Reconciliation on rebase over R0a (#709): vitest's default include
pattern collects e2e/*.spec.ts and fails on Playwright imports.
e2e/ belongs to 'pnpm test:e2e'; vitest owns src/.
Verified post-rebase: vitest 27 files/181 tests EXIT=0 + playwright 12/12.
Full 'pnpm test' previously hung indefinitely (killed at CI walls,
misdiagnosed as teardown slowness). Two root causes found and fixed:
1. RightInspector.test.tsx called setSubject() during render with a fresh
object every pass -> infinite synchronous render loop (100% CPU spin,
blocks the event loop so no timeout can fire). Moved into useEffect.
2. Test QueryClients used retry:false but default gcTime (5 min) -> a live
GC timer per cached query kept workers from exiting. New shared
createTestQueryClient() with gcTime:0 adopted across all 7 test files.
Hardening so any future leak fails loudly instead of hanging:
- vite.config.ts: testTimeout/hookTimeout 10s, teardownTimeout 5s
- useManagedTimeout hook owns previously-bare setTimeouts in DigestBadge,
MetadataTable, RatificationCommandPanel (4 sites), CommandPalette focus
First-ever frontend CI lane (.github/workflows/workbench-ui.yml):
path-filtered to workbench-ui/** AND the workflow file itself,
pnpm install --frozen-lockfile + build + vitest, timeout-minutes 15.
Honesty fix: KeyboardHelp no longer advertises j/k, /, Enter (unbuilt
until R0d restores them registry-backed).
Route conformance test (ADR-0162 §6, executable): empty/error/loading
contracts asserted for Chat/Proposals/Evals/Replay; fixed the two gaps
it caught (ReplayRoute bare-div error branch -> ErrorState contract;
ArtifactList empty state gained a next action).
Result: 27 files / 181 tests pass, suite EXITS in 4.9s wall-clock
(was: indefinite hang).
Brief 4 of the Wave 1 evidence spine — wire the evidence-context architecture
so every route can project into one shared evidence manifold.
Command registry (1A):
- commandRegistry.ts: useSyncExternalStore-backed command store with a cached
snapshot (referentially stable to avoid render loops); useCommands /
useCommandRegistry; recent-items in localStorage (last 10).
- CommandPalette.tsx: reads from the registry; all ten routes are navigation
commands (was Chat/Proposals/Evals hardcoded); fuzzy filter, recent section,
shortcut badges; Router/Fallback split preserved.
- useGlobalKeyboard.ts: Cmd+K palette, Cmd+I inspector, Cmd+1-0 routes, ? help.
Evidence drawer (1B):
- evidenceContext.tsx: EvidenceSubject union (turn|proposal|artifact|
eval_result|none) + useEvidenceSubject hook + EvidenceProvider above the
router Outlet so inspector state persists across route transitions.
- RightInspector.tsx: five evidence projections (was a null stub); reuses the
Brief 2 primitives (MetadataTable, DigestBadge, Timestamp, badges).
- Shell.tsx: visibility driven by inspectorOpen (collapsed by default); no more
hardcoded collapsed=true.
- KeyboardHelp.tsx: shortcut reference dialog.
- TopBar.tsx: palette open state lifted to Shell via props.
Tests: evidenceContext + RightInspector specs added; CommandPalette keyboard
contract updated for the ten-command navigation set (clamp at both ends).
Deferred (noted in spine doc): per-route register()/setSubject call sites,
action-commands (run eval / copy hash), resizable inspector width.
Verified: tsc -b + vite build green; affected specs pass per-file.
Restore README.md from the parent of PR #701. The merged PR replaced the project README with a blank file; this correction preserves current main history and repairs the documentation without rewriting history.
Replace blanket no-mutation language with the admitted-corridor rule: ADR-governed path, visible preconditions, auditable telemetry, and replay evidence before action.
Math ratification is documented as the first admitted proposal corridor. Corpus, pack, workflow, arbitrary file, and unadmitted proposal mutation remain forbidden.
