From 767dc92a97f1b3d9ffbb76467bdda9ecf2261e40 Mon Sep 17 00:00:00 2001 From: Agent IX Date: Thu, 10 Sep 2026 14:05:39 -0700 Subject: [PATCH 1/9] spec: define progressive source-readiness boundary --- .../AD-002-source-readiness-boundary.md | 135 ++++++++++++ .../AP-002-progressive-source-readiness.md | 119 +++++++++++ ...P-002-source-readiness-obligation-state.md | 66 ++++++ spec/evidence/suites.md | 17 +- .../IT-001-shared-source-readiness-handoff.md | 106 ++++++++++ .../IT-002-integrator-package-handoff.md | 121 +++++++++++ .../FR-014-bind-source-readiness-candidate.md | 118 +++++++++++ .../FR-015-preserve-readiness-stages.md | 96 +++++++++ ...R-016-emit-integrator-readiness-package.md | 110 ++++++++++ ...7-require-human-source-release-decision.md | 119 +++++++++++ ...-classify-qualification-execution-paths.md | 90 ++++++++ .../NFR-003-qualification-integrity.md | 12 +- ...reproduce-source-readiness-observations.md | 77 +++++++ ...serve-readiness-authority-and-retention.md | 77 +++++++ .../StR-003-formal-temporal-frontends.md | 36 ++-- .../StR-004-progressive-source-readiness.md | 81 ++++++++ spec/source-readiness-test-matrix.md | 92 +++++++++ spec/source-readiness.md | 195 ++++++++++++++++++ spec/spec.md | 10 +- tests/shared_assurance.rs | 21 +- 20 files changed, 1671 insertions(+), 27 deletions(-) create mode 100644 spec/assurance/AD-002-source-readiness-boundary.md create mode 100644 spec/assurance/AP-002-progressive-source-readiness.md create mode 100644 spec/assurance/MP-002-source-readiness-obligation-state.md create mode 100644 spec/integration/IT-001-shared-source-readiness-handoff.md create mode 100644 spec/integration/IT-002-integrator-package-handoff.md create mode 100644 spec/requirements/FR-014-bind-source-readiness-candidate.md create mode 100644 spec/requirements/FR-015-preserve-readiness-stages.md create mode 100644 spec/requirements/FR-016-emit-integrator-readiness-package.md create mode 100644 spec/requirements/FR-017-require-human-source-release-decision.md create mode 100644 spec/requirements/FR-018-classify-qualification-execution-paths.md create mode 100644 spec/requirements/NFR-004-reproduce-source-readiness-observations.md create mode 100644 spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md create mode 100644 spec/requirements/StR-004-progressive-source-readiness.md create mode 100644 spec/source-readiness-test-matrix.md create mode 100644 spec/source-readiness.md diff --git a/spec/assurance/AD-002-source-readiness-boundary.md b/spec/assurance/AD-002-source-readiness-boundary.md new file mode 100644 index 0000000..f7e5119 --- /dev/null +++ b/spec/assurance/AD-002-source-readiness-boundary.md @@ -0,0 +1,135 @@ +--- +id: AD-002 +title: tl-syntax source-readiness and integrator boundary +type: ArchitectureDescription +status: proposed +owner: tl-syntax-maintainer +system: tl-syntax source-readiness preparation and future integrator handoff +relationships: + - target: ix://agent-ix/tl-syntax/MRS-004 + type: realizes + - target: ix://agent-ix/tl-syntax/AP-002 + type: references +--- + +# tl-syntax source-readiness and integrator boundary + +## System Boundary + +tl-syntax owns its Rust domain producers, exact candidate/configuration inputs, +component-specific assumptions/limitations and adapter to accepted shared +contracts. Engineering Assurance owns compatibility, future reusable producer- +execution and integrator/use-specific qualification contracts. Quire owns +source-grounded static export. Quoin owns the shared evidence-retention and +orchestration contract; current workspace bytes remain transient until an exact +backend/handle lifecycle passes retrieval. +GitHub branch protection/review history and the human release owner remain +external authorities. Native Quire is the only editable formal-clause language; +tl-syntax is internal representation infrastructure. + +## Views + +The source-readiness flow is: + +```text +exact Git source + Cargo/toolchain/config/profile/corpus identities + -> tl-syntax Rust domain producers + -> compatible released Quire source export + -> compatible released Engineering Assurance classification/contracts + -> Quoin record/attestation/intake/receipt and conditional retained handle + -> independent spec/code/gap reviews + -> attributed human source-release decision + -> future shared integrator package with adopter fields still open +``` + +The external context is: + +```text +PGM-01 + native-language ruling + LR08 policy + | +Git/repository -> tl-syntax Rust readiness projection/admission adapter + | | | + released Quire/EA/Quoin GitHub review human release owner + | | + selected retention backend/operator downstream integrator +``` + +Failure remains visible at the stage where it occurs. No later stage repairs a +missing producer input, identity, review, limitation or decision. Historical +facts remain immutable and are linked by supersession/invalidation. + +The current executable-path inventory for review distinguishes: + +| Class | Current path | Disposition boundary | +|---|---|---| +| Rust domain/library logic | `src/`, Rust examples/tests/fuzz targets | Retain as tl-syntax-owned; every new first-party path is Rust. | +| Existing Python domain/assurance helpers | corpus oracle, feature gate, assurance adapter | Explicit legacy inventory; replace with reviewed Rust/shared capabilities or obtain bounded owner disposition with parity/failure evidence. | +| Existing shell/Make/workflow orchestration | Makefile, shell audits, hosted YAML/inline commands | Not a trust root; inventory and migrate reusable executable semantics under LR08. | +| Existing Quoin Node/TypeScript | installed shared Quoin release | Sole recorded accommodation; contain rather than copy or broaden. | +| Quire and Engineering Assurance | released shared tools/contracts | Consume exact compatible artifacts; do not fork or reproduce locally. | + +## External Dependencies and Trust + +`Assumed` means tl-syntax preserves an attributable input without proving the +external authority's semantic correctness. `Guaranteed` means a named planned +contract test verifies this consumer boundary; where the required release is +missing, the guarantee remains unavailable rather than falling back locally. + +| Dependency | Trust mode | Contract and current state | +|---|---|---| +| PGM-01 and native-language ruling | Assumed | Governance/source-language authority; bind exact immutable identity before implementation. | +| Git repository/object/materialization | Guaranteed boundary; Git correctness/provenance assumed | TC-059/060/069 bind/refuse identities; Git implementation and repository provenance remain external assumptions. | +| Rust/Cargo toolchain and public package delivery | Guaranteed identity; semantics/provenance assumed | FR-014 identity mutations; no compiler or registry certification claim. | +| Released Quire source export and Engineering Assurance classifier | Guaranteed when available | IT-001; unavailable until the `tl-syntax#16` accepted release set exists. | +| Released Quoin record/attestation/intake/receipt | Guaranteed when available | IT-001 real interfaces; Quoin does not execute producers or decide sufficiency. | +| Retention backend/operator | Guaranteed when selected | TC-067 verifies handle/content/lifecycle after workspace deletion; currently unselected/unavailable. | +| GitHub review/event facts | Assumed input, guaranteed binding | TC-073 checks exact policy/actor/subject binding; authenticated event semantics remain external. | +| Reviewer-independence and human-release policy | Assumed authority, guaranteed admission | FR-017/TC-073; currently unavailable until an immutable policy/event source and actor set are selected. | +| LR08 cross-repository language policy | Assumed | `quire-research#64`; tl-syntax guarantees only its local census/classification under TC-064/065. | +| Future Engineering Assurance integrator package | Guaranteed when available | IT-002; currently no accepted compatible contract. | +| Downstream intended-use/deployment facts | Assumed input, guaranteed separation | IT-002 preserves adopter attribution and non-transfer of acceptance. | +| License/reuse-right authority | Assumed authority, guaranteed mapping | TC-072 checks material mapping; it does not establish legal validity. | +| Hosted CI provider/run event | Assumed optional observation | Only a human-dispatched exact run may be cited; no dispatch is required here. | + +## Decisions + +1. Source-readiness identity is the product of exact source and declared + configuration, not a branch name, command name or latest compatible version. +2. Developer observation, retained evidence, review and human decision are + orthogonal facts. No aggregate score carries release authority. +3. The future integrator package retains source facts but leaves intended-use, + deployment and validation obligations open for each adopter. +4. Missing shared capabilities return unsupported/unavailable. Local schema, + parser, runner, store, compatibility map and approval substitutes are + prohibited. +5. “Source” in this architecture means the tl-syntax Rust repository candidate, + never an alternative user-authored temporal source language. +6. The `readiness projection` and `admission adapter` are tl-syntax Rust + component projections/checks over released shared types. They are not a new + generic evidence schema, aggregate qualification interpreter or approval + workflow. + +## Risks + +- `agent-ix/tl-syntax#16` cannot resume until an immutable Engineering Assurance + release accepts the source-grounded Quire release and artifact shape. +- The latest immutable Engineering Assurance release does not yet carry its + corrected human-acceptance predicate or accept Quire 0.32; branch-head state + and a repository-local compatibility fixture are not substitutes. +- The general shared integrator-package contract is not yet selected; IT-002 + remains blocked on a real accepted Rust-consumable release. +- `agent-ix/engineering-assurance#11/#34` must reconcile use-specific + qualification and bounded Rust producer execution; tl-syntax must not fill + that gap locally. +- Existing Python/shell/Make/inline-workflow paths require the LR08 inventory, + Rust parity or explicit owner disposition before stable qualification use. +- Quire status-column classification and Quoin binary-attachment/non-release- + build profile gaps remain explicit prerequisites when the selected evidence + depends on them; local parsers, archives or false `release` labels are + prohibited. +- The measured Make false-success class remains an open limitation; a Quoin + record constrains produced bytes but cannot prove an omitted command ran. +- Existing retention prose conflicts over ignored `target/` state versus a + repository evidence area. No durable-retention claim is admitted until an + exact released shared backend, immutable handle, retrieval result and + lifecycle rule resolve that conflict. diff --git a/spec/assurance/AP-002-progressive-source-readiness.md b/spec/assurance/AP-002-progressive-source-readiness.md new file mode 100644 index 0000000..4c26757 --- /dev/null +++ b/spec/assurance/AP-002-progressive-source-readiness.md @@ -0,0 +1,119 @@ +--- +id: AP-002 +title: tl-syntax progressive source-readiness profile +type: AssuranceProfile +status: proposed +owner: tl-syntax-release-owner +profile_version: 0.2 +profile_kind: general +scope: one exact tl-syntax Rust source candidate, declared build/evaluation configuration and source-release disposition +impact_assessments: + - id: impact-readiness-subject-substitution + scenario: evidence or review for one source revision or configuration is reused for another + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-014 + - id: impact-automated-authority-promotion + scenario: a local gate, receipt or package is treated as human release or adopter authority + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-017 + - id: impact-limitation-loss + scenario: a limitation, exception, negative result or open adopter obligation is omitted from a favorable readiness view + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-015 + - id: impact-local-assurance-substitute + scenario: an unavailable shared capability is replaced by repository-local qualification logic + severity: material + verifiability: + class: cheap-conclusive + stochastic_dependency: none + detect_before_harm: + expected: true + control_ref: ix://agent-ix/tl-syntax/FR-018 +review_policy: + mode: require + operations: [spec-review, code-review, gap-analysis] +relationships: + - target: ix://agent-ix/tl-syntax/MRS-004 + type: governs + - target: ix://agent-ix/tl-syntax/AP-001 + type: references + - target: ix://agent-ix/quire-contract-ir/PGM-01 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: governs +--- + +# tl-syntax progressive source-readiness profile + +## Decision Boundary + +This profile prepares a human source-release decision for one exact Rust source +candidate and configuration. It extends rather than rewrites AP-001. It does not +qualify the native Quire language, a generated MLTL formula, a parser/evaluator/ +rewriter/monitor, crates.io publication, a consuming system or an integrator's +intended use. + +## Impact Scenarios + +The material risks are candidate/configuration substitution, promotion of an +automated observation into human authority, omission of unfavorable or open +facts, and construction of a local assurance substitute when a shared contract +is unavailable. Each is deterministic and admits a one-axis negative control. + +## Evidence Policy + +Every fact retains source, configuration, producer, procedure, environment, +outcome, stage, authority, limitation, retention-lifecycle and supersession +identities. Developer, source-release and adopter facts remain distinct. A +released Quoin contract retains evidence only when its configured backend and +handle remain retrievable; +Engineering Assurance defines shared compatibility and later use-specific +qualification; Quire owns static source-grounded exports. tl-syntax retains no +evidence store, score, approval registry or compatibility map. + +Specification review is base plus failure-domain, integrity, dependency, +evidence, risk-complexity, scope-boundary and EARS analyses. Implementation later +requires independent code review and gap analysis. Human source-release +acceptance remains a separate attributed decision after those reviews. +Every P0 M6 implementation suite must demonstrate at least one load-bearing +negative mutation before its positive results become admissible; matrix +priority is the current criticality carrier because the installed obligation +schema has no acceptance-criterion criticality column. + +## Resource Bounds + +- A symlink-resolution chain admits at most 32 links. +- The only admitted source-resolution root is the canonical immutable isolated + candidate root, whose path and filesystem/mount identity are candidate-bound; + descendant mount crossing is refused. +- A supersession traversal admits at most 4,096 facts, 8,192 directed edges and + depth 4,096. +- A value at a bound is admitted; the first value above it produces the typed + non-success required by FR-014 or FR-015 without exposing a partial result. + +## Exceptions + +No implicit exception exists. Every exception names an owner, exact subject, +affected impact scenario/obligation, rationale, expiry, counterevidence and +human disposition. Expiry or a material subject/configuration change reopens the +affected decision. The existing Quoin implementation is the only permanent +shared-runtime non-Rust accommodation; temporary legacy paths remain pre-stable, +explicitly inventoried and inadmissible for stable qualification. A bounded +owner disposition can authorize only its named pre-stable use; stable use still +requires a Rust/shared replacement with parity. Neither category grants +permission for a new non-Rust readiness path. diff --git a/spec/assurance/MP-002-source-readiness-obligation-state.md b/spec/assurance/MP-002-source-readiness-obligation-state.md new file mode 100644 index 0000000..2dc757c --- /dev/null +++ b/spec/assurance/MP-002-source-readiness-obligation-state.md @@ -0,0 +1,66 @@ +--- +id: MP-002 +title: tl-syntax source-readiness obligation-state plan +type: MeasurementPlan +status: proposed +owner: tl-syntax-evidence-owner +metric: tl-syntax.source-readiness-obligation-state +definition_version: tl-syntax.source-readiness-obligation-state/v1 +stage: gate +statistical_design: + population: every applicable readiness requirement criterion, declared candidate/configuration axis, selected domain suite, review operation, limitation, exception, shared dependency and human decision field + sampling: complete enumeration with no sampling; stochastic campaigns remain separate attributable observations + repetitions: 2 + estimator: per-obligation categorical outcome with no weighted or aggregate qualification score + error_model: stale or substituted source/configuration, omitted obligation, shared-contract incompatibility, producer non-execution, review/decision misattribution, limitation loss and nondeterministic domain output + uncertainty: deterministic repetitions must agree; disagreements and every missing/unavailable/non-success state are reported individually and never averaged away + decision_rule: block a source-readiness claim when any required obligation is non-success or lacks current attributable evidence; the measurement never approves release or adopter use +relationships: + - target: ix://agent-ix/tl-syntax/AP-002 + type: measures + - target: ix://agent-ix/tl-syntax/NFR-004 + type: measures + - target: ix://agent-ix/tl-syntax/NFR-005 + type: measures +--- + +# tl-syntax source-readiness obligation-state plan + +## Decision Use + +The observation informs the human release owner whether one exact candidate and +configuration has a complete, current and reviewable source-readiness fact set. +It does not approve release, certify a tool, qualify native Quire/TL semantics, +publish a crate or accept an integrator's use. + +## Population + +Enumerate every FR-014 through FR-018 and NFR-004/NFR-005 criterion; each selected +feature/target/build/toolchain/corpus/profile/shared-contract axis; every domain +suite and required review; all assumptions, limitations, exceptions, +counterevidence and supersession facts; and the human decision field. Record the +exact population identity and count before collection. Additions invalidate the +old complete-population claim. + +## Collection Procedure + +At one clean candidate, select the compatible immutable shared releases and +record all configuration identities. Run domain producers only through their +declared entry points, obtain Quire's source-grounded export, and pass existing +bytes through the real Engineering Assurance and Quoin interfaces. Quarantine +prior producer output and either isolate immutable inputs or validate every +bound identity before and after each handoff. Repeat the deterministic +population twice under the same declared inputs. Apply one-axis mutations from +TC-060 and TC-063 through TC-070. A released Quoin contract retains produced evidence only when its +configured backend and handle pass retrieval; this +repository stores only specifications, configuration and domain fixtures it +owns. + +## Interpretation + +Report each categorical result and discrepancy. A missing, failed, skipped, +unsupported, stale, suspect, vacuous, tampered or nondeterministic result blocks +only the claim that requires it and remains visible. Do not compute a score that +can hide an obligation or act as a decision. Environmental or stochastic +differences retain their exact provenance. Human review and decision consume the +measurement but are never outputs of it. diff --git a/spec/evidence/suites.md b/spec/evidence/suites.md index a7c3385..8801517 100644 --- a/spec/evidence/suites.md +++ b/spec/evidence/suites.md @@ -1,10 +1,10 @@ --- id: SUR-001 -title: tl-syntax v0.1 evidence suite registry +title: tl-syntax evidence suite registry type: SuiteRegistry --- -# tl-syntax v0.1 evidence suite registry +# tl-syntax evidence suite registry ## Suites @@ -17,6 +17,11 @@ type: SuiteRegistry | SUITE-005 | Corpus schema, derived horizon, and closed-trace oracle | `python3 scripts/validate_corpus.py --json` | Python jsonschema Draft 7, tl-syntax corpus oracle | Analysis | | SUITE-006 | Shared assurance intake chain | `python3 scripts/assurance_chain.py --candidate-revision ` | quoin 0.23.1 change-assurance and evidence surfaces | Integration | | SUITE-008 | Shared assurance contract tests | `cargo test --test shared_assurance --all-features` | cargo/rustc; Git supplies the version-control path inventory | Integration | +| SUITE-009 | Source-readiness property and state-model tests | `cargo test --test source_readiness_properties --all-features` | planned Rust proptest/state-machine harness | Property | +| SUITE-010 | Source-readiness fault and freshness tests | `cargo test --test source_readiness_failures --all-features` | planned Rust fault-injection harness | Integration | +| SUITE-011 | Real shared source-readiness contract tests | `cargo test --test source_readiness_shared --all-features -- --ignored` | planned Rust integration harness plus released Engineering Assurance/Quire/Quoin | Integration | +| SUITE-012 | Real integrator-package contract tests | `cargo test --test integrator_package --all-features -- --ignored` | planned Rust contract/state/concurrency harness plus released shared package | Integration | +| SUITE-013 | Rust dependency license/source facts | `cargo deny check licenses sources` | cargo-deny input to the independent TC-072 rights-source review; not a complete material-population disposition by itself | Static | ## Notes @@ -58,3 +63,11 @@ and lifecycle boundary. TC-038 checks the exact command and verifies that the change-assurance proof declarations do not convert SUITE-008 into an attested proof input. Independent review, not that self-check, establishes whether the suite ran at the reported exact head. + +SUITE-009 through SUITE-013 are planned M6 producer identities, not present +executables and not current evidence. SUITE-011 remains blocked on the +`tl-syntax#16` accepted release set. SUITE-012 remains blocked