core/capability/domains.py's DOMAIN_PACKS declares domain -> pack membership
for the capability ledger. Each packs/data/<pack>/manifest.json independently
declares domain_id. Two statements of one fact, and only one direction was
ever checked: domain_contract_predicates P3 validates domain_id -> a known
ledger domain. Nothing validated DOMAIN_PACKS -> the manifest agrees.
P3 passes VACUOUSLY on a manifest with no domain_id at all — the same shape as
its own test_pack_without_contract_reports_absent. So a pack that DOMAIN_PACKS
places in a domain, but whose manifest never says so, is invisible to every
check in the repository.
Measured: 7 of 9 bound, 0 contradictory, 2 absent — en_core_cognition_v1 and
en_core_meta_v1, both placed in philosophy_theology, which is one of the four
bands queued to earn a SERVE license behind R-8. The domain whose license is
next to be earned is the one whose binding exists in only one place.
Why nothing caught it: tests/test_domain_contract_predicates.py exercises
P1-P9 entirely against synthetic tmp_path manifests, never against the real
nine, and is itself in no curated suite. A predicate proven correct on
fabricated input and never run on the real input is this arc's defect class
stated precisely — its success state and "it never ran here" are
indistinguishable.
tests/test_domain_pack_binding.py, registered in smoke (on the gate):
- every pack DOMAIN_PACKS names has a manifest on disk
- a manifest that CONTRADICTS the table always fails
- a manifest with NO domain_id fails unless the pack is in UNBOUND_BASELINE
- the reverse direction: a pack may not self-assign a ledger domain the
table does not grant (clean across all 30 packs today, pinned because a
new manifest copying domain_id from a sibling is the obvious mistake and
would silently widen a licensed domain)
- both directions on the baseline: a pack that gains domain_id must leave it
- the parse is guarded against vacuity (N-1 has produced three false
conclusions in this repo)
- the count is pinned so the gap moving is a reviewed decision
Four sabotages, each observed red, each caught by its intended pin.
PINNED, NOT FIXED, deliberately. Whether en_core_cognition_v1 is a
philosophy_theology domain pack or merely grouped under that domain for ledger
accounting decides what the license actually covers. That is
ratification-adjacent content, not engineering, and it is routed to R-8 /
PR-14 where that band's license is decided. Sealing that ledger without
answering it licenses a domain whose membership is asserted in one place and
denied by silence in the other.
How it was found, recorded because the method is the point. An external
assessment proposed collapsing the pack/domain machinery, stating its method
up front: "I have enough from the directory and CLAIMS.md to reason
seriously." That is the method AGENTS.md protocol rule 1 forbids, and five of
its six proposals are falsified by opening the file — recorded in full in
31-hindrance-audit.md, in short:
- conftest.py "almost certainly" holds suite-membership logic: it holds two
autouse fixtures and two data registries, and its collection hook stamps
markers and never skips. Zero membership logic.
- cli_test.py "almost certainly a nested conditional or a big dict": a flat
dict, 17 keys, zero conditionals in the module body.
- field/algebra/morphology as a peer triad needing a single serve(): 72, 15
and 3 importers respectively, morphology is 97 lines, and no def serve(
exists anywhere in core/, chat/ or generate/.
- the grade space is richer than the serve layer consumes: all 15
EpistemicState members have non-test consumers.
- constraints: blocks in 314 ADRs: that is 314 new places that must be kept
true, inside ratified immutable records, in the repository whose dominant
defect class is records drifting from reality. The existing design puts
the machine-readable half in the checker that reads the ADR, which is
better on purpose.
- a root contracts.toml as "the highest-leverage single change": the
principle is already ADR-0263 Rule 5 and is implemented in the very file
the assessment cites. Centralizing four tables with four authorities adds
a fifth copy that must agree with four generators.
The seam it pointed at was real even though every specific was wrong. Bad
method, useful direction; both halves recorded, and the triage rule earns a
second demonstration — every rejected proposal failed on a file its author did
not open.
AGENTS.md — the standing philosophy revised to eleven, per Shay's review.
- "be quick to be humble" -> "investigate yourself first". Speed is a
consequence of reflex, not a criterion; writing it in makes velocity sound
like the point. Examples replaced with three that are verifiable in-repo:
the H-13 refcount claim, and the two rulings that were about to be
recorded stronger than they were made.
- the defect-class principle gains its prescriptive half as its own
sentence, and gains this commit's instance: a predicate that passes
vacuously on the input it was written for.
- NEW #2: don't build a ratchet to guard a ratchet. Placed adjacent to
"less is more" and named as its corollary so it does not read as
duplication. The arc paid for it — a membership ratchet needed a
reachability ratchet to mean anything, and what actually shrank the gap
was deleting four suites nobody called.
- NEW #10: a closed issue is not evidence the problem is gone. G-7 was
CLOSED and REOPENED-PARTLY inside one arc; H-13 was closed with a fix that
did not work.
Two review points were already satisfied in the file and are recorded as such
rather than re-applied: the defect-class principle already stood alone on its
first line, and already sat at position 3, not 8. The review was reading a
chat summary, not AGENTS.md — which is, exactly, reviewing the record instead
of the reality.
PR-5 additionally owes one page: an index of which declared tables exist and
what pin makes each true. That is the defensible residue of the contracts.toml
proposal, and explicitly not a fifth copy of four tables.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
ca5e614ec8