SplitPane, TabBar, MetadataTable, DigestBadge, Timestamp, SearchInput.
All token-driven, keyboard-navigable, ARIA-accessible, dark theme,
motion-respectful. No new dependencies — TabBar uses native ARIA
semantics instead of @radix-ui/react-tabs.
PreviewPage updated with all six components in representative states.
Section 1C checked off in wave-1-evidence-spine.md.
Append-only JSONL journal records the exact ChatTurnResult envelope returned by /chat/turn with stable turn_id, trace_hash, all three surfaces, verdicts, and deterministic journal_digest.
GET /trace/turns and GET /trace/{turn_id} serve journal evidence for the Trace route frontend. Read model only; no teaching, pack, or journal-owned engine_state mutation.
Local deterministic demo exposing the formal entailment substrate as its
own public authority: the proposer's verdict/confidence/proof are data
only; CORE recomputes propositional entailment through the pinned ROBDD
engine (generate.proof_chain.entail.evaluate_entailment_with_trace),
independently cross-checks with the deductive lane's code-disjoint
truth-table oracle (evals.deductive_logic.oracle.oracle_entailment), and
serves entailed/refuted/unknown only when both procedures agree —
refusing on inconsistent premises (no vacuous entailment), out-of-regime
input (by design, before grammar), a distinct-atom regime bound (honors
the brute-force oracle's small-atom contract), and engine/oracle
disagreement (test-only fault injection, defensive refusal).
Seven committed scenarios with byte-pinned expected artifacts; 38 tests
covering recursive schema closure, output-smuggling-before-evaluation,
proposer-garbage byte-invariance in both directions, oracle module
disjointness, trace-hash folding of trace + oracle verdict, runner
hardening, and INV-21/24/29 discipline of the demo files.
Two-pass hardening of the #690 demo so no epistemic state is proposer-mintable:
Pass 1 (sealed corpus, from the reconciliation pass):
- evidence items are references only (evidence_id + content_sha256) resolved
against a committed content-addressed corpus (evidence_corpus.json)
- support derived from committed subject/predicate match; independence from
distinct provenance_root values; proposer support/independence labels are
rejected by the closed schema
- evidence-strength taxonomy (substrate-capability vs interface-contract) in
PUBLIC-DEMO-ROADMAP / DEMO-PACKAGING-CHECKLIST; position-paper refinements
Pass 2 (entailment-decided inference, closes a live false-status hazard):
- the merged inferred leg required only that premise IDs resolve — a claim
with no support citing one unrelated record as a premise was assigned
'inferred' (empirically confirmed). inferred is now decided by
generate.proof_chain.entail (sound+complete ROBDD) over resolved corpus
premises, cross-checked against the independent truth-table oracle
(evals.deductive_logic.oracle, no shared code); proof keys + oracle verdict
in the trace; disagreement => defensive refusal; refutation => contradicted
- committed adversarial scenario unrelated-premise-still-undetermined proves
the attack now lands on undetermined
- corpus seal (corpus_sha256) pinned into every evaluated trace; scope
refusals no longer consult the corpus; corpus cache hands out copies;
claim subject/predicate constrained to atom-compatible snake_case
- .gitignore: private packet dir, agent worktrees, tooling artifacts
Validation: 30 demo tests; 96 across all three demo suites; 7/7 scenarios
double-run byte-identical; 61 architectural invariants green.
