G-9's charge: "law-enforced-by-review is weaker than law-enforced-by-test." Its
stated method — verification pass first, then mechanical PRs — is what made this
worth doing, because the three prohibitions turned out to be in three different
states and only one of them was the state the register assumed.
(a) EXACT RECALL — the real gap, and worse than recorded. "Would a cosine
ranker actually fail a test?" answers NO across nearly the whole surface. The
only import ban in the repository covers exactly one file
(core/physics/wave_manifold.py, via test_third_door_cohesion.py — itself in no
curated suite). Meanwhile generate/realize/recall.py, which IS the recall path,
states the prohibition in its module docstring — "an exact, deterministic
equality scan (no cosine / HNSW / ANN)" — and nothing enforced it. Law asserted
where it executes, enforced nowhere: H-8's failure mode applied to a
prohibition rather than a record.
Now scanned across vault/, generate/realize/, generate/meaning_graph/, field/,
recognition/ for banned ANN libraries AND for hand-rolled cosine* definitions.
The second half matters: an import ban only stops the convenient version, and
ten lines of numpy is the realistic way a well-meaning contributor violates
this. A third pin ties the docstring claim to the scan, so the sentence and its
enforcement cannot drift apart.
(b) GOVERNANCE BYPASS — now exact. INV-07 proves governance works WHEN CALLED;
nothing proved it could not be skipped. Mechanism: no function in
chat/runtime.py may construct a TurnVerdicts without invoking
safety_check.check, and every such call must pass self.safety_pack — because a
bypass need not skip the call, it can substitute the pack. Measured at close:
two verdict-constructing functions, both governed.
(c) SAFETY-PACK NON-SWAPPABILITY — already well pinned; the gap was REACH, not
coverage. tests/test_safety_pack.py pins unratified-pack-refused-in-production,
missing-companion-report-refused, seal-failure-refused, path-traversal-rejected,
missing-pack-fails-closed — and ran in NO curated suite, so a fail-closed safety
contract was verified only after merge. Promoted onto the gate; the new pin
guards that placement rather than duplicating the substance.
FOUR SABOTAGES, EACH OBSERVED RED, each caught by its own pin: a banned library
imported on a recall path, a hand-rolled cosine ranker, a serving path
assembling verdicts without governing, the safety pack demoted off the gate.
Both new files registered in TEST_SUITES["smoke"] on creation (#136). Source
scans only — no runtime behavior, no flag, no serving path touched.
Registers: G-9 CLOSED with the per-item findings; PR-6 marked LANDED.
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
