feat(analysis): bind template-copy identity refusals to an analysis-run profile - #416
seonghobae wants to merge 81 commits into
Conversation
…un profile GAP-004 leftover / ADR 0058. Bind existing copy_identity refusals (refuse_copy_as_source_identity, refuse_copy_as_transition) to cutoff-safe copy_identity_v1. identity_recovery_rate stays library-side. Distinct from simulation method-effect census (#415). Not GPU, not MCMC, and not topic birth/split/merge.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
…profile GAP-004 leftover / ADR 0066. Bind existing location_membership refusals (refuse_location_as_entity_identity, refuse_location_as_language_channel) to cutoff-safe location_membership_v1. identity_recovery_rate stays library-side. Distinct from membership-posterior ICC (#398), copied-text (#427), citation-edge (#426), and corpus-background (#422). Not GPU, not MCMC, and not topic birth/split/merge.
…ofile GAP-004 leftover / ADR 0069. Bind existing MembershipTargetKind and refuse_collapsed_target to cutoff-safe membership_target_v1. Language, episode, template, department, and opportunity-pool targets are not entities; identity_recovery_rate stays library-side.
…rofile GAP-004 leftover / ADR 0072. Bind existing EventWindow and refuse_membership_outside_episode to cutoff-safe episode_membership_v1 (tepp.episode_membership.v1). Mixed contained/escaped census, AvailableTime cutoff exclusion, and MAX_EVIDENCE_UNITS fail closed. identity_recovery_rate stays library-side. Distinct from relation-absence, outcome-order, membership-target, location-membership, and copy-identity.
GAP-004 leftover / ADR 0073. Bind existing EvidenceStatus, refuse_inferred_as_observed, and refuse_inferred_as_transition to cutoff-safe inferred_status_v1. Mixed observed/inferred corpora emit a digest-bound census. identity_recovery_rate stays library-side. Fixes #472.
Use the review-reproduced oversized compact artifact as RED evidence. Enforce the same MAX_EVIDENCE_UNITS invariant at artifact deserialization/serialization that execution already enforces, and add regression coverage for both directions.
Document the artifact-count invariant and exact-head landing procedure, and collapse the duplicated documentation map into one canonical index so the new doctoring entry cannot diverge between copies.
|
Rubin activation fold handoff advanced: Draft #506 exact head is now |
|
Rubin projection child #506 has a new valid delta that must survive the eventual conflict-resolving fold. Current child exact head is |
|
Rubin projection fold handoff advanced again. #506 exact head is now |
|
#506/#511 handoff — surviving Analysis Run fold에서 다음 delta를 실제 conflict-resolving inheritance 해야 합니다.
핵심 invariant는 receipt/runtime snapshot equality만으로 positive Rubin authority를 만들지 않는 것입니다. Owner-controlled approved Validation Evidence pairing이 자체 immutable #506은 현재 #504 exact parent 위 ordinary forward stack이며 production approval registry는 비어 있습니다. #416 exact head에서 이 source/test/ADR/research delta가 실제 승계되고 새 default-branch gates를 취득하기 전에는 #506/#511을 simple-close한 것으로 보지 마십시오. |
|
Surviving Analysis Run fold handoff from Draft #506 / issue #512: inherit the full source-snapshot content-authority lineage, not only the logical snapshot ID. Required delta is RED |
|
#506 has a new valid delta that must survive ordinary conflict-resolving fold rather than simple-close: issue #515, concrete Rubin draw-payload authority. Inherit RED |
|
Additional #506 delta for the surviving Analysis Run fold: #516 makes |
|
Surviving Analysis Run fold handoff from #506/#519: preserve RED |
|
Successor-fold handoff for #522: the surviving Analysis Run vehicle must inherit the full forward lineage, not only the earlier draw-matrix commitment. Required deltas are RED The scientific invariant is that every cutoff-admitted numeric input consumed by |
|
#522 successor-handoff update: the semantic wire/API rename is now part of the required inherited delta. In addition to RED The eventual v1 field/accessor is |
|
#592 fold handoff for The fold must preserve this ordinary-forward lineage and its corrected cutoff order:
Required surviving behavior: raw cardinality remains bounded; cross-snapshot rows fail closed; |
|
Additional #593 fold handoff from #372 current head Preserve this ordinary-forward delta in the surviving fold:
This matches #416's existing invariant that |
|
#372 has now been non-destructively retargeted onto this surviving Analysis Run vehicle. Current child head is Fresh child review also found #595: Conflict-resolution acceptance for the eventual #372 fold must preserve #592/#593/#595, use this vehicle's current shared-profile deltas, leave canonical TRACEABILITY/ADR-index/product-gap ownership to #435, and keep #501 open as the separate true-parameter recovery acceptance gap. No predecessor check/review receipt transfers after the surviving head changes. |
Preserve #592/#593/#595/#596 deltas on #416 without rewriting history. Reconcile analysis_engine shared source, retain #416 profile modules and dependencies, keep shared documentation at the surviving owner state, and leave the #596 finite-mean consumer contract intentionally RED pending a released numerical owner.