Two-pass hardening of the #690 demo so no epistemic state is proposer-mintable:
Pass 1 (sealed corpus, from the reconciliation pass):
- evidence items are references only (evidence_id + content_sha256) resolved
against a committed content-addressed corpus (evidence_corpus.json)
- support derived from committed subject/predicate match; independence from
distinct provenance_root values; proposer support/independence labels are
rejected by the closed schema
- evidence-strength taxonomy (substrate-capability vs interface-contract) in
PUBLIC-DEMO-ROADMAP / DEMO-PACKAGING-CHECKLIST; position-paper refinements
Pass 2 (entailment-decided inference, closes a live false-status hazard):
- the merged inferred leg required only that premise IDs resolve — a claim
with no support citing one unrelated record as a premise was assigned
'inferred' (empirically confirmed). inferred is now decided by
generate.proof_chain.entail (sound+complete ROBDD) over resolved corpus
premises, cross-checked against the independent truth-table oracle
(evals.deductive_logic.oracle, no shared code); proof keys + oracle verdict
in the trace; disagreement => defensive refusal; refutation => contradicted
- committed adversarial scenario unrelated-premise-still-undetermined proves
the attack now lands on undetermined
- corpus seal (corpus_sha256) pinned into every evaluated trace; scope
refusals no longer consult the corpus; corpus cache hands out copies;
claim subject/predicate constrained to atom-compatible snake_case
- .gitignore: private packet dir, agent worktrees, tooling artifacts
Validation: 30 demo tests; 96 across all three demo suites; 7/7 scenarios
double-run byte-identical; 61 architectural invariants green.
Local deterministic public evidence for the ratified PCCP capability:
proposer submits claim + proof candidate + status/confidence garbage; CORE
ignores proposer authority, fresh-reads curator-certified store state,
recomputes the proof under the pinned engine, and promotes/refuses only
through VaultStore.apply_certified_promotion. The trace proves the decision.
- demos/proof_carrying_promotion/{schema.json,authority.py,run_demo.py}:
closed recursive schema (output fields unsuppliable at the root), the REAL
decider (teaching.proof_promotion.certify_promotion) and the REAL owner —
no demo-local promotion reimplementation. The local arena is rebuilt via
VaultStore.from_dict over dict-literal metadata: demos/ is scanned by
INV-21/INV-24/INV-29, and the demo adds no vault writer, no recall site,
and no status-transition site (proven in tests with the invariants' own
detectors).
- 8 fixtures + pinned expected artifacts: entailed-promotes,
proposer-status-ignored, non-coherent-premise, uncertified-reading,
tampered-certificate (fails byte replay), stale-premise-status (same
honest certificate digest as the promoting run — live state is what
differs), non-sequitur, invalid-state-smuggling (rejected before
evaluation, authority_evaluated=false, null digest).
- Hardened runner per the #688/#690 pattern: default out/ dir, unsafe
output roots refused, --write-expected explicit, double-run byte-identity
enforced per fixture, scenario pass/fail summary.
- tests/test_proof_carrying_promotion_demo.py (26): expected-artifact
conformance, tamper detection, proposer-garbage decision-invariance (incl.
on the promotable setup), refused-cases-mutate-nothing, REFUTED-never-
demotes, trace-hash folds certificate digest, forbidden-import/call scan
(incl. uuid/random/time), INV-21/INV-29 allowlists pinned unchanged, no
named-company/strategy terms.
No runtime turn integration; promotion remains SPECULATIVE->COHERENT only;
README carries the full honesty ledger.
The ratified capability, through the existing mutation owner only:
- teaching/proof_promotion.py — pure decider. Fresh-reads every premise AND
the claim from the store (claim_entry_index; forms never proposer-supplied),
strict status compares (no parse-defaulting), reading_certified must be the
boolean True, engine certification via the pinned deductive engine,
proposer_payload accepted and provably never read (del before use; poisoned-
mapping test), certificate digest emitted for D4 trace-hash folding. Zero
mutation; zero vault.store calls; zero status writes (proven with the
INV-21/INV-29 detectors themselves).
- vault/store.py::apply_certified_promotion — the single transition site.
Independently re-verifies: byte-for-byte replay under DEDUCTIVE_ENGINE_PIN,
promotion_positive, live claim form/reading/status cross-checks, live
premise form/reading/status cross-checks (staleness refuses). Fabricated or
tampered certificates flip nothing; authority is live store state plus
recomputation, never the artifact.