on a compatible +released integrator-package contract. The durable-retention branch of +SUITE-011 remains blocked until a shared backend/operator, immutable handle and +lifecycle pass TC-067. Every P0 M6 suite requires a load-bearing negative +mutation before its positive result may support a source-readiness claim. diff --git a/spec/integration/IT-001-shared-source-readiness-handoff.md b/spec/integration/IT-001-shared-source-readiness-handoff.md new file mode 100644 index 0000000..629f488 --- /dev/null +++ b/spec/integration/IT-001-shared-source-readiness-handoff.md @@ -0,0 +1,106 @@ +--- +id: IT-001 +title: Hand source-readiness inputs through the released shared stack +type: IT +relationships: + - target: ix://agent-ix/tl-syntax/FR-014 + type: verifies + - target: ix://agent-ix/tl-syntax/FR-015 + type: verifies + - target: ix://agent-ix/tl-syntax/NFR-004 + type: verifies + - target: ix://agent-ix/tl-syntax/NFR-005 + type: verifies + - target: ix://agent-ix/tl-syntax/FR-017 + type: verifies +--- + +# IT-001: Hand source-readiness inputs through the released shared stack + +## Objective + +Verify that one exact tl-syntax candidate and configuration flow through the +real released Engineering Assurance, Quire and Quoin interfaces without a local +schema/parser/runner and without promoting an unavailable or incomplete result. + +## Target Integration + +The system under test is the tl-syntax source-readiness handoff. External +dependencies are the exact released Engineering Assurance compatibility +classifier, Quire source-grounded export and Quoin record/attestation/intake/ +receipt interfaces. Tests invoke the installed real interfaces; none is mocked. + +## Preconditions + +A compatible immutable release set exists, is installed from its public +artifacts and is identified by the packaged Engineering Assurance matrix. The +worktree is clean at one exact reviewed commit. Domain producers and their +configurations are available. Hosted CI remains manual and need not be +dispatched for this local integration. + +## Inputs + +One valid candidate/configuration, its complete tracked source set, real +structured domain results and Quire export; paired mutations omit or alter one +source path/digest, feature, target, toolchain, corpus, shared artifact or +producer input. + +## Test Procedure + +1. Probe and classify every installed shared artifact through the released + compatibility interface. + - IT-001-SC-01: every selected identity/version/digest is compatible and no local mapping is consulted. +2. Produce domain results only through the declared tl-syntax producer target, + then obtain the real source-grounded Quire export. + - IT-001-SC-02: the export binds every selected requirement/source identity and reports no inferred or omitted live source. +3. Pass the existing bytes through Quoin seal, attestation, intake and receipt + operations without allowing Quire or Quoin to execute a producer. + - IT-001-SC-03: every output retains the exact subject/configuration and actual non-success/human-decision state. +4. Repeat each one-axis missing, stale, incompatible and substituted input case. + - IT-001-SC-04: each case refuses or remains unavailable/incomplete and cannot reuse the healthy result. +5. Quarantine prior output, force skip/crash/timeout/partial-output outcomes, + and mutate one bound source/configuration identity during a run. + - IT-001-SC-05: no stale output is accepted and every mid-run mutation refuses the observation. +6. Substitute repository/Git object identity and each applicable symlink, + submodule, Git LFS, generated or fetched-input identity. + - IT-001-SC-06: each changed materialized input creates a new subject or an explicit unavailable result. +7. Mutate the selected reviewer/decision policy and each actor, contributor, + conflict, delegation, revocation, quorum and review-subject binding. + - IT-001-SC-07: an unverifiable event is refused while the disposition stays open; insufficient quorum stays open without a local policy registry. +8. Retrieve every claimed durable handle after deleting only the disposable + producer workspace, then substitute returned bytes, media type, subject, + lifecycle and handle binding. + - IT-001-SC-08: durable success requires current exact retrieval from the declared backend/operator; every mutation is unavailable, tampered or refused rather than retained success. +9. Submit acyclic, dangling, cyclic, cross-subject, forked and contradictory + supersession relations plus unresolved, satisfied and expired conditional + decision states. + - IT-001-SC-09: graph and decision transitions match FR-015/FR-017 exactly and never choose a favorable branch or auto-accept a satisfied condition. + +## Expected Results + +The healthy candidate produces source-grounded shared artifacts for its exact +subject. Every mutated case fails on the changed axis. A missing human decision +remains missing, and no command or receipt approves the release. + +## Metadata + +- Priority: High +- Target Integration: released Engineering Assurance + Quire + Quoin interfaces +- Automation: Planned Rust integration test plus real shared CLI boundary + +## Dependencies + +`agent-ix/tl-syntax#16` remains blocked until a released Engineering Assurance +matrix accepts the source-grounded Quire artifact. This test cannot run against +a branch-head or local substitute. + +## Notes + +The exact shared versions are selected at implementation time from a reviewed +immutable compatible release set; this draft does not approve the currently +missing combination. + +## Traceability + +Planned matrix cases TC-059, TC-060, TC-062, TC-063, TC-066 through TC-070 and +TC-073 exercise this integration boundary. diff --git a/spec/integration/IT-002-integrator-package-handoff.md b/spec/integration/IT-002-integrator-package-handoff.md new file mode 100644 index 0000000..7d4586a --- /dev/null +++ b/spec/integration/IT-002-integrator-package-handoff.md @@ -0,0 +1,121 @@ +--- +id: IT-002 +title: Preserve source facts through the real integrator-package contract +type: IT +relationships: + - target: ix://agent-ix/tl-syntax/FR-016 + type: verifies + - target: ix://agent-ix/tl-syntax/FR-017 + type: verifies +--- + +# IT-002: Preserve source facts through the real integrator-package contract + +## Objective + +Verify that the future real shared integrator-package writer/reader preserves +tl-syntax source-release facts and open adopter obligations without creating a +qualification, certification or acceptance claim. + +## Target Integration + +The system under test is the tl-syntax adapter to a compatible released +Engineering Assurance integrator-package contract. The test invokes the real +shared writer and strict reader. No repository-local format or mock reader is +admitted. + +## Preconditions + +Engineering Assurance has released an accepted Rust-consumable package +contract, and the compatibility matrix selects its exact identity/version/ +digest. A human source-release disposition and its source facts exist for one +exact tl-syntax candidate. Until those conditions hold, this integration is +blocked and package emission remains unavailable. + +## Inputs + +One complete source-release fact set; two different adopter intended-use and +deployment configurations; open and completed adopter fields; and mutations of +each assumption, limitation, exception, negative result, review, decision, +profile, corpus, configuration and supersession identity. +Applicable license and reuse-right identities are included in the valid set and +mutated independently. + +Completed adopter fields are preserved only as separately attributed adopter- +stage inputs. Package readability and the source-release disposition neither +validate those fields nor convert them into accepted adopter obligations. + +## Test Procedure + +1. Emit and read the valid package through the real shared contract. + - IT-002-SC-01: every source-release and open adopter fact survives exactly with its stage and authority. +2. Pair the same source release with two intended-use/configuration subjects. + - IT-002-SC-02: the reader returns two distinct open adopter subjects and no inherited acceptance. +3. Delete or alter each required fact independently and submit the bytes to the + strict reader. + - IT-002-SC-03: the reader refuses the mutation or retains the named incomplete/unrepresented obligation without improving disposition; license and reuse-right loss is not silent. +4. Remove the compatible shared contract selection. + - IT-002-SC-04: tl-syntax reports unavailable and no local writer, schema, reader or approval path runs. +5. Force writer/reader spawn, timeout, signal, nonzero, truncation, partial-write + and schema/version failures while a prior package exists. + - IT-002-SC-05: no partial or prior package is exposed as new; only a candidate-bound temporary object that passes strict read and integrity verification becomes visible. +6. Supply conditional, concurrent and contradictory decision successors. + - IT-002-SC-06: the package preserves condition/conflict state and cannot present unconditional or adopter acceptance. +7. Reconcile every material against authoritative license/reuse-right sources, + then remove, conflict or substitute each authority independently. + - IT-002-SC-07: one normalized SPDX expression and complete source set represents valid `AND`/`OR`/nested licensing; missing resolution is incomplete, conflicting resolution is conflict, and unverifiable authority is refused. +8. Retry identical package attempts, reuse one attempt identity with changed + inputs, and race non-identical writers. + - IT-002-SC-08: identical retries resolve to one verified object; identity reuse and non-identical races produce conflict without exposing a timing-selected winner. + +## Expected Results + +The shared package is lossless for source facts and explicit about every open +adopter obligation. Mutations fail closed. Neither source-release acceptance nor +package readability establishes publication, certification, monitor +qualification or adopter acceptance. + +## License and Rights Analysis Procedure + +TC-072 binds its analysis population to the exact candidate and includes every +tracked source file, emitted package member, `Cargo.lock` dependency, and +generated or embedded third-party material. The authoritative evidence for each +material is the repository license/notice set, the exact dependency package or +release metadata, and any immutable registry or upstream notice selected by the +review policy; every source is retained with its issuer, applicability basis, +identity and digest. + +SUITE-013 supplies dependency-license and dependency-source facts for the Rust +closure. An independent rights reviewer reconciles those facts and the remaining +material population against the authoritative evidence, records the exact +candidate, tool/configuration identity, reviewer identity and policy, limitations +and complete source set, and assigns one normalized SPDX expression per +material. Missing disposition produces `incomplete`, incompatible resolutions +produce `conflict`, and an unverifiable authority produces `refused`. The output +is attributable engineering analysis; neither the automated check nor the +review is represented as legal advice, certification or a transfer of release +authority. + +## Metadata + +- Priority: High +- Target Integration: future released Engineering Assurance integrator package +- Automation: Planned real Rust/shared-contract integration test + +## Dependencies + +Engineering Assurance owns the shared package and use-specific qualification +contract. Quoin owns the retention/receipt interface, while the selected +external backend operator/custodian owns stored bytes. tl-syntax implements only +the reviewed consumer and handle verification after exact compatible releases +and authorities exist. + +## Notes + +This planned test is deliberately blocked on a real contract. A mock would hide +the central compatibility and losslessness boundary. + +## Traceability + +Planned TC-061, TC-062, TC-063, TC-066, TC-068 and TC-070 through TC-072 cover +its acceptance dimensions. diff --git a/spec/requirements/FR-014-bind-source-readiness-candidate.md b/spec/requirements/FR-014-bind-source-readiness-candidate.md new file mode 100644 index 0000000..34e9820 --- /dev/null +++ b/spec/requirements/FR-014-bind-source-readiness-candidate.md @@ -0,0 +1,118 @@ +--- +id: FR-014 +title: Bind source-readiness facts to one candidate and configuration +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/NFR-003 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-018 + type: depends_on +--- + +# FR-014: Bind source-readiness facts to one candidate and configuration + +## Description + +When source-readiness facts are prepared, tl-syntax shall bind them to one exact +candidate revision, declared complete live-source population and build/evaluation +configuration through released shared-assurance contracts. + +## Inputs + +- Canonical repository identity, exact Git commit/tree identity and clean + declared materialized source population selected for review, including + tracked regular-file bytes, symlink targets and any submodule, Git LFS, + generated or build-time fetched input disposition. +- The ordered canonical admitted-root set and each root's immutable filesystem/ + mount identity; AP-002 admits only the isolated candidate root. +- Crate name/version plus `Cargo.toml`, `Cargo.lock`, Rust toolchain and source + artifact digests. +- Selected features, target triples, build flags, corpus/profile revisions and + domain-suite identities. +- Exact Engineering Assurance, Quire, Quoin and workflow package identities, + versions and consumed artifact digests. +- For every executed producer: executable bytes, invocation identity/run nonce, + arguments/environment, start and completion facts, process outcome and fresh + output identity. + +## Outputs + +- Source-grounded shared-contract inputs for one exact candidate/configuration, + or the exact MRS-004 `ReadinessState` produced by a non-success condition, + including `unavailable` for an absent/incompatible required shared capability, + `incomplete` for missing package/artifact integrity and `refused` for a + missing, stale or ambiguous candidate identity. + +## Behavior + +- tl-syntax shall treat a changed candidate revision, tracked source path or + byte, feature set, target, toolchain, build flag, corpus/profile revision, + shared-contract release or consumed artifact digest as a different readiness + subject. +- tl-syntax shall refuse a dirty or incompletely enumerated live source + population instead of describing it as the reviewed candidate. +- tl-syntax shall execute against immutable isolated candidate/configuration + bytes or revalidate every bound identity before and after each producer and + shared handoff. +- If any bound identity changes during execution, then the tl-syntax Rust + readiness projection shall produce `refused`. +- tl-syntax shall quarantine or remove prior producer outputs before invocation. +- The tl-syntax Rust readiness projection shall accept only output freshly + created by the successful bound invocation. +- The tl-syntax Rust readiness projection shall record the exact + `ExecutionOutcome` without reusing a prior output. +- tl-syntax shall retain unsupported and unevaluated configurations as explicit + states instead of copying a result from a nearby configuration. +- While compatible released capabilities are available, tl-syntax shall use + the source-grounded Quire export and Quoin source connections. +- A packaged compatibility matrix shall be bound through the immutable released + package/version and package-integrity mechanism that supplies it. +- Every artifact consumed outside the matrix's package shall retain its own + digest. +- If package integrity or an external-artifact digest is missing, then the + tl-syntax Rust readiness projection shall classify the shared artifact set as + `incomplete`. +- tl-syntax shall preserve symlink link bytes. +- When the build consumes a symlink referent, tl-syntax shall bind its resolved + bytes and identity. +- tl-syntax shall constrain every resolved symlink referent to a profile- + admitted root. +- tl-syntax shall constrain every resolved symlink referent to an ordinary file + type. +- The tl-syntax source walk shall detect resolution cycles. +- The tl-syntax source walk shall enforce the AP-002 symlink-chain bound. +- The tl-syntax source walk shall normalize and resolve every path segment + beneath the bound admitted root without crossing a descendant mount. +- The tl-syntax source walk shall bind the admitted-root set, canonical paths + and filesystem/mount identities before and after resolution. +- If root/path/mount identity changes during resolution, then the tl-syntax Rust + readiness projection shall produce `refused`. +- If a symlink is dangling, cyclic, out-of-root, special-file targeting or over + the declared chain bound, then the tl-syntax Rust readiness projection shall + produce `refused`. +- If a required released source-grounding capability is unavailable, then + tl-syntax shall report the readiness request unavailable. +- tl-syntax shall not parse Markdown, copy a branch-head contract or introduce + a local source-identity schema as a substitute. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-014-AC-1 | Every healthy readiness input names one exact candidate revision, complete tracked-source set, crate/package bytes, feature/target/build configuration, corpus/profile revision, suite set and compatible shared-contract artifact set. | Test (TC-059) | +| FR-014-AC-2 | Mutating any identity or digest changes the readiness subject; omitting a required candidate identity is refused, while absence/incompatibility of a required shared capability is unavailable, and no prior result is reused. | Test (TC-060) | +| FR-014-AC-3 | Dirty, untracked-live, mutable-ignore, incomplete-census and unavailable-enumeration cases cannot be represented as a clean reviewed candidate. | Test (TC-060) | +| FR-014-AC-4 | Absence of a compatible released source-grounding contract remains unavailable and creates no local parser, schema, matrix or branch-head substitute. | Test (TC-066) | +| FR-014-AC-5 | Every `ExecutionOutcome` value in MRS-004 is exercised with a valid stale output present; no non-`succeeded` value yields a current successful domain output, every accepted output binds fresh invocation/executable/termination facts, and a mid-run source/configuration mutation is refused. | Test (TC-068) | +| FR-014-AC-6 | Candidate identity includes repository/Git/materialized-source/admitted-root identities; material or root/path/mount substitution/race is detected or unavailable, symlink chains below/at AP-002's bound terminate, and dangling/cyclic/out-of-root/special/mount-crossing/over-bound paths are refused. | Test (TC-069) | + +## Dependencies + +- [FR-006](./FR-006-shared-assurance-intake.md) owns current shared intake. +- [NFR-003](./NFR-003-qualification-integrity.md) owns existing v0.1 + qualification meaning and the pre-stable limitations. +- `agent-ix/tl-syntax#16` owns adoption of a released source-grounded Quire and + Engineering Assurance compatibility set; this requirement does not bypass + its resume condition. diff --git a/spec/requirements/FR-015-preserve-readiness-stages.md b/spec/requirements/FR-015-preserve-readiness-stages.md new file mode 100644 index 0000000..4d72928 --- /dev/null +++ b/spec/requirements/FR-015-preserve-readiness-stages.md @@ -0,0 +1,96 @@ +--- +id: FR-015 +title: Preserve developer, source-release and integrator stages +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-014 + type: depends_on +--- + +# FR-015: Preserve developer, source-release and integrator stages + +## Description + +When a verification, review or decision fact is consumed, the tl-syntax Rust +readiness projection shall preserve whether it is a developer observation, +source-release input, human source-release decision or integrator-adoption +input. + +## Inputs + +- Candidate/configuration identity from [FR-014](./FR-014-bind-source-readiness-candidate.md). +- Structured domain results, Quire static exports, Quoin records/attestations/ + receipts, independent review facts, human decision events, assumptions, + exceptions, counterevidence and limitations. +- For every retained fact: the shared retention authority/backend, immutable + record or content handle, retention start/rule, retrieval method, + supersession link, expiry/deletion rule and current availability. + +## Outputs + +- Independently classified facts retaining their producer, subject, + configuration, stage, outcome, authority and limitations. + +## Behavior + +- The tl-syntax Rust readiness projection shall keep every MRS-004 + `ReadinessState` value distinct. +- The tl-syntax Rust readiness projection shall not promote a local or hosted command result + into an independent review, Quoin attestation, human decision or integrator + validation. +- The tl-syntax Rust readiness projection shall not treat a Quoin receipt or complete source- + release evidence set as authority to approve or publish a release. +- The tl-syntax Rust readiness projection shall retain every declared assumption, exception, + known anomaly, failed/missing obligation and evidence limitation alongside + any successful fact it qualifies. +- The tl-syntax Rust readiness projection shall preserve immutable earlier facts + when a later result supersedes, invalidates or narrows them. +- The tl-syntax Rust readiness projection shall link every superseding, + invalidating or narrowing fact to the exact prior identity. +- Supersession/invalidation links shall target existing facts for the same + subject lineage and remain acyclic. +- The tl-syntax Rust readiness projection shall refuse a dangling, + cross-subject or cyclic supersession link. +- The tl-syntax Rust readiness projection shall produce `conflict` for forked + or contradictory successors until an attributed successor explicitly + supersedes the complete conflicting set. +- The tl-syntax Rust readiness projection shall preserve an unknown stage, + outcome, authority or lifecycle enum value as raw input and produce + `unsupported`. +- The tl-syntax Rust readiness projection shall produce `refused` for a + malformed encoding of a known value. +- The tl-syntax Rust readiness projection shall distinguish a transient workspace result from + evidence retained by an identified shared authority. +- The tl-syntax Rust readiness projection shall assign exactly one MRS-004 + `RetentionState` from current backend/handle/lifecycle/retrieval facts. +- The tl-syntax Rust readiness projection shall not infer provenance truth, + actor identity, non-repudiation, semantic correctness or evidence sufficiency + from a digest. +- Supersession traversal shall be iterative or maintain a visited set and obey + the AP-002 node, edge and depth bounds. +- If a supersession bound is exceeded, then the tl-syntax Rust readiness + projection shall produce `unsupported` without selecting a partial current + fact. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-015-AC-1 | Developer observations, source-release inputs, human decisions and integrator-adoption inputs remain distinguishable without diagnostic prose. | Test (TC-062) | +| FR-015-AC-2 | Replacing any non-success outcome, missing review, absent decision, limitation or exception with success is detected and refused. | Test (TC-063) | +| FR-015-AC-3 | A later superseding/invalidation fact retains the earlier bytes and identity and names the exact changed premise; it cannot silently restamp the earlier fact. | Test (TC-063) | +| FR-015-AC-4 | No automated result, receipt, score or complete-evidence classification creates release, publication, certification or integrator-acceptance authority. | Test (TC-066) | +| FR-015-AC-5 | Every evidence fact names its retention authority/backend/operator, handle, lifecycle and retrieval bindings and maps to exactly one MRS-004 `RetentionState`; workspace deletion, unavailable handles and every retrieval failure follow the total mapping and cannot report `retained-current`. | Test (TC-067) | +| FR-015-AC-6 | Supersession/invalidation traversal terminates over an acyclic same-subject graph below/at AP-002's node/edge/depth bounds; over-bound is `unsupported`, dangling/cross-subject/cyclic relations are refused, and forked/contradictory successors produce `conflict` without selecting a favorable current fact. | Test (TC-070) | +| FR-015-AC-7 | Every unknown stage, outcome, authority or lifecycle enum value remains attributable raw input and produces `unsupported`; malformed known values produce `refused`, with neither coerced to success or another favorable state. | Test (TC-063) | + +## Dependencies + +Quoin owns the shared evidence-recording, retention and orchestration contract +but neither operates an unspecified backend nor decides evidence sufficiency. +The selected external backend operator/custodian owns stored bytes; tl-syntax +only consumes and verifies handles. Engineering Assurance owns shared +compatibility and later use-specific qualification contracts. The human source-release owner retains the decision in +[FR-017](./FR-017-require-human-source-release-decision.md). diff --git a/spec/requirements/FR-016-emit-integrator-readiness-package.md b/spec/requirements/FR-016-emit-integrator-readiness-package.md new file mode 100644 index 0000000..2444163 --- /dev/null +++ b/spec/requirements/FR-016-emit-integrator-readiness-package.md @@ -0,0 +1,110 @@ +--- +id: FR-016 +title: Emit a shared-contract integrator readiness package +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-014 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-015 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-017 + type: depends_on +--- + +# FR-016: Emit a shared-contract integrator readiness package + +## Description + +Where a compatible released integrator-package contract exists, tl-syntax shall +populate that contract with reusable source-release facts while leaving the +integrator's intended-use, deployment and validation decision open. + +## Inputs + +- Exact source candidate/configuration and stage-classified facts from + [FR-014](./FR-014-bind-source-readiness-candidate.md) and + [FR-015](./FR-015-preserve-readiness-stages.md). +- The compatible released integrator-package contract identity, revision and + digest. +- Declared tl-syntax assumptions, feature/target limits, semantic profile and + corpus scope, known anomalies, exceptions, counterevidence, review facts, + human source-release disposition, applicable license/rights notices and + adoption guidance. +- The authoritative material population plus the issuer/source and applicability + basis for every license or reuse-right notice. + +## Outputs + +- A `PackageResult` from MRS-004 and, only for `published`, a package in the + released shared format with every reusable and still-open obligation + represented. + +## Behavior + +- The package shall distinguish immutable source-release facts from adopter- + supplied intended use, deployed artifact/configuration, platform, monitor, + hazard/consequence analysis, validation evidence and acceptance authority. +- The package shall retain exact source, crate artifact, configuration, profile, + corpus, shared-contract, evidence, review, decision, assumption, limitation, + exception, supersession, license and reuse-right identities. +- The package shall list unsupported and unrepresented consumer obligations + rather than omitting them or relabeling them as satisfied. +- Each included source/package material shall map to exactly one attributable + `LicenseResolution` containing a normalized SPDX expression and complete + authoritative source set. +- The tl-syntax Rust package adapter shall preserve valid `AND`, `OR` and nested + SPDX expressions as compound expressions rather than conflicts. +- If a license/reuse-right disposition is missing, then the tl-syntax Rust + package adapter shall produce `incomplete`. +- If license/reuse-right dispositions conflict, then the tl-syntax Rust package + adapter shall produce `conflict`. +- If a license/reuse-right authority is unverifiable, then the tl-syntax Rust + package adapter shall produce `refused` without repair by copying a notice. +- The package shall not claim native Quire source-language qualification, + R2U2/C2PO monitor qualification, consuming-system certification, + accreditation, authorization or non-repudiation. +- If the compatible released integrator-package contract is absent, then + tl-syntax shall report `unavailable`. +- If package writing, strict reading or integrity verification fails by spawn, + timeout, signal, nonzero exit, truncation, partial write or schema/version + mismatch, then tl-syntax shall retain the exact failure and expose no package. +- The tl-syntax Rust package adapter shall map every package-stage + `ExecutionOutcome` to the total `PackageResult` mapping in MRS-004 while + retaining the exact execution value. +- The tl-syntax Rust package adapter shall use candidate-bound temporary output. +- If strict reading and integrity verification succeed, then the tl-syntax Rust + package adapter shall expose the package atomically. +- If package production fails, then the tl-syntax Rust package adapter shall + leave no partial or prior package addressable as new. +- The tl-syntax Rust package adapter shall bind a shared-contract idempotency/ + attempt identity. +- If a retry has identical inputs and attempt identity, then the tl-syntax Rust + package adapter shall resolve it to the same verified object. +- If a retry reuses an attempt identity with non-identical inputs, then the + tl-syntax Rust package adapter shall produce `conflict`. +- If concurrent writers have non-identical inputs, then the tl-syntax Rust + package adapter shall produce `conflict` without exposing either as current. +- tl-syntax shall not create a local package schema, evidence store, validator, + approval workflow or compatibility map. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-016-AC-1 | A package round trip through the real released shared reader preserves every named source-release fact, identity, assumption, limitation, exception, counterexample, review, decision, applicable license and reuse-right state. | Test (TC-061, IT-002) | +| FR-016-AC-2 | The same source release paired with two intended uses or deployed configurations remains two distinct open integrator subjects and inherits no adopter acceptance. | Test (TC-061) | +| FR-016-AC-3 | Removing an unsupported obligation, limitation, exception, negative result or open adopter field cannot improve the package or create a complete integrator disposition. | Test (TC-063) | +| FR-016-AC-4 | Without a compatible released shared contract, package production is explicitly unavailable and no repository-local substitute exists. | Test (TC-066) | +| FR-016-AC-5 | Every package-stage `ExecutionOutcome` maps exactly as MRS-004 specifies, retains its cause and exposes no partial/stale/mislabeled package; only a strictly read and verified candidate-bound temporary object becomes atomically visible. | Test (TC-068, IT-002) | +| FR-016-AC-6 | Identical retries resolve to one verified object; attempt-identity reuse with different inputs and concurrent non-identical writers produce `conflict`, so neither input can win by timing. | Test (TC-071, IT-002) | +| FR-016-AC-7 | Every included source/package material maps to one normalized applicable license/reuse-right resolution and its complete authoritative source set, preserving valid compound expressions; missing disposition is `incomplete`, incompatible expressions are `conflict`, and unverifiable authority is `refused` even when a notice round-trips unchanged. | Analysis (TC-072) | + +## Dependencies + +The reusable package format and use-specific qualification model belong to +Engineering Assurance. Quoin owns the retention/receipt interface, and a +selected external backend operator/custodian owns stored bytes. No +implementation begins until exact compatible released contracts, authorities +and lifecycle semantics are available and reviewed for this consumer. diff --git a/spec/requirements/FR-017-require-human-source-release-decision.md b/spec/requirements/FR-017-require-human-source-release-decision.md new file mode 100644 index 0000000..dbcb452 --- /dev/null +++ b/spec/requirements/FR-017-require-human-source-release-decision.md @@ -0,0 +1,119 @@ +--- +id: FR-017 +title: Require an exact human source-release decision +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-015 + type: depends_on +--- + +# FR-017: Require an exact human source-release decision + +## Description + +When a source-release disposition is requested, the tl-syntax Rust admission +adapter shall +require an attributed human release-owner decision for the exact candidate and +configuration after the required independent reviews and limitation inspection. + +## Inputs + +- Exact candidate/configuration identity. +- Required specification, code and gap-review outcomes, each binding reviewer + identity/independence, exact head and base, reviewed configuration/evidence + set, finding dispositions and accepted limitations. +- Current evidence/counterevidence, assumptions, exceptions, limitations and + unresolved challenges. +- The authoritative