Repair the first reconciliation tree without rewriting history. Start from exact #416, then overlay only the surviving longitudinal CWC production adapter, contracts, ADR/doctoring, merged manifest, and merged analysis_engine root. This restores every #416-owned file while retaining #592/#593/#595/#596 deltas.
1 participant
Consolidation status
landing_vehicle_candidate— Validation / Analysis Run simple-refusal/census landing vehicle tracked by #435. It is not a new bounded context. Folded profiles preserve domain refusal semantics and focused tests here; per-profile ADR numbers remain implementation lineage pending #437 repository-wide ADR normalization.Fold lineage already preserved here: #473
inferred_status_v1, #430location_membership_v1, #461episode_membership_v1, #478subevent_containment_v1, and #434membership_target_v1. Those closed children are lineage into this Draft branch, not protected-main delivery.Current exact branch head is
03f8de2ed0a0fb842d2022d411814e440df7cfb4on protectedmain@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0. History remains ordinary forward history; no rebase or force update is used.Scientific and cross-profile contract repairs
AnalysisResultSummary.validation_statusremains provider-authored validation status, not a domain inference claim. Folded profiles compare parsedKnowledgeCutoff::instant()values rather than timestamp text and keep domaininference_statusseparate from terminalvalidation_status == "validated".The leakage invariant is explicit: evidence with
AvailableTime > knowledge_cutoffmust not enter the historical scientific census, duplicate/domain admission, counts, artifacts, or terminal scientific result. Duplicate identities among evidence actually available at the cutoff still fail closed. The engine-wide raw input cardinality guard remains an operational admission bound and is not weakened by this rule.Current repair lineage:
copy_identity_v1: RED contractc89123d7c7165ec3acf2bffcd40676ea81f72c92proves that a future-unavailable row reusing a visible document identity must not change a historical replay. Repair745345544bd424cf410debab6d78a232638db8beexcludes future rows before duplicate/domain admission and derivesdocument_countfrom admitted identities. Exact coverage artifact from predecessor93be3e043ddd21625d0b4aa67ba046bce8ef7621also showed the post-validationto_jsonbyte-limit branch uncovered. Because valid IDs are bounded to 256 UTF-8 bytes, the census is bounded byMAX_EVIDENCE_UNITS, and all other serialized fields are fixed/bounded,9ee6d60ff4443d7e843e5b20c745a332dca6d097adds a maximal-valid serialization proof andced4b09dbbc1310c5c2503c787ae69815b4660e1removes only that unreachable egress branch. The untrusted-inputfrom_json256 KiB cap remains fail-closed.inferred_status_v1:12bbcfbce7e3248f1237c601e99c7cf9426ffa57removes a bounded, unreachable post-validation output-size branch while preserving the untrusted-inputfrom_jsoncap; provider-result drift is checked through a directly testable fail-closed refusal guard. Fresh historical-replay REDd669d6f4367f9dfb88289920e22698d6963fe7cdproves a future-unavailable duplicate evidence identity cannot change an earlier run; repair4591837f4d11617232779e0447a56751a0b5cce0performs availability admission before duplicate/domain admission.location_membership_v1:294f091cfb353e90267932da67289a65afc17cdastops discarding the two canonical location-refusal results and verifies the exact expected domain errors. It also proves the maximal valid canonical artifact remains below the input wire cap. Fresh REDf0e9f425843d1ff0628e18f4b963a217aef3ed0bproves that a future-unavailable location row reusing a visible document identity cannot perturb the historical artifact or terminal result. Repair03f8de2ed0a0fb842d2022d411814e440df7cfb4excludes future rows before identity/domain admission and derivesdocument_countfrom the admitted identity set rather than raw input length.episode_membership_v1: REDb4a135ed0149b7020383f071edda6db9f5d3ff60proves that a future-unavailable duplicate identity must not change a historical run; repaircb5d97cb159958ef259b2f2d97968fdd7830a1e3moves availability admission before duplicate insertion. Exact predecessor coverage also left the post-validation output-size and unexpected-provider-error paths uncovered.17b98449b391b178d8a777172536fceca4fc51d0proves a maximal valid artifact remains below the 256 KiB wire cap,21eda89ee8ce68a5ef35621676d0ab7cc72ad0b7removes only that unreachable egress check while preservingfrom_jsonadmission, and03f6870c8b5cd201185cd7d53b503e3cea930121moves the non-exhaustive provider-result fallback into a directly testable fail-closed classifier without weakening future-variant refusal.subevent_containment_v1: RED21d85de0793c1a386d693aefc42399d5d558d584and repair315de53a0f03de9d476ea578e47b43798a3a4debapply the same cutoff-before-identity rule without weakening visible-duplicate refusal. Exact predecessor coverage likewise exposed an unreachable post-validation output-size branch and an unexercised provider-drift fallback.7dad37591e8f220c95bc08227dfbb7b591b6a4a7adds the maximal-valid wire-bound proof,b3a3edcc09f6cd25e2067308e83d71f29c6711f4removes only the unreachable egress check while retaining the untrusted-input cap, and722affdd2c02d331bfba3816fbda799059cc1778makes the provider-drift fallback directly testable and fail-closed.membership_target_v1: RED66951df7d6c704e03edc7fd9b41a1857788034caexposes that the profile called itself cutoff-safe whileMembershipTargetDocumentcarried no availability provenance. Repair5f3bd54f6aaf6bf01d95953f5ff5f74decd019dfadds explicitAvailableTime, excludes future-unavailable rows before identity/domain admission, and makesdocument_countthe admitted count rather than raw input length.93be3e043ddd21625d0b4aa67ba046bce8ef7621migrates the existing integration contract to explicit availability. Exact predecessor coverage also showed its post-validation output-size branch uncovered;8ea980da36e73edde8a0512d8ea6710f17e34861proves a maximal valid artifact stays below the 256 KiB wire cap and441545fa9ea3d994a10f005329734fb249e98f5aremoves only that unreachable egress check while preserving the inbound cap. There is no compatibility constructor that invents an availability timestamp.The predecessor
93be3e043ddd21625d0b4aa67ba046bce8ef7621Rust Foundation run exposed both the exact authored coverage deficit and a realcargo fmt --all -- --checkRED in the newly added episode/subevent cutoff regressions and membership-target fixture. Ordinary forward formatting commits corrected only those rustfmt deltas before the later coverage-driven repairs; predecessor hosted receipts are not transferred to the current head.#487 adds another scientific repair that must survive the fold: observed Allen relation classes are data, not run prerequisites. Its RED
a2892b6ad4f632882f63da39eed2d4706ddf9213and repaira64020152300232cb3214a66b45d97225b6d2b5brequire sparse covered-only or contradiction-only censuses to report truthful zero class counts. Child heade07b2ff9f78ef456ff911b8643710af20921fe54also changes ADR 0079 from prematureAcceptedbranch authority toProposedimplementation lineage and removes its stale mixed-four-class eligibility claim. The eventual fold must inherit that corrected ADR semantics.Profiles preserved on this head
copy_identity_v1: copy versus source identity/transition refusal, typed cutoff equality, cutoff-before-identity admission, bounded digest artifact.inferred_status_v1: observed versus inferred remain distinct; inferred is neither observed evidence nor transition; future-unavailable rows are excluded before identity/domain admission.location_membership_v1: location remains distinct from entity identity and language channel; future-unavailable rows are excluded before identity/domain admission; inspect remains recovery-metric-free.episode_membership_v1: membership windows are checked against episode intervals with cutoff-safe admission;identity_recovery_ratestays library-side.subevent_containment_v1: child intervals cannot escape parent intervals; TRACEABILITY excludes bothcontainment_recovery_rateandidentity_recovery_ratefrom inspect.membership_target_v1: language/episode/template/department/opportunity-pool target kinds stay distinct from entity/project and carry explicit availability provenance.Current fold children
