Establishes the canonical Delta-CRDT reference contract so a future native
(Rust/Zig) backend is gate-G1-eligible under ADR-0196 — the ZC-0 'contract
pinning' slice. No Zig code; ZC-1+ remains gated at G2.
- vault/crdt.py: canonical Python reference (ArenaEntry, Delta, LocalArena,
merge_kernel, canonical_bytes, delta_hash). Pure content law — content-
addressed by IEEE-754 bits then provenance; no normalization, no versor
closure, no global Vault writes.
- ZC-0 contract tests (semilattice C-1..C-5; content ordering / signed-zero /
NaN bit-addressing; C-7 no-global-write) — all failable (mutation-checked:
no-dedup breaks C3/C5, arrival-order breaks C1).
- Golden fixture corpus (tests/fixtures/crdt/) regenerated deterministically
from the reference; single source of truth also emits the Rust expected hex.
- core-rs: Delta::canonical_bytes + test_crdt_hash_parity.rs proving Rust
produces byte-identical canonical_bytes to the Python reference.
- ADR-0180 -> Accepted: locked contract, byte layout, obligation map, and the
explicit boundary that no Zig is authorized.
Verification: ZC-0 21 passed, Rust arena+parity 16 passed, architectural
invariants 40 passed, smoke 67 passed. Serving frozen: 7/8 lane SHAs match;
the public_demo miss is a pre-existing wall-clock budget overrun (ADR-0099,
~46-48s > 30s) reproduced identically on clean main — environmental.
Implements ADR-0180 §4.1 item 1: the Delta-CRDT write-accumulation substrate
in core-rs/src/vault.rs.
- ArenaEntry: (versor, provenance) — provenance is part of the content key.
- LocalArena (§2.1): thread-local, share-nothing, lock-free write cache;
snapshot() emits a canonical Delta; non-destructive (flush/GC is the kernel's
concern, safe across the §3.2 eventual-consistency window).
- SemilatticeDelta trait + Delta (§2.2): join is commutative, associative,
idempotent under content-addressed equality (IEEE-754 versor bits +
provenance bytes), never arrival order — per the §2.2 amendment landed today.
- merge_kernel (§2.2): folds deltas into one content-addressed, deduped,
totally ordered set; permutation- and duplicate-invariant — the property
§4.3's hash(Sequential)==hash(Concurrent) rides on.
Pure-CPU only (§1.5.5): no MLX/UMA handshake, no Python binding — those are
downstream (§4.1 item 2; ADR-0181 PR-5). Existing vault recall/reproject paths
untouched; zero eval impact.
10 failable property tests in tests/test_arena.rs (mutation-verified: disabling
the content sort fails 6 of them loudly, per CLAUDE.md §Schema-Defined Proof
Obligations). Also fixes a pre-existing broken doctest in the vault.rs header
(indented math block was parsed as a Rust doctest).