release-owner/reviewer-independence policy identity and + version, authorized actors/quorum, candidate author/contributor set, conflict + disclosures and current delegation/revocation facts. +- Zero or more authenticated decision events for the exact subject lineage from + the authoritative event source, including every current concurrent successor. + +## Outputs + +- A `DecisionDisposition` from MRS-004 for the exact subject plus zero or more + per-event `DecisionEventAdmission` values and event records. +- An event-backed accepted/rejected/deferred/conditional disposition retains + exact event identity and rationale; `open` requires no absent event fields, + and `conflict` retains the complete conflicting event set. + +## Behavior + +- While a required review or human decision is absent, the tl-syntax Rust + admission adapter shall keep the disposition `open`. +- The tl-syntax Rust admission adapter shall aggregate the complete event set + for the exact subject lineage through the AP-002 node, edge and depth bounds. +- If an event is stale or bound to the wrong actor/subject, then the tl-syntax + Rust admission adapter shall set its `DecisionEventAdmission` to `refused`. +- If current events are ambiguous or contradictory, then the tl-syntax Rust + admission adapter shall produce `conflict`. +- The tl-syntax Rust admission adapter shall preserve a human rejection, conditional + acceptance, exception and expiry without translating any of them into an + unconditional pass. +- A conditional disposition shall bind each condition to its owner, required + evidence and expiry. +- While any condition is unresolved and unexpired, the tl-syntax Rust admission + adapter shall keep the disposition `conditional`. +- If a condition is satisfied, then the tl-syntax Rust admission adapter shall + preserve `conditional` until a new authorized decision is recorded. +- If a condition expires, then the tl-syntax Rust admission adapter shall mark + the prior conditional decision stale and set the current disposition `open`. +- The tl-syntax Rust admission adapter shall require a new decision when the candidate, + configuration, applicable profile, material limitation, required review or + shared-contract identity changes. +- The tl-syntax Rust admission adapter shall not synthesize, infer or replay a human decision + from a green gate, Quoin receipt, pull-request merge or prior release. +- The tl-syntax Rust admission adapter shall not count an author's self-review as an + independent review. +- The tl-syntax Rust admission adapter shall invalidate a review relation when + its exact head, base, configuration, evidence set or accepted limitation changes. +- The tl-syntax Rust admission adapter shall verify reviewer independence and decision + authority against the bound policy/version, actor, author/contributor set, + conflicts, delegations, revocations and quorum instead of accepting a + self-asserted Boolean independence field. +- The tl-syntax Rust admission adapter shall require every accepted limitation + or exception to be attributable to the authorized human release owner for the + exact decision subject. +- The tl-syntax Rust admission adapter shall preserve every accepted + limitation's or exception's rationale, affected obligations, counterevidence + and expiry. +- If review/decision successors are concurrent, forked or contradictory, then + the tl-syntax Rust admission adapter shall produce `conflict` until an + attributed authorized resolution explicitly supersedes every conflicting + predecessor in the same subject lineage. +- A deferred decision shall bind its owner, rationale, resume condition and + expiry. +- A deferred decision shall remain `deferred` until a new authorized decision + resolves it. +- If a current accepted, rejected, deferred or conditional decision, exception + or policy binding expires, then the tl-syntax Rust admission adapter shall + preserve it as stale history and set the current disposition `open`. +- A source-release decision shall not decide crates.io publication or an + integrator's use-specific qualification. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-017-AC-1 | Accepted/rejected/deferred/conditional/open/conflict remain distinct exact-subject dispositions; event-backed states retain identity/rationale/exception/expiry, `open` requires no absent event fields, and `conflict` retains the complete event set. | Test (TC-062) | +| FR-017-AC-2 | An absent required review/decision leaves the disposition `open`; a stale or wrong-actor/subject event is `refused` while the disposition stays `open`; an ambiguous/contradictory current set produces `conflict`, and none is inferred as accepted. | Test (TC-063) | +| FR-017-AC-3 | Every material candidate/configuration/profile/limitation/shared-contract change requires a new review/decision relation and preserves the historical disposition. | Test (TC-063) | +| FR-017-AC-4 | A source-release acceptance grants neither publication nor integrator/system/monitor qualification. | Test (TC-066) | +| FR-017-AC-5 | Each required review binds an attributable independent reviewer, exact head/base/configuration/evidence set, finding dispositions and accepted limitations; self-review or any bound-identity change leaves the review requirement open. | Test (TC-073) | +| FR-017-AC-6 | Independence and authority are evaluated against an exact policy/version, author/contributor set, conflicts, delegations, revocations and quorum; an unverifiable event is `refused`, and an insufficient quorum leaves the disposition `open`. | Test (TC-073) | +| FR-017-AC-7 | Conditional decisions retain condition owner/evidence/expiry; unresolved and satisfied conditions stay `conditional` until a new authorized decision, expiry reopens the disposition, deferred decisions retain owner/resume/expiry until a new authorized decision, and concurrent/contradictory successors produce `conflict` until explicitly resolved. | Test (TC-070) | + +## Dependencies + +- [AP-002](../assurance/AP-002-progressive-source-readiness.md) selects the + required review operations and decision boundary. +- `agent-ix/engineering-assurance#11` owns later use-specific producer + qualification and independence, not this source-release decision. +- PGM-01 and the repository's exact human-release-owner policy own source- + release authority; GitHub supplies authenticated review/event facts but does + not define independence or quorum. Until the exact immutable policy/event + source and authorized actor set are selected, decision admission remains + unavailable and tl-syntax creates no local reviewer or approval registry. diff --git a/spec/requirements/FR-018-classify-qualification-execution-paths.md b/spec/requirements/FR-018-classify-qualification-execution-paths.md new file mode 100644 index 0000000..5d3c6db --- /dev/null +++ b/spec/requirements/FR-018-classify-qualification-execution-paths.md @@ -0,0 +1,90 @@ +--- +id: FR-018 +title: Classify every readiness execution path +type: FR +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: implements + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/NFR-003 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-006 + type: depends_on +--- + +# FR-018: Classify every readiness execution path + +## Description + +The maintainer shall complete classification of every executable production, +test, fixture-audit, +adapter, orchestration and qualification path as retained shared capability, +domain-specific Rust logic, missing reusable capability or explicitly +owner-dispositioned legacy logic before implementing source readiness or +deciding a stable candidate. + +## Inputs + +- Exact candidate tracked-source census and executable-path inventory. +- Implementation-language owner policy. +- Released shared-capability inventory and open upstream tickets. +- Existing behavior, failure-path evidence and proposed replacement ownership. + +## Outputs + +- A reviewed disposition for every executable path, including language, + purpose, authority, owner, replacement/retention decision, parity obligation, + failure-path evidence and resume condition. + +## Behavior + +- New first-party libraries, CLI/tools, generators, validators, + canonicalization, adapters, test assertions and fixture/CI audits shall be + Rust. +- Existing Quoin shall remain the only permanent shared-runtime non-Rust + accommodation. +- The Quoin accommodation shall not authorize new TypeScript or Node semantics. +- Existing Python, shell, Make, inline workflow and other executable paths shall + remain classified as temporary pre-stable legacy paths. +- The tl-syntax executable census shall keep every temporary legacy path in the + inventory. +- Stable qualification shall exclude every temporary legacy path. +- A bounded owner disposition shall authorize only its named pre-stable use. +- Stable qualification shall require a Rust/shared replacement with positive + and failure-path parity for every required legacy behavior. +- The inventory shall distinguish data schemas and foreign-language fixture + samples from executable logic. +- The census unit shall be one tracked executable entry point or interpreter/ + runtime invocation. +- The tl-syntax executable census shall apply this exhaustive candidate-class + set: released shared tool, tl-syntax-owned Rust, owner-dispositioned legacy + executable and missing reusable capability. +- If zero or multiple candidate classes match, then the tl-syntax executable + census shall produce an ambiguity error rather than choosing by order. +- The tl-syntax executable census shall include tracked scripts/binaries, build scripts, generated + workflow steps, inline/nested interpreter or runtime invocations, dynamically + assembled commands and executable generators. +- If an executable construction cannot be resolved, then the tl-syntax + executable census shall keep it unclassified in the population. +- A missing shared runner, source export, integrator format, evidence store or + qualification contract shall remain an upstream dependency. +- tl-syntax shall not re-create a missing shared capability in this repository. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| FR-018-AC-1 | Every tracked executable entry point/runtime invocation is present exactly once with language, purpose, authority, owner, disposition, parity/failure evidence and resume condition; adding an entry point or producing zero/multiple class matches makes the census fail until classified. | Test (TC-064) | +| FR-018-AC-2 | Every new first-party executable readiness path is Rust; Quoin's retained accommodation does not admit another Node/TypeScript path. | Test (TC-064) | +| FR-018-AC-3 | Each replacement demonstrates positive and forced-failure parity before the legacy path is removed; missing parity leaves the replacement incomplete. | Test (TC-065) | +| FR-018-AC-4 | No missing reusable assurance capability is replaced by a local runner, parser, schema, evidence store, compatibility map or approval workflow. | Test (TC-066) | + +## Dependencies + +- `agent-ix/quire-research#64` owns the cross-repository policy/catalog; + tl-syntax owns exhaustive local enumeration, classification, refusal and + bounded legacy disposition. +- `agent-ix/engineering-assurance#34` owns the planned reusable Rust producer- + execution boundary. +- `agent-ix/tl-syntax#16` owns the source-grounded shared-contract migration. diff --git a/spec/requirements/NFR-003-qualification-integrity.md b/spec/requirements/NFR-003-qualification-integrity.md index 3e72ad2..9650ab7 100644 --- a/spec/requirements/NFR-003-qualification-integrity.md +++ b/spec/requirements/NFR-003-qualification-integrity.md @@ -14,10 +14,8 @@ relationships: ## Statement -Candidate qualification shall preserve the distinction between repository -verification, shared-contract intake, and a human release decision; bind every -claimed result to the identified candidate and producer bytes; keep non-success -outcomes out of the passing class; and grant no automated release authority. +Candidate qualification shall preserve repository verification, shared-contract +intake and a human release decision as distinct attributable states. ## Scope and ownership @@ -27,6 +25,10 @@ Assurance, Quire, and Quoin contracts. This requirement owns the qualification meaning and lifecycle of those results. It does not make Quire or Quoin a test runner and does not turn a local test result into a Quoin attestation. +Every claimed result shall bind the identified candidate and producer bytes. +Every non-success outcome shall remain outside the passing class. No automated +gate, receipt or classification shall grant release authority. + | Control | Requirement owner | Verification | Lifecycle boundary | |---|---|---|---| | Shared component compatibility | NFR-003-AC-1 | TC-021 invokes the packaged Engineering Assurance classifier over every declared component and consumed artifact digest. | Re-run for every candidate or adopted shared-component release. | @@ -69,7 +71,7 @@ CI ran, or authorize a release. | ID | Criteria | Verification | |---|---|---| -| NFR-003-AC-1 | Every declared shared component version and consumed artifact digest is classified by the packaged Engineering Assurance compatibility matrix, with no repository-local mapping or internal mirror substitute. | Test (TC-021) | +| NFR-003-AC-1 | Every declared shared component version and externally consumed artifact digest is classified by the packaged Engineering Assurance compatibility matrix; that matrix is bound by its exact released package/version and package integrity rather than circular self-classification, with no repository-local mapping or internal mirror substitute. | Test (TC-021) | | NFR-003-AC-2 | SUITE-008 identifies the exact local shared-assurance test command, and neither the change-assurance declaration nor any Quoin proof obligation claims that SUITE-008 was attested; its result is valid only for the exact-head review that reports it. | Test (TC-038) | | NFR-003-AC-3 | The candidate source identity covers every non-archival tracked path, refuses every ordinary-untracked live path and mutable ignore policy, and scans arbitrary tracked bytes without allowing a forbidden deleted identity to hide. | Test (TC-026, TC-034, TC-035) | | NFR-003-AC-4 | Every attested proof result is derived from a declared producer's structured bytes, with absent, empty, unreadable, or foreign-protocol input refused, and neither Quire nor Quoin executes a producer. | Test (TC-022) | diff --git a/spec/requirements/NFR-004-reproduce-source-readiness-observations.md b/spec/requirements/NFR-004-reproduce-source-readiness-observations.md new file mode 100644 index 0000000..792fb5f --- /dev/null +++ b/spec/requirements/NFR-004-reproduce-source-readiness-observations.md @@ -0,0 +1,77 @@ +--- +id: NFR-004 +title: Reproduce source-readiness observations without authority drift +type: NFR +quality_attribute: reliability +relationships: + - target: ix://agent-ix/tl-syntax/FR-014 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-015 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-016 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-017 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-018 + type: constrains +--- + +# NFR-004: Reproduce source-readiness observations without authority drift + +## Statement + +For identical candidate bytes, configuration identities, shared-contract +artifacts and deterministic producer inputs, the readiness path shall reproduce +the same source-grounded subject and per-obligation outcome. + +## Scope + +- Applies to source-readiness preparation, shared-contract intake, review + handoff and future integrator-package emission. +- Does not require identical wall-clock time, filesystem location, human + rationale or stochastic campaign result. +- Does not make Make, a hosted workflow, the repository, Quire or Quoin a human + decision authority. +- The readiness path shall retain environmental differences, non-deterministic + results and human decisions as separate attributable facts. +- Every producer declaration identifies the deterministic comparison projection + and every volatile, environmental or stochastic field excluded from equality; + an undeclared volatile field is a discrepancy, not silently normalized data. + +## Rationale + +Reproducibility is useful only when the repeated subject and configuration are +the same and every meaningful environmental difference remains visible. A +repeated command name alone cannot establish this identity. + +## Measurement and Evaluation + +| Metric | Target | Threshold | Method | +|---|---|---|---| +| Deterministic obligations changing under identical declared inputs | 0 | 0 | Test (TC-059) | +| Configuration/source/shared-contract mutations reusing an earlier subject | 0 | 0 | Test (TC-060) | +| Missing, failed or stale facts promoted during repetition | 0 | 0 | Test (TC-063) | +| Unclassified executable readiness paths | 0 | 0 | Test (TC-064) | + +## Verification + +Repeat the real local/shared handoff for one frozen candidate and configuration, +then mutate source, feature, target, toolchain, corpus, shared-release, +environment and limitation axes independently. Compare source-grounded subject +and per-obligation states, not only aggregate exit status. Retain each invalid or +non-deterministic run as its actual state. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| NFR-004-AC-1 | Two executions over identical declared deterministic inputs produce the same source-grounded subject identity and per-obligation states. | Test (TC-059) | +| NFR-004-AC-2 | Each one-axis source/configuration/shared-contract mutation creates a distinct subject or a typed refusal and cannot reuse earlier evidence. | Test (TC-060) | +| NFR-004-AC-3 | Environmental differences, stochastic results, exceptions, limitations and human decisions remain separate facts rather than inputs to a fabricated deterministic aggregate. | Test (TC-062, TC-063) | +| NFR-004-AC-4 | Evidence retention and interpretation use released Quoin/Engineering Assurance contracts; no repository-local store, score or decision function exists. | Test (TC-066) | +| NFR-004-AC-5 | Each producer declares its deterministic comparison fields and separately preserves every volatile/environmental/stochastic field; an undeclared or changed field cannot be silently normalized away. | Test (TC-059) | + +## Measurement Allocation + +[MP-002](../assurance/MP-002-source-readiness-obligation-state.md) defines the +planned complete observation population without granting release authority. diff --git a/spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md b/spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md new file mode 100644 index 0000000..3e43173 --- /dev/null +++ b/spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md @@ -0,0 +1,77 @@ +--- +id: NFR-005 +title: Preserve source-readiness authority and retention truth +type: NFR +quality_attribute: reliability +relationships: + - target: ix://agent-ix/tl-syntax/FR-015 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-016 + type: constrains + - target: ix://agent-ix/tl-syntax/FR-017 + type: constrains +--- + +# NFR-005: Preserve source-readiness authority and retention truth + +## Statement + +When a source-readiness fact is retained, reviewed, transferred or consumed in +a decision, the readiness path shall preserve its exact authority, subject, +limitations and lifecycle. + +## Scope + +- Applies to developer observations selected for release, source-release facts, + review relations, decision events and future integrator-package references. +- Covers transient and durable evidence, unavailable or expired handles, + supersession, accepted limitations and independent-review identity. +- The readiness path shall not convert identity or integrity evidence into + provenance, sufficiency or decision authority. +- Does not create a repository-local evidence store, reviewer registry, + signature authority, compatibility map or approval service. + +## Rationale + +A content digest can establish byte identity but cannot by itself establish who +produced the bytes, whether the procedure ran, whether the evidence is +sufficient or whether a human accepted the subject. Likewise, a path under an +ignored workspace directory is not durable retention merely because a command +describes it as retained. + +## Measurement and Evaluation + +| Metric | Target | Threshold | Method | +|---|---|---|---| +| Required facts missing authority, subject, limitation or lifecycle identity | 0 | 0 | Test (TC-067) | +| Self-reviews or stale reviews accepted as independent/current | 0 | 0 | Test (TC-073) | +| Unavailable or workspace-only bytes reported as durably retained | 0 | 0 | Test (TC-067) | +| Digest/receipt facts promoted into provenance, sufficiency or decision claims | 0 | 0 | Test (TC-066) | + +## Verification + +Inspect the selected shared retention contract and exercise retrieval for every +retained handle. Mutate reviewer, subject, head, base, configuration, evidence +set, limitation, lifecycle, availability, returned bytes, media type and handle +binding independently. Delete only a +disposable test workspace and prove that any claimed durable handle remains +retrievable from its declared shared authority; otherwise classify it as +transient, unavailable or expired. + +## Acceptance Criteria + +| ID | Criteria | Verification | +|---|---|---| +| NFR-005-AC-1 | Every evidence fact has a declared retention authority/backend/operator, immutable handle, lifecycle/retrieval/content/subject/freshness bindings and exactly one MRS-004 `RetentionState`; current retrieval verifies each binding and every failure follows the total mapping. | Test (TC-067) | +| NFR-005-AC-2 | Reviewer identity/independence policy and exact head/base/configuration/evidence-set bindings are preserved; self-review, unverifiable policy/authority and each one-axis binding mutation remain open or invalid. | Test (TC-073) | +| NFR-005-AC-3 | Every claim retains applicable assumptions, limitations, exceptions, counterevidence and accepted dispositions; omission cannot improve readiness. | Test (TC-063) | +| NFR-005-AC-4 | A digest or receipt proves only the property supplied by its released contract and never implies provenance truth, actor