- generate/proof_chain/engine_pin.py — DEDUCTIVE_ENGINE_PIN mirrors the
deductive_logic_v1 lane SHA; sync pinned by AST test against
scripts/verify_lane_shas.py.
- Consistency fix found in lookback: both promotion sites now stamp
epistemic_state alongside epistemic_status (the ADR-0148 site left the
stored state tag stale; recall recomputed it, but the stored key lied).
Obligations: all six strict-xfail markers retired and live (O1/O2
strengthened to prove the transition through the vault owner); the
module-existence pin deleted per its own docstring; the two remaining
honesty pins kept. INV-21 allowlist unchanged; INV-29 allowlist unchanged
({vault/store.py}); INV-29's 29c visibility floor raised 2 -> 3 to cover the
new site.
No runtime turn path calls promotion; the deterministic demo is PR D.
Validation: new suite 49 passed; obligations 8 passed (0 xfail remaining);
invariants 66 passed; certificate 27 passed; 0148 6 passed; epistemic 20
passed; smoke files green; lane SHAs verified.
Architect-directed ratification: D1 (pure decider / vault-owned mutation),
D2 (reading stays curator-certified in the first cut), D3 (exact predicate,
including REFUTED -> no transition), D4 (certificate fields + trace-hash
folding), and INV-29 as the permanent transition-site boundary, all ACCEPTED.
Two fail-closed realizations recorded under D3: the claim form is fresh-read
from the claim's own stored entry (never proposer-supplied), and zero-premise
tautology certificates refuse rather than promote in v1.
Docs-only: no runtime behavior changes in this commit. P3 implementation
(teaching/proof_promotion.py + VaultStore.apply_certified_promotion) follows
in the same PR as separate commits.
Pure evidence substrate for proof-carrying coherence promotion. No
promotion, no vault import, no status transition, no teaching-path
change; ADR-0218 stays Proposed.
- generate/proof_chain/certificate.py: frozen PromotionCertificate
(version/claim_form/premise ids+forms+statuses/entailment_trace/
engine_pin/decision/reason, canonical_json with sort_keys+compact
separators); build_certificate runs evaluate_entailment_with_trace
over entry_id-sorted premises; verify_certificate rebuilds from the
embedded forms and accepts iff byte-identical — tampered forms/claim/
trace/decision/reason/ordering/version all fail replay, structural
breakage fails closed as malformed_certificate.
- promotion_positive is necessary-not-sufficient: entailed over a
non-empty all-coherent recorded premise set; REFUTED/UNKNOWN/REFUSED
verify as themselves but are never positive; zero-premise tautology
certificates fail-closed non-positive in v1.
- engine_pin is recorded provenance; pin tampering is caught only via
caller-supplied expected_engine_pin (P3 must pass the lane SHA) —
limit pinned by dedicated tests.
- entail.py: docstring-only fix removing the incorrect ADR-0206
attribution (numbering collision); now cites ADR-0218. Zero behavior
change. generate_claims.py:74 still carries the label (serving-frozen
surface, flagged for follow-up).
- No xfail markers retire: every PR-A obligation binds to the P3
promoter, which must not exist before ratification. The certificate-
shaped halves of O1/O7 are proven for real in
tests/test_proof_chain_certificate.py (27 tests). ADR phasing bullet
and obligations docstring record the reconciliation.
Validation: certificate 27 passed; obligations 3 passed + 6 xfailed;
architectural invariants 61 passed (INV-21/INV-29 green, allowlists
unchanged); entail/builder/rules 61 passed; smoke files 95 passed.
INV-29 is the load-bearing contribution of #693, so its detector must match
its claim. The assignment-only scan missed common write indirections; the
widened _status_transition_writes (renamed from _status_assignment_targets)
now also catches:
- m.update({"epistemic_status": ...}) / update(epistemic_status=...) /
update(**{...}) / update(dict(epistemic_status=...))
