coulomb/clay-borg
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
clay-borg/facts.toml

131 lines
2.2 KiB
TOML
Raw Normal View History

CB-WP-0004 T04: fact registry and make facts-check — DFD gets a gate Duplicated-fact drift is the fourth error class and the only one with no executable rule. No positive control catches it (both copies are internally consistent) and re-derivation does not either (the copy reproduces whatever it was copied from). It is caught only by reading a copy against its source, which nothing in the loop required. facts.toml holds 15 facts and is GENERATED by `make facts-gen` from cb-cost, dep-weight and rule-coverage. The trap this task named — a hand-maintained registry that becomes another drifting copy — is closed by facts-check re-running the instruments and failing when the committed registry disagrees with them. A stale registry cannot certify stale artifacts. An artifact quoting a fact tags it: **$93.15** <!-- fact --> with the key. 17 occurrences across 5 artifacts are now checked. Falsified before being believed: changing CostAccounting.md line 158 from $93.15 to $92.87 — the exact historical drift — produced exit 1 naming the file, the line and the expected value. Tested against the class it exists to catch, on a real artifact, not only in its self-test. It then caught a live tag inside its own documentation example in InnerLoop.md within the hour. Third time a gate has failed on its own pass's work. What it does not close is stated rather than implied: 22 untagged literal copies remain and are reported, not failed. Tagging is opt-in, a number can legitimately recur, and a gate that fires on coincidence gets routed around. Naming the uncovered surface beats claiming the class is closed. InnerLoop single-source-of-fact moves from prose to executable — v1.3. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 10:24:39 +02:00
# GENERATED — do not edit. `make facts-gen` rewrites this file.
#
# The single source of fact for numbers that appear in more than
# one artifact (InnerLoop v1.2). Every value here is produced by
# the instrument named in its `by` field, on the current tree.
# `make facts-check` fails if this file disagrees with the
# instruments, or if a tagged artifact disagrees with this file.
CB-WP-0006 T04: withdraw AM-4c; and fix where AM-6 is measured AM-4c is withdrawn from the acceptance table and retained as a reported diagnostic. GameKernel §5a carries the argument. The ratio has no monotone better direction. INTENT's rule is "own the semantics, assimilate the implementation": rising can mean owning semantics properly or reimplementing what should have been assimilated; falling can mean leverage or dependency bloat. A target requires knowing which way is better. It is also redundant — AM-4a/AM-4b bound the denominator and AM-2 bounds own-source density, so AM-4c is a ratio of two already-targeted quantities. Measured at withdrawal: 1,426 own lines per 100k third-party (shipped), 1,107 (dev). make dep-weight now prints both, labelled diagnostic — the row was never actually reported before. M-D1-MUT keeps AM-4c in its denominator on purpose and says so in the output. Dropping it would move the score 7/14 -> 7/13 without enforcing anything: a score improved by deleting the question. Decided before Phase B deliberately, since ADR-0005 predicts own-source growth that will move this ratio; deciding after would be the retarget §Step 4 forbids. A T01 correction found here. The AM-6 gate failed inside `make all` at 38,753 ev/s against 341,280 in isolation — a 9x drop, because cargo test runs binaries and threads concurrently. A throughput assertion inside a parallel harness measures contention, not throughput. T01's measurement was valid; its gate placement was not. Fixed by running it only where valid — #[ignore] plus `make am6` in release with --test-threads=1, now 2.0M ev/s at 20.2x headroom — and not by lowering the target, which T01 forbade. My first attempt did drift that way, adding a debug "sanity floor" of 50,000, and was backed out: a second threshold is still a second chance to tune. The mutation then went SURVIVED on the first run after the move. 4,000 black_box iterations were calibrated against debug's 3.4x headroom and are invisible against release's 20x. Raised to 100,000; back to red. A weak mutation is not a fixed property of a row — it can become weak when the row's measurement conditions change. Tier S (amends one row, creates no capability), chaos d4=2, no override. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 10:06:00 +02:00
