From e2a2957b3a68935c375ea965604c890b3592a4c0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 31 Jul 2026 17:58:36 +0200 Subject: [PATCH] Fix loadability, and put the deferred analysis where the work is MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit loop-lint failed: CB-WP-0005 was 401 lines against a ~400 limit, one over, after the status-vocabulary note. Pushed before checking — my error; the gate caught it on the next run. The fix is not a trim. The gate exposed a circular reference I had created: CB-WP-0005's cancelled tasks held the full analysis while CB-WP-0006 pointed back at them for detail, so the live workplan deferred to a cancelled one. The analysis now lives in CB-WP-0006 Phase B next to the work, and CB-WP-0005 keeps a forward pointer per task. One copy, single source of fact, and the reference points forward. CB-WP-0006 T05 and T06 gain the detail that moved: K9's mutation proof and what its acceptance property actually is, K11's detection clause and budget attribution, and the D2 correction the reviewer forced — the bundle is not "a directory of four files" but a change to the runner's data flow, because scenario.rs creates an EventLog, appends to it and never reads it. Co-Authored-By: Claude Opus 5 --- workplans/CB-WP-0005-assertion-coverage.md | 88 ++++---------------- workplans/CB-WP-0006-instrument-the-table.md | 47 ++++++++--- 2 files changed, 50 insertions(+), 85 deletions(-) diff --git a/workplans/CB-WP-0005-assertion-coverage.md b/workplans/CB-WP-0005-assertion-coverage.md index 42adcb2..0a89d94 100644 --- a/workplans/CB-WP-0005-assertion-coverage.md +++ b/workplans/CB-WP-0005-assertion-coverage.md @@ -244,102 +244,46 @@ downgrade inline, so a reader of the spec cannot reach the old claim. > one: *these* task records are superseded, and equivalents live in > CB-WP-0006 T05–T07. The work is deferred, not abandoned. -## Phase C — implement what the instruments expose (deferred) +## Phase C — implement what the instruments expose (cancelled here) -## Task: K9 and K11 — durable log, LogStore port, real conformance suite +The three tasks below were written in full, then cancelled unstarted. Their +analysis now lives where the work will happen — **[CB-WP-0006](CB-WP-0006-instrument-the-table.md) +Phase B** — rather than here, so there is one copy and it is next to the +code it describes. What each was, and what it became: + +## Task: K9 and K11 — durable log, LogStore port, conformance suite ```task id: CB-WP-0005-T04 status: cancel -priority: high state_hub_task_id: "35876b28-97ac-4379-bb71-72e74c4116d4" ``` -**K9** currently round-trips a `BTreeMap` with `EventSeq(17)` -as a literal. Deliver the real property: *snapshot at seq N + events -N+1..M ≡ genesis fold*, on `GroundState`, hash-compared. - -**K11** — append-only, length-prefixed, versioned framing, with a -truncated tail **detected**. Reimplemented, not assimilated (ADR-0005 §2): -~100 lines against a format Kafka and EventStore converged on -independently. Charged to **AM-4a** (shipped runtime, 1.5% headroom) and -adds no dependency. - -**The port** (ADR-0005 §3): a `LogStore` trait with a shared -`fn conformance(…)` driven by an in-memory impl **and** a -file-backed impl. Retro-fit the same shape to `KernelRng`, whose pair is -currently exercised by two separate non-shared tests — which is why AM-11 -was never earned. - -Negative controls, not optional: truncate by one byte → reject; corrupt -the length prefix → reject. K11's operative clause is *detection*. +K9's acceptance property is mutation-proven unasserted; K11 has no durable +format; AM-11's conformance suite does not exist. → **CB-WP-0006 T05**. ## Task: K10 — the replay bundle and `--replay` ```task id: CB-WP-0005-T05 status: cancel -priority: high state_hub_task_id: "8592b6e7-8b83-4b47-b310-90e16a35eb6a" ``` -INTENT design decision **8 of 10**, unimplemented. `cb-sim` has no flag -parsing at all, so `--replay` has nowhere to go yet. +INTENT design decision 8 of 10, unimplemented; four controls required +verbatim from ADR-0005 §6. → **CB-WP-0006 T06**. -D2 note carried from the review: this is **not** "a directory of four -files". `scenario.rs` creates an `EventLog`, appends to it and never reads -it — the one production instantiation of the K11 log is a write-only sink. -`Pass` carries the *end* state, not an initial snapshot, and failures are a -formatted `String`, not structured expected-vs-actual. Plumb the log out of -`execute`, capture an initial snapshot, restructure `RunOutcome::Failed`. - -The bundle writer is **dev-only** behind the `scenarios` feature and is -charged to **AM-4b** (9.4% headroom), not AM-4a. - -**Four controls, from ADR-0005 §6, verbatim and all required:** - -1. a committed **deliberately-failing fixture** scenario, plus an - assertion that bundles produced `> 0` and equals expected failures — - all 21 scenarios pass today, so a corpus sweep verifies zero bundles - and prints `ok`; -2. the comparison hash **read out of the bundle**, written by the first - process — never recomputed in the second, which is `assert_eq!