diff --git a/plan/Plan-007-source-qualification-readiness/index.md b/plan/Plan-007-source-qualification-readiness/index.md new file mode 100644 index 0000000..caa016c --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/index.md @@ -0,0 +1,19 @@ +--- +type: index +title: "Plan-007 — Progressive source-qualification readiness" +description: "Contents of the Plan-007 source-qualification-readiness bundle." +okf_version: "0.1" +--- +# Plan-007 — Progressive source-qualification readiness + +## Contents + +* [Plan-007: Progressive source-qualification readiness](./plan.md) - Requirements, dependency graph, tests, tracks and gates. +* [Task-009: M6 specification and review](./tasks/Task-009-m6-specification-review.md) - Frozen reviewed source-readiness contract; tracked by tl-syntax#34. +* [Task-010: Prerequisite admission](./tasks/Task-010-prerequisite-admission.md) - External identity ledger and no-workaround gate; tracked by tl-syntax#45. +* [Task-011: Executable-path classification](./tasks/Task-011-executable-path-classification.md) - Complete census and Rust/shared parity; tracked by tl-syntax#46. +* [Task-012: Candidate binding](./tasks/Task-012-candidate-binding.md) - Immutable subject and fresh producer output; tracked by tl-syntax#47. +* [Task-013: Lifecycle and decision admission](./tasks/Task-013-lifecycle-decision-admission.md) - Retention, history, review and human authority; tracked by tl-syntax#48. +* [Task-014: Real source-grounding integration](./tasks/Task-014-real-source-grounding-integration.md) - IT-001 shared-contract gate; tracked by tl-syntax#49. +* [Task-015: Integrator package](./tasks/Task-015-integrator-package.md) - IT-002 publication and rights handoff; tracked by tl-syntax#50. +* [Task-016: Final assurance](./tasks/Task-016-final-assurance.md) - Independent review, gap analysis and human gate; tracked by tl-syntax#51. diff --git a/plan/Plan-007-source-qualification-readiness/log.md b/plan/Plan-007-source-qualification-readiness/log.md new file mode 100644 index 0000000..9b3e36e --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/log.md @@ -0,0 +1,26 @@ +--- +type: log +title: "Plan-007 — Update Log" +description: "Chronological log of the progressive source-qualification-readiness plan." +--- +# Plan-007 — Update Log + +## History + +* **2026-09-10** — Created from reviewed M6 specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`; decomposed into eight tasks across specification, external-gate, critical-path, post-gate and final-assurance tracks. The then-named Task-001 is complete; all implementation tasks remain blocked on merge and their declared shared prerequisites. +* **2026-09-13** — Independent review renumbered the bundle to repository-unique + Task-009 through Task-016, mapped the completed specification task to #34, + created implementation tickets #45 through #51, and recorded exact owners, + consumers, evidence methods and resume conditions. Engineering Assurance #34 + is merged but remains unavailable here until an immutable compatible release + carries that contract. +* **2026-09-13** — Independent SR-066 through SR-074 review at `33678fa` + closed pathname ABA/TOCTOU, event-population/time-authority and archival- + census bypass findings. All implementation tasks remain blocked; no TM-004 + row or human release decision advanced. +* **2026-09-13** — Merged current main at `5b1c134`, preserving its W/M source + and canonical-graph corpus additions alongside the narrowed archival census. + SR-075 records the exact `9598fea` candidate review: `make ci` passes with 75 + Rust tests and one doctest, Quire validates 163 specification and 11 plan + documents, and all 48 M6 obligations classify without an assurance mismatch. + TM-004 remains truthfully planned at 0 of 17 rows. diff --git a/plan/Plan-007-source-qualification-readiness/plan.md b/plan/Plan-007-source-qualification-readiness/plan.md new file mode 100644 index 0000000..3eecd29 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/plan.md @@ -0,0 +1,170 @@ +--- +id: Plan-007 +title: "tl-syntax — progressive source-qualification readiness" +type: Plan +status: active +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: references + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/IT-001 + type: references + - target: ix://agent-ix/tl-syntax/IT-002 + type: references +--- +# Implementation Plan: Progressive source-qualification readiness + +This TDD plan advances M6 only through released shared contracts and attributed +human decisions. It does not qualify native Quire, a monitor, or an integrating +system, and it does not turn tl-syntax into a user-authored language. + +## Requirements Summary + +### Stakeholder Requirements + +- [ ] **StR-004**: Supply attributable, progressively reviewable source-readiness facts without claiming downstream qualification. + +### Functional Requirements + +- [ ] **FR-014**: Bind every fact to one immutable candidate/configuration and fresh producer execution. +- [ ] **FR-015**: Preserve lifecycle stages, authority, retention and supersession without promotion. +- [ ] **FR-016**: Emit a lossless integrator package only through the accepted shared contract. +- [ ] **FR-017**: Admit an exact, policy-authorized human source-release disposition. +- [ ] **FR-018**: Classify every executable readiness path and remove stable reliance on legacy paths. + +### Non-Functional and Integration Requirements + +- [ ] **NFR-004**: Reproduce deterministic observations and preserve every volatile field. +- [ ] **NFR-005**: Preserve authority, limitation and retention truth. +- [ ] **IT-001**: Exercise the real source-grounding handoff. +- [ ] **IT-002**: Exercise the real integrator-package round trip. + +## Dependency Graph + +- `M6 specification + review -> every implementation task` + Reason: the specification snapshot and SR-058 through SR-065 establish the + boundary and test vocabulary before code is authorized. +- `external prerequisite admission -> FR-014, FR-015, FR-016, FR-017, FR-018` + Reason: source export/matrix, retention, decision policy, package format and + LR08 ownership are shared enablement and cannot be reconstructed locally. +- `FR-018 -> FR-014` + Reason: the complete executable-path census and Rust/shared disposition must + be known before a stable source subject can be declared complete. +- `FR-014 -> FR-015 -> FR-017` + Reason: lifecycle facts need an exact candidate, and a decision needs exact + staged facts, reviews and limitations. +- `FR-014 + FR-015 + FR-017 -> IT-001` + Reason: the real shared handoff consumes candidate, lifecycle and authority + records together. +- `FR-014 + FR-015 + FR-017 + IT-001 -> FR-016 -> IT-002` + Reason: package publication follows verified source facts and human decision; + its real reader is the only admitted integration oracle. +- `NFR-004 + NFR-005 -> every implementation and integration task` + Reason: reproducibility, non-promotion, retention and authority are + cross-cutting correctness properties. + +The principal seams are the existing Rust shared-assurance intake in +`tests/shared_assurance.rs`, future Rust source-readiness modules, the released +Quire/Engineering Assurance export, Quoin retention handles, and the future +Engineering Assurance integrator package. Markdown parsing and local contract +copies are outside every seam. + +## Test Plan + +### Candidate and Execution Properties + +- [ ] **TC-059**: Reproduce exact candidate/configuration identity. +- [ ] **TC-060**: Reject one-axis candidate, source, configuration and contract mutations. +- [ ] **TC-064**: Census and classify every executable entry point exactly once. +- [ ] **TC-065**: Require positive and forced-failure parity before legacy removal. +- [ ] **TC-068**: Exercise every producer/package execution outcome with stale output present. +- [ ] **TC-069**: Reject source-root, path, mount and symlink boundary failures. + +### Lifecycle and Authority Properties + +- [ ] **TC-062**: Preserve four stages and all six decision dispositions. +- [ ] **TC-063**: Prove omissions and non-success states cannot improve readiness. +- [ ] **TC-066**: Prove absent shared capability stays unavailable with no local substitute. +- [ ] **TC-067**: Exercise every retention state and retrieval failure. +- [ ] **TC-070**: Exercise bounded supersession and decision transition topology. +- [ ] **TC-073**: Mutate every review/decision policy and identity binding. + +### Real Shared Integrations + +- [ ] **TC-061**: Round-trip source facts and distinct adopter subjects through the real package. +- [ ] **TC-071**: Exercise idempotent retries and racing package writers. +- [ ] **TC-072**: Complete independent, candidate-bound license/reuse-right analysis. + +## Remaining Work + +### Track S: Specification gate + +- **S1 = Task-009** M6 specification and composite review — Done; exit: the exact snapshot is strict-valid with no review-owned finding. + +### Track G: External admission gate + +- **G1 = Task-010** prerequisite ledger and no-workaround gate — Blocked; exit: each consumed release, policy, authority and backend has an immutable compatible identity. + +### Track A: Critical path (serial) + +- **A1 = Task-011** executable-path inventory and Rust/shared parity — Hard; exit: every entry point has one reviewed class and every stable-required legacy behavior has parity. +- **A2 = Task-012** candidate binding and producer freshness — Hard; exit: identity races, stale output and path escapes fail closed. +- **A3 = Task-013** lifecycle, retention and human decision admission — Hard; exit: state/history/authority transitions are total and non-promoting. +- **Gate = Task-014** real source-grounding integration — Hard; measures lossless shared handoff; pass: every IT-001 subcase and load-bearing negative mutation succeeds at the exact candidate. + +### Track C: Post-gate package work + +- **C1 = Task-015** integrator package and rights handoff — Hard; exit: the real reader preserves every fact and concurrent/invalid publication exposes nothing favorable. + +### Track J: Final assurance + +- **J1 = Task-016** independent code/gap review and human release gate — Medium; exit: all planned rows are genuinely backed and an authorized human disposition is recorded or remains explicitly open. + +## Parallel Execution Summary + +```text +Track S: Task-009 (done) +Track G: Task-010 [external prerequisites] +Track A: Task-011 -> Task-012 -> Task-013 -> Task-014 +Track C: Task-015 +Track J: Task-016 +``` + +## Task File Mapping + +| Task | Track | Owns (references) | Verified by (verifies) | Status | +| --- | --- | --- | --- | --- | +| Task-009 | S | StR-004, FR-014..FR-018, NFR-004..NFR-005 | TC-066 | done | +| Task-010 | G | FR-014..FR-018, NFR-005 | TC-066, TC-067, TC-073 | blocked | +| Task-011 | A | FR-018 | TC-064..TC-066 | blocked | +| Task-012 | A | FR-014, NFR-004 | TC-059, TC-060, TC-068, TC-069 | blocked | +| Task-013 | A | FR-015, FR-017, NFR-005 | TC-062, TC-063, TC-067, TC-070, TC-073 | blocked | +| Task-014 | A | IT-001, FR-014, FR-015, FR-017, FR-018 | TC-059, TC-060, TC-062, TC-063, TC-066..TC-070, TC-073 | blocked | +| Task-015 | C | FR-016, IT-002 | TC-061, TC-063, TC-066, TC-068, TC-070..TC-072 | blocked | +| Task-016 | J | StR-004, NFR-004, NFR-005 | TC-059..TC-073 | blocked | + +## Coordination Rules + +- Freeze MRS-004, TM-004 and the closed vocabularies after merge; a semantic + change requires a new specification review before downstream code. +- Task-010 is an admission gate, not permission to vendor, mirror, branch-pin or + locally emulate missing shared capabilities. +- Keep one writer for shared census, state and fixture files; downstream tasks + rebase after each predecessor merges. +- Do not dispatch hosted CI without explicit authorization. Local evidence must + state its exact environment and may not imply hosted execution. +- No task may present tl-syntax as an editable Quire alternative or infer a + release/qualification decision from passing automation. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md new file mode 100644 index 0000000..f64f9e9 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md @@ -0,0 +1,55 @@ +--- +id: Task-009 +title: "M6 source-readiness specification and composite review" +type: Task +status: done +track: S +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: specification-and-composite-review +github_issue: ix://agent-ix/tl-syntax/issues/34 +resume_conditions: [] +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: references + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies +--- +# Task-009: M6 source-readiness specification and composite review + +## Scope + +Define the source-readiness boundary, closed result domains, acceptance matrix, +assurance records and real-integration scenarios before implementation. + +## Subtasks + +- [x] Author MRS-004, TM-004 and their requirement/assurance/integration artifacts. +- [x] Run base, failure-domain, integrity, dependency, evidence, risk, scope and EARS reviews. +- [x] Correct every review-owned finding and validate the exact snapshot strictly. + +## Deliverables + +- Specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40` +- Author reviews SR-058 through SR-065 +- Independent exact-head reviews SR-066 through SR-075 + +## Notes + +- TC-066 is the boundary criterion this task defines and reviews; its executable evidence remains downstream. +- Completion of this authoring task does not mark any TM-004 implementation row covered. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-010-prerequisite-admission.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-010-prerequisite-admission.md new file mode 100644 index 0000000..aa603f8 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-010-prerequisite-admission.md @@ -0,0 +1,60 @@ +--- +id: Task-010 +title: "Admit external prerequisites without local substitutes" +type: Task +status: blocked +track: G +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: released-contract-admission +github_issue: ix://agent-ix/tl-syntax/issues/45 +resume_conditions: [ix://agent-ix/tl-syntax/issues/16, ix://agent-ix/quire-research/issues/64, ix://agent-ix/engineering-assurance/issues/11] +relationships: + - target: ix://agent-ix/tl-syntax/Task-009 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-010: Admit external prerequisites without local substitutes + +## Scope + +Maintain the immutable compatibility/authority ledger and admit each external +capability only when its released identity satisfies MRS-004. + +## Subtasks + +- [ ] Admit a released matrix selecting the source-grounded Quire export. +- [ ] Select the Quoin retention contract, backend/operator and lifecycle. +- [ ] Select the immutable reviewer/decision policy and authoritative event source. +- [ ] Admit the Engineering Assurance Rust runner and integrator-package contracts. +- [ ] Record LR08 executable-language dispositions and refuse local workarounds. + +## Deliverables + +- Candidate-bound prerequisite ledger with release identities, digests and resume decisions + +## Notes + +- Blocked on tl-syntax#16, engineering-assurance#11, an immutable release + containing the merged engineering-assurance#34 producer boundary, the + retention/operator selection, policy/event source, integrator-package release + and quire-research#64. +- Individual downstream work may resume only when every prerequisite it consumes is admitted; a partial ledger is not a global pass. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-011-executable-path-classification.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-011-executable-path-classification.md new file mode 100644 index 0000000..8fb3605 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-011-executable-path-classification.md @@ -0,0 +1,47 @@ +--- +id: Task-011 +title: "Classify executable paths and prove Rust/shared parity" +type: Task +status: blocked +track: A +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: integration-and-property-test +github_issue: ix://agent-ix/tl-syntax/issues/46 +resume_conditions: [ix://agent-ix/tl-syntax/issues/34, ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/quire-research/issues/64] +relationships: + - target: ix://agent-ix/tl-syntax/Task-010 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/TC-064 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-065 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies +--- +# Task-011: Classify executable paths and prove Rust/shared parity + +## Scope + +Build the complete executable-entry-point inventory and migrate stable-required +first-party behavior to Rust or a released shared capability. + +## Subtasks + +- [ ] Write failing exact-census/classifier tests before the classifier. +- [ ] Inventory scripts, build steps, nested interpreters and generated commands. +- [ ] Record owner, authority, pre-stable disposition, parity evidence and resume condition. +- [ ] Demonstrate positive and forced-failure parity before removing each legacy path. + +## Deliverables + +- Rust executable census/classifier and reviewed disposition inventory +- TC-064 through TC-066 evidence + +## Notes + +- Blocked until the current specification is independently reviewed/merged and + the consumed LR08/shared-runner entries are admitted by Task-010. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md new file mode 100644 index 0000000..e8d5f43 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md @@ -0,0 +1,54 @@ +--- +id: Task-012 +title: "Bind immutable candidates and fresh producer results" +type: Task +status: blocked +track: A +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: property-and-integration-test +github_issue: ix://agent-ix/tl-syntax/issues/47 +resume_conditions: [ix://agent-ix/tl-syntax/issues/34, ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/46] +relationships: + - target: ix://agent-ix/tl-syntax/Task-010 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-011 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/TC-059 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-060 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-069 + type: verifies +--- +# Task-012: Bind immutable candidates and fresh producer results + +## Scope + +Implement candidate/configuration identity, source traversal and producer- +freshness projection through released source-grounding contracts. + +## Subtasks + +- [ ] Write property tests for every identity axis and source-walk boundary. +- [ ] Implement immutable-root binding and bounded symlink traversal in Rust. +- [ ] Consume the same descriptor-backed snapshots used for identity; refuse + pathname reopen and change-then-restore races. +- [ ] Implement total execution/decode mappings and stale-output quarantine. +- [ ] Prove deterministic equality and one-axis isolation. + +## Deliverables + +- Rust candidate/source binding and producer adapter +- TC-059, TC-060, TC-068 and TC-069 evidence + +## Notes + +- No Markdown parser, branch-head contract or repository-local compatibility map is admissible. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md new file mode 100644 index 0000000..39b9c46 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md @@ -0,0 +1,59 @@ +--- +id: Task-013 +title: "Preserve lifecycle, retention and human decision authority" +type: Task +status: blocked +track: A +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: state-machine-and-integration-test +github_issue: ix://agent-ix/tl-syntax/issues/48 +resume_conditions: [ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/47] +relationships: + - target: ix://agent-ix/tl-syntax/Task-010 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-012 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-062 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-013: Preserve lifecycle, retention and human decision authority + +## Scope + +Implement stage/history projection, retention verification, bounded +supersession and policy-backed decision admission without automated promotion. + +## Subtasks + +- [ ] Write state-machine properties for stage, retention and decision domains. +- [ ] Implement bounded same-subject supersession/conflict traversal. +- [ ] Verify real retention handles and map every retrieval failure. +- [ ] Admit complete decision-event sets against policy, quorum and independence facts. +- [ ] Refuse incomplete/cross-snapshot event enumeration and bind expiry to the + verified authoritative evaluation-time contract. + +## Deliverables + +- Rust lifecycle/retention/decision adapters +- TC-062, TC-063, TC-067, TC-070 and TC-073 evidence + +## Notes + +- Blocked until Task-010 selects the retention backend/operator and + authoritative policy/event source. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-014-real-source-grounding-integration.