generated = "2026-08-01"
CB-WP-0004 T04: fact registry and make facts-check — DFD gets a gate Duplicated-fact drift is the fourth error class and the only one with no executable rule. No positive control catches it (both copies are internally consistent) and re-derivation does not either (the copy reproduces whatever it was copied from). It is caught only by reading a copy against its source, which nothing in the loop required. facts.toml holds 15 facts and is GENERATED by `make facts-gen` from cb-cost, dep-weight and rule-coverage. The trap this task named — a hand-maintained registry that becomes another drifting copy — is closed by facts-check re-running the instruments and failing when the committed registry disagrees with them. A stale registry cannot certify stale artifacts. An artifact quoting a fact tags it: **$93.15** <!-- fact --> with the key. 17 occurrences across 5 artifacts are now checked. Falsified before being believed: changing CostAccounting.md line 158 from $93.15 to $92.87 — the exact historical drift — produced exit 1 naming the file, the line and the expected value. Tested against the class it exists to catch, on a real artifact, not only in its self-test. It then caught a live tag inside its own documentation example in InnerLoop.md within the hour. Third time a gate has failed on its own pass's work. What it does not close is stated rather than implied: 22 untagged literal copies remain and are reported, not failed. Tagging is opt-in, a number can legitimately recur, and a gate that fires on coincidence gets routed around. Naming the uncovered surface beats claiming the class is closed. InnerLoop single-source-of-fact moves from prose to executable — v1.3. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 10:24:39 +02:00
pin = "fc76445"
[am4a_loc]
value = 246250
text = "246,250"
fmt = "{:,}"
by = "tools/dep-weight.py"
[am4a_target]
value = 250000
text = "250,000"
fmt = "{:,}"
by = "tools/dep-weight.py TARGETS"
[am4b_loc]
value = 317021
text = "317,021"
fmt = "{:,}"
by = "tools/dep-weight.py"
[am4b_target]
value = 350000
text = "350,000"
fmt = "{:,}"
by = "tools/dep-weight.py TARGETS"
CB-WP-0005 T02: M-D1-MUT — 4 of 14 acceptance rows are enforced For each acceptance row in GameKernel §5, invert the property and require the verifying command to go red. adapted:mutation-testing, with the denominator changed from source lines to acceptance rows. M-D1-MUT: 4/14 rows enforced PARTIAL 2 (AM-7, AM-8 — some clauses live, some inert) unmutatable 8 (no property to invert, reason stated per row) SURVIVED 0 Two corrections to our own numbers. There are 14 rows, not the twelve ADR-0005 and CB-WP-0005 both asserted — AM-4 splits into a/b/c. And the prediction of 9-of-12 (75%) becomes >=10 of 14; measured 4 (29%), badly unmet. No target moved in this commit. The second correction matters more. My first run reported two SURVIVED rows and both were my own no-op mutations: `pub struct NullRng;` -> `pub struct NullRng {}` is semantically identical, and renaming max_age_days does nothing because CA-17 reads it with a default of 90. Both would have been published as "this row asserts nothing" — a false accusation against code that is fine. Replaced with real inversions (a per-construction counter in the ChaCha seed; reverting AC-9's output resolution to the first-wins bug it was fixed for), after which both go red. T08 asks whether writing a weak mutation is the new grep. It is, demonstrably, on the first attempt. The finding is larger than the workplan assumed. 8 of 14 rows are unmutatable — AM-2, AM-3, AM-4c, AM-5, AM-6, AM-9, AM-10, AM-11 have no instrument at all. AM-6 is the sharpest: nothing in the workspace compares any number to 100,000 events/s, the headline throughput claim. The problem is not three unimplemented rules, it is that more than half the acceptance table has nothing behind it. Harness controls: a stale find-string reports HARNESS-BROKEN rather than scoring the baseline as the mutant; a red baseline reports inconclusive rather than red; the tree is restored in a finally and the restoration is verified. Not in `make all` — it rebuilds the workspace once per row. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 17:27:23 +02:00