#458
outcome_order_v1at08165e3b3c929b4ae77396689549f72723ff8ff5, #460relation_absence_v1atdfab4eab5ff733731e565a9348072b8dab2e4912, #482role_contradiction_v1at506dbae236a4484301b704b6c6a05b20faf0fe69, #483retrospective_edge_v1at847d96f913bb261803ac0bd751ad7e4f51324cee, #484summarizes_edge_v1at9a1be78b5342ff65e3cf2aac1e9331c68943f246, #485support_edge_v1atf71591864efc2beff336ced7ef35d5a013305c36, and #487prediction_contradiction_v1ate07b2ff9f78ef456ff911b8643710af20921fe54remain conflict-resolving fold children.#484, #485, and #487 change the same shared Analysis Run integration surface as this vehicle (
Cargo.lock,analysis_engineCargo/lib,DOCUMENTATION.md, TRACEABILITY and ADR index). They remain non-destructively retargeted here; unique source/tests/doctoring must survive a real conflict-resolving fold. Closing a child without verified inheritance is not consolidation.Coverage and current exact-head evidence
Predecessor coverage receipts never transfer to a new source head. At
93be3e043ddd21625d0b4aa67ba046bce8ef7621, exactcoverage.lcovreported 17 authored production lines uncovered. Four post-validation egress size branches identified in that artifact have now been removed only after maximal-valid serialization proofs were added; the inbound 256 KiBfrom_jsoncaps remain. Episode/subevent unexpected-provider outcomes are now explicit testable fail-closed contract guards rather than unexercised inline fallbacks. Current-head coverage must be regenerated before any lower uncovered-line count is claimed.The current source head
03f8de2ed0a0fb842d2022d411814e440df7cfb4must obtain its own Rust Foundation, Documentation Quality, Security Scan, Semgrep, and CodeQL receipts. Those workflows have been freshly admitted; predecessor GREEN/RED states are not transferred. This body does not claim GREEN or merge readiness.A separate protected-main repository-contract failure remains outside this lane:
tests/quality/test_hourly_nim_product_development.py:79still expects repository-localcron: "47 * * * *", although protected main removed repository-local scheduling under #490. Canonical repair remains Draft #492 (794ba9e6...) and owns the central-admission/dispatch-only contract. This Analysis Run fold must not restore or duplicate the old workflow policy.The predecessor Security Scan failure was confined to
dependency-review: Trivy, OSV and Scorecard were GREEN while authenticated dependency-graph compare returned HTTP 403 and failed closed. That remains a central support/control-plane finding rather than demonstrated source vulnerability here; no leaf bypass or scanner suppression is permitted.DDD boundary and merge gate
The Analysis Run application/Validation boundary owns request admission, cutoff-safe temporal composition, digest-bound result projection and claim refusals. Source-specific rule crates own domain vocabulary. Folding proceeds through shared admission/artifact invariants plus profile-specific adapters, not a flat model enum or technical god-module.
This vehicle remains Draft. Fold scope, DDD/docs, #492 prerequisite, exact current-head line/branch coverage, security control-plane availability, required checks, qualifying independent review, and conflict-resolving inheritance of active children must converge on one unchanged surviving head before Ready/merge. No self-approval, coverage exclusion, fail-open security change, force push, destructive rebase, routine admin bypass, no-op retrigger, or predecessor-head evidence transfer is allowed.