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-014-real-source-grounding-integration.md new file mode 100644 index 0000000..bf01572 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-014-real-source-grounding-integration.md @@ -0,0 +1,72 @@ +--- +id: Task-014 +title: "Exercise the real shared source-grounding handoff" +type: Task +status: blocked +track: A +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: real-shared-contract-integration-test +github_issue: ix://agent-ix/tl-syntax/issues/49 +resume_conditions: [ix://agent-ix/tl-syntax/issues/16, ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/47, ix://agent-ix/tl-syntax/issues/48] +relationships: + - target: ix://agent-ix/tl-syntax/Task-010 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-012 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-013 + type: depends_on + - target: ix://agent-ix/tl-syntax/IT-001 + type: references + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/TC-059 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-060 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-062 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-069 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-014: Exercise the real shared source-grounding handoff + +## Scope + +Run IT-001 through the exact released Engineering Assurance, Quire and Quoin +contracts with no mock reader or local substitute. + +## Subtasks + +- [ ] Write blocked integration fixtures against the released schemas/readers. +- [ ] Exercise valid, missing, stale, malformed, unavailable and conflict paths. +- [ ] Falsify each P0 claim with a load-bearing mutation. +- [ ] Record exact tool, source, configuration and environment identities. + +## Deliverables + +- Real Rust/shared-contract IT-001 harness and evidence + +## Notes + +- Blocked on the tl-syntax#16 accepted release set and completion of Tasks + 012–013. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-015-integrator-package.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-015-integrator-package.md new file mode 100644 index 0000000..db43551 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-015-integrator-package.md @@ -0,0 +1,58 @@ +--- +id: Task-015 +title: "Publish and verify the shared integrator package" +type: Task +status: blocked +track: C +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: real-writer-reader-integration-and-analysis +github_issue: ix://agent-ix/tl-syntax/issues/50 +resume_conditions: [ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/49, ix://agent-ix/engineering-assurance/issues/11] +relationships: + - target: ix://agent-ix/tl-syntax/Task-010 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-014 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/IT-002 + type: references + - target: ix://agent-ix/tl-syntax/TC-061 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-071 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-072 + type: verifies +--- +# Task-015: Publish and verify the shared integrator package + +## Scope + +Implement atomic/idempotent package publication and prove lossless separation +of source-release facts from adopter-owned validation and acceptance. + +## Subtasks + +- [ ] Write real writer/strict-reader round-trip and mutation tests. +- [ ] Implement candidate-bound temporary output and atomic visibility. +- [ ] Exercise retry identity and non-identical writer races. +- [ ] Complete the independent exact-population license/reuse-right review. + +## Deliverables + +- Rust adapter to the released integrator-package contract +- IT-002 and TC-061/063/066/068/070/071/072 evidence + +## Notes + +- Blocked until Engineering Assurance releases and accepts the real package contract; no local schema or mock can close this task. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-016-final-assurance.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-016-final-assurance.md new file mode 100644 index 0000000..c058df9 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-016-final-assurance.md @@ -0,0 +1,83 @@ +--- +id: Task-016 +title: "Close implementation evidence and human source-release gate" +type: Task +status: blocked +track: J +priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: rust-review-gap-analysis-and-human-decision +github_issue: ix://agent-ix/tl-syntax/issues/51 +resume_conditions: [ix://agent-ix/tl-syntax/issues/46, ix://agent-ix/tl-syntax/issues/47, ix://agent-ix/tl-syntax/issues/48, ix://agent-ix/tl-syntax/issues/49, ix://agent-ix/tl-syntax/issues/50] +relationships: + - target: ix://agent-ix/tl-syntax/Task-011 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-012 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-013 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-014 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-015 + type: depends_on + - target: ix://agent-ix/tl-syntax/StR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-059 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-060 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-061 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-062 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-064 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-065 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-069 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-071 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-072 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-016: Close implementation evidence and human source-release gate + +## Scope + +Run the final exact-head assurance suite, independent code review and gap +analysis, then preserve the authorized human source-release disposition. + +## Subtasks + +- [ ] Prove every TM-004 row is backed by real exact-head evidence. +- [ ] Run independent code review and full semantic gap analysis. +- [ ] Resolve or explicitly accept every finding/limitation through the bound policy. +- [ ] Record accepted/rejected/deferred/conditional/open/conflict without inferring publication or downstream qualification. + +## Deliverables + +- Exact-head code-review and gap-analysis artifacts +- Complete matrix evidence and attributed human decision state + +## Notes + +- Passing automation cannot complete the human gate. +- Hosted CI remains undispatched unless separately authorized. diff --git a/spec/assurance/AD-002-source-readiness-boundary.md b/spec/assurance/AD-002-source-readiness-boundary.md new file mode 100644 index 0000000..c0dee07 --- /dev/null +++ b/spec/assurance/AD-002-source-readiness-boundary.md @@ -0,0 +1,136 @@ +--- +id: AD-002 +title: tl-syntax source-readiness and integrator boundary +type: ArchitectureDescription +status: proposed +owner: tl-syntax-maintainer +system: tl-syntax source-readiness preparation and future integrator handoff +relationships: + - target: ix://agent-ix/tl-syntax/MRS-004 + type: realizes + - target: ix://agent-ix/tl-syntax/AP-002 + type: references +--- + +# tl-syntax source-readiness and integrator boundary + +## System Boundary + +tl-syntax owns its Rust domain producers, exact candidate/configuration inputs, +component-specific assumptions/limitations and adapter to accepted shared +contracts. Engineering Assurance owns compatibility, future reusable producer- +execution and integrator/use-specific qualification contracts. Quire owns +source-grounded static export. Quoin owns the shared evidence-retention and +orchestration contract; current workspace bytes remain transient until an exact +backend/handle lifecycle passes retrieval. +GitHub branch protection/review history and the human release owner remain +external authorities. Native Quire is the only editable formal-clause language; +tl-syntax is internal representation infrastructure. + +## Views + +The source-readiness flow is: + +```text +exact Git source + Cargo/toolchain/config/profile/corpus identities + -> tl-syntax Rust domain producers + -> compatible released Quire source export + -> compatible released Engineering Assurance classification/contracts + -> Quoin record/attestation/intake/receipt and conditional retained handle + -> independent spec/code/gap reviews + -> attributed human source-release decision + -> future shared integrator package with adopter fields still open +``` + +The external context is: + +```text +PGM-01 + native-language ruling + LR08 policy + | +Git/repository -> tl-syntax Rust readiness projection/admission adapter + | | | + released Quire/EA/Quoin GitHub review human release owner + | | + selected retention backend/operator downstream integrator +``` + +Failure remains visible at the stage where it occurs. No later stage repairs a +missing producer input, identity, review, limitation or decision. Historical +facts remain immutable and are linked by supersession/invalidation. + +The current executable-path inventory for review distinguishes: + +| Class | Current path | Disposition boundary | +|---|---|---| +| Rust domain/library logic | `src/`, Rust examples/tests/fuzz targets | Retain as tl-syntax-owned; every new first-party path is Rust. | +| Existing Python domain/assurance helpers | corpus oracle, feature gate, assurance adapter | Explicit legacy inventory; replace with reviewed Rust/shared capabilities or obtain bounded owner disposition with parity/failure evidence. | +| Existing shell/Make/workflow orchestration | Makefile, shell audits, hosted YAML/inline commands | Not a trust root; inventory and migrate reusable executable semantics under LR08. | +| Existing Quoin Node/TypeScript | installed shared Quoin release | Sole recorded accommodation; contain rather than copy or broaden. | +| Quire and Engineering Assurance | released shared tools/contracts | Consume exact compatible artifacts; do not fork or reproduce locally. | + +## External Dependencies and Trust + +`Assumed` means tl-syntax preserves an attributable input without proving the +external authority's semantic correctness. `Guaranteed` means a named planned +contract test verifies this consumer boundary; where the required release is +missing, the guarantee remains unavailable rather than falling back locally. + +| Dependency | Trust mode | Contract and current state | +|---|---|---| +| PGM-01 and native-language ruling | Assumed | Governance/source-language authority; bind exact immutable identity before implementation. | +| Git repository/object/materialization | Guaranteed boundary; Git correctness/provenance assumed | TC-059/060/069 bind/refuse identities; Git implementation and repository provenance remain external assumptions. | +| Rust/Cargo toolchain and public package delivery | Guaranteed identity; semantics/provenance assumed | FR-014 identity mutations; no compiler or registry certification claim. | +| Released Quire source export and Engineering Assurance classifier | Guaranteed when available | IT-001; unavailable until the `tl-syntax#16` accepted release set exists. | +| Released Quoin record/attestation/intake/receipt | Guaranteed when available | IT-001 real interfaces; Quoin does not execute producers or decide sufficiency. | +| Retention backend/operator | Guaranteed when selected | TC-067 verifies handle/content/lifecycle after workspace deletion; currently unselected/unavailable. | +| GitHub review/event facts | Assumed input, guaranteed binding | TC-073 checks exact policy/actor/subject binding; authenticated event semantics remain external. | +| Reviewer-independence and human-release policy | Assumed authority, guaranteed admission | FR-017/TC-073; currently unavailable until an immutable policy/event source and actor set are selected. | +| LR08 cross-repository language policy | Assumed | `quire-research#64`; tl-syntax guarantees only its local census/classification under TC-064/065. | +| Future Engineering Assurance integrator package | Guaranteed when available | IT-002; currently no accepted compatible contract. | +| Downstream intended-use/deployment facts | Assumed input, guaranteed separation | IT-002 preserves adopter attribution and non-transfer of acceptance. | +| License/reuse-right authority | Assumed authority, guaranteed mapping | TC-072 checks material mapping; it does not establish legal validity. | +| Hosted CI provider/run event | Assumed optional observation | Only a human-dispatched exact run may be cited; no dispatch is required here. | + +## Decisions + +1. Source-readiness identity is the product of exact source and declared + configuration, not a branch name, command name or latest compatible version. +2. Developer observation, retained evidence, review and human decision are + orthogonal facts. No aggregate score carries release authority. +3. The future integrator package retains source facts but leaves intended-use, + deployment and validation obligations open for each adopter. +4. Missing shared capabilities return unsupported/unavailable. Local schema, + parser, runner, store, compatibility map and approval substitutes are + prohibited. +5. “Source” in this architecture means the tl-syntax Rust repository candidate, + never an alternative user-authored temporal source language. +6. The `readiness projection` and `admission adapter` are tl-syntax Rust + component projections/checks over released shared types. They are not a new + generic evidence schema, aggregate qualification interpreter or approval + workflow. + +## Risks + +- `agent-ix/tl-syntax#16` cannot resume until an immutable Engineering Assurance + release accepts the source-grounded Quire release and artifact shape. +- The latest immutable Engineering Assurance release does not yet carry its + corrected human-acceptance predicate or accept Quire 0.32; branch-head state + and a repository-local compatibility fixture are not substitutes. +- The general shared integrator-package contract is not yet selected; IT-002 + remains blocked on a real accepted Rust-consumable release. +- `agent-ix/engineering-assurance#11` still owns use-specific qualification; + engineering-assurance#34 delivered bounded Rust producer execution, but no + immutable compatible release available to this plan contains it yet. + tl-syntax must not fill either remaining admission gap locally. +- Existing Python/shell/Make/inline-workflow paths require the LR08 inventory, + Rust parity or explicit owner disposition before stable qualification use. +- Quire status-column classification and Quoin binary-attachment/non-release- + build profile gaps remain explicit prerequisites when the selected evidence + depends on them; local parsers, archives or false `release` labels are + prohibited. +- The measured Make false-success class remains an open limitation; a Quoin + record constrains produced bytes but cannot prove an omitted command ran. +- Existing retention prose conflicts over ignored `target/` state versus a + repository evidence area. No durable-retention claim is admitted until an + exact released shared backend, immutable handle, retrieval result and + lifecycle rule resolve that conflict. diff --git a/spec/assurance/AP-002-progressive-source-readiness.md b/spec/assurance/AP-002-progressive-source-readiness.md new file mode 100644 index 0000000..9c516f6 --- /dev/null +++ b/spec/assurance/AP-002-progressive-source-readiness.md @@ -0,0 +1,122 @@ +--- +id: AP-002 +title: tl-syntax progressive source-readiness profile +type: AssuranceProfile +status: proposed +owner: tl-syntax-release-owner +profile_version: 0.2 +profile_kind: general +scope: one exact tl-syntax Rust source candidate, declared build/evaluation configuration and source-release disposition +impact_assessments: + - id: impact-readiness-subject-substitution + scenario: evidence or review for one source revision or configuration is reused for another + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-014 + - id: impact-automated-authority-promotion + scenario: a local gate, receipt or package is treated as human release or adopter authority + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-017 + - id: impact-limitation-loss + scenario: a limitation, exception, negative result or open adopter obligation is omitted from a favorable readiness view + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-015 + - id: impact-local-assurance-substitute + scenario: an unavailable shared capability is replaced by repository-local qualification logic + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-018 +review_policy: + mode: require + operations: [spec-review, code-review, gap-analysis] +relationships: + - target: ix://agent-ix/tl-syntax/MRS-004 + type: governs + - target: ix://agent-ix/tl-syntax/AP-001 + type: references + - target: ix://agent-ix/quire-contract-ir/PGM-01 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: governs +--- + +# tl-syntax progressive source-readiness profile + +## Decision Boundary + +This profile prepares a human source-release decision for one exact Rust source +candidate and configuration. It extends rather than rewrites AP-001. It does not +qualify the native Quire language, a generated MLTL formula, a parser/evaluator/ +rewriter/monitor, crates.io publication, a consuming system or an integrator's +intended use. + +## Impact Scenarios + +The material risks are candidate/configuration substitution, promotion of an +automated observation into human authority, omission of unfavorable or open +facts, and construction of a local assurance substitute when a shared contract +is unavailable. Each is deterministic and admits a one-axis negative control. + +## Evidence Policy + +Every fact retains source, configuration, producer, procedure, environment, +outcome, stage, authority, limitation, retention-lifecycle and supersession +identities. Developer, source-release and adopter facts remain distinct. A +released Quoin contract retains evidence only when its configured backend and +handle remain retrievable; +Engineering Assurance defines shared compatibility and later use-specific +qualification; Quire owns static source-grounded exports. tl-syntax retains no +evidence store, score, approval registry or compatibility map. + +Specification review is base plus failure-domain, integrity, dependency, +evidence, risk-complexity, scope-boundary and EARS analyses. Implementation later +requires independent code review and gap analysis. Human source-release +acceptance remains a separate attributed decision after those reviews. +Every P0 M6 implementation suite must demonstrate at least one load-bearing +negative mutation before its positive results become admissible; matrix +priority is the current criticality carrier because the installed obligation +schema has no acceptance-criterion criticality column. + +## Resource Bounds + +- A symlink-resolution chain admits at most 32 links. +- The only admitted source-resolution root is the canonical immutable isolated + candidate root, whose path and filesystem/mount identity are candidate-bound; + descendant mount crossing is refused. +- A supersession traversal admits at most 4,096 facts, 8,192 directed edges and + depth 4,096. +- A decision-event intake admits at most 4,096 events from one immutable + authoritative-source query snapshot. Pagination may not mix snapshot/cursor + identities, omit or duplicate an event, or select a favorable prefix. +- A value at a bound is admitted; the first value above it produces the typed + non-success required by FR-014 or FR-015 without exposing a partial result. + +## Exceptions + +No implicit exception exists. Every exception names an owner, exact subject, +affected impact scenario/obligation, rationale, expiry, counterevidence and +human disposition. Expiry or a material subject/configuration change reopens the +affected decision. The existing Quoin implementation is the only permanent +shared-runtime non-Rust accommodation; temporary legacy paths remain pre-stable, +explicitly inventoried and inadmissible for stable qualification. A bounded +owner disposition can authorize only its named pre-stable use; stable use still +requires a Rust/shared replacement with parity. Neither category grants +permission for a new non-Rust readiness path. diff --git a/spec/assurance/MP-002-source-readiness-obligation-state.md b/spec/assurance/MP-002-source-readiness-obligation-state.md new file mode 100644 index 0000000..2dc757c --- /dev/null +++ b/spec/assurance/MP-002-source-readiness-obligation-state.md @@ -0,0 +1,66 @@ +--- +id: MP-002 +title: tl-syntax source-readiness obligation-state plan +type: MeasurementPlan +status: proposed +owner: tl-syntax-evidence-owner +metric: tl-syntax.source-readiness-obligation-state +definition_version: tl-syntax.source-readiness-obligation-state/v1 +stage: gate +statistical_design: + population: every applicable readiness requirement criterion, declared candidate/configuration axis, selected domain suite, review operation, limitation, exception, shared dependency and human decision field + sampling: complete enumeration with no sampling; stochastic campaigns remain separate attributable observations + repetitions: 2 + estimator: per-obligation categorical outcome with no weighted or aggregate qualification score + error_model: stale or substituted source/configuration, omitted obligation, shared-contract incompatibility, producer non-execution, review/decision misattribution, limitation loss and nondeterministic domain output + uncertainty: deterministic repetitions must agree; disagreements and every missing/unavailable/non-success state are reported individually and never averaged away + decision_rule: block a source-readiness claim when any required obligation is non-success or lacks current attributable evidence; the measurement never approves release or adopter use +relationships: + - target: ix://agent-ix/tl-syntax/AP-002 + type: measures + - target: ix://agent-ix/tl-syntax/NFR-004 + type: measures + - target: ix://agent-ix/tl-syntax/NFR-005 + type: measures +--- + +# tl-syntax source-readiness