[am_rows]
value = 14
text = "14"
fmt = "{:,}"
by = "tools/mutation-check.py"
[am_unmutatable]
CB-WP-0006 T05: K9's assertion, K11's format, and the AM-11 suites K11 is implemented: crates/cb-events/src/store.rs, magic + version header, 4-byte little-endian length prefix, append-only. Reimplemented not assimilated per ADR-0005 §2 — no new dependency, and AM-4a/AM-4b are unchanged at 246,250 / 317,021 because nothing entered the graph. The operative clause is "detected", so corruption is tested rather than assumed: a tail short by one byte, a half-written length prefix, a length prefix corrupted to claim more than the file holds, foreign magic, and a future format version are each rejected with a distinct error. A reader that accepts a truncated tail is worse than no format, because it silently returns a short history that looks complete. AM-11 is earned. LogStore has two impls — MemLogStore and FileLogStore — driven through ONE conformance(). The trait carries raw/set_raw precisely so the corruption controls live in the shared suite: a format contract that only one impl enforces is not a contract. The same shape is retro-fitted to KernelRng, which is what AM-11 actually names: ChaChaRng and NullRng now pass one suite asserting bounds, draw(1) == 0, determinism across fresh instances, and shuffle preserving the multiset. They were previously exercised by two separate tests, which is why "met, narrow" was never earned and ADR-0005 §4 downgraded it. K9 gets the assertion it did not have: snapshot at seq N + events N+1..M must equal the from-genesis fold, hash-compared, on GroundState, single-seed on purpose — AM-7's probe folds a multi-seed log, which is not a replay of anything, and that defect is not repeated. Two positive controls: the log must exceed 50 events, and the mid-log snapshot must differ from the end state or "apply the remainder" is vacuous. Proof it works: the exact mutation that SURVIVED in CB-WP-0005 — making Snapshot::take discard its EventSeq — now fails on the K9 assertion. AM-11's mutation breaks NullRng::draw to return its bound and the shared suite fails. That is what M-D4-SWAP claims — either impl substitutable — and exactly what two separate per-impl tests could never demonstrate. M-D1-MUT: 7 -> 8 of 14. CB-EV-0001's scoreboard is refreshed: AM-2, AM-5 and AM-9 added, AM-6 moved to enforced, and the headline total corrected from 4 to 8 — it had gone stale inside the same workplan that produced it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 10:50:52 +02:00
value = 4
text = "4"
CB-WP-0005 T02: M-D1-MUT — 4 of 14 acceptance rows are enforced For each acceptance row in GameKernel §5, invert the property and require the verifying command to go red. adapted:mutation-testing, with the denominator changed from source lines to acceptance rows. M-D1-MUT: 4/14 rows enforced PARTIAL 2 (AM-7, AM-8 — some clauses live, some inert) unmutatable 8 (no property to invert, reason stated per row) SURVIVED 0 Two corrections to our own numbers. There are 14 rows, not the twelve ADR-0005 and CB-WP-0005 both asserted — AM-4 splits into a/b/c. And the prediction of 9-of-12 (75%) becomes >=10 of 14; measured 4 (29%), badly unmet. No target moved in this commit. The second correction matters more. My first run reported two SURVIVED rows and both were my own no-op mutations: `pub struct NullRng;` -> `pub struct NullRng {}` is semantically identical, and renaming max_age_days does nothing because CA-17 reads it with a default of 90. Both would have been published as "this row asserts nothing" — a false accusation against code that is fine. Replaced with real inversions (a per-construction counter in the ChaCha seed; reverting AC-9's output resolution to the first-wins bug it was fixed for), after which both go red. T08 asks whether writing a weak mutation is the new grep. It is, demonstrably, on the first attempt. The finding is larger than the workplan assumed. 8 of 14 rows are unmutatable — AM-2, AM-3, AM-4c, AM-5, AM-6, AM-9, AM-10, AM-11 have no instrument at all. AM-6 is the sharpest: nothing in the workspace compares any number to 100,000 events/s, the headline throughput claim. The problem is not three unimplemented rules, it is that more than half the acceptance table has nothing behind it. Harness controls: a stale find-string reports HARNESS-BROKEN rather than scoring the baseline as the mutant; a red baseline reports inconclusive rather than red; the tree is restored in a finally and the restoration is verified. Not in `make all` — it rebuilds the workspace once per row. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 17:27:23 +02:00
fmt = "{:,}"
by = "tools/mutation-check.py"
CB-WP-0004 T04: fact registry and make facts-check — DFD gets a gate Duplicated-fact drift is the fourth error class and the only one with no executable rule. No positive control catches it (both copies are internally consistent) and re-derivation does not either (the copy reproduces whatever it was copied from). It is caught only by reading a copy against its source, which nothing in the loop required. facts.toml holds 15 facts and is GENERATED by `make facts-gen` from cb-cost, dep-weight and rule-coverage. The trap this task named — a hand-maintained registry that becomes another drifting copy — is closed by facts-check re-running the instruments and failing when the committed registry disagrees with them. A stale registry cannot certify stale artifacts. An artifact quoting a fact tags it: **$93.15** <!-- fact --> with the key. 17 occurrences across 5 artifacts are now checked. Falsified before being believed: changing CostAccounting.md line 158 from $93.15 to $92.87 — the exact historical drift — produced exit 1 naming the file, the line and the expected value. Tested against the class it exists to catch, on a real artifact, not only in its self-test. It then caught a live tag inside its own documentation example in InnerLoop.md within the hour. Third time a gate has failed on its own pass's work. What it does not close is stated rather than implied: 22 untagged literal copies remain and are reported, not failed. Tagging is opt-in, a number can legitimately recur, and a gate that fires on coincidence gets routed around. Naming the uncovered surface beats claiming the class is closed. InnerLoop single-source-of-fact moves from prose to executable — v1.3. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 10:24:39 +02:00
[gr_covered]
value = 58
text = "58"
fmt = "{:,}"
by = "tools/rule-coverage.py"
[gr_linked]
value = 49
text = "49"
fmt = "{:,}"
by = "tools/rule-coverage.py"
[gr_rules]
value = 58
text = "58"
fmt = "{:,}"
by = "tools/rule-coverage.py"
[gr_scenarios]
value = 21
text = "21"
fmt = "{:,}"
by = "tools/rule-coverage.py"
CB-WP-0005 T01: spec->code link over every numbered spec and every crate AGGREGATE becomes a list of source roots and rule patterns become per-spec, so the link runs over every numbered spec x every crate rather than GroundRules.md x games/ground/src/lib.rs. The prediction held on the first run: AM-1b kernel spec->code link: 15/18 (83%) across 10 source files unlinked: K10 K14 K18 Kernel rules are link-only by design, and the output says so: they are kernel invariants with no aggregate, setup preset or command vocabulary, so scenarios/kernel/*.yaml with covers: [K11] would be a tag in a directory the runner cannot dispatch. Claiming scenario coverage for them is the inflation this gate exists to prevent. Per ADR-0005 §5 the kernel arm reports without feeding the exit code until 2026-08-31, then binds — the date in the tool, not in prose, with days remaining printed every run, because open-ended "gate it later" is how AM-4's targets went unratified for four workplans. The self-test asserts the gate returns 0 before that date and 2 after. The zero-rules positive control is replicated on the new denominator: a kernel regex that stops matching aborts rather than printing 0/0 as though it were 100%. The self-test passed while the tool was completely broken. A print( inside say() became say(), so every real `make coverage` died with RecursionError while --self-test reported all-ok — it only ever called kernel_arm(quiet=True) and never executed the reporting path. The control named the behaviour and did not assert it, which is precisely what this workplan is about. Fixed by exercising the loud path and asserting it prints, then verified by re-breaking say() and confirming both new checks go red. Seventh instance of the harness-does-nothing shape, in the tool written to find that shape. Also caught by its own gate: a self-test label that printed "0 K-ids" beside a passing ">5" assertion, because the detail string rebuilt the pattern with different escaping. A label that contradicts its own check is worse than no label. k_rules, k_linked and k_unlinked are registered facts under facts-check. A limit of that checker is recorded rather than patched: it is line-based, so a tagged value that prose-wraps fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 16:54:07 +02:00
[k_linked]
CB-WP-0006 T06: K10 replay bundles, --replay, and AM-7 re-earned INTENT design decision 8 of 10, unimplemented for six passes. cb-sim had no flag parsing at all, so --replay had nowhere to go. The bundle is manifest + commands.log + initial.snapshot + expected.yaml, dev-only behind the scenarios feature and charged to AM-4b. The command stream goes through the K11 framing built in T05, so a truncated bundle is detected rather than replayed short — the two tasks compose rather than duplicating. The reviewer's D2 correction was real: this was not "a directory of four files". Pass carried only the end state, RunOutcome::Failed was a formatted String, and scenario.rs created an EventLog, appended to it and never read it. All three had to change. The first round trip failed to reproduce, and the cause is worth keeping: state_hash_hex over a serde_json::Value is a different canonical form than over the typed aggregate — Value's map is key-sorted, a struct serializes in declaration order. The bundle was written with one basis and verified with the other. A round trip written to recompute its own comparison value would have PASSED this bug; it failed because the recorded hash came from the producing process, which is control 2's entire purpose. make replay-test implements ADR-0005 §6's four controls, 14/14: a committed deliberately-failing fixture outside the corpus with covers: [] so it neither fails `make sim` nor inflates AM-1; a tampered recorded hash must fail; a log short by one byte and a corrupted length prefix must be rejected; and a mutated manifest seed must fail — which bites only because replay re-derives the initial state from seed+setup and checks it against the recorded snapshot, since restoring from the snapshot alone would leave the seed inert. Plus a control on the controls: the bundle must still replay after every mutation is reverted. AM-7's hash-identical clause is re-earned. The probe records a hash per per-game segment and replays each from its own genesis; folding from the wrong seed now fails. That is the clause ADR-0005 §4 withdrew as mutation-proven inert. The scaling >= 0.9x clause is still unenforced, so AM-7 stays PARTIAL — reported, not rounded up. Kernel coverage 15/18 -> 16/18. facts-check immediately caught the spec's copy of that number going stale, on a number that moved the same hour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 11:05:37 +02:00
value = 16
text = "16"
CB-WP-0005 T01: spec->code link over every numbered spec and every crate AGGREGATE becomes a list of source roots and rule patterns become per-spec, so the link runs over every numbered spec x every crate rather than GroundRules.md x games/ground/src/lib.rs. The prediction held on the first run: AM-1b kernel spec->code link: 15/18 (83%) across 10 source files unlinked: K10 K14 K18 Kernel rules are link-only by design, and the output says so: they are kernel invariants with no aggregate, setup preset or command vocabulary, so scenarios/kernel/*.yaml with covers: [K11] would be a tag in a directory the runner cannot dispatch. Claiming scenario coverage for them is the inflation this gate exists to prevent. Per ADR-0005 §5 the kernel arm reports without feeding the exit code until 2026-08-31, then binds — the date in the tool, not in prose, with days remaining printed every run, because open-ended "gate it later" is how AM-4's targets went unratified for four workplans. The self-test asserts the gate returns 0 before that date and 2 after. The zero-rules positive control is replicated on the new denominator: a kernel regex that stops matching aborts rather