- m.setdefault("epistemic_status", ...)
- bound and unbound __setitem__ with the literal key
- setattr(entry, "epistemic_status", ...)
- writes hidden in tuple-unpacking assignment targets
29b now proves all 13 shapes are flagged (per-shape, so one regression names
itself); new 29b' proves reads, other keys, and dict-literal construction do
NOT flag (false positives would train reflexive allowlisting). Honest scope
note added: variable keys / exec / C-level aliasing are statically
undetectable and belong to review.
Pre-scan confirmed zero production call-shape writes exist, so the widened
detector flags nothing new; ALLOWED_STATUS_TRANSITION_SITES stays
{"vault/store.py"}. No runtime change; ADR-0218 still Proposed.
Validation:
- tests/test_architectural_invariants.py: 61 passed
- tests/test_proof_carrying_promotion_obligations.py: 3 passed, 6 xfailed
PR A of the stack specified by docs/issues/proof-carrying-coherence-promotion.md.
No runtime change; no promotion behavior; ADR-0218 is Proposed, not ratified.
- ADR-0218 (Proposed): rulings the issue Section 9 demands — extend the
existing mutation owner (policy decides in teaching/proof_promotion.py at
P3, only vault/store.py mutates), reading stays curator-certified in the
first cut, exact fail-closed admissibility predicate, certificate folds
into trace_hash. Records two substrate corrections: proof_chain Phase 2
(2.1-2.4) is already implemented, and ADR-0148 already automates an
energy-arm promotion.
- INV-29 (passing): epistemic-status transition sites are allowlisted.
ADR-0148's in-place promotion proved INV-21's AST scan cannot see
status transitions (they are not store() calls) — the boundary the
issue calls highest-risk did not actually cover the riskiest shape.
Allowlist pinned to {vault/store.py} BEFORE any promoter exists;
detector mutation-proven non-vacuous (29b/29c).
- Obligations O1-O5, O7 as strict xfail (executable spec; ImportError today;
strict=True forces the P3 PR to retire markers and pass for real) + three
honesty pins that flip red if promotion is wired without review.
Validation (worktree off main@187b008b, python -m pytest):
- tests/test_proof_carrying_promotion_obligations.py: 3 passed, 6 xfailed
- tests/test_architectural_invariants.py: 60 passed (56 prior + 4 INV-29)
- smoke file set: 94 passed
- proof_chain/entail/binding-graph/ADR-0148 set: 84 passed
- epistemic/teaching set: 40 passed
- scripts/verify_lane_shas.py: 8/9 pinned lanes match incl. deductive_logic_v1;
public_demo missed on the known env wall-clock budget flake (47.6s > 30s),
pre-existing and unrelated (diff is docs+tests only).
§3.4 said promotion "requires a curator-mediated coherence judgment." That
over-states a necessity. ADR-0021 §3 only requires promotion be a function of
coherence with the reviewed field. For claims *deductively entailed* by
already-COHERENT facts, the entailment proof IS that coherence judgment and can
be machine-certified by the sound deductive_logic_v1 engine — the logical arm of
the "structural coherence metric" ADR-0021's v2 gap already names.
- position_paper.md §3.4: split "own asserted output" (no standing — kept) from
"deductively entailed from COHERENT facts" (proof = coherence judgment);
relocate review to the *reading*, not the deduction; flag the proof-carrying
path as specified-but-unwired with a link to the new issue.
- teaching/epistemic.py: the EpistemicStatus docstring claimed transitions are
"computed from coherence" — they are not; review_correction carries status as
a curator-supplied input. Docstring now states this honestly.
- docs/issues/proof-carrying-coherence-promotion.md: thorough spec for the
unbuilt capability (scope, the reading hazard, INV-21 impact, trust boundary,
falsification tests, phased plan, proposed ADR-0218).
No runtime behavior change. Green: test_epistemic_invariants,
test_epistemic_phase3_state_tagging, TestINV21OneMutationPath (15 passed).