(h, h)` - and the AM-7 defect exactly; -3. truncate-by-one-byte and corrupt-length-prefix rejection; -4. a **mutated-seed** control: change the manifest seed and the replay - must fail to reproduce. A round-trip that cannot fail proves nothing. - -## Task: K14 and K18 — implement, or amend the spec and say why +## Task: K14 and K18 — implement, or amend the spec ```task id: CB-WP-0005-T06 status: cancel -priority: medium -state_hub_task_id: "774b1c8a-71c1-4e0a-91b1-0247a3e397cf" +state_hub_task_id: "774b1c8a-3b26-4c4f-a2c8-46cb0b7ba5a7" ``` -Both are named nowhere in source, and both have an honest second option -that must be considered rather than assumed away. - -**K14** — "one commit window per Select". `CommitWindow` exists, has zero -non-test users, and `games/ground` does not import it; GROUND collects -selections in its own aggregate. Either wire GROUND through the runtime -primitive as K14 requires, **or** amend K14 to describe what the kernel -actually guarantees and record why the primitive stays. A dead abstraction -certified by a test that exercises only itself is worse than no -abstraction — it is an AM-11-shaped claim waiting to be quoted. - -**K18** — "Criterion benches driving the same scenario format". The bench -hardcodes commands in Rust and never touches `ScenarioFile`, and -`benchmarks/` contains only `baselines/model-prices.toml` against a spec -that says benches live there. Either drive the bench from scenario files, -**or** amend K18 and MetricsAndScenarios §3 to match reality. - -Whichever way each goes, the outcome is a rule and an implementation that -agree. Deleting a rule to make a gate green is forbidden; deleting a rule -*with an argument*, recorded, is a legitimate outcome and the more likely -one for K18. - +`CommitWindow` has zero non-test users; the bench never touches +`ScenarioFile`. Implement, or amend with a recorded argument. → +**CB-WP-0006 T07**. ## Phase D — measure it, then say what the loop should change ## Task: control loop — did the numbers get worse, then better? diff --git a/workplans/CB-WP-0006-instrument-the-table.md b/workplans/CB-WP-0006-instrument-the-table.md index 0068c85..dd491be 100644 --- a/workplans/CB-WP-0006-instrument-the-table.md +++ b/workplans/CB-WP-0006-instrument-the-table.md @@ -128,11 +128,11 @@ threshold *after* seeing that movement would be the retarget InnerLoop ## Phase B — the kernel work inherited from CB-WP-0005 -> These three carry their full analysis in -> [CB-WP-0005](CB-WP-0005-assertion-coverage.md) Phase C, where they were -> written and then deferred unstarted. They are summarized here; read that -> file for the detail, the four replay controls, and the D2 correction on -> what the bundle writer actually requires. +> These three were written in [CB-WP-0005](CB-WP-0005-assertion-coverage.md) +> Phase C and cancelled unstarted. Their analysis lives **here**, next to +> the work — CB-WP-0005 keeps only a forward pointer, so there is one copy. +> The normative controls are in +> [ADR-0005](../decisions/ADR-0005-assertion-coverage-and-replay.md) §6. ## Task: K9 and K11 — durable log, LogStore port, real conformance suite @@ -143,9 +143,20 @@ priority: high state_hub_task_id: "2a357dbf-3861-499d-a12e-f7682b7332f6" ``` -Inherited from CB-WP-0005 T04. K9's acceptance property (snapshot at N + -events N+1..M ≡ genesis fold) is mutation-proven unasserted; K11 has no -durable format at all. The `LogStore` port with a shared +**K9** — the acceptance property is *snapshot at seq N + events N+1..M ≡ +genesis fold*, hash-compared, on `GroundState`. What exists instead is one +test round-tripping a `BTreeMap` with `EventSeq(17)` as a +literal: no game aggregate, no events applied, no from-genesis comparison. +Mutation-proven — making `Snapshot::take` discard its `EventSeq` leaves the +test green, so the half of K9 that says "+ the EventId it includes" is +unverified. `Snapshot` has no callers outside its own test. + +**K11** — append-only, length-prefixed, versioned framing, with a truncated +tail **detected**; the operative clause is *detection*, so truncate-by-one- +byte and corrupt-length-prefix rejection are required, not optional. +Reimplemented rather than assimilated (ADR-0005 §2): ~100 lines against a +format Kafka and EventStore converged on independently, adding no +dependency, charged to **AM-4a** (shipped runtime, 1.5% headroom). The `LogStore` port with a shared `fn conformance(…)`, retro-fitted to `KernelRng`, is what finally earns **AM-11** — currently downgraded to unmet because the pair exists and the suite does not. @@ -162,11 +173,21 @@ priority: high state_hub_task_id: "d459444d-41be-40c5-9101-7a8420b42fb6" ``` -Inherited from CB-WP-0005 T05. INTENT design decision 8 of 10, -unimplemented. All four controls from ADR-0005 §6 are required verbatim, -including the two the adversarial reviewer supplied: truncate-by-one-byte -rejection, and a mutated-seed control so the round-trip is capable of -failing. +INTENT design decision 8 of 10, unimplemented. `cb-sim` has no flag +parsing at all, so `--replay` has nowhere to go yet. + +**This is not "a directory of four files"** — the D2 correction the +adversarial review forced. `scenario.rs` creates an `EventLog`, appends to +it and never reads it: the one production instantiation of the K11 log is a +write-only sink. `Pass` carries the *end* state, not an initial snapshot, +and failures are a formatted `String`, not structured expected-vs-actual. +Plumb the log out of `execute`, capture an initial snapshot, restructure +`RunOutcome::Failed`. The writer is **dev-only** behind the `scenarios` +feature and is charged to **AM-4b** (9.4% headroom), not AM-4a. + +All four controls from ADR-0005 §6 are required verbatim, including the two +the reviewer supplied: truncate-by-one-byte rejection, and a mutated-seed +control so the round-trip is capable of failing. Fixing this is also what lets **AM-7's withdrawn `hash-identical` clause** be re-earned, since a real replay is what the clause was always