than printing 0/0 as though it were 100%. The self-test passed while the tool was completely broken. A print( inside say() became say(), so every real `make coverage` died with RecursionError while --self-test reported all-ok — it only ever called kernel_arm(quiet=True) and never executed the reporting path. The control named the behaviour and did not assert it, which is precisely what this workplan is about. Fixed by exercising the loud path and asserting it prints, then verified by re-breaking say() and confirming both new checks go red. Seventh instance of the harness-does-nothing shape, in the tool written to find that shape. Also caught by its own gate: a self-test label that printed "0 K-ids" beside a passing ">5" assertion, because the detail string rebuilt the pattern with different escaping. A label that contradicts its own check is worse than no label. k_rules, k_linked and k_unlinked are registered facts under facts-check. A limit of that checker is recorded rather than patched: it is line-based, so a tagged value that prose-wraps fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 16:54:07 +02:00
fmt = "{:,}"
by = "tools/rule-coverage.py"
[k_rules]
value = 18
text = "18"
fmt = "{:,}"
by = "tools/rule-coverage.py"
[k_unlinked]
CB-WP-0006 T06: K10 replay bundles, --replay, and AM-7 re-earned INTENT design decision 8 of 10, unimplemented for six passes. cb-sim had no flag parsing at all, so --replay had nowhere to go. The bundle is manifest + commands.log + initial.snapshot + expected.yaml, dev-only behind the scenarios feature and charged to AM-4b. The command stream goes through the K11 framing built in T05, so a truncated bundle is detected rather than replayed short — the two tasks compose rather than duplicating. The reviewer's D2 correction was real: this was not "a directory of four files". Pass carried only the end state, RunOutcome::Failed was a formatted String, and scenario.rs created an EventLog, appended to it and never read it. All three had to change. The first round trip failed to reproduce, and the cause is worth keeping: state_hash_hex over a serde_json::Value is a different canonical form than over the typed aggregate — Value's map is key-sorted, a struct serializes in declaration order. The bundle was written with one basis and verified with the other. A round trip written to recompute its own comparison value would have PASSED this bug; it failed because the recorded hash came from the producing process, which is control 2's entire purpose. make replay-test implements ADR-0005 §6's four controls, 14/14: a committed deliberately-failing fixture outside the corpus with covers: [] so it neither fails `make sim` nor inflates AM-1; a tampered recorded hash must fail; a log short by one byte and a corrupted length prefix must be rejected; and a mutated manifest seed must fail — which bites only because replay re-derives the initial state from seed+setup and checks it against the recorded snapshot, since restoring from the snapshot alone would leave the seed inert. Plus a control on the controls: the bundle must still replay after every mutation is reverted. AM-7's hash-identical clause is re-earned. The probe records a hash per per-game segment and replays each from its own genesis; folding from the wrong seed now fails. That is the clause ADR-0005 §4 withdrew as mutation-proven inert. The scaling >= 0.9x clause is still unenforced, so AM-7 stays PARTIAL — reported, not rounded up. Kernel coverage 15/18 -> 16/18. facts-check immediately caught the spec's copy of that number going stale, on a number that moved the same hour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 11:05:37 +02:00
value = 'K14 K18'
text = "K14 K18"