identity, non-repudiation, correctness, sufficiency or acceptance. | Test (TC-066) | + +## Dependencies + +Released Quoin contracts own the retention/receipt interface; a separately +selected external backend operator/custodian owns stored bytes. tl-syntax only +consumes and verifies handles. GitHub review identity and the declared human +source-release owner remain external authorities. Until those exact contracts, +operators and handles are selected and exercised, retention and independent- +review claims remain planned or unavailable. diff --git a/spec/requirements/StR-003-formal-temporal-frontends.md b/spec/requirements/StR-003-formal-temporal-frontends.md index d94bf87..d1b0dff 100644 --- a/spec/requirements/StR-003-formal-temporal-frontends.md +++ b/spec/requirements/StR-003-formal-temporal-frontends.md @@ -1,28 +1,28 @@ --- id: StR-003 -title: Formal temporal frontends need typed signals and attributable source context +title: Native Quire temporal bridges need typed signals and attributable source context type: StR relationships: - target: ix://agent-ix/tl-syntax/FR-007 type: satisfied_by --- -# StR-003: Formal temporal frontends need typed signals and attributable source context +# StR-003: Native Quire temporal bridges need typed signals and attributable source context ## Stakeholder Need -Formal temporal frontend maintainers require that an MLTL formula shall bind its -free propositions to stable named signals with explicit bounded value domains, -and that downstream temporal evidence shall retain the exact requirement -revision, clause, anchor, and source span when the frontend supplies them. +Native Quire temporal-bridge maintainers require that the bridge shall preserve +stable named total-Boolean signal bindings and the exact native requirement +revision, clause, anchor, and source span through internal MLTL evaluation. ## Rationale -`agent-ix/quire-contract-ir#57` derives variables from a typed semantic IR -package. An id-to-name proposition map cannot prove that a free variable came -from a bounded field, and a formula id cannot prove which requirement revision -or clause produced a temporal result. The shared syntax substrate must carry -those identities without importing the IR or evidence systems themselves. +`agent-ix/quire-contract-ir#63` projects total Boolean predicates from a typed +native semantic IR package. An id-to-name proposition map cannot prove that a +free variable came from an admitted bounded field, and a formula id cannot +prove which requirement revision or clause produced a temporal result. The +shared syntax substrate must carry those identities without importing the IR or +evidence systems themselves. ## Validation Criteria @@ -33,16 +33,18 @@ those identities without importing the IR or evidence systems themselves. ## Stakeholders -Maintainers of `quire-contract-ir#57`, tl-parse, tl-rewrite, tl-mltl, R2U2/C2PO +Maintainers of `quire-contract-ir#63`, tl-parse, tl-rewrite, tl-mltl, R2U2/C2PO adapters, and human assurance reviewers. ## Context and Assumptions -The future FRETish frontend owns IR-field derivation and predicate lowering. -tl-syntax owns only the parser-independent identity, bounded-domain, binding, -and source-context contract. A non-Boolean source field may participate through -an explicitly derived Boolean signal, but this crate does not define that -predicate expression or silently cast the field. +The native Quire frontend owns IR-field derivation and typed predicate lowering. +tl-syntax owns only the internal parser-independent identity, bounded-domain, +binding, and source-context contract. A non-Boolean source field may participate +through an explicitly derived total Boolean signal, but this crate does not +define that predicate expression or silently cast the field. FRETish is an +export-only mapping and never an editable source authority or qualification +dependency. ## Traceability diff --git a/spec/requirements/StR-004-progressive-source-readiness.md b/spec/requirements/StR-004-progressive-source-readiness.md new file mode 100644 index 0000000..1596086 --- /dev/null +++ b/spec/requirements/StR-004-progressive-source-readiness.md @@ -0,0 +1,81 @@ +--- +id: StR-004 +title: Release owners and integrators need bounded source-readiness facts +type: StR +relationships: + - target: ix://agent-ix/tl-syntax/FR-014 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-015 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-016 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-017 + type: satisfied_by + - target: ix://agent-ix/tl-syntax/FR-018 + type: satisfied_by +--- + +# StR-004: Release owners and integrators need bounded source-readiness facts + +## Stakeholder Need + +Release owners and downstream integrators require that tl-syntax shall expose +reviewable facts for one exact Rust source candidate without turning developer +checks, a source-release decision or an integrator's later validation into one +interchangeable qualification claim. + +## Rationale + +The same test result can be useful during development, source release and +downstream adoption while carrying different authority and assumptions. If +those stages or their configurations are collapsed, a green local command can +be mistaken for human approval or for evidence about a consuming system that +was never assessed. + +## Validation Criteria + +| ID | Criteria | Validation | +|---|---|---| +| StR-004-VC-1 | A release owner can identify the exact candidate, configuration, review state, evidence limitations and human disposition without inferring any missing field. | Demonstration (TC-059, TC-062) | +| StR-004-VC-2 | An integrator can distinguish reusable source-release facts from adopter-supplied intended use, deployment configuration and validation obligations. | Demonstration (TC-061) | +| StR-004-VC-3 | No artifact describes tl-syntax as a user-authored Quire alternative, certifies a tool or monitor, or grants automated release authority. | Inspection (TC-066) | + +## Stakeholders + +The tl-syntax human source-release owner, downstream TL crate maintainers, +native Quire bridge maintainers, consuming-system integrators and independent +assurance reviewers. + +## Context and Assumptions + +The existing v0.1 assurance profile remains the pre-stable source-release +boundary. Shared Engineering Assurance, Quire and Quoin contracts own generic +compatibility, evidence retention and review orchestration. A future reusable +integrator-package contract may be unavailable at the time this requirement is +reviewed. + +## Stakeholder Constraints (Contextual) + +Useful pre-stable delivery must not wait for a universal qualification scheme. +The readiness contract must remain valid when a dependent shared capability is +reported unavailable and must not replace that capability locally. + +## Dependencies + +Upstream policy comes from `ix://agent-ix/quire-contract-ir/PGM-01`, the native- +language owner ruling and the released shared-assurance contracts. Downstream +realization is allocated to [FR-014](./FR-014-bind-source-readiness-candidate.md) +through [FR-018](./FR-018-classify-qualification-execution-paths.md), +[NFR-004](./NFR-004-reproduce-source-readiness-observations.md) and +[NFR-005](./NFR-005-preserve-readiness-authority-and-retention.md). + +## Priority and Risk (Informative) + +Priority is high before a stable source-release candidate. The principal risk +is an overbroad qualification or certification inference from evidence gathered +for a narrower candidate and configuration. + +## Traceability + +This need is the stakeholder boundary for `agent-ix/tl-syntax#31` and +`agent-ix/tl-syntax#34`. diff --git a/spec/source-readiness-test-matrix.md b/spec/source-readiness-test-matrix.md new file mode 100644 index 0000000..71ba634 --- /dev/null +++ b/spec/source-readiness-test-matrix.md @@ -0,0 +1,92 @@ +--- +id: TM-004 +title: Progressive source-readiness test matrix +type: TestMatrix +relationships: + - target: ix://agent-ix/tl-syntax/MRS-004 + type: covers +--- + +# Progressive source-readiness test matrix + +## Functional Requirement Coverage + +| Functional Req | Acceptance Criteria | Test Cases | Coverage Status | +|---|---|---|---| +| FR-014 | FR-014-AC-1 through FR-014-AC-6 | TC-059, TC-060, TC-066, TC-068, TC-069 | 🚧 planned | +| FR-015 | FR-015-AC-1 through FR-015-AC-7 | TC-062, TC-063, TC-066, TC-067, TC-070 | 🚧 planned | +| FR-016 | FR-016-AC-1 through FR-016-AC-7 | TC-061, TC-063, TC-066, TC-068, TC-071, TC-072, IT-002 | 🚧 planned | +| FR-017 | FR-017-AC-1 through FR-017-AC-7 | TC-062, TC-063, TC-066, TC-070, TC-073 | 🚧 planned | +| FR-018 | FR-018-AC-1 through FR-018-AC-4 | TC-064, TC-065, TC-066 | 🚧 planned | + +## Stakeholder Requirement Coverage + +| Stakeholder Req | Trace to US/FR | Test/Validation | Coverage Status | +|---|---|---|---| +| StR-004 | StR-004-VC-1 through StR-004-VC-3 | TC-059, TC-061, TC-062, TC-066 | 🚧 planned | + +## Non-Functional Requirement Coverage + +| Non-Functional Req | Verification Method | Evidence/Test Cases | Status | +|---|---|---|---| +| NFR-004 | Repeatability, one-axis mutation and boundary inspection | TC-059, TC-060, TC-062, TC-063, TC-064, TC-066 | 🚧 planned | +| NFR-005 | Authority/subject/lifecycle mutation, retrieval and boundary inspection | TC-063, TC-066, TC-067, TC-073 | 🚧 planned | + +## Test Case Summary + +| Test ID | Title | Type | Priority | Traces To | Status | +|---|---|---|---|---|---| +| TC-059 | Repeat the complete source-readiness population at one exact candidate/configuration | Integration | P0 | FR-014-AC-1, NFR-004-AC-1, NFR-004-AC-5, StR-004-VC-1 | 🚧 planned | +| TC-060 | Mutate every candidate, source, configuration, environment and shared-contract identity | Property | P0 | FR-014-AC-2, FR-014-AC-3, NFR-004-AC-2 | 🚧 planned | +| TC-061 | Round-trip source facts and two distinct open adopter subjects through the real shared package | Integration | P0 | FR-016-AC-1, FR-016-AC-2, StR-004-VC-2, IT-002 | 🚧 blocked on shared contract | +| TC-062 | Preserve developer, release-input, human-decision and adopter stages and all six decision dispositions | Integration | P0 | FR-015-AC-1, FR-017-AC-1, NFR-004-AC-3, StR-004-VC-1 | 🚧 planned | +| TC-063 | Refuse promotion, limitation omission, stale decisions and unknown-value coercion | Integration | P0 | FR-015-AC-2, FR-015-AC-3, FR-015-AC-7, FR-016-AC-3, FR-017-AC-2, FR-017-AC-3, NFR-004-AC-3, NFR-005-AC-3 | 🚧 planned | +| TC-064 | Census and classify every executable readiness path and new-path mutation | Integration | P0 | FR-018-AC-1, FR-018-AC-2, NFR-004-AC-4 | 🚧 blocked on LR08 disposition | +| TC-065 | Demonstrate positive and forced-failure parity for each replaced executable path | Integration | P0 | FR-018-AC-3 | 🚧 blocked on reviewed replacements | +| TC-066 | Prove authority, language, certification and no-local-substitute boundaries | Integration | P0 | FR-014-AC-4, FR-015-AC-4, FR-016-AC-4, FR-017-AC-4, FR-018-AC-4, NFR-004-AC-4, NFR-005-AC-4, StR-004-VC-3 | 🚧 planned | +| TC-067 | Mutate evidence lifecycle/content binding and exercise durable-handle retrieval after disposable workspace deletion | Integration | P0 | FR-015-AