fix(pipeline): back-stamp served surface onto TurnEvent — close T13 telemetry-consistency red #101

Merged

core-labs merged 1 commit from fix/telemetry-serve-boundary into main

2026-07-23 04:58:03 +00:00

core-labs commented

2026-07-23 04:30:12 +00:00

Owner

Closes the T13 fast-lane red on main (weekly audit 2026-07-22). Telemetry half only — the goldtether over-refusal (decision 2) and the durable-sink deferral (R7) are ledgered for separate treatment (see below).

Defect (Absolute Provenance break)

CognitiveTurnPipeline.run() calls runtime.chat() (pipeline.py:287), which seals + emits TurnEvent with the runtime-owned surface. The pipeline then applies the #96 fail-closed resolve_surface (:470) and the #97 logos-morph override (~:517). An overridden turn therefore serves a surface telemetry never recorded — TurnEvent.surface != pipeline.run().surface.

Metric: warmed_session_consistency telemetry_consistency_rate = 0.9444 (17/18) on unmodified main.
Introduced by e0d1b475 (#96). Verified pre-existing (fails plain AND state-isolated; unrelated to the #100 isolation fix).
Reproducer — warmed case "What is doubt?": TurnEvent carried the pack-grounded surface ("To doubt means to think maybe not. pack-grounded (en_core_meta_v1).") while the pipeline returned the typed refusal ("I cannot certify an answer: the geometric coherence contract is open (goldtether_residual).").

Nothing gated this: smoke does not cover the lane, and GitHub Actions are dead signals.

Fix (TDD)

RED confirmed on the branch base (bf80bc7f): telemetry_consistency_rate 0.9444.
GREEN: new ChatRuntime.finalize_turn_surface — a sibling to the existing finalize_turn_trace_hash back-stamp. The pipeline owns the final surface decision, so it back-stamps the resolved surface/articulation_surface onto turn_log[-1] immediately after the trace-hash back-stamp (pipeline.py, right after :809). Operates on the most-recent TurnEvent (main or refusal-stub path); no-ops when unchanged or when no turn exists.
Byte-identity preserved: trace_hash folds the pre-decoration surface, not the served surface, so re-stamping TurnEvent.surface cannot move trace_hash.

Diff: +57 / −0 across 2 code files + the ledger. No control-flow change; mirrors an established pattern.

Scope boundaries (deliberately NOT in this PR)

T13 decision (2) — goldtether over-refusal — OPEN, needs a ruling. Orthogonal to the red (telemetry now matches whatever is served). I recommend against a query-type "definitional/epistemic" classifier bypass: it fails a geometric coherence gate open on a lexical cue — the fail-open / cue-table pattern ADR-0252 retired and INV-34 / fail-closed forbid. Principled alternative: route open-geometry-but-pack-grounded surfaces to the existing hedge arm (chat/refusal.py; already mutually exclusive with refusal — verdicts.py:42 "refusal supersedes hedge"), discriminated by grounding provenance (structural), not question type. Own PR + real-data validation.
R7 — durable-sink deferral. The opt-in telemetry sink still receives the pre-override event (same limitation finalize_turn_trace_hash already carries; default sink is None, so no live consumer is affected). A single deferred emission at the pipeline serve boundary would repair surface + trace_hash together. Ledgered.

Validation

tests/test_warmed_session_lane.py: 10/10 passed (telemetry_consistency_rate 0.9444 → 1.0).
No new pyright diagnostics from the added method (pre-existing unused-import / operator findings untouched).

[Verification]: uv run core test --suite smoke -q in worktree core-wt-t13serve @ 5a343b49 — 180 passed in 133.17s, exit 0.

Merge on your authorization (no-merge-automation doctrine).

Closes the **T13 fast-lane red** on `main` (weekly audit 2026-07-22). Telemetry half only — the goldtether over-refusal (decision 2) and the durable-sink deferral (R7) are ledgered for separate treatment (see below). ## Defect (Absolute Provenance break) `CognitiveTurnPipeline.run()` calls `runtime.chat()` (`pipeline.py:287`), which **seals + emits `TurnEvent`** with the runtime-owned surface. The pipeline **then** applies the #96 fail-closed `resolve_surface` (`:470`) and the #97 logos-morph override (`~:517`). An overridden turn therefore serves a surface **telemetry never recorded** — `TurnEvent.surface != pipeline.run().surface`. - Metric: `warmed_session_consistency` `telemetry_consistency_rate` = **0.9444** (17/18) on unmodified `main`. - Introduced by `e0d1b475` (#96). Verified pre-existing (fails plain AND state-isolated; unrelated to the #100 isolation fix). - Reproducer — warmed case "What is doubt?": `TurnEvent` carried the pack-grounded surface (`"To doubt means to think maybe not. pack-grounded (en_core_meta_v1)."`) while the pipeline returned the typed refusal (`"I cannot certify an answer: the geometric coherence contract is open (goldtether_residual)."`). Nothing gated this: smoke does not cover the lane, and GitHub Actions are dead signals. ## Fix (TDD) - **RED** confirmed on the branch base (`bf80bc7f`): `telemetry_consistency_rate` 0.9444. - **GREEN**: new `ChatRuntime.finalize_turn_surface` — a sibling to the existing `finalize_turn_trace_hash` back-stamp. The pipeline owns the final surface decision, so it back-stamps the resolved `surface`/`articulation_surface` onto `turn_log[-1]` immediately after the trace-hash back-stamp (`pipeline.py`, right after `:809`). Operates on the most-recent `TurnEvent` (main or refusal-stub path); no-ops when unchanged or when no turn exists. - **Byte-identity preserved**: `trace_hash` folds the **pre-decoration** surface, not the served surface, so re-stamping `TurnEvent.surface` cannot move `trace_hash`. Diff: **+57 / −0** across 2 code files + the ledger. No control-flow change; mirrors an established pattern. ## Scope boundaries (deliberately NOT in this PR) - **T13 decision (2) — goldtether over-refusal — OPEN, needs a ruling.** Orthogonal to the red (telemetry now matches whatever is served). I recommend **against** a query-type "definitional/epistemic" classifier bypass: it fails a geometric coherence gate **open** on a lexical cue — the fail-open / cue-table pattern ADR-0252 retired and INV-34 / fail-closed forbid. Principled alternative: route open-geometry-but-**pack-grounded** surfaces to the existing hedge arm (`chat/refusal.py`; already mutually exclusive with refusal — `verdicts.py:42` "refusal supersedes hedge"), discriminated by grounding **provenance** (structural), not question type. Own PR + real-data validation. - **R7 — durable-sink deferral.** The opt-in telemetry sink still receives the pre-override event (same limitation `finalize_turn_trace_hash` already carries; default sink is `None`, so no live consumer is affected). A single deferred emission at the pipeline serve boundary would repair surface + `trace_hash` together. Ledgered. ## Validation - `tests/test_warmed_session_lane.py`: **10/10 passed** (`telemetry_consistency_rate` 0.9444 → **1.0**). - No new pyright diagnostics from the added method (pre-existing unused-import / operator findings untouched). [Verification]: `uv run core test --suite smoke -q` in worktree `core-wt-t13serve` @ `5a343b49` — **180 passed in 133.17s**, exit 0. Merge on your authorization (no-merge-automation doctrine).

core-labs added 1 commit 2026-07-23 04:30:13 +00:00

fix(pipeline): back-stamp served surface onto TurnEvent — close T13 telemetry-consistency red 5a343b49e9

CognitiveTurnPipeline emits TurnEvent inside runtime.chat() and only THEN
applies the #96 fail-closed surface resolution (resolve_surface) and the #97
logos-morph override — so an overridden turn's telemetry recorded a surface
the user never saw. warmed_session_consistency telemetry_consistency_rate was
0.9444 on main (fast-lane red since #96 e0d1b475): an audit/replay trust break
(Absolute Provenance).

Add ChatRuntime.finalize_turn_surface, a sibling to finalize_turn_trace_hash:
the pipeline owns the final surface decision, so it back-stamps the resolved
surface onto turn_log[-1] immediately after the trace-hash back-stamp.
trace_hash byte-identity is preserved — it folds the pre-decoration surface,
not the served surface.

Scope: telemetry-consistency half of T13 only.
- Decision (2), the goldtether over-refusal, is orthogonal to the red and
  OPEN pending ruling (ledger) — recommend AGAINST a query-type cue bypass
  (fail-open / ADR-0252-retired cue-table pattern); prefer routing
  open-geometry-but-pack-grounded surfaces to the existing hedge arm.
- Durable-sink deferral tracked as R7.

telemetry_consistency_rate 0.9444 -> 1.0 (10/10 warmed_session tests green).

[Verification]: uv run core test --suite smoke -q in core-wt-t13serve @ HEAD — 180 passed in 133.17s, exit 0; warmed_session lane 10/10 green.