auto fast/full defaults, frozen f64 GP Python SOT suite, real
sensorium compiler → ψ → algebraic ρ feed, V2 fib/dyadic/log fixed-replay
evidence without production energy promotion, and project doctrine restored to
local-first + ubuntu-latest:host (no Docker CI for merge).
[Verification]: Smoke suite passed locally (145s, 176 passed); make test-fast
(-n auto) passed twice (11709 passed, 108 skipped each ~11–12 min).
Lands Shay's own correction (authored 2026-07-16 as commit 798c6d1c in
the primary checkout, never pushed): tea frequently hangs/times out
(Cloudflare 524) via HTTP/2 proxying and WAF handoffs — use the Forgejo
MCP tools instead. Also fixes two references the Local-First CI
Validation Protocol section had left stale: the smoke suite is 175
tests, not 108+ (parity-pinned by test_cli_smoke_suite_covers_ci_smoke_gate),
and PR creation goes through the Forgejo MCP tools, not `tea pr create`.
Ports the runner-migration doctrine (authored by the Gemini session against
a stale checkout; grafted here onto current main so the #40-era Local-First
protocol section is preserved, not clobbered):
- CI jobs dispatch to a local Act runner on the primary developer's Mac
(label ubuntu-latest:host = native macOS host execution; the ubuntu name
is a fiction — no Linux-only steps).
- The GCP e2-micro server-side runner was REMOVED 2026-07-16; never
re-provision it (1GB RAM, OOM class). A waiting queue while the Mac is
asleep is intentional — pre-push local gates are the real discipline.
- Workflows remain canonical and install the locked universe (uv sync
--locked, committed uv.lock). GitHub mirror Actions are billing-locked
dead signals.
- CLAUDE.md gains a one-line pointer (policy stays in AGENTS.md).
[Verification]: smoke suite passed locally (175 passed); docs-only.
Extracts the reasoning protocol demonstrated in the contemplation
refactor session into a canonical, reusable guide in AGENTS.md.
- New section: Reasoning and Problem-Solving Discipline (7 steps)
- Covers: read-first, shape-finding, leverage ranking, precise
enumeration, claims-grounded proof, cognitive model connection,
and commit discipline
- Documents the failure modes each step prevents
- CLAUDE.md + GEMINI.md: add pointer to the new protocol section
* fix: final cleanups for CGA substrate migration PR
- Update UI test fixtures to packs/data paths
- Clean CLAUDE.md/GEMINI.md to minimal per AGENTS.md
- Refactor fraction geometric construction into dedicated helper in problem_frame_contracts.py
- No TODOs left in code; notes in PR description
This completes the mechanical readiness for the CGA substrate + registry consolidation work.
* docs: include PR description for review
* chore: enforce forgejo tooling in AGENTS.md
* docs: update bootstrap skill and add git-forgejo config doc per new rules
* docs: remove deprecated git-forgejo wrapper docs
* chore: ignore local .mcp.json configuration file
* fix(ui): remove unsupported assessment.bindings usage to fix TS2339/TS7006 in constructionEvidencePanelModel
This change removes duplicate provider-specific rules across CLAUDE/GPT55/GROK files and replaces them with thin, provider-neutral shims that point back to the canonical AGENTS.md for all architectural invariants, PR discipline, and trust boundaries.
- update AGENTS.md with standing efficiency/performance and security doctrine
- align CLAUDE.md with current performance/security expectations
- update Copilot/Codex instructions with hot-path, trust-boundary, and CLI validation defaults
- refresh work sequencing now that eval and calibration are on main
Three items from the post-assessment stabilization slice:
1. field/state.py: restore frozen=True, slots=True
slots=True closes __dict__ on FieldState instances, preventing
incidental attribute injection that frozen=True alone does not block.
The holonomy field works cleanly with slots because ndarray | None
is a valid slotted field type in Python 3.12.
2. README.md: correct vocab/ layer description
Was: 'Word-to-versor manifold, edge rotors'
Now: 'Surface-token manifold points; indexed access for algebraic
transition construction'
Edge rotors are constructed by algebra/, not stored in vocab/.
This exact confusion caused vocab.edge_rotor() drift in earlier work.
3. AGENTS.md: add language-pack checksum rule
Manifest checksums MUST be computed by reading back the bytes
written to disk (Path(f).read_bytes()), never from in-memory strings
before serialization. Unicode-escaped JSON on disk != Python str.