obligation-state plan + +## Decision Use + +The observation informs the human release owner whether one exact candidate and +configuration has a complete, current and reviewable source-readiness fact set. +It does not approve release, certify a tool, qualify native Quire/TL semantics, +publish a crate or accept an integrator's use. + +## Population + +Enumerate every FR-014 through FR-018 and NFR-004/NFR-005 criterion; each selected +feature/target/build/toolchain/corpus/profile/shared-contract axis; every domain +suite and required review; all assumptions, limitations, exceptions, +counterevidence and supersession facts; and the human decision field. Record the +exact population identity and count before collection. Additions invalidate the +old complete-population claim. + +## Collection Procedure + +At one clean candidate, select the compatible immutable shared releases and +record all configuration identities. Run domain producers only through their +declared entry points, obtain Quire's source-grounded export, and pass existing +bytes through the real Engineering Assurance and Quoin interfaces. Quarantine +prior producer output and either isolate immutable inputs or validate every +bound identity before and after each handoff. Repeat the deterministic +population twice under the same declared inputs. Apply one-axis mutations from +TC-060 and TC-063 through TC-070. A released Quoin contract retains produced evidence only when its +configured backend and handle pass retrieval; this +repository stores only specifications, configuration and domain fixtures it +owns. + +## Interpretation + +Report each categorical result and discrepancy. A missing, failed, skipped, +unsupported, stale, suspect, vacuous, tampered or nondeterministic result blocks +only the claim that requires it and remains visible. Do not compute a score that +can hide an obligation or act as a decision. Environmental or stochastic +differences retain their exact provenance. Human review and decision consume the +measurement but are never outputs of it. diff --git a/spec/evidence/suites.md b/spec/evidence/suites.md index a7c3385..8801517 100644 --- a/spec/evidence/suites.md +++ b/spec/evidence/suites.md @@ -1,10 +1,10 @@ --- id: SUR-001 -title: tl-syntax v0.1 evidence suite registry +title: tl-syntax evidence suite registry type: SuiteRegistry --- -# tl-syntax v0.1 evidence suite registry +# tl-syntax evidence suite registry ## Suites @@ -17,6 +17,11 @@ type: SuiteRegistry | SUITE-005 | Corpus schema, derived horizon, and closed-trace oracle | `python3 scripts/validate_corpus.py --json` | Python jsonschema Draft 7, tl-syntax corpus oracle | Analysis | | SUITE-006 | Shared assurance intake chain | `python3 scripts/assurance_chain.py --candidate-revision ` | quoin 0.23.1 change-assurance and evidence surfaces | Integration | | SUITE-008 | Shared assurance contract tests | `cargo test --test shared_assurance --all-features` | cargo/rustc; Git supplies the version-control path inventory | Integration | +| SUITE-009 | Source-readiness property and state-model tests | `cargo test --test source_readiness_properties --all-features` | planned Rust proptest/state-machine harness | Property | +| SUITE-010 | Source-readiness fault and freshness tests | `cargo test --test source_readiness_failures --all-features` | planned Rust fault-injection harness | Integration | +| SUITE-011 | Real shared source-readiness contract tests | `cargo test --test source_readiness_shared --all-features -- --ignored` | planned Rust integration harness plus released Engineering Assurance/Quire/Quoin | Integration | +| SUITE-012 | Real integrator-package contract tests | `cargo test --test integrator_package --all-features -- --ignored` | planned Rust contract/state/concurrency harness plus released shared package | Integration | +| SUITE-013 | Rust dependency license/source facts | `cargo deny check licenses sources` | cargo-deny input to the independent TC-072 rights-source review; not a complete material-population disposition by itself | Static | ## Notes @@ -58,3 +63,11 @@ and lifecycle boundary. TC-038 checks the exact command and verifies that the change-assurance proof declarations do not convert SUITE-008 into an attested proof input. Independent review, not that self-check, establishes whether the suite ran at the reported exact head. + +SUITE-009 through SUITE-013 are planned M6 producer identities, not present +executables and not current evidence. SUITE-011 remains blocked on the +`tl-syntax#16` accepted release set. SUITE-012 remains blocked on a compatible +released integrator-package contract. The durable-retention branch of +SUITE-011 remains blocked until a shared backend/operator, immutable handle and +lifecycle pass TC-067. Every P0 M6 suite requires a load-bearing negative +mutation before its positive result may support a source-readiness claim. diff --git a/spec/integration/IT-001-shared-source-readiness-handoff.md b/spec/integration/IT-001-shared-source-readiness-handoff.md new file mode 100644 index 0000000..f031c53 --- /dev/null +++ b/spec/integration/IT-001-shared-source-readiness-handoff.md @@ -0,0 +1,110 @@ +--- +id: IT-001 +title: Hand source-readiness inputs through the released shared stack +type: IT +relationships: + - target: ix://agent-ix/tl-syntax/FR-014 + type: verifies + - target: ix://agent-ix/tl-syntax/FR-015 + type: verifies + - target: ix://agent-ix/tl-syntax/NFR-004 + type: verifies + - target: ix://agent-ix/tl-syntax/NFR-005 + type: verifies + - target: ix://agent-ix/tl-syntax/FR-017 + type: verifies +--- + +# IT-001: Hand source-readiness inputs through the released shared stack + +## Objective + +Verify that one exact tl-syntax candidate and configuration flow through the +real released Engineering Assurance, Quire and Quoin interfaces without a local +schema/parser/runner and without promoting an unavailable or incomplete result. + +## Target Integration + +The system under test is the tl-syntax source-readiness handoff. External +dependencies are the exact released Engineering Assurance compatibility +classifier, Quire source-grounded export and Quoin record/attestation/intake/ +receipt interfaces. Tests invoke the installed real interfaces; none is mocked. + +## Preconditions + +A compatible immutable release set exists, is installed from its public +artifacts and is identified by the packaged Engineering Assurance matrix. The +worktree is clean at one exact reviewed commit. Domain producers and their +configurations are available. Hosted CI remains manual and need not be +dispatched for this local integration. + +## Inputs + +One valid candidate/configuration, its complete tracked source set, real +structured domain results and Quire export; paired mutations omit or alter one +source path/digest, feature, target, toolchain, corpus, shared artifact or +producer input. + +## Test Procedure + +1. Probe and classify every installed shared artifact through the released + compatibility interface. + - IT-001-SC-01: every selected identity/version/digest is compatible and no local mapping is consulted. +2. Produce domain results only through the declared tl-syntax producer target, + then obtain the real source-grounded Quire export. + - IT-001-SC-02: the export binds every selected requirement/source identity and reports no inferred or omitted live source. +3. Pass the existing bytes through Quoin seal, attestation, intake and receipt + operations without allowing Quire or Quoin to execute a producer. + - IT-001-SC-03: every output retains the exact subject/configuration and actual non-success/human-decision state. +4. Repeat each one-axis missing, stale, incompatible and substituted input case. + - IT-001-SC-04: each case refuses or remains unavailable/incomplete and cannot reuse the healthy result. +5. Quarantine prior output, force skip/crash/timeout/partial-output outcomes, + mutate one bound source/configuration identity during a run, restore it + before completion, and replace a pathname after its bytes are observed. + - IT-001-SC-05: no stale output is accepted; mid-run and change-then-restore mutations refuse the observation; and the exact descriptor-backed bytes identified before execution are the bytes consumed without pathname reopen. +6. Substitute repository/Git object identity and each applicable symlink, + submodule, Git LFS, generated or fetched-input identity. + - IT-001-SC-06: each changed materialized input creates a new subject or an explicit unavailable result. +7. Mutate the selected reviewer/decision policy and each actor, contributor, + conflict, delegation, revocation, quorum and review-subject binding. Split, + duplicate, reorder or omit event pages; change their snapshot/cursor identity; + exceed the event bound; and vary the evaluation instant/time authority at, + below and above an expiry. + - IT-001-SC-07: an unverifiable event is refused while the disposition stays open; insufficient quorum or an incomplete/non-atomic event population stays open without a local policy registry; and expiry changes state only under the bound verified time authority and canonical ordering. +8. Retrieve every claimed durable handle after deleting only the disposable + producer workspace, then substitute returned bytes, media type, subject, + lifecycle and handle binding. + - IT-001-SC-08: durable success requires current exact retrieval from the declared backend/operator; every mutation is unavailable, tampered or refused rather than retained success. +9. Submit acyclic, dangling, cyclic, cross-subject, forked and contradictory + supersession relations plus unresolved, satisfied and expired conditional + decision states. + - IT-001-SC-09: graph and decision transitions match FR-015/FR-017 exactly and never choose a favorable branch or auto-accept a satisfied condition. + +## Expected Results + +The healthy candidate produces source-grounded shared artifacts for its exact +subject. Every mutated case fails on the changed axis. A missing human decision +remains missing, and no command or receipt approves the release. + +## Metadata + +- Priority: High +- Target Integration: released Engineering Assurance + Quire + Quoin interfaces +- Automation: Planned Rust integration test plus real shared CLI boundary + +## Dependencies + +`agent-ix/tl-syntax#16` remains blocked until a released Engineering Assurance +matrix accepts the source-grounded Quire artifact. This test cannot run against +a branch-head or local substitute. + +## Notes + +The exact shared versions are selected at implementation time from a reviewed +immutable compatible release set; this draft does not approve the currently +missing combination. + +## Traceability + +Planned matrix cases TC-059, TC-060, TC-062, TC-063, TC-066 through TC-070 and +TC-073 exercise this integration boundary. diff --git a/spec/integration/IT-002-integrator-package-handoff.md b/spec/integration/IT-002-integrator-package-handoff.md new file mode 100644 index 0000000..7d4586a --- /dev/null +++ b/spec/integration/IT-002-integrator-package-handoff.md @@ -0,0 +1,121 @@ +--- +id: IT-002 +title: Preserve source facts through the real integrator-package contract +type: IT +relationships: + - target: ix://agent-ix/tl-syntax/FR-016 + type: verifies + - target: ix://agent-ix/tl-syntax/FR-017 + type: verifies +--- + +# IT-002: Preserve source facts through the real integrator-package contract + +## Objective + +Verify that the future real shared integrator-package writer/reader preserves +tl-syntax source-release facts and open adopter obligations without creating a +qualification, certification or acceptance claim. + +## Target Integration + +The system under test is the tl-syntax adapter to a compatible released +Engineering Assurance integrator-package contract. The test invokes the real +shared writer and strict reader. No repository-local format or mock reader is +admitted. + +## Preconditions + +Engineering Assurance has released an accepted Rust-consumable package +contract, and the compatibility matrix selects its exact identity/version/ +digest. A human source-release disposition and its source facts exist for one +exact tl-syntax candidate. Until those conditions hold, this integration is +blocked and package emission remains unavailable. + +## Inputs + +One complete source-release fact set; two different adopter intended-use and +deployment configurations; open and completed adopter fields; and mutations of +each assumption, limitation, exception, negative result, review, decision, +profile, corpus, configuration and supersession identity. +Applicable license and reuse-right identities are included in the valid set and +mutated independently. + +Completed adopter fields are preserved only as separately attributed adopter- +stage inputs. Package readability and the source-release disposition neither +validate those fields nor convert them into accepted adopter obligations. + +## Test Procedure + +1. Emit and read the valid package through the real shared contract. + - IT-002-SC-01: every source-release and open adopter fact survives exactly with its stage and authority. +2. Pair the same source release with two intended-use/configuration subjects. + - IT-002-SC-02: the reader returns two distinct open adopter subjects and no inherited acceptance. +3. Delete or alter each required fact independently and submit the bytes to the + strict reader. + - IT-002-SC-03: the reader refuses the mutation or retains the named incomplete/unrepresented obligation without improving disposition; license and reuse-right loss is not silent. +4. Remove the compatible shared contract selection. + - IT-002-SC-04: tl-syntax reports unavailable and no local writer, schema, reader or approval path runs. +5. Force writer/reader spawn, timeout, signal, nonzero, truncation, partial-write + and schema/version failures while a prior package exists. + - IT-002-SC-05: no partial or prior package is exposed as new; only a candidate-bound temporary object that passes strict read and integrity verification becomes visible. +6. Supply conditional, concurrent and contradictory decision successors. + - IT-002-SC-06: the package preserves condition/conflict state and cannot present unconditional or adopter acceptance. +7. Reconcile every material against authoritative license/reuse-right sources, + then remove, conflict or substitute each authority independently. + - IT-002-SC-07: one normalized SPDX expression and complete source set represents valid `AND`/`OR`/nested licensing; missing resolution is incomplete, conflicting resolution is conflict, and unverifiable authority is refused. +8. Retry identical package attempts, reuse one attempt identity with changed + inputs, and race non-identical writers. + - IT-002-SC-08: identical retries resolve to one verified object; identity reuse and non-identical races produce conflict without exposing a timing-selected winner. + +## Expected Results + +The shared package is lossless for source facts and explicit about every open +adopter obligation. Mutations fail closed. Neither source-release acceptance nor +package readability establishes publication, certification, monitor +qualification or adopter acceptance. + +## License and Rights Analysis Procedure + +TC-072 binds its analysis population to the exact candidate and includes every +tracked source file, emitted package member, `Cargo.lock` dependency, and +generated or embedded third-party material. The authoritative evidence for each +material is the repository license/notice set, the exact dependency package or +release metadata, and any immutable registry or upstream notice selected by the +review policy; every source is retained with its issuer, applicability basis, +identity and digest. + +SUITE-013 supplies dependency-license and dependency-source facts for the Rust +closure. An independent rights reviewer reconciles those facts and the remaining +material population against the authoritative evidence, records the exact +candidate, tool/configuration identity, reviewer identity and policy, limitations +and complete source set, and assigns one normalized SPDX expression per +material. Missing disposition produces `incomplete`, incompatible resolutions +produce `conflict`, and an unverifiable authority produces `refused`. The output +is attributable engineering analysis; neither the automated check nor the +review is represented as legal advice, certification or a transfer of release +authority. + +## Metadata + +- Priority: High +- Target Integration: future released Engineering Assurance integrator package +- Automation: Planned real Rust/shared-contract integration test + +## Dependencies + +Engineering Assurance owns the shared package and use-specific qualification +contract. Quoin owns the retention/receipt interface, while the selected +external backend operator/custodian owns stored bytes. tl-syntax implements only +the reviewed consumer and handle verification after exact compatible releases +and authorities exist. + +## Notes + +This planned test is deliberately blocked on a real contract. A mock would hide +the central compatibility and losslessness boundary. + +## Traceability + +Planned TC-061, TC-062, TC-063, TC-066, TC-068 and TC-070 through TC-072 cover +its acceptance dimensions. diff --git a/spec/requirements/FR-014-bind-source-readiness-candidate.md b/spec/requirements/FR-014-bind-source-readiness-candidate.md new file mode 100644 index 0000000..d9fe4da --- /dev/null +++ b/spec/requirements/FR-014-bind-source-readiness-candidate.md @@ -0,0 +1,125 @@ +--- +id: FR-014 +title: Bind source-readiness facts to one candidate and configuration +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/NFR-003 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-018 + type: depends_on +--- + +# FR-014: Bind source-readiness facts to one candidate and configuration + +## Description + +When source-readiness facts are prepared, tl-syntax shall bind them to one exact +candidate revision, declared complete live-source population and build/evaluation +configuration through released shared-assurance contracts. + +## Inputs + +- Canonical repository identity, exact Git commit/tree identity and clean + declared materialized source population selected for review, including + tracked regular-file bytes, symlink targets and any submodule, Git LFS, + generated or build-time fetched input disposition. +- The ordered canonical admitted-root set and each root's immutable filesystem/ + mount identity; AP-002 admits only the isolated candidate root. +- Crate name/version plus `Cargo.toml`, `Cargo.lock`, Rust toolchain and source + artifact digests. +- Selected features, target triples, build flags, corpus/profile revisions and + domain-suite identities. +- Exact Engineering Assurance, Quire, Quoin and workflow package identities, + versions and consumed artifact digests. +- For every executed producer: executable bytes, invocation identity/run nonce, + arguments/environment, start and completion facts, process outcome and fresh + output identity. +- For every opened source or producer input: the released-contract snapshot or + capability identity whose exact bytes are hashed and consumed without a + pathname reopen. + +## Outputs + +- Source-grounded shared-contract inputs for one exact candidate/configuration, + or the exact MRS-004 `ReadinessState` produced by a non-success condition, + including `unavailable` for an absent/incompatible required shared capability, + `incomplete` for missing package/artifact integrity and `refused` for a + missing, stale or ambiguous candidate identity. + +## Behavior + +- tl-syntax shall treat a changed candidate revision, tracked source path or + byte, feature set, target, toolchain, build flag, corpus/profile revision, + shared-contract release or consumed artifact digest as a different readiness + subject. +- tl-syntax shall refuse a dirty or incompletely enumerated live source + population instead of describing it as the reviewed candidate. +- tl-syntax shall execute against immutable isolated candidate/configuration + snapshots. A before/after pathname recheck alone is not evidence of + immutability because an input can change and return to its original identity + between checks. +- The same descriptor-backed snapshot or capability whose bytes and metadata + establish a bound identity shall be the input exposed to each producer and + shared handoff; reopening the original pathname after observation is refused. +- If any bound identity changes during execution, then the tl-syntax Rust + readiness projection shall produce `refused`. +- tl-syntax shall quarantine or remove prior producer outputs before invocation. +- The tl-syntax Rust readiness projection shall accept only output freshly + created by the successful bound invocation. +- The tl-syntax Rust readiness projection shall record the exact + `ExecutionOutcome` without reusing a prior output. +- tl-syntax shall retain unsupported and unevaluated configurations as explicit + states instead of copying a result from a nearby configuration. +- While compatible released capabilities are available, tl-syntax shall use + the source-grounded Quire export and Quoin source connections. +- A packaged compatibility matrix shall be bound through the immutable released + package/version and package-integrity mechanism that supplies it. +- Every artifact consumed outside the matrix's package shall retain its own + digest. +- If package integrity or an external-artifact digest is missing, then the + tl-syntax Rust readiness projection shall classify the shared artifact set as + `incomplete`. +- tl-syntax shall preserve symlink link bytes. +- When the build consumes a symlink referent, tl-syntax shall bind its resolved + bytes and identity. +- tl-syntax shall constrain every resolved symlink referent to a profile- + admitted root. +- tl-syntax shall constrain every resolved symlink referent to an ordinary file + type. +- The tl-syntax source walk shall detect resolution cycles. +- The tl-syntax source walk shall enforce the AP-002 symlink-chain bound. +- The tl-syntax source walk shall normalize and resolve every path segment + beneath the bound admitted root without crossing a descendant mount. +- The tl-syntax source walk shall bind the admitted-root set, canonical paths + and filesystem/mount identities before and after resolution. +- If root/path/mount identity changes during resolution, then the tl-syntax Rust + readiness projection shall produce `refused`. +- If a symlink is dangling, cyclic, out-of-root, special-file targeting or over + the declared chain bound, then the tl-syntax Rust readiness projection shall + produce `refused`. +- If a required released source-grounding capability is unavailable, then + tl-syntax shall report the readiness request unavailable. +- tl-syntax shall not parse Markdown, copy a branch-head contract or introduce + a local source-identity schema as a substitute. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-014-AC-1 | Every healthy readiness input names one exact candidate revision, complete tracked-source set, crate/package bytes, feature/target/build configuration, corpus/profile revision, suite set and compatible shared-contract artifact set. | Test (TC-059) | +| FR-014-AC-2 | Mutating any identity or digest changes the readiness subject; omitting a required candidate identity is refused, while absence/incompatibility of a required shared capability is unavailable, and no prior result is reused. | Test (TC-060) | +| FR-014-AC-3 | Dirty, untracked-live, mutable-ignore, incomplete-census and unavailable-enumeration cases cannot be represented as a clean reviewed candidate. | Test (TC-060) | +| FR-014-AC-4 | Absence of a compatible released source-grounding contract remains unavailable and creates no local parser, schema, matrix or branch-head substitute. | Test (TC-066) | +| FR-014-AC-5 | Every `ExecutionOutcome` value in MRS-004 is exercised with a valid stale output present; no non-`succeeded` value yields a current successful domain output, every accepted output binds fresh invocation/executable/termination facts, and mid-run plus change-then-restore source/configuration mutations are refused. | Test (TC-068) | +| FR-014-AC-6 | Candidate identity includes repository/Git/materialized-source/admitted-root identities; the exact descriptor-backed bytes that are identified are consumed without pathname reopen; material or root/path/mount substitution/race is detected or unavailable; symlink chains below/at AP-002's bound terminate; and dangling/cyclic/out-of-root/special/mount-crossing/over-bound paths are refused. | Test (TC-069) | + +## Dependencies + +- [FR-006](./FR-006-shared-assurance-intake.md) owns current shared intake. +- [NFR-003](./NFR-003-qualification-integrity.md) owns existing v0.1 + qualification meaning and the pre-stable limitations. +- `agent-ix/tl-syntax#16` owns adoption of a released source-grounded Quire and + Engineering Assurance compatibility set; this requirement does not bypass + its resume condition. diff --git a/spec/requirements/FR-015-preserve-readiness-stages.md b/spec/requirements/FR-015-preserve-readiness-stages.md new file mode 100644 index 0000000..4d72928 --- /dev/null +++ b/spec/requirements/FR-015-preserve-readiness-stages.md @@ -0,0 +1,96 @@ +--- +id: FR-015 +title: Preserve developer, source-release and integrator stages +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-014 + type: depends_on +--- + +# FR-015: Preserve developer, source-release and integrator stages + +## Description + +When a verification, review or decision fact is consumed, the tl-syntax Rust +readiness projection shall preserve whether it is a developer observation, +source-release input, human source-release decision or integrator-adoption +input. + +## Inputs + +- Candidate/configuration identity from [FR-014](./FR-014-bind-source-readiness-candidate.md). +- Structured domain results, Quire static exports, Quoin records/attestations/ + receipts, independent review facts, human decision events, assumptions, + exceptions, counterevidence and limitations. +- For every retained fact: the shared retention authority/backend, immutable + record or content handle, retention start/rule, retrieval method, + supersession link, expiry/deletion rule and current availability. + +## Outputs + +- Independently classified facts retaining their producer, subject, + configuration, stage, outcome, authority and limitations. + +## Behavior + +- The tl-syntax Rust readiness projection shall keep every MRS-004 + `ReadinessState` value distinct. +- The tl-syntax Rust readiness projection shall not promote a local or hosted command result + into an independent review, Quoin attestation, human decision or integrator + validation. +- The tl-syntax Rust readiness projection shall not treat a Quoin receipt or complete source- + release evidence set as authority to approve or publish a release. +- The tl-syntax Rust readiness projection shall retain every declared assumption, exception, + known anomaly, failed/missing obligation and evidence limitation alongside + any successful fact it qualifies. +- The tl-syntax Rust readiness projection shall preserve immutable earlier facts + when a later result supersedes, invalidates or narrows them. +- The tl-syntax Rust readiness projection shall link every superseding, + invalidating or narrowing fact to the exact prior identity. +- Supersession/invalidation links shall target existing facts for the same + subject lineage and remain acyclic. +- The tl-syntax Rust readiness projection shall refuse a dangling, + cross-subject or cyclic supersession link. +- The tl-syntax Rust readiness projection shall produce `conflict` for forked + or contradictory successors until an attributed successor explicitly + supersedes the complete conflicting set. +- The tl-syntax Rust readiness projection shall preserve an unknown stage, + outcome, authority or lifecycle enum value as raw input and produce + `unsupported`. +- The tl-syntax Rust readiness projection shall produce `refused` for a + malformed encoding of a known value. +- The tl-syntax Rust readiness projection shall distinguish a transient workspace result from + evidence retained by an identified shared authority. +- The tl-syntax Rust readiness projection shall assign exactly one MRS-004 + `RetentionState` from current backend/handle/lifecycle/retrieval facts. +- The tl-syntax Rust readiness projection shall not infer provenance truth, + actor identity, non-repudiation, semantic correctness or evidence sufficiency + from a digest. +- Supersession traversal shall be iterative or maintain a visited set and obey + the AP-002 node, edge and depth bounds. +- If a supersession bound is exceeded, then the tl-syntax Rust readiness + projection shall produce `unsupported` without selecting a partial current + fact. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-015-AC-1 | Developer observations, source-release inputs, human decisions and integrator-adoption inputs remain distinguishable without diagnostic prose. | Test (TC-062) | +| FR-015-AC-2 | Replacing any non-success outcome, missing review, absent decision, limitation or exception with success is detected and refused. | Test (TC-063) | +| FR-015-AC-3 | A later superseding/invalidation fact retains the earlier bytes and identity and names the exact changed premise; it cannot silently restamp the earlier fact. | Test (TC-063) | +| FR-015-AC-4 | No automated result, receipt, score or complete-evidence classification creates release, publication, certification or integrator-acceptance authority. | Test (TC-066) | +| FR-015-AC-5 | Every evidence fact names its retention authority/backend/operator, handle, lifecycle and retrieval bindings and maps to exactly one MRS-004 `RetentionState`; workspace deletion, unavailable handles and every retrieval failure follow the total mapping and cannot report `retained-current`. | Test (TC-067) | +| FR-015-AC-6 | Supersession/invalidation traversal terminates over an acyclic same-subject graph below/at AP-002's node/edge/depth bounds; over-bound is `unsupported`, dangling/cross-subject/cyclic relations are refused, and forked/contradictory successors produce `conflict` without selecting a favorable current fact. | Test (TC-070) | +| FR-015-AC-7 | Every unknown stage, outcome, authority or lifecycle enum value remains attributable raw input and produces `unsupported`; malformed known values produce `refused`, with neither coerced to success or another favorable state. | Test (TC-063) | + +## Dependencies + +Quoin owns the shared evidence-recording, retention and orchestration contract +but neither operates an unspecified backend nor decides evidence sufficiency. +The selected external backend operator/custodian owns stored bytes; tl-syntax +only consumes and verifies handles. Engineering Assurance owns shared +compatibility and later use-specific qualification contracts. The human source-release owner retains the decision in +[FR-017](./FR-017-require-human-source-release-decision.md). diff --git a/spec/requirements/FR-016-emit-integrator-readiness-package.md b/spec/requirements/FR-016-emit-integrator-readiness-package.md new file mode 100644 index 0000000..2444163 --- /dev/null +++ b/spec/requirements/FR-016-emit-integrator-readiness-package.md @@ -0,0 +1,110 @@ +--- +id: FR-016 +title: Emit a shared-contract integrator readiness package +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-014 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-015 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-017 + type: depends_on +--- + +# FR-016: Emit a shared-contract integrator readiness package + +## Description + +Where a compatible released integrator-package contract exists, tl-syntax shall +populate that contract with reusable source-release facts while leaving the +integrator's intended-use, deployment and validation decision open. + +## Inputs + +- Exact source candidate/configuration and stage-classified facts from + [FR-014](./FR-014-bind-source-readiness-candidate.md) and + [FR-015](./FR-015-preserve-readiness-stages.md). +- The compatible released integrator-package contract identity, revision and + digest. +- Declared tl-syntax assumptions, feature/target limits, semantic profile and + corpus scope, known anomalies, exceptions, counterevidence, review facts, + human source-release disposition, applicable license/rights notices and + adoption guidance. +- The authoritative material population plus the issuer/source and applicability + basis for every license or reuse-right notice. + +## Outputs + +- A `PackageResult` from MRS-004 and, only for `published`, a package in the + released shared format with every reusable and still-open obligation + represented. + +## Behavior + +- The package shall distinguish immutable source-release facts from adopter- + supplied intended use, deployed artifact/configuration, platform, monitor, + hazard/consequence analysis, validation evidence and acceptance authority. +- The package shall retain exact source, crate artifact, configuration, profile, + corpus, shared-contract, evidence, review, decision, assumption, limitation, + exception, supersession, license and reuse-right identities. +- The package shall list unsupported and unrepresented consumer obligations + rather than omitting them or relabeling them as satisfied. +- Each included source/package material shall map to exactly one attributable + `LicenseResolution` containing a normalized SPDX expression and complete + authoritative source set. +- The tl-syntax Rust package adapter shall preserve valid `AND`, `OR` and nested + SPDX expressions as compound expressions rather than conflicts. +- If a license/reuse-right disposition is missing, then the tl-syntax Rust + package adapter shall produce `incomplete`. +- If license/reuse-right dispositions conflict, then the tl-syntax Rust package + adapter shall produce `conflict`. +- If a license/reuse-right authority is unverifiable, then the tl-syntax Rust + package adapter shall produce `refused` without repair by copying a notice. +- The package shall not claim native Quire source-language qualification, + R2U2/C2PO monitor qualification, consuming-system certification, + accreditation, authorization or non-repudiation. +- If the compatible released integrator-package contract is absent, then + tl-syntax shall report `unavailable`. +- If package writing, strict reading or integrity verification fails by spawn, + timeout, signal, nonzero exit, truncation, partial write or schema/version + mismatch, then tl-syntax shall retain the exact failure and expose no package. +- The tl-syntax Rust package adapter shall map every package-stage + `ExecutionOutcome` to the total `PackageResult` mapping in MRS-004 while + retaining the exact execution value. +- The tl-syntax Rust package adapter shall use candidate-bound temporary output. +- If strict reading and integrity verification succeed, then the tl-syntax Rust + package adapter shall expose the package atomically. +- If package production fails, then the tl-syntax Rust package adapter shall + leave no partial or prior package addressable as new. +- The tl-syntax Rust package adapter shall bind a shared-contract idempotency/ + attempt identity. +- If a retry has identical inputs and attempt identity, then the tl-syntax Rust + package adapter shall resolve it to the same verified object. +- If a retry reuses an attempt identity with non-identical inputs, then the + tl-syntax Rust package adapter shall produce `conflict`. +- If concurrent writers have non-identical inputs, then the tl-syntax Rust + package adapter shall produce `conflict` without exposing either as current. +- tl-syntax shall not create a local package schema, evidence store, validator, + approval workflow or compatibility map. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-016-AC-1 | A package round trip through the real released shared reader preserves every named source-release fact, identity, assumption, limitation, exception, counterexample, review, decision, applicable license and reuse-right state. | Test (TC-061, IT-002) | +| FR-016-AC-2 | The same source release paired with two intended uses or deployed configurations remains two distinct open integrator subjects and inherits no adopter acceptance. | Test (TC-061) | +| FR-016-AC-3 | Removing an unsupported obligation, limitation, exception, negative result or open adopter field cannot improve the package or create a complete integrator disposition. | Test (TC-063) | +| FR-016-AC-4 | Without a compatible released shared contract, package production is explicitly unavailable and no repository-local substitute exists. | Test (TC-066) | +| FR-016-AC-5 | Every package-stage `ExecutionOutcome` maps exactly as MRS-004 specifies, retains its cause and exposes no partial/stale/mislabeled package; only a strictly read and verified candidate-bound temporary object becomes atomically visible. | Test (TC-068, IT-002) | +| FR-016-AC-6 | Identical retries resolve to one verified object; attempt-identity reuse with different inputs and concurrent non-identical writers produce `conflict`, so neither input can win by timing. | Test (TC-071, IT-002) | +| FR-016-AC-7 | Every included source/package material maps to one normalized applicable license/reuse-right resolution and its complete authoritative source set, preserving valid compound expressions; missing disposition is `incomplete`, incompatible expressions are `conflict`, and unverifiable authority is `refused` even when a notice round-trips unchanged. | Analysis (TC-072) | + +## Dependencies + +The reusable package format and use-specific qualification model belong to +Engineering Assurance. Quoin owns the retention/receipt interface, and a +selected external backend operator/custodian owns stored bytes. No +implementation begins until exact compatible released contracts, authorities +and lifecycle semantics are available and reviewed for this consumer. diff --git a/spec/requirements/FR-017-require-human-source-release-decision.md b/spec/requirements/FR-017-require-human-source-release-decision.md new file mode 100644 index 0000000..351f3c8 --- /dev/null +++ b/spec/requirements/FR-017-require-human-source-release-decision.md @@ -0,0 +1,133 @@ +--- +id: FR-017 +title: Require an exact human source-release decision +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-015 + type: depends_on +--- + +# FR-017: Require an exact human source-release decision + +## Description + +When a source-release disposition is requested, the tl-syntax Rust admission +adapter shall +require an attributed human release-owner decision for the exact candidate and +configuration after the required independent reviews and limitation inspection. + +## Inputs + +- Exact candidate/configuration identity. +- Required specification, code and gap-review outcomes, each binding reviewer + identity/independence, exact head and base, reviewed configuration/evidence + set, finding dispositions and accepted limitations. +- Current evidence/counterevidence, assumptions, exceptions, limitations and + unresolved challenges. +- The authoritative release-owner/reviewer-independence policy identity and + version, authorized actors/quorum, candidate author/contributor set, conflict + disclosures and current delegation/revocation facts. +- Zero or more authenticated decision events for the exact subject lineage from + the authoritative event source, including every current concurrent successor, + one immutable query snapshot/cursor identity and a completeness result. +- The decision-evaluation instant, named clock/time authority and the released + contract's canonical timestamp/ordering rules used for expiry decisions. + +## Outputs + +- A `DecisionDisposition` from MRS-004 for the exact subject plus zero or more + per-event `DecisionEventAdmission` values and event records. +- An event-backed accepted/rejected/deferred/conditional disposition retains + exact event identity and rationale; `open` requires no absent event fields, + and `conflict` retains the complete conflicting event set. + +## Behavior + +- While a required review or human decision is absent, the tl-syntax Rust + admission adapter shall keep the disposition `open`. +- The tl-syntax Rust admission adapter shall aggregate the complete event set + for the exact subject lineage through the AP-002 node, edge and depth bounds. +- The event set shall come from one immutable source snapshot. Duplicate, + missing, reordered or cross-snapshot pages, a changed cursor/snapshot identity, + an incomplete enumeration or an over-bound population shall keep the current + disposition `open` and retain the exact non-success limitation; no observed + favorable subset is admissible. +- If an event is stale or bound to the wrong actor/subject, then the tl-syntax + Rust admission adapter shall set its `DecisionEventAdmission` to `refused`. +- If current events are ambiguous or contradictory, then the tl-syntax Rust + admission adapter shall produce `conflict`. +- The tl-syntax Rust admission adapter shall preserve a human rejection, conditional + acceptance, exception and expiry without translating any of them into an + unconditional pass. +- A conditional disposition shall bind each condition to its owner, required + evidence and expiry. +- While any condition is unresolved and unexpired, the tl-syntax Rust admission + adapter shall keep the disposition `conditional`. +- If a condition is satisfied, then the tl-syntax Rust admission adapter shall + preserve `conditional` until a new authorized decision is recorded. +- If a condition expires, then the tl-syntax Rust admission adapter shall mark + the prior conditional decision stale and set the current disposition `open`. + Expiry occurs exactly when a verified evaluation instant is equal to or later + than the bound expiry under the released contract's canonical ordering. +- If the evaluation instant, clock/time authority or canonical ordering cannot + be verified, then the tl-syntax Rust admission adapter shall preserve the + historical event and keep the current disposition `open` rather than guess + whether it expired. +- The tl-syntax Rust admission adapter shall require a new decision when the candidate, + configuration, applicable profile, material limitation, required review or + shared-contract identity changes. +- The tl-syntax Rust admission adapter shall not synthesize, infer or replay a human decision + from a green gate, Quoin receipt, pull-request merge or prior release. +- The tl-syntax Rust admission adapter shall not count an author's self-review as an + independent review. +- The tl-syntax Rust admission adapter shall invalidate a review relation when + its exact head, base, configuration, evidence set or accepted limitation changes. +- The tl-syntax Rust admission adapter shall verify reviewer independence and decision + authority against the bound policy/version, actor, author/contributor set, + conflicts, delegations, revocations and quorum instead of accepting a + self-asserted Boolean independence field. +- The tl-syntax Rust admission adapter shall require every accepted limitation + or exception to be attributable to the authorized human release owner for the + exact decision subject. +- The tl-syntax Rust admission adapter shall preserve every accepted + limitation's or exception's rationale, affected obligations, counterevidence + and expiry. +- If review/decision successors are concurrent, forked or contradictory, then + the tl-syntax Rust admission adapter shall produce `conflict` until an + attributed authorized resolution explicitly supersedes every conflicting + predecessor in the same subject lineage. +- A deferred decision shall bind its owner, rationale, resume condition and + expiry. +- A deferred decision shall remain `deferred` until a new authorized decision + resolves it. +- If a current accepted, rejected, deferred or conditional decision, exception + or policy binding expires, then the tl-syntax Rust admission adapter shall + preserve it as stale history and set the current disposition `open`. +- A source-release decision shall not decide crates.io publication or an + integrator's use-specific qualification. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-017-AC-1 | Accepted/rejected/deferred/conditional/open/conflict remain distinct exact-subject dispositions; event-backed states retain identity/rationale/exception/expiry, `open` requires no absent event fields, and `conflict` retains the complete event set. | Test (TC-062) | +| FR-017-AC-2 | An absent required review/decision or an incomplete, cross-snapshot, changed-cursor or over-bound event enumeration leaves the disposition `open`; a stale or wrong-actor/subject event is `refused` while the disposition stays `open`; an ambiguous/contradictory complete current set produces `conflict`, and none is inferred as accepted. | Test (TC-063) | +| FR-017-AC-3 | Every material candidate/configuration/profile/limitation/shared-contract change requires a new review/decision relation and preserves the historical disposition. | Test (TC-063) | +| FR-017-AC-4 | A source-release acceptance grants neither publication nor integrator/system/monitor qualification. | Test (TC-066) | +| FR-017-AC-5 | Each required review binds an attributable independent reviewer, exact head/base/configuration/evidence set, finding dispositions and accepted limitations; self-review or any bound-identity change leaves the review requirement open. | Test (TC-073) | +| FR-017-AC-6 | Independence and authority are evaluated against an exact policy/version, author/contributor set, conflicts, delegations, revocations and quorum; an unverifiable event is `refused`, and an insufficient quorum leaves the disposition `open`. | Test (TC-073) | +| FR-017-AC-7 | Conditional decisions retain condition owner/evidence/expiry; unresolved and satisfied conditions stay `conditional` until a new authorized decision; expiry reopens the disposition only at a verified equal-or-later instant under the bound clock/time authority and canonical ordering; deferred decisions retain owner/resume/expiry until a new authorized decision; and concurrent/contradictory successors produce `conflict` until explicitly resolved. | Test (TC-070) | + +## Dependencies + +- [AP-002](../assurance/AP-002-progressive-source-readiness.md) selects the + required review operations and decision boundary. +- `agent-ix/engineering-assurance#11` owns later use-specific producer + qualification and independence, not this source-release decision. +- PGM-01 and the repository's exact human-release-owner policy own source- + release authority; GitHub supplies authenticated review/event facts but does + not define independence or quorum. Until the exact immutable policy/event + source and authorized actor set are selected, decision admission remains + unavailable and tl-syntax creates no local reviewer or approval registry. diff --git a/spec/requirements/FR-018-classify-qualification-execution-paths.md b/spec/requirements/FR-018-classify-qualification-execution-paths.md new file mode 100644 index 0000000..ae1df5f --- /dev/null +++ b/spec/requirements/FR-018-classify-qualification-execution-paths.md @@ -0,0 +1,91 @@ +--- +id: FR-018 +title: Classify every readiness execution path +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/NFR-003 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-006 + type: depends_on +--- + +# FR-018: Classify every readiness execution path + +## Description + +The maintainer shall complete classification of every executable production, +test, fixture-audit, +adapter, orchestration and qualification path as retained shared capability, +domain-specific Rust logic, missing reusable capability or explicitly +owner-dispositioned legacy logic before implementing source readiness or +deciding a stable candidate. + +## Inputs + +- Exact candidate tracked-source census and executable-path inventory. +- Implementation-language owner policy. +- Released shared-capability inventory and open upstream tickets. +- Existing behavior, failure-path evidence and proposed replacement ownership. + +## Outputs + +- A reviewed disposition for every executable path, including language, + purpose, authority, owner, replacement/retention decision, parity obligation, + failure-path evidence and resume condition. + +## Behavior + +- New first-party libraries, CLI/tools, generators, validators, + canonicalization, adapters, test assertions and fixture/CI audits shall be + Rust. +- Existing Quoin shall remain the only permanent shared-runtime non-Rust + accommodation. +- The Quoin accommodation shall not authorize new TypeScript or Node semantics. +- Existing Python, shell, Make, inline workflow and other executable paths shall + remain classified as temporary pre-stable legacy paths. +- The tl-syntax executable census shall keep every temporary legacy path in the + inventory. +- Stable qualification shall exclude every temporary legacy path. +- A bounded owner disposition shall authorize only its named pre-stable use. +- Stable qualification shall require a Rust/shared replacement with positive + and failure-path parity for every required legacy behavior. +- The inventory shall distinguish data schemas and foreign-language fixture + samples from executable logic. +- The census unit shall be one tracked executable entry point or interpreter/ + runtime invocation. +- The tl-syntax executable census shall apply this exhaustive candidate-class + set: released shared tool, tl-syntax-owned Rust, owner-dispositioned legacy + executable and missing reusable capability. +- If zero or multiple candidate classes match, then the tl-syntax executable + census shall produce an ambiguity error rather than choosing by order. +- The tl-syntax executable census shall include tracked scripts/binaries, build scripts, generated + workflow steps, inline/nested interpreter or runtime invocations, dynamically + assembled commands and executable generators. +- If an executable construction cannot be resolved, then the tl-syntax + executable census shall keep it unclassified in the population. +- A missing shared runner, source export, integrator format, evidence store or + qualification contract shall remain an upstream dependency. +- tl-syntax shall not re-create a missing shared capability in this repository. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-018-AC-1 | Every tracked executable entry point/runtime invocation is present exactly once with language, purpose, authority, owner, disposition, parity/failure evidence and resume condition; adding an entry point or producing zero/multiple class matches makes the census fail until classified. | Test (TC-064) | +| FR-018-AC-2 | Every new first-party executable readiness path is Rust; Quoin's retained accommodation does not admit another Node/TypeScript path. | Test (TC-064) | +| FR-018-AC-3 | Each replacement demonstrates positive and forced-failure parity before the legacy path is removed; missing parity leaves the replacement incomplete. | Test (TC-065) | +| FR-018-AC-4 | No missing reusable assurance capability is replaced by a local runner, parser, schema, evidence store, compatibility map or approval workflow. | Test (TC-066) | + +## Dependencies + +- `agent-ix/quire-research#64` owns the cross-repository policy/catalog; + tl-syntax owns exhaustive local enumeration, classification, refusal and + bounded legacy disposition. +- `agent-ix/engineering-assurance#34` delivered the reusable Rust producer- + execution boundary; Task-010 must still admit an immutable compatible release + that contains it before this repository consumes it. +- `agent-ix/tl-syntax#16` owns the source-grounded shared-contract migration. diff --git a/spec/requirements/NFR-003-qualification-integrity.md b/spec/requirements/NFR-003-qualification-integrity.md index 3e72ad2..9650ab7 100644 --- a/spec/requirements/NFR-003-qualification-integrity.md +++ b/spec/requirements/NFR-003-qualification-integrity.md @@ -14,10 +14,8 @@ relationships: ## Statement -Candidate qualification shall preserve the distinction between repository -verification, shared-contract intake, and a human release decision; bind every -claimed result to the identified candidate and producer bytes; keep non-success -outcomes out of the passing class; and grant no automated release authority. +Candidate qualification shall preserve repository verification, shared-contract +intake and a human release decision as distinct attributable states. ## Scope and ownership @@ -27,6 +25,10 @@ Assurance, Quire, and Quoin contracts. This requirement owns the qualification meaning and lifecycle of those results. It does not make Quire or Quoin a test runner and does not turn a local test result into a Quoin attestation. +Every claimed result shall bind the identified candidate and producer bytes. +Every non-success outcome shall remain outside the passing class. No automated +gate, receipt or classification shall grant release authority. + | Control | Requirement owner | Verification | Lifecycle boundary | |---|---|---|---| | Shared component compatibility | NFR-003-AC-1 | TC-021 invokes the packaged Engineering Assurance classifier over every declared component and consumed artifact digest. | Re-run for every candidate or adopted shared-component release. | @@ -69,7 +71,7 @@ CI ran, or authorize a release. | ID | Criteria | Verification | |---|---|---| -| NFR-003-AC-1 | Every declared shared component version and consumed artifact digest is classified by the packaged Engineering Assurance compatibility matrix, with no repository-local mapping or internal mirror substitute. | Test (TC-021) | +| NFR-003-AC-1 | Every declared shared component version and externally consumed artifact digest is classified by the packaged Engineering Assurance compatibility matrix; that matrix is bound by its exact released package/version and package integrity rather than circular self-classification, with no repository-local mapping or internal mirror substitute. | Test (TC-021) | | NFR-003-AC-2 | SUITE-008 identifies the exact local shared-assurance test command, and neither the change-assurance declaration nor any Quoin proof obligation claims that SUITE-008 was attested; its result is valid only for the exact-head review that reports it. | Test (TC-038) | | NFR-003-AC-3 | The candidate source identity covers every non-archival tracked path, refuses every ordinary-untracked live path and mutable ignore policy, and scans arbitrary tracked bytes without allowing a forbidden deleted identity to hide. | Test (TC-026, TC-034, TC-035) | | NFR-003-AC-4 | Every attested proof result is derived from a declared producer's structured bytes, with absent, empty, unreadable, or foreign-protocol input refused, and neither Quire nor Quoin executes a producer. | Test (TC-022) | diff --git a/spec/requirements/NFR-004-reproduce-source-readiness-observations.md b/spec/requirements/NFR-004-reproduce-source-readiness-observations.md new file mode 100644 index 0000000..792fb5f --- /dev/null +++ b/spec/requirements/NFR-004-reproduce-source-readiness-observations.md @@ -0,0 +1,77 @@ +--- +id: NFR-004 +title: Reproduce source-readiness observations without authority drift +type: NFR +quality_attribute: reliability +relationships: + - target: ix://agent-ix/tl-syntax/FR-014 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-015 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-016 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-017 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-018 + type: constrains +--- + +# NFR-004: Reproduce source-readiness observations without authority drift + +## Statement + +For identical candidate bytes, configuration identities, shared-contract +artifacts and deterministic producer inputs, the readiness path shall reproduce +the same source-grounded subject and per-obligation outcome. + +## Scope + +- Applies to source-readiness preparation, shared-contract intake, review + handoff and future integrator-package emission. +- Does not require identical wall-clock time, filesystem location, human + rationale or stochastic campaign result. +- Does not make Make, a hosted workflow, the repository, Quire or Quoin a human + decision authority. +- The readiness path shall retain environmental differences, non-deterministic + results and human decisions as separate attributable facts. +- Every producer declaration identifies the deterministic comparison projection + and every volatile, environmental or stochastic field excluded from equality; + an undeclared volatile field is a discrepancy, not silently normalized data. + +## Rationale + +Reproducibility is useful only when the repeated subject and configuration are +the same and every meaningful environmental difference remains visible. A +repeated command name alone cannot establish this identity. + +## Measurement and Evaluation + +| Metric | Target | Threshold | Method | +|---|---|---|---| +| Deterministic obligations changing under identical declared inputs | 0 | 0 | Test (TC-059) | +| Configuration/source/shared-contract mutations reusing an earlier subject | 0 | 0 | Test (TC-060) | +| Missing, failed or stale facts promoted during repetition | 0 | 0 | Test (TC-063) | +| Unclassified executable readiness paths | 0 | 0 | Test (TC-064) | + +## Verification + +Repeat the real local/shared handoff for one frozen candidate and configuration, +then mutate source, feature, target, toolchain, corpus, shared-release, +environment and limitation axes independently. Compare source-grounded subject +and per-obligation states, not only aggregate exit status. Retain each invalid or +non-deterministic run as its actual state. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| NFR-004-AC-1 | Two executions over identical declared deterministic inputs produce the same source-grounded subject identity and per-obligation states. | Test (TC-059) | +| NFR-004-AC-2 | Each one-axis source/configuration/shared-contract mutation creates a distinct subject or a typed refusal and cannot reuse earlier evidence. | Test (TC-060) | +| NFR-004-AC-3 | Environmental differences, stochastic results, exceptions, limitations and human decisions remain separate facts rather than inputs to a fabricated deterministic aggregate. | Test (TC-062, TC-063) | +| NFR-004-AC-4 | Evidence retention and interpretation use released Quoin/Engineering Assurance contracts; no repository-local store, score or decision function exists. | Test (TC-066) | +| NFR-004-AC-5 | Each producer declares its deterministic comparison fields and separately preserves every volatile/environmental/stochastic field; an undeclared or changed field cannot be silently normalized away. | Test (TC-059) | + +## Measurement Allocation + +[MP-002](../assurance/MP-002-source-readiness-obligation-state.md) defines the +planned complete observation population without granting release authority. diff --git a/spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md b/spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md new file mode 100644 index 0000000..3e43173 --- /dev/null +++ b/spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md @@ -0,0 +1,77 @@ +--- +id: NFR-005 +title: Preserve source-readiness authority and retention truth +type: NFR +quality_attribute: reliability +relationships: + - target: ix://agent-ix/tl-syntax/FR-015 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-016 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-017 + type: constrains +--- + +# NFR-005: Preserve source-readiness authority and retention truth + +## Statement + +When a source-readiness fact is retained, reviewed, transferred or consumed in +a decision, the readiness path shall preserve its exact authority, subject, +limitations and lifecycle. + +## Scope + +- Applies to developer observations selected for release, source-release facts, + review relations, decision events and future integrator-package references. +- Covers transient and durable evidence, unavailable or expired handles, + supersession, accepted limitations and independent-review identity. +- The readiness path shall not convert identity or integrity evidence into + provenance, sufficiency or decision authority. +- Does not create a repository-local evidence store, reviewer registry, + signature authority, compatibility map or approval service. + +## Rationale + +A content digest can establish byte identity but cannot by itself establish who +produced the bytes, whether the procedure ran, whether the evidence is +sufficient or whether a human accepted the subject. Likewise, a path under an +ignored workspace directory is not durable retention merely because a command +describes it as retained. + +## Measurement and Evaluation + +| Metric | Target | Threshold | Method | +|---|---|---|---| +| Required facts missing authority, subject, limitation or lifecycle identity | 0 | 0 | Test (TC-067) | +| Self-reviews or stale reviews accepted as independent/current | 0 | 0 | Test (TC-073) | +| Unavailable or workspace-only bytes reported as durably retained | 0 | 0 | Test (TC-067) | +| Digest/receipt facts promoted into provenance, sufficiency or decision claims | 0 | 0 | Test (TC-066) | + +## Verification + +Inspect the selected shared retention contract and exercise retrieval for every +retained handle. Mutate reviewer, subject, head, base, configuration, evidence +set, limitation, lifecycle, availability, returned bytes, media type and handle +binding independently. Delete only a +disposable test workspace and prove that any claimed durable handle remains +retrievable from its declared shared authority; otherwise classify it as +transient, unavailable or expired. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| NFR-005-AC-1 | Every evidence fact has a declared retention authority/backend/operator, immutable handle, lifecycle/retrieval/content/subject/freshness bindings and exactly one MRS-004 `RetentionState`; current retrieval verifies each binding and every failure follows the total mapping. | Test (TC-067) | +| NFR-005-AC-2 | Reviewer identity/independence policy and exact head/base/configuration/evidence-set bindings are preserved; self-review, unverifiable policy/authority and each one-axis binding mutation remain open or invalid. | Test (TC-073) | +| NFR-005-AC-3 | Every claim retains applicable assumptions, limitations, exceptions, counterevidence and accepted dispositions; omission cannot improve readiness. | Test (TC-063) | +| NFR-005-AC-4 | A digest or receipt proves only the property supplied by its released contract and never implies provenance truth, actor identity, non-repudiation, correctness, sufficiency or acceptance. | Test (TC-066) | + +## Dependencies + +Released Quoin contracts own the retention/receipt interface; a separately +selected external backend operator/custodian owns stored bytes. tl-syntax only +consumes and verifies handles. GitHub review identity and the declared human +source-release owner remain external authorities. Until those exact contracts, +operators and handles are selected and exercised, retention and independent- +review claims remain planned or unavailable. diff --git a/spec/requirements/StR-003-formal-temporal-frontends.md b/spec/requirements/StR-003-formal-temporal-frontends.md index d94bf87..d1b0dff 100644 --- a/spec/requirements/StR-003-formal-temporal-frontends.md +++ b/spec/requirements/StR-003-formal-temporal-frontends.md @@ -1,28 +1,28 @@ --- id: StR-003 -title: Formal temporal frontends need typed signals and attributable source context +title: Native Quire temporal bridges need typed signals and attributable source context type: StR relationships: - target: ix://agent-ix/tl-syntax/FR-007 type: satisfied_by --- -# StR-003: Formal temporal frontends need typed signals and attributable source context +# StR-003: Native Quire temporal bridges need typed signals and attributable source context ## Stakeholder Need -Formal temporal frontend maintainers require that an MLTL formula shall bind its -free propositions to stable named signals with explicit bounded value domains, -and that downstream temporal evidence shall retain the exact requirement -revision, clause, anchor, and source span when the frontend supplies them. +Native Quire temporal-bridge maintainers require that the bridge shall preserve +stable named total-Boolean signal bindings and the exact native requirement +revision, clause, anchor, and source span through internal MLTL evaluation. ## Rationale -`agent-ix/quire-contract-ir#57` derives variables from a typed semantic IR -package. An id-to-name proposition map cannot prove that a free variable came -from a bounded field, and a formula id cannot prove which requirement revision -or clause produced a temporal result. The shared syntax substrate must carry -those identities without importing the IR or evidence systems themselves. +`agent-ix/quire-contract-ir#63` projects total Boolean predicates from a typed +native semantic IR package. An id-to-name proposition map cannot prove that a +free variable came from an admitted bounded field, and a formula id cannot +prove which requirement revision or clause produced a temporal result. The +shared syntax substrate must carry those identities without importing the IR or +evidence systems themselves. ## Validation Criteria @@ -33,16 +33,18 @@ those identities without importing the IR or evidence systems themselves. ## Stakeholders -Maintainers of `quire-contract-ir#57`, tl-parse, tl-rewrite, tl-mltl, R2U2/C2PO +Maintainers of `quire-contract-ir#63`, tl-parse, tl-rewrite, tl-mltl, R2U2/C2PO adapters, and human assurance reviewers. ## Context and Assumptions -The future FRETish frontend owns IR-field derivation and predicate lowering. -tl-syntax owns only the parser-independent identity, bounded-domain, binding, -and source-context contract. A non-Boolean source field may participate through -an explicitly derived Boolean signal, but this crate does not define that -predicate expression or silently cast the field. +The native Quire frontend owns IR-field derivation and typed predicate lowering. +tl-syntax owns only the internal parser-independent identity, bounded-domain, +binding, and source-context contract. A non-Boolean source field may participate +through an explicitly derived total Boolean signal, but this crate does not +define that predicate expression or silently cast the field. FRETish is an +export-only mapping and never an editable source authority or qualification +dependency. ## Traceability diff --git a/spec/requirements/StR-004-progressive-source-readiness.md b/spec/requirements/StR-004-progressive-source-readiness.md new file mode 100644 index 0000000..1596086 --- /dev/null +++ b/spec/requirements/StR-004-progressive-source-readiness.md @@ -0,0 +1,81 @@ +--- +id: StR-004 +title: Release owners and integrators need bounded source-readiness facts +type: StR +relationships: + - target: ix://agent-ix/tl-syntax/FR-014 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-015 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-016 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-017 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-018 + type: satisfied_by +--- + +# StR-004: Release owners and integrators need bounded source-readiness facts + +## Stakeholder Need + +Release owners and downstream integrators require that tl-syntax shall expose +reviewable facts for one exact Rust source candidate without turning developer +checks, a source-release decision or an integrator's later validation into one +interchangeable qualification claim. + +## Rationale + +The same test result can be useful during development, source release and +downstream adoption while carrying different authority and assumptions. If +those stages or their configurations are collapsed, a green local command can +be mistaken for human approval or for evidence about a consuming system that +was never assessed. + +## Validation Criteria + +| ID | Criteria | Validation | +|---|---|---| +| StR-004-VC-1 | A release owner can identify the exact candidate, configuration, review state, evidence limitations and human disposition without inferring any missing field. | Demonstration (TC-059, TC-062) | +| StR-004-VC-2 | An integrator can distinguish reusable source-release facts from adopter-supplied intended use, deployment configuration and validation obligations. | Demonstration (TC-061) | +| StR-004-VC-3 | No artifact describes tl-syntax as a user-authored Quire alternative, certifies a tool or monitor, or grants automated release authority. | Inspection (TC-066) | + +## Stakeholders + +The tl-syntax human source-release owner, downstream TL crate maintainers, +native Quire bridge maintainers, consuming-system integrators and independent +assurance reviewers. + +## Context and Assumptions + +The existing v0.1 assurance profile remains the pre-stable source-release +boundary. Shared Engineering Assurance, Quire and Quoin contracts own generic +compatibility, evidence retention and review orchestration. A future reusable +integrator-package contract may be unavailable at the time this requirement is +reviewed. + +## Stakeholder Constraints (Contextual) + +Useful pre-stable delivery must not wait for a universal qualification scheme. +The readiness contract must remain valid when a dependent shared capability is +reported unavailable and must not replace that capability locally. + +## Dependencies + +Upstream policy comes from `ix://agent-ix/quire-contract-ir/PGM-01`, the native- +language owner ruling and the released shared-assurance contracts. Downstream +realization is allocated to [FR-014](./FR-014-bind-source-readiness-candidate.md) +through [FR-018](./FR-018-classify-qualification-execution-paths.md), +[NFR-004](./NFR-004-reproduce-source-readiness-observations.md) and +[NFR-005](./NFR-005-preserve-readiness-authority-and-retention.md). + +## Priority and Risk (Informative) + +Priority is high before a stable source-release candidate. The principal risk +is an overbroad qualification or certification inference from evidence gathered +for a narrower candidate and configuration. + +## Traceability + +This need is the stakeholder boundary for `agent-ix/tl-syntax#31` and +`agent-ix/tl-syntax#34`. diff --git a/spec/reviews/SR-058-source-readiness-base-spec-review.md b/spec/reviews/SR-058-source-readiness-base-spec-review.md new file mode 100644 index 0000000..d0bfa04 --- /dev/null +++ b/spec/reviews/SR-058-source-readiness-base-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-058 +title: "Base review of progressive tl-syntax source readiness" +type: SpecReview +analysis: base +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The complete M6 source-readiness profile was reviewed at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Quire validated 120/120 documents +with zero grammar findings. The profile treats tl-syntax only as internal Rust +syntax/evaluator infrastructure: native Quire remains the sole editable formal- +clause language, and every downstream package or qualification decision remains +outside this crate's authority. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-5801 | low | No new base defect remains; M6's implementation and evidence rows are explicitly planned or blocked and must not be represented as current coverage. | MRS-004, TM-004 | diff --git a/spec/reviews/SR-059-source-readiness-failure-domain-spec-review.md b/spec/reviews/SR-059-source-readiness-failure-domain-spec-review.md new file mode 100644 index 0000000..38a9682 --- /dev/null +++ b/spec/reviews/SR-059-source-readiness-failure-domain-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-059 +title: "Failure-domain review of progressive tl-syntax source readiness" +type: SpecReview +analysis: failure-domain +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +Candidate substitution, stale producer output, symlink escape, typed decode, +retention failure, event conflict, supersession topology, partial publication, +retry and license-authority failures were reviewed at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. The specified state domains are +closed and non-promoting, with explicit traversal/resource bounds. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-5901 | medium | Real failure-path evidence cannot exist until the released source-grounding, retention, reviewer-policy and integrator-package dependencies are selected; the correct current result is unavailable or blocked, not a local substitute. | tl-syntax#16, FR-014-AC-4, FR-015-AC-5, FR-016-AC-4, FR-017-AC-6 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-060-source-readiness-integrity-spec-review.md b/spec/reviews/SR-060-source-readiness-integrity-spec-review.md new file mode 100644 index 0000000..571d282 --- /dev/null +++ b/spec/reviews/SR-060-source-readiness-integrity-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-060 +title: "Integrity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: integrity +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The requirements, closed vocabularies, acceptance criteria, integration +scenarios and matrix were cross-checked at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. All review-owned cardinality, +atomicity, transition, decode and failure-mapping findings were corrected before +this artifact was authored. The planned rows remain truthfully unbacked. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6001 | medium | Quire reports the M6 rows as unbacked exactly as authored; no completion status may advance until real symbols and evidence bind TC-059 through TC-073 and the blocked integrations. | TM-004, IT-001, IT-002 | correct-requirement-no-evidence | +| FND-6002 | low | The installed shared module expects a `Status` column while both matrices author `Coverage Status`, so its status classifier is skipped; this does not hide a current M6 status lie, but the upstream declaration must be reconciled before that classifier is relied upon. | TM-001, TM-004, quoin#363, quoin#364 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-061-source-readiness-dependency-spec-review.md b/spec/reviews/SR-061-source-readiness-dependency-spec-review.md new file mode 100644 index 0000000..2da6094 --- /dev/null +++ b/spec/reviews/SR-061-source-readiness-dependency-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-061 +title: "Dependency review of progressive tl-syntax source readiness" +type: SpecReview +analysis: dependency +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AD-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The M6 dependency graph was checked for ownership and cycles at specification +commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Local work orders executable- +path classification before source binding, stage preservation and human +decision admission; package publication follows all of them. External +enablement remains separate from feature implementation. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6101 | medium | IT-001 remains blocked until tl-syntax#16 has a compatible released Engineering Assurance matrix accepting the source-grounded Quire release; branch pins and repository-local mappings are inadmissible. | tl-syntax#16, FR-014, IT-001 | correct-requirement-no-evidence | +| FND-6102 | medium | Decision admission, durable retention and integrator packaging remain blocked on an immutable reviewer/decision policy, a selected retention backend/operator, and accepted shared contracts from Engineering Assurance and Quoin. | FR-015, FR-016, FR-017, engineering-assurance#11, engineering-assurance#34 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-062-source-readiness-evidence-spec-review.md b/spec/reviews/SR-062-source-readiness-evidence-spec-review.md new file mode 100644 index 0000000..79ace3d --- /dev/null +++ b/spec/reviews/SR-062-source-readiness-evidence-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-062 +title: "Evidence-method review of progressive tl-syntax source readiness" +type: SpecReview +analysis: evidence +scope: "TM-004, FR-014..FR-018, NFR-004..NFR-005, IT-001..IT-002, spec/evidence/suites.md" +review_set: all +--- + +## Summary + +Quoin's catalog advisor evaluated 100 obligations at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. It reported no M6 mismatch, +uncatalogued obligation or inconclusive recommendation. TM-004 allocates every +new criterion to TC-059 through TC-073 and SUITE-009 through SUITE-013 without +claiming that the planned producers exist. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6201 | low | Four legacy metric methods remain advisory mismatches: NFR-001-M-1, NFR-001-M-2, NFR-002-M-2 and NFR-003-M-7. They require an owner decision and are not silently rewritten by M6. | NFR-001-M-1, NFR-001-M-2, NFR-002-M-2, NFR-003-M-7 | correct-requirement-no-evidence | +| FND-6202 | medium | SUITE-009 through SUITE-013 are planned identities; IT-001, IT-002, durable-retention and policy/event evidence cannot run until their declared external prerequisites are available. | spec/evidence/suites.md, IT-001, IT-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-063-source-readiness-risk-complexity-spec-review.md b/spec/reviews/SR-063-source-readiness-risk-complexity-spec-review.md new file mode 100644 index 0000000..1857f0d --- /dev/null +++ b/spec/reviews/SR-063-source-readiness-risk-complexity-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-063 +title: "Risk-complexity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: risk-complexity +scope: "MRS-004, TM-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The M6 profile was assessed at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Its highest-risk seams are mutable +source identity, external-process freshness, review/event concurrency, durable +retention, and atomic package publication. The specification bounds these seams +and requires load-bearing negative mutations before evidence admission. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-6301 | medium | Implementation must not begin at a blocked shared seam or collapse the typed failure domains; each P0 suite needs a demonstrated negative mutation before its positive output is admissible. | AP-002, TC-060, TC-063, TC-068..TC-073 | diff --git a/spec/reviews/SR-064-source-readiness-scope-boundary-spec-review.md b/spec/reviews/SR-064-source-readiness-scope-boundary-spec-review.md new file mode 100644 index 0000000..27c47e6 --- /dev/null +++ b/spec/reviews/SR-064-source-readiness-scope-boundary-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-064 +title: "Scope-boundary review of progressive tl-syntax source readiness" +type: SpecReview +analysis: scope-boundary +scope: "MRS-004, StR-003, StR-004, FR-014..FR-018, NFR-004..NFR-005, AD-002" +review_set: all +--- + +## Summary + +The owner ruling and per-lane notice were applied at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Native Quire is the sole editable +formal-clause source profile. tl-syntax owns parser-independent Rust syntax +values and local source-readiness projection only; shared compatibility, +retention, qualification and human authority remain with their declared owners. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6401 | medium | LR08 inventory and shared Rust producer execution remain cross-repository responsibilities; tl-syntax may enumerate and classify its paths but may not invent a local runner, source language, evidence store or qualification framework. | quire-research#64, engineering-assurance#34, FR-018, AD-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-065-source-readiness-ears-conformance-spec-review.md b/spec/reviews/SR-065-source-readiness-ears-conformance-spec-review.md new file mode 100644 index 0000000..c2c7988 --- /dev/null +++ b/spec/reviews/SR-065-source-readiness-ears-conformance-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-065 +title: "EARS-conformance review of progressive tl-syntax source readiness" +type: SpecReview +analysis: ears-conformance +scope: "StR-003, StR-004, FR-014..FR-018, NFR-003..NFR-005" +review_set: all +--- + +## Summary + +Quire strict validation and a semantic EARS/atomicity pass were run against +specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. +Event, state, unwanted-condition and optional-feature triggers match their +intended semantics; accountable subjects, observable responses and separately +scoped obligations remain explicit. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-6501 | low | No remaining M6 EARS or atomicity defect was found; the requirement-bearing corpus is grammar-clean under the pinned Quire engine. | StR-003, StR-004, FR-014..FR-018, NFR-003..NFR-005 | diff --git a/spec/reviews/SR-066-source-readiness-independent-base-spec-review.md b/spec/reviews/SR-066-source-readiness-independent-base-spec-review.md new file mode 100644 index 0000000..674e0f4 --- /dev/null +++ b/spec/reviews/SR-066-source-readiness-independent-base-spec-review.md @@ -0,0 +1,26 @@ +--- +id: SR-066 +title: "Independent base review of progressive tl-syntax source readiness" +type: SpecReview +analysis: base +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002, PLAN-007" +review_set: all +--- + +## Summary + +Independent review of exact snapshot +`33678fa` finds the M6 boundary implementable once its declared external +contracts and authorities are admitted. Native Quire remains the sole editable +formal-clause language; M6 prepares source facts and preserves a human decision +without claiming publication or downstream qualification. + +Quire reports 142/142 specification documents and 11/11 PLAN-007 documents +grammar-clean. All M6 implementation rows remain planned or explicitly blocked. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6601 | medium | PLAN-007 originally reused Task-001..Task-008, had no task tickets, and did not expose owner, consumer, evidence-method or resume metadata. It now uses repository-unique Task-009..Task-016 and maps #34 plus #45..#51. | PLAN-007 | missing-requirement | +| FND-6602 | low | No M6 implementation or source-release completion is present; accepting this specification may close #34 but cannot advance Task-010..Task-016 or any TM-004 row. | TM-004, PLAN-007 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-067-source-readiness-independent-failure-domain-spec-review.md b/spec/reviews/SR-067-source-readiness-independent-failure-domain-spec-review.md new file mode 100644 index 0000000..208369c --- /dev/null +++ b/spec/reviews/SR-067-source-readiness-independent-failure-domain-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-067 +title: "Independent failure-domain review of progressive tl-syntax source readiness" +type: SpecReview +analysis: failure-domain +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +Independent review at `33678fa` exercised candidate substitution, stale output, +path and symlink races, event-set incompleteness, expiry authority, retention, +supersession, concurrent publication, typed decode and license-resolution +failures. The closed outcomes remain non-promoting and resource-bounded. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6701 | high | FR-014 previously allowed before/after pathname revalidation, which cannot detect change-then-restore substitution and did not require the identified bytes to be the consumed bytes. It now requires one descriptor-backed snapshot/capability and refuses pathname reopen. | FR-014-AC-5, FR-014-AC-6, IT-001-SC-05 | wrong-requirement | +| FND-6702 | high | Decision intake previously lacked immutable event-population identity, completeness/bounds and an authoritative expiry instant, permitting a favorable page or guessed expiry. The requirement now keeps incomplete/cross-snapshot/over-bound input open and binds expiry to a verified time authority and canonical ordering. | FR-017-AC-2, FR-017-AC-7, AP-002, IT-001-SC-07 | missing-requirement | +| FND-6703 | medium | Real failure evidence is unavailable until the released source-grounding, retention, policy/event and integrator-package contracts are admitted; a mock or local substitute cannot resolve this finding. | Task-010, IT-001, IT-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-068-source-readiness-independent-integrity-spec-review.md b/spec/reviews/SR-068-source-readiness-independent-integrity-spec-review.md new file mode 100644 index 0000000..46235d8 --- /dev/null +++ b/spec/reviews/SR-068-source-readiness-independent-integrity-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-068 +title: "Independent integrity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: integrity +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002, PLAN-007" +review_set: all +--- + +## Summary + +The exact `33678fa` requirements, matrices, scenarios and plan were checked for +atomicity, total state mappings, identity collisions, trace targets and truthful +status. Every M6 criterion is allocated to TC-059..TC-073, and every task has an +owner, ticket, evidence method and explicit resume set. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6801 | medium | TM-004 declared `Integration ID` where the installed trace model mints `Test ID`, so IT-001/IT-002 were not indexed. The header now matches the declared contract. | TM-004 | wrong-requirement | +| FND-6802 | medium | Task identity reuse made `ix://.../Task-NNN` dependencies ambiguous across plans. PLAN-007 now owns the unused Task-009..Task-016 range; active sibling branches were checked for collisions. | PLAN-007 | missing-requirement | +| FND-6803 | low | The repository-wide TestMatrix `Status` versus `Coverage Status` declaration conflict remains outside M6 and is tracked upstream; no M6 status is claimed complete, so it currently hides no completion lie. | TM-001, TM-002, TM-004 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-069-source-readiness-independent-dependency-spec-review.md b/spec/reviews/SR-069-source-readiness-independent-dependency-spec-review.md new file mode 100644 index 0000000..4f4e56c --- /dev/null +++ b/spec/reviews/SR-069-source-readiness-independent-dependency-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-069 +title: "Independent dependency review of progressive tl-syntax source readiness" +type: SpecReview +analysis: dependency +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AD-002, IT-001..IT-002, PLAN-007" +review_set: all +--- + +## Summary + +The internal `33678fa` graph is acyclic: prerequisite admission precedes path +classification, candidate binding, lifecycle/decision admission, real shared +integration, package work and final assurance. GitHub tickets #45..#51 carry +that same order and remain open. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6901 | medium | Engineering Assurance #34 is closed and PR #46 merged, so describing its implementation as open was stale. No current immutable release contains the merge, so Task-010 truthfully retains release admission as the blocker. | FR-018, AD-002, Task-010 | correct-requirement-no-evidence | +| FND-6902 | medium | Source grounding remains blocked on tl-syntax#16 and LR08 on quire-research#64; retention backend/operator, reviewer policy/event source and integrator-package contracts are still unselected. | Task-010, #45 | correct-requirement-no-evidence | +| FND-6903 | low | Partial prerequisite admission is intentionally per-consumer and cannot be interpreted as a global gate pass. | PLAN-007, Task-010 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-070-source-readiness-independent-evidence-spec-review.md b/spec/reviews/SR-070-source-readiness-independent-evidence-spec-review.md new file mode 100644 index 0000000..574a7a7 --- /dev/null +++ b/spec/reviews/SR-070-source-readiness-independent-evidence-spec-review.md @@ -0,0 +1,25 @@ +--- +id: SR-070 +title: "Independent evidence-method review of progressive tl-syntax source readiness" +type: SpecReview +analysis: evidence +scope: "TM-004, FR-014..FR-018, NFR-004..NFR-005, IT-001..IT-002, spec/evidence/suites.md" +review_set: all +--- + +## Summary + +At `33678fa`, using spec-artifacts-process +`737987b7131938203c2bda0f153f4bf15e8818bd`, Quoin advised on 48 M6 +obligations with zero mismatches, zero uncatalogued methods and zero +inconclusive recommendations. Quire coverage is 84/162 repository rows backed +and 0/15 for TM-004, exactly matching the planned state. Rust trace authoring +is 45/45 symbols tagged and bound. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7001 | medium | SUITE-009..SUITE-013 and TC-059..TC-073 are allocations, not current evidence. They may advance only when real symbols and admitted shared interfaces exist. | TM-004, spec/evidence/suites.md | correct-requirement-no-evidence | +| FND-7002 | low | TC-072 is attributable engineering analysis and intentionally mints no Rust source symbol; its candidate, population, reviewer, policy, source set and limitations must be recorded before FR-016-AC-7 can be backed. | TC-072, IT-002-SC-07 | correct-requirement-no-evidence | +| FND-7003 | low | Four legacy metric-method mismatches remain outside M6: NFR-001-M-1/M-2, NFR-002-M-2 and NFR-003-M-7. | SR-062 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-071-source-readiness-independent-risk-complexity-spec-review.md b/spec/reviews/SR-071-source-readiness-independent-risk-complexity-spec-review.md new file mode 100644 index 0000000..f6e6116 --- /dev/null +++ b/spec/reviews/SR-071-source-readiness-independent-risk-complexity-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-071 +title: "Independent risk-complexity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: risk-complexity +scope: "MRS-004, TM-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The highest-risk `33678fa` seams are descriptor-bound source identity, +producer freshness, authoritative event completeness/time, durable retention, +supersession topology and atomic package publication. The specification assigns +each to a bounded negative control and prevents unavailable shared capability +from becoming local implementation. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7101 | medium | Each P0 suite needs a demonstrated load-bearing mutation, including the new change-then-restore source and event-page/snapshot/time controls, before favorable evidence is admissible. | AP-002, TC-068, TC-073 | correct-requirement-no-evidence | +| FND-7102 | medium | Publication races and event snapshots require real shared coordination semantics; filesystem naming or fetch-until-empty loops are not equivalent implementations. | FR-016-AC-6, FR-017-AC-2 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-072-source-readiness-independent-scope-boundary-spec-review.md b/spec/reviews/SR-072-source-readiness-independent-scope-boundary-spec-review.md new file mode 100644 index 0000000..fbed796 --- /dev/null +++ b/spec/reviews/SR-072-source-readiness-independent-scope-boundary-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-072 +title: "Independent scope-boundary review of progressive tl-syntax source readiness" +type: SpecReview +analysis: scope-boundary +scope: "MRS-004, StR-003, StR-004, FR-014..FR-018, NFR-004..NFR-005, AD-002, PLAN-007" +review_set: all +--- + +## Summary + +The exact `33678fa` allocation keeps tl-syntax responsible for Rust domain +values, candidate/source projection and consumer adapters. Engineering +Assurance, Quire, Quoin, the retention operator, GitHub facts and human policy +retain their named authority. No editable TL/FRETish source path, local evidence +store, compatibility map, approval registry or qualification claim is added. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7201 | medium | LR08 dispositions remain cross-repository work. tl-syntax may enumerate its paths and implement Rust domain logic but cannot invent a local general runner or broaden Quoin's sole non-Rust accommodation. | FR-018, AD-002, quire-research#64 | correct-requirement-no-evidence | +| FND-7202 | low | The future integrator package transfers source facts only; intended-use, deployment, monitor and adoption authority remain open adopter inputs. | FR-016, IT-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-073-source-readiness-independent-ears-spec-review.md b/spec/reviews/SR-073-source-readiness-independent-ears-spec-review.md new file mode 100644 index 0000000..b1ff5fe --- /dev/null +++ b/spec/reviews/SR-073-source-readiness-independent-ears-spec-review.md @@ -0,0 +1,21 @@ +--- +id: SR-073 +title: "Independent EARS review of progressive tl-syntax source readiness" +type: SpecReview +analysis: ears-conformance +scope: "StR-003, StR-004, FR-014..FR-018, NFR-003..NFR-005" +review_set: all +--- + +## Summary + +Quire strict validation at `33678fa` reports 142/142 specification documents +grammar-clean. An independent semantic pass checked the new immutable-snapshot, +event-completeness and expiry clauses: each has an explicit subject, trigger, +observable response and failure state without merging separate authorities. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7301 | low | No remaining M6 EARS or requirement-atomicity defect was found. The implementation-dependent clauses remain conditional on their named released contracts. | FR-014..FR-018, NFR-004..NFR-005 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-074-source-readiness-census-rust-code-review.md b/spec/reviews/SR-074-source-readiness-census-rust-code-review.md new file mode 100644 index 0000000..7641874 --- /dev/null +++ b/spec/reviews/SR-074-source-readiness-census-rust-code-review.md @@ -0,0 +1,31 @@ +--- +id: SR-074 +title: "Independent Rust review of the source-readiness census update" +type: SpecReview +analysis: code-review +scope: "tests/shared_assurance.rs diff from origin/main through 33678fa" +review_set: subset +--- + +## Summary + +The branch changes no production Rust API. The `tests/shared_assurance.rs` +source-census union was reviewed under `agent-skills/rust-review/SKILL.md` for +fail-closed behavior, test load-bearing value, panic scope, unsafe, blocking and +resource surfaces. The exact expected population and area counts pass; all +panics and filesystem/process operations remain test-only; no unsafe block, +async/lock change, wire conversion or production resource bound is introduced. + +At `33678fa`, the complete local `make ci` composite passes without hosted CI: +formatting, feature matrix, strict Clippy, 44 Rust tests plus one doctest, +corpus/digest/oracle gates, cargo-deny, fuzz-target build, unsafe audit, strict +spec validation, MSRV tests, rustdoc, pin checks, mutation probes and the shared +assurance chain. Cargo-deny reports only its pre-existing unused-license and +fuzz path-dependency warnings. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7401 | high | The branch initially excluded every path below top-level `plan/`, allowing executable source placed there to evade the live census. The exemption is now limited to Markdown plan/review records, and a tracked extensionless `plan/run` fixture proves the executable remains live. | `is_archival_record`, `live_source_enumeration_has_an_exact_fail_closed_partition` | implementation-bug-despite-evidence | +| FND-7402 | low | Review and plan Markdown remain deliberately archival so adding an independent review cannot invalidate the exact source population it reviewed. Executable content still belongs to the separate FR-018 exhaustive invocation census. | FR-018, source census | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-075-source-readiness-merged-head-code-review.md b/spec/reviews/SR-075-source-readiness-merged-head-code-review.md new file mode 100644 index 0000000..b58a266 --- /dev/null +++ b/spec/reviews/SR-075-source-readiness-merged-head-code-review.md @@ -0,0 +1,57 @@ +--- +id: SR-075 +title: "Exact-head review of source readiness after the W/M source merge" +type: SpecReview +analysis: code-review +scope: "origin/main 5b1c134 through candidate snapshot 9598fea" +review_set: subset +--- + +## Summary + +The current `origin/main` W/M source and canonical-graph corpus work was merged +into the source-readiness branch and reviewed together with the M6 changes under +`agent-skills/rust-review/SKILL.md`. The conflict resolution preserves the +landed W/M fixtures and counts while retaining the narrowed archival predicate: +the fail-closed source census now covers exactly 128 tracked live-source paths, +including 34 corpus, 42 specification, 9 production-source and 10 test paths. +The tracked extensionless `plan/run` control continues to prove that an +executable cannot hide below an archival directory. + +The landed matrix contract now uses the single `Status` column, and TM-004 was +aligned to it at `9598fea`. Strict Quire validation passes for all 163 +specification documents and all 11 plan documents. Coverage reports 99 of 165 +rows overall, 76 of 76 Rust rows covered and the 17 M6 rows truthfully planned +rather than implemented. Quoin classifies all 48 M6 obligations with zero +mismatches, uncatalogued methods or inconclusive recommendations. + +At the exact candidate snapshot `9598fea`, `make ci` passes formatting, the +feature matrix, strict Clippy, 75 Rust tests plus one doctest, corpus/digest/ +oracle gates, cargo-deny, fuzz-target build, unsafe audit, strict specification +validation, MSRV tests, rustdoc, pin checks, mutation probes and the shared +assurance chain. No hosted CI result is claimed. + +## Verdict + +**PASS** — no unresolved Rust or code/test-alignment defect was found in the +specification-only M6 PR after the current-main integration. + +## Assurance Context + +- **Profiles:** AP-001 and proposed AP-002, both profile version 0.2; AP-002 + requires specification review, independent code review and gap analysis. +- **Baseline:** PR #39 head `7a3d15b27436155f42e693b44b1a2f98e2ae9902` + over `origin/main` `5b1c134`; reviewed executable candidate `9598fea` plus + the final review/task-status record. +- **Impact evaluated:** live-source omission, candidate/configuration + substitution, automated authority promotion and limitation loss. +- **Decision boundary:** the PR defines M6 and its routing only. It implements + none of the 17 M6 rows and records no human source-release decision. +- **Active exceptions:** none. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7501 | medium | Merging current main initially required a manual source-census union. The resolved population preserves every landed W/M source and fixture as well as the M6 fail-closed archival control; the exact 128-path and per-area assertions pass. | `tests/shared_assurance.rs`, PR #43, SR-074 | implementation-bug-despite-evidence | +| FND-7502 | low | SR-068's matrix-header finding is superseded by the single `Status` contract landed on main. TM-004 now uses that contract, validates without identifier/status warnings and remains honestly planned at 0 of 17 rows. | TM-004, SR-068, `9598fea` | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-076-plan-007-source-readiness-gap-analysis.md b/spec/reviews/SR-076-plan-007-source-readiness-gap-analysis.md new file mode 100644 index 0000000..db41973 --- /dev/null +++ b/spec/reviews/SR-076-plan-007-source-readiness-gap-analysis.md @@ -0,0 +1,54 @@ +--- +id: SR-076 +title: "Gap analysis — PLAN-007 progressive source readiness" +type: SpecReview +analysis: gap-analysis +scope: "plan/Plan-007-source-qualification-readiness/, spec/source-readiness-test-matrix.md, source and tests at 7a3d15b" +review_set: subset +relationships: + - { target: ix://agent-ix/tl-syntax/PLAN-007, type: reviews } + - { target: ix://agent-ix/tl-syntax/TM-004, type: references } +--- + +# Gap analysis — PLAN-007 progressive source readiness + +## Summary + +PLAN-007's specification/review task is done, while all seven implementation, +integration, package and final-assurance tasks remain blocked on their declared +shared contracts and human authorities. Quire reports 99 of 165 repository rows +backed and all 17 M6 rows truthfully planned and unbacked. + +## Verdict + +**FAIL** — 1 of 8 PLAN-007 tasks is done and 17 M6 rows lack executable backing. +This is the expected readiness state for the specification deliverable and +prevents any source-qualification or release claim. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-7601 | high | Task-010 through Task-016 are blocked, so PLAN-007 is incomplete. The blockers include released source-grounding and LR08 contracts, retention/operator selection, authoritative decision events, real integration and human final assurance. | PLAN-007; Task-010 through Task-016 | +| FND-7602 | high | TM-004 has 0/17 rows backed. No planned M6 test or integration row is marked implemented, yielding 99/165 repository-wide backing. | TM-004; TC-059 through TC-073; IT-001; IT-002 | +| FND-7603 | medium | Engineering Assurance #34 is merged but no admitted immutable compatible release carries it; LR08 and retention/event/integrator-package contracts remain unresolved. Local substitutes are explicitly forbidden. | Task-010; FR-018; AD-002; quire-research#64 | + +## Coverage + +- Target plan: `plan/Plan-007-source-qualification-readiness/`. +- Tasks done: 1 / 8; blocked: 7 / 8. +- Repository rows backed: 99 / 165. +- M6 rows backed: 0 / 17. +- Rust binding census: 76 / 76 / 76 candidates, tagged and bound; no symbol is + presented as M6 implementation evidence. +- Changed production stubs: 0; the PR changes no production Rust. +- Reverse trace: every M6 criterion has a planned TC/IT owner and PLAN-007 task; + no planned row claims executable completion. +- Optional semantic intent/test/code review: not run because no explicit opt-in + was given. The comprehensive M6 specification lenses are recorded separately. + +## Disposition + +The specification is ready for its human acceptance gate. Keep Task-010 through +Task-016 and their GitHub issues blocked until each named resume condition is +actually satisfied. diff --git a/spec/source-readiness-test-matrix.md b/spec/source-readiness-test-matrix.md new file mode 100644 index 0000000..e8bf167 --- /dev/null +++ b/spec/source-readiness-test-matrix.md @@ -0,0 +1,92 @@ +--- +id: TM-004 +title: Progressive source-readiness test matrix +type: TestMatrix +relationships: + - target: ix://agent-ix/tl-syntax/MRS-004 + type: covers +--- + +# Progressive source-readiness test matrix + +## Functional Requirement Coverage + +| Functional Req | Acceptance Criteria | Test Cases | Status | +|---|---|---|---| +| FR-014 | FR-014-AC-1 through FR-014-AC-6 | TC-059, TC-060, TC-066, TC-068, TC-069 | 🚧 planned | +| FR-015 | FR-015-AC-1 through FR-015-AC-7 | TC-062, TC-063, TC-066, TC-067, TC-070 | 🚧 planned | +| FR-016 | FR-016-AC-1 through FR-016-AC-7 | TC-061, TC-063, TC-066, TC-068, TC-071, TC-072, IT-002 | 🚧 planned | +| FR-017 | FR-017-AC-1 through FR-017-AC-7 | TC-062, TC-063, TC-066, TC-070, TC-073 | 🚧 planned | +| FR-018 | FR-018-AC-1 through FR-018-AC-4 | TC-064, TC-065, TC-066 | 🚧 planned | + +## Stakeholder Requirement Coverage + +| Stakeholder Req | Trace to US/FR | Test/Validation | Status | +|---|---|---|---| +| StR-004 | StR-004-VC-1 through StR-004-VC-3 | TC-059, TC-061, TC-062, TC-066 | 🚧 planned | + +## Non-Functional Requirement Coverage + +| Non-Functional Req | Verification Method | Evidence/Test Cases | Status | +|---|---|---|---| +| NFR-004 | Repeatability, one-axis mutation and boundary inspection | TC-059, TC-060, TC-062, TC-063, TC-064, TC-066 | 🚧 planned | +| NFR-005 | Authority/subject/lifecycle mutation, retrieval and boundary inspection | TC-063, TC-066, TC-067, TC-073 | 🚧 planned | + +## Test Case Summary + +| Test ID | Title | Type | Priority | Traces To | Status | +|---|---|---|---|---|---| +| TC-059 | Repeat the complete source-readiness population at one exact candidate/configuration | Integration | P0 | FR-014-AC-1, NFR-004-AC-1, NFR-004-AC-5, StR-004-VC-1 | 🚧 planned | +| TC-060 | Mutate every candidate, source, configuration, environment and shared-contract identity | Property | P0 | FR-014-AC-2, FR-014-AC-3, NFR-004-AC-2 | 🚧 planned | +| TC-061 | Round-trip source facts and two distinct open adopter subjects through the real shared package | Integration | P0 | FR-016-AC-1, FR-016-AC-2, StR-004-VC-2, IT-002 | 🚧 blocked on shared contract | +| TC-062 | Preserve developer, release-input, human-decision and adopter stages and all six decision dispositions | Integration | P0 | FR-015-AC-1, FR-017-AC-1, NFR-004-AC-3, StR-004-VC-1 | 🚧 planned | +| TC-063 | Refuse promotion, limitation omission, stale decisions and unknown-value coercion | Integration | P0 | FR-015-AC-2, FR-015-AC-3, FR-015-AC-7, FR-016-AC-3, FR-017-AC-2, FR-017-AC-3, NFR-004-AC-3, NFR-005-AC-3 | 🚧 planned | +| TC-064 | Census and classify every executable readiness path and new-path mutation | Integration | P0 | FR-018-AC-1, FR-018-AC-2, NFR-004-AC-4 | 🚧 blocked on LR08 disposition | +| TC-065 | Demonstrate positive and forced-failure parity for each replaced executable path | Integration | P0 | FR-018-AC-3 | 🚧 blocked on reviewed replacements | +| TC-066 | Prove authority, language, certification and no-local-substitute boundaries | Integration | P0 | FR-014-AC-4, FR-015-AC-4, FR-016-AC-4, FR-017-AC-4, FR-018-AC-4, NFR-004-AC-4, NFR-005-AC-4, StR-004-VC-3 | 🚧 planned | +| TC-067 | Mutate evidence lifecycle/content binding and exercise durable-handle retrieval after disposable workspace deletion | Integration | P0 | FR-015-AC-5, NFR-005-AC-1 | 🚧 blocked on selected shared retention contract | +| TC-068 | Quarantine stale outputs; force skipped, crashed, timed-out, malformed and partial producer/package executions; and reject change-then-restore input mutation | Integration | P0 | FR-014-AC-5, FR-016-AC-5 | 🚧 planned | +| TC-069 | Mutate repository/Git/materialized/admitted-root/path/mount identities and probe symlink escape/cycle/race/special/mount/bound cases | Property | P0 | FR-014-AC-6 | 🚧 planned | +| TC-070 | Mutate supersession topology/bounds, conditional/deferred transitions and concurrent review/decision successors | Property | P0 | FR-015-AC-6, FR-017-AC-7 | 🚧 planned | +| TC-071 | Race non-identical package writers and retry identical/different attempt identities | Integration | P0 | FR-016-AC-6 | 🚧 blocked on accepted shared contract | +| TC-072 | An independent rights reviewer reconciles the exact candidate's tracked source, package contents, dependency closure and generated/embedded third-party material against identity-bound authoritative license and reuse-right sources | Analysis | P0 | FR-016-AC-7, IT-002-SC-07 | 🚧 planned | +| TC-073 | Mutate reviewer/decision policy, actor, contributor, conflict, delegation, revocation, quorum, event snapshot/cursor/completeness, evaluation time authority, head/base/configuration and evidence bindings | Property | P0 | FR-017-AC-2, FR-017-AC-5, FR-017-AC-6, FR-017-AC-7, NFR-005-AC-2 | 🚧 blocked on authoritative policy/event source | + +## Planned Suite Allocation + +| Test Cases | Planned Suites | +|---|---| +| TC-059, TC-060, TC-062, TC-069, TC-073 | SUITE-009 and, for real shared boundaries, SUITE-011 | +| TC-063, TC-064, TC-066 | SUITE-009 | +| TC-070 | SUITE-009 and SUITE-012 | +| TC-065, TC-068 | SUITE-010 and, for package failures, SUITE-012 | +| TC-061, TC-071 | SUITE-012 | +| TC-067 | SUITE-011 | +| TC-072 | SUITE-013 | + +## Matrix Design Coverage + +| Required design rule | Coverage | +|---|---| +| Every acceptance criterion mapped | FR/StR/NFR tables map every criterion to TC-059 through TC-073. | +| Relevant option permutations | TC-061 varies intended use/deployed configuration; TC-062 varies evidence stage and decision disposition. | +| Boundary conditions | TC-059 fixes the complete population; TC-060/069 change one identity/materialization axis; TC-067 crosses transient/durable and current/expired boundaries. | +| Error conditions | TC-063/068 cover missing, stale, omitted, crashed, partial and unsupported results; TC-066 covers unavailable shared capabilities. | +| State transitions | TC-062/063/070 cover promotion, decision, expiry, invalidation, conflict and supersession transitions. | +| Edge cases | TC-060/063/067/068/069/070 cover substitution, self-review, workspace loss, stale output, source indirection, cycles/forks, unavailable handles, limitation omission and silent restamping. | + +## Integration Test Matrix + +| Test ID | Purpose | Type | Target | Test Cases | Status | +|---|---|---|---|---|---| +| IT-001 | Source-grounded handoff through real released Engineering Assurance, Quire and Quoin | service | shared assurance stack | TC-059, TC-060, TC-062, TC-063, TC-066 through TC-070, TC-073 | 🚧 blocked on tl-syntax#16 release set and authoritative policy/event source | +| IT-002 | Lossless future integrator-package handoff without transferred qualification | service | Engineering Assurance integrator package | TC-061, TC-062, TC-063, TC-066, TC-068, TC-070 through TC-072 | 🚧 blocked on accepted shared contract | + +## Evidence Limits + +Every row is planned or explicitly blocked. This matrix claims no executed M6 +test, complete source release, qualified record, shared package, hosted run, +signed tag, publication or human decision. Existing v0.1 tests do not +automatically back these new criteria. A TC row passes only when every named +subcase and conjunct succeeds; a skipped, unavailable or partially executed +subcase is reported separately and leaves the row non-passing. diff --git a/spec/source-readiness.md b/spec/source-readiness.md new file mode 100644 index 0000000..00e7df8 --- /dev/null +++ b/spec/source-readiness.md @@ -0,0 +1,196 @@ +--- +id: MRS-004 +title: Progressive tl-syntax source-readiness and integrator boundary +type: MasterRequirements +relationships: + - target: ix://agent-ix/tl-syntax/MRS-001 + type: depends_on + - target: ix://agent-ix/tl-syntax/issues/34 + type: references + - target: ix://agent-ix/quire-contract-ir/PGM-01 + type: depends_on +--- + +# Progressive tl-syntax source-readiness and integrator boundary + +## Purpose + +This specification defines progressive readiness facts for a human decision +about one exact tl-syntax Rust source candidate and configuration, plus a +deferred boundary for transferring those facts to a future shared integrator +package. It extends the v0.1 source-release boundary without retroactively +blocking useful pre-stable delivery. + +“Source” means the Rust repository candidate. Native Quire remains the sole +editable formal-clause language. TL text and formula documents are internal +interchange/evaluator inputs and never a second user-authored Quire source +profile. + +## Scope + +### In Scope + +- Exact candidate, source-population, crate, configuration, toolchain, profile, + corpus, shared-contract and producer identities. +- Distinct developer observation, source-release input, human decision and + integrator-adoption stages. +- Review, evidence/counterevidence, limitation, exception, retention, + supersession and human-authority rules. +- A future shared-contract package containing reusable source facts and still- + open adopter obligations. +- Reproducibility controls and a complete executable-path disposition. + +### Out of Scope + +- Native Quire language qualification or an editable TL/FRETish source path. +- Automatic release/publication decisions, crates.io publication, universal + trusted-tool status, certification, accreditation, authorization or + non-repudiation. +- Qualification of tl-parse, tl-rewrite, tl-mltl, R2U2/C2PO, another monitor, + a consuming system or an integrator's intended use. +- A repository-local source parser, compatibility matrix, generic runner, + evidence schema/store, aggregate score, approval workflow or substitute for + an unavailable shared capability. + +## System Overview + +### System Description + +tl-syntax supplies domain results and exact component-owned assumptions/ +limitations. Released Engineering Assurance, Quire and Quoin contracts supply +shared compatibility, source grounding, retention and orchestration. Independent +reviewers assess the exact head and evidence set. Only the declared human +release owner decides the source release. A later integrator supplies a distinct +intended use, deployment/configuration and validation decision. + +### Intended Users + +The human tl-syntax release owner, independent specification/code/gap reviewers, +TL ecosystem maintainers, native Quire bridge maintainers and future +consuming-system integrators. + +## Lifecycle Vocabulary + +| Stage | Meaning | Authority limit | +|---|---|---| +| Developer observation | One attributable local or hosted result for an exact revision/configuration | No retention, independence, release or adopter inference unless separately established | +| Source-release input | Candidate-bound fact selected for review and retained through shared contracts | Does not approve release | +| Human source-release decision | Attributed accepted/rejected/deferred/conditional/open/conflict disposition for the exact candidate | Does not publish or qualify downstream use | +| Integrator-adoption input | Reusable source facts plus adopter intended use/configuration and open validation fields | Does not inherit source-release acceptance as adopter acceptance | +| Use-specific qualification | Separately scoped producer/system decision under Engineering Assurance | Outside this component profile until its shared contract and owner decision exist | + +## Closed Result Vocabularies + +The following closed types are distinct even where a label is linguistically +similar. No implementation may store them in one untyped status field. + +| Type | Values | +|---|---| +| `ExecutionOutcome` | `succeeded`, `skipped`, `spawn-failed`, `completed-nonzero`, `signalled`, `timed-out`, `truncated`, `invalid-output` | +| `ReadinessState` | `pass`, `fail`, `unavailable`, `unsupported`, `inconclusive`, `not-computed`, `malformed`, `partial`, `stale`, `suspect`, `vacuous`, `tampered`, `incomplete`, `conflict`, `refused` | +| `ReviewRelation` | `current`, `open`, `invalid`, `conflict` | +| `DecisionEventAdmission` | `admitted`, `refused` | +| `DecisionDisposition` | `accepted`, `rejected`, `deferred`, `conditional`, `open`, `conflict` | +| `PackageResult` | `published`, `failed`, `unavailable`, `unsupported`, `incomplete`, `refused`, `conflict`; every non-published result carries its exact cause | +| `RetentionState` | `transient`, `retained-current`, `unavailable`, `expired`, `deleted`, `tampered`, `refused`, `unsupported` | +| `LicenseResolution` | `complete`, `incomplete`, `conflict`, `refused`; `complete` contains one normalized SPDX expression and its complete authoritative source set | +| `TypedDecode` | `decoded(T)`, `unsupported { raw }`, `refused { raw, cause }`; the non-decoded variants do not construct a value of `T` | + +Execution mapping is total and non-improving: `skipped` maps to `not-computed`; +`spawn-failed` to `unavailable`; `completed-nonzero`, `signalled` and +`timed-out` to `fail`; and `truncated`/`invalid-output` to `malformed`. +`succeeded` only admits fresh output for domain interpretation and does not +itself map to `pass`. Every serialized occurrence of every closed result type is +decoded through `TypedDecode`: an unknown enum value produces `unsupported` +and preserves the raw value, while a malformed known encoding produces +`refused` and preserves its raw bytes and cause. Review/event/package/decision/ +license states never implicitly map into another type, and a decode failure is +never injected into the domain enum it failed to construct. + +For package execution, `skipped` maps to `incomplete`, `spawn-failed` to +`unavailable`, `completed-nonzero`/`signalled`/`timed-out` to `failed`, and +`truncated`/`invalid-output` to `refused`; each result retains the exact +`ExecutionOutcome`. For retention, workspace-only bytes are `transient`, a +fresh successful exact retrieval is `retained-current`, denied/missing backend +or handle is `unavailable`, elapsed lifecycle is `expired`, confirmed governed +removal is `deleted`, content/binding mismatch is `tampered`, malformed known +input is `refused`, and an unknown enum value is `unsupported`. + +## Requirements Architecture + +[StR-004](./requirements/StR-004-progressive-source-readiness.md) states the +stakeholder need. [FR-014](./requirements/FR-014-bind-source-readiness-candidate.md) +binds the candidate/configuration; +[FR-015](./requirements/FR-015-preserve-readiness-stages.md) separates evidence +stages; [FR-016](./requirements/FR-016-emit-integrator-readiness-package.md) +defines the deferred package boundary; +[FR-017](./requirements/FR-017-require-human-source-release-decision.md) keeps +human authority exact; and +[FR-018](./requirements/FR-018-classify-qualification-execution-paths.md) +governs executable-path ownership. [NFR-004](./requirements/NFR-004-reproduce-source-readiness-observations.md) +constrains reproducibility, while +[NFR-005](./requirements/NFR-005-preserve-readiness-authority-and-retention.md) +constrains authority and retention truth. AP-002, AD-002 and MP-002 record assurance scope, +architecture and observation meaning. [TM-004](./source-readiness-test-matrix.md) +allocates planned evidence. + +## Dependency Map + +The internal hard-prerequisite graph is acyclic: + +```text +MRS-001 + PGM-01 + NFR-003 + FR-006 + -> FR-018 executable-path classification + -> FR-014 candidate/configuration binding + -> FR-015 stage and lifecycle preservation + -> FR-017 review and human-decision relation + -> FR-016 deferred integrator package +``` + +NFR-004 and NFR-005 are cross-cutting controls designed with FR-018 and gate +completion of every functional requirement they constrain. AP-002 selects the +review boundary; MP-002 operationalizes the NFR observations and does not +precede or redefine either NFR. Specification/review can finish while an +implementation node remains unavailable at an external resume condition. + +## Dependencies and Resume Conditions + +- Specification and composite review may proceed now. +- Actual v0.1 source-release evidence remains provisional until the exact M0 + candidate, required independent reviews, human Task-007 decision and signed + tag/checksum exist in the order governed by `quire-contract-ir#4`/PGM-01. +- Authoritative source-path/scope sealing remains blocked on `tl-syntax#16`: + resume only after an immutable, reviewed and human-accepted Engineering + Assurance release names the Quire 0.32 source-grounded export and exact + compatible artifacts. +- Use-specific qualified records remain blocked on + `engineering-assurance#11`. Engineering-assurance#34 delivered reusable + bounded Rust producer execution, but M6 may consume it only after an immutable + compatible release containing that contract is admitted by Task-010. +- Executable-language disposition remains owned by `quire-research#64`. +- Quire status-classification and Quoin binary-attachment/non-release-build + gaps remain conditional blockers for claims that depend on those capabilities. +- The packaged Engineering Assurance matrix is bound by its exact immutable + package/version and package-integrity mechanism, not by a self-digest. Every + externally consumed artifact still requires its own declared digest; until + this distinction is exercised, a complete shared-artifact claim is unavailable. +- Existing documentation disagrees about whether Quoin evidence survives only + in ignored `target/` state or in a repository evidence area. Durable-retention + claims remain unavailable until the selected released Quoin backend, handle, + retrieval and lifecycle rule are named and exercised; prose or a digest is + not a substitute. +- Historical plans and reviews remain records of their original campaigns, not + current M6 evidence or authority. PLAN-007 will carry the current dependency + and resume-state addendum without rewriting those archival claims. +- Hosted CI remains manual-only and is evidence only when a human dispatches and + identifies its exact run; this specification dispatches nothing. + +## References + +- [M6 parent](https://github.com/agent-ix/tl-syntax/issues/31) and + [specification ticket](https://github.com/agent-ix/tl-syntax/issues/34). +- [Cross-repository source-release campaign](https://github.com/agent-ix/quire-contract-ir/issues/4). +- [Source-grounding consumer gate](https://github.com/agent-ix/tl-syntax/issues/16). +- [Use-specific qualification](https://github.com/agent-ix/engineering-assurance/issues/11) + and [Rust producer execution](https://github.com/agent-ix/engineering-assurance/issues/34). +- [Executable-language boundary](https://github.com/agent-ix/quire-research/issues/64). diff --git a/spec/spec.md b/spec/spec.md index ccb83cf..2072dfc 100644 --- a/spec/spec.md +++ b/spec/spec.md @@ -38,6 +38,11 @@ without redefining or weakening it. - Formula rewriting or normalization. - Finite-trace evaluation and horizon computation algorithms. - Production stream monitoring. +- A user-authored TL or FRETish source language; native Quire is the sole + editable formal-clause authority. +- Automatic release approval, tool certification, consuming-system + qualification, monitor qualification, crates.io publication, or a local + evidence/approval framework. ## System Overview @@ -69,9 +74,12 @@ inspection evidence. - [tl-syntax epic](https://github.com/agent-ix/tl-syntax/issues/5). - [Contract-derived verification program](https://github.com/agent-ix/quire-contract-ir/issues/1). -- [FRETish temporal frontend](https://github.com/agent-ix/quire-contract-ir/issues/57). +- [Native Quire typed-predicate bridge](https://github.com/agent-ix/quire-contract-ir/issues/63). +- [Export-only FRETish mapping](https://github.com/agent-ix/quire-contract-ir/issues/57). - [Typed signal and source-context child](https://github.com/agent-ix/tl-syntax/issues/15). - [Post-v0.1 future operator-profile specification](./future-profile.md). +- [Progressive source-readiness child](https://github.com/agent-ix/tl-syntax/issues/34). +- [Progressive source-readiness specification](./source-readiness.md). - [PGM-01 governance gate](https://github.com/agent-ix/quire-contract-ir/issues/3), identified as `ix://agent-ix/quire-contract-ir/PGM-01`. - Cargo package manifest and repository contribution policy. diff --git a/tests/shared_assurance.rs b/tests/shared_assurance.rs index c857a14..8e8879b 100644 --- a/tests/shared_assurance.rs +++ b/tests/shared_assurance.rs @@ -390,7 +390,7 @@ fn git_files(root: &Path, arguments: &[&str]) -> CensusResult> .collect()) } -const EXPECTED_LIVE_TRACKED: [&str; 113] = [ +const EXPECTED_LIVE_TRACKED: [&str; 128] = [ ".agent/rules/writing_rust.md", ".github/CODEOWNERS", ".github/workflows/ci.yml", @@ -460,13 +460,18 @@ const EXPECTED_LIVE_TRACKED: [&str; 113] = [ "scripts/validate_corpus.py", "spec/assurance/AA-001.md", "spec/assurance/AD-001.md", + "spec/assurance/AD-002-source-readiness-boundary.md", "spec/assurance/ADR-001-future-operator-profile.md", "spec/assurance/AP-001.md", + "spec/assurance/AP-002-progressive-source-readiness.md", "spec/assurance/CAC-001.md", "spec/assurance/MP-001.md", + "spec/assurance/MP-002-source-readiness-obligation-state.md", "spec/evidence/suites.md", "spec/future-profile-test-matrix.md", "spec/future-profile.md", + "spec/integration/IT-001-shared-source-readiness-handoff.md", + "spec/integration/IT-002-integrator-package-handoff.md", "spec/requirements/FR-001-inclusive-intervals.md", "spec/requirements/FR-002-validated-formula.md", "spec/requirements/FR-003-identities-and-profiles.md", @@ -477,12 +482,22 @@ const EXPECTED_LIVE_TRACKED: [&str; 113] = [ "spec/requirements/FR-008-future-operator-lowering.md", "spec/requirements/FR-009-future-profile-compatibility.md", "spec/requirements/FR-010-future-profile-downstream-evidence.md", + "spec/requirements/FR-014-bind-source-readiness-candidate.md", + "spec/requirements/FR-015-preserve-readiness-stages.md", + "spec/requirements/FR-016-emit-integrator-readiness-package.md", + "spec/requirements/FR-017-require-human-source-release-decision.md", + "spec/requirements/FR-018-classify-qualification-execution-paths.md", "spec/requirements/NFR-001-no-std-feature-boundary.md", "spec/requirements/NFR-002-determinism-and-integrity.md", "spec/requirements/NFR-003-qualification-integrity.md", + "spec/requirements/NFR-004-reproduce-source-readiness-observations.md", + "spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md", "spec/requirements/StR-001-embedded-consumers.md", "spec/requirements/StR-002-temporal-interoperability.md", "spec/requirements/StR-003-formal-temporal-frontends.md", + "spec/requirements/StR-004-progressive-source-readiness.md", + "spec/source-readiness-test-matrix.md", + "spec/source-readiness.md", "spec/spec.md", "spec/test-matrix.md", "src/bounded_string.rs", @@ -517,8 +532,10 @@ const FORBIDDEN: [&str; 5] = [ fn is_archival_record(relative: &str) -> bool { relative == "tests/shared_assurance.rs" || relative == "spec/.gitkeep" - || relative.starts_with("spec/reviews/") - || relative.starts_with("spec/plans/") + || (relative.ends_with(".md") + && (relative.starts_with("spec/reviews/") + || relative.starts_with("spec/plans/") + || relative.starts_with("plan/"))) } fn source_sets(root: &Path) -> CensusResult<(BTreeSet, BTreeSet)> { @@ -808,6 +825,7 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { std::env::temp_dir().join(format!("tl-syntax-source-census-fixture-{process}")), ); fs::create_dir_all(fixture.path().join("src")).expect("create tracked fixture area"); + fs::create_dir_all(fixture.path().join("plan")).expect("create plan fixture area"); fs::create_dir_all(fixture.path().join("tests/proptest-regressions")) .expect("create ignored fixture area"); fs::write(fixture.path().join(".gitignore"), "proptest-regressions/\n") @@ -817,6 +835,13 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { "pub const TRACKED: bool = true;\n", ) .expect("write tracked fixture"); + fs::write( + fixture.path().join("plan/record.md"), + "# Inert plan record\n", + ) + .expect("write archival plan fixture"); + fs::write(fixture.path().join("plan/run"), "#!/bin/sh\nexit 0\n") + .expect("write executable plan fixture"); fs::write( fixture.path().join("tests/untracked.rs"), "pub const FORBIDDEN_REFERENCE: &str = \"legacy_evidence_view\";\n", @@ -836,7 +861,13 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { .expect("initialize source-census fixture repository"); assert!(initialized.success(), "fixture git init failed"); let staged = Command::new("git") - .args(["add", ".gitignore", "src/tracked.rs"]) + .args([ + "add", + ".gitignore", + "src/tracked.rs", + "plan/record.md", + "plan/run", + ]) .current_dir(fixture.path()) .status() .expect("stage source-census fixture"); @@ -846,12 +877,18 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { source_sets(fixture.path()).expect("enumerate source-census fixture"); assert_eq!( fixture_tracked, - BTreeSet::from([".gitignore".to_owned(), "src/tracked.rs".to_owned()]) + BTreeSet::from([ + ".gitignore".to_owned(), + "plan/run".to_owned(), + "src/tracked.rs".to_owned(), + ]), + "Markdown plan records are archival, but a tracked executable under plan/ must remain live" ); assert_eq!( fixture_scanned, BTreeSet::from([ ".gitignore".to_owned(), + "plan/run".to_owned(), "src/tracked.rs".to_owned(), "tests/untracked.rs".to_owned(), ]), @@ -901,9 +938,10 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { ("examples", 1), ("fuzz", 4), ("scripts", 7), - // Issue #32 adds six reviewed post-v0.1 profile artifacts; SpecReviews - // remain archival and outside the live-source population. - ("spec", 27), + // Issue #32 adds six reviewed post-v0.1 profile artifacts and issue #34 + // adds fifteen live source-readiness specification and assurance + // artifacts; SpecReviews/plans remain archival exclusions. + ("spec", 42), // Issue #40 adds the future-lowering module and its traced tests. ("src", 9), // Issue #41 adds the paired-corpus replay.