CB-WP-0005 T01: spec->code link over every numbered spec and every crate AGGREGATE becomes a list of source roots and rule patterns become per-spec, so the link runs over every numbered spec x every crate rather than GroundRules.md x games/ground/src/lib.rs. The prediction held on the first run: AM-1b kernel spec->code link: 15/18 (83%) across 10 source files unlinked: K10 K14 K18 Kernel rules are link-only by design, and the output says so: they are kernel invariants with no aggregate, setup preset or command vocabulary, so scenarios/kernel/*.yaml with covers: [K11] would be a tag in a directory the runner cannot dispatch. Claiming scenario coverage for them is the inflation this gate exists to prevent. Per ADR-0005 §5 the kernel arm reports without feeding the exit code until 2026-08-31, then binds — the date in the tool, not in prose, with days remaining printed every run, because open-ended "gate it later" is how AM-4's targets went unratified for four workplans. The self-test asserts the gate returns 0 before that date and 2 after. The zero-rules positive control is replicated on the new denominator: a kernel regex that stops matching aborts rather than printing 0/0 as though it were 100%. The self-test passed while the tool was completely broken. A print( inside say() became say(), so every real `make coverage` died with RecursionError while --self-test reported all-ok — it only ever called kernel_arm(quiet=True) and never executed the reporting path. The control named the behaviour and did not assert it, which is precisely what this workplan is about. Fixed by exercising the loud path and asserting it prints, then verified by re-breaking say() and confirming both new checks go red. Seventh instance of the harness-does-nothing shape, in the tool written to find that shape. Also caught by its own gate: a self-test label that printed "0 K-ids" beside a passing ">5" assertion, because the detail string rebuilt the pattern with different escaping. A label that contradicts its own check is worse than no label. k_rules, k_linked and k_unlinked are registered facts under facts-check. A limit of that checker is recorded rather than patched: it is line-based, so a tagged value that prose-wraps fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 16:54:07 +02:00
fmt = "{}"
by = "tools/rule-coverage.py"
CB-WP-0004 T04: fact registry and make facts-check — DFD gets a gate Duplicated-fact drift is the fourth error class and the only one with no executable rule. No positive control catches it (both copies are internally consistent) and re-derivation does not either (the copy reproduces whatever it was copied from). It is caught only by reading a copy against its source, which nothing in the loop required. facts.toml holds 15 facts and is GENERATED by `make facts-gen` from cb-cost, dep-weight and rule-coverage. The trap this task named — a hand-maintained registry that becomes another drifting copy — is closed by facts-check re-running the instruments and failing when the committed registry disagrees with them. A stale registry cannot certify stale artifacts. An artifact quoting a fact tags it: **$93.15** <!-- fact --> with the key. 17 occurrences across 5 artifacts are now checked. Falsified before being believed: changing CostAccounting.md line 158 from $93.15 to $92.87 — the exact historical drift — produced exit 1 naming the file, the line and the expected value. Tested against the class it exists to catch, on a real artifact, not only in its self-test. It then caught a live tag inside its own documentation example in InnerLoop.md within the hour. Third time a gate has failed on its own pass's work. What it does not close is stated rather than implied: 22 untagged literal copies remain and are reported, not failed. Tagging is opt-in, a number can legitimately recur, and a gate that fires on coincidence gets routed around. Naming the uncovered surface beats claiming the class is closed. InnerLoop single-source-of-fact moves from prose to executable — v1.3. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 10:24:39 +02:00
[pinned_main]
value = 92.03371920000004
text = "$92.03"
fmt = "${:,.2f}"
by = "tools/cb-cost.py --pin fc76445"
[pinned_mechanical_cost]
value = 33.3506319
text = "$33.35"
fmt = "${:,.2f}"
by = "tools/cb-cost.py --pin fc76445"
[pinned_mechanical_share]
value = 36
text = "36%"
fmt = "{:d}%"
by = "tools/cb-cost.py --pin fc76445"
[pinned_mechanical_turns]
value = 167
text = "167"
fmt = "{:,}"
by = "tools/cb-cost.py --pin fc76445"
[pinned_responses]
value = 346
text = "346"
fmt = "{:,}"
by = "tools/cb-cost.py --pin fc76445"
[pinned_subagent]
value = 1.1137235
text = "$1.11"
fmt = "${:,.2f}"
by = "tools/cb-cost.py --pin fc76445"
[pinned_total]
value = 93.14744270000004
text = "$93.15"
fmt = "${:,.2f}"
by = "tools/cb-cost.py --pin fc76445"
Reference in a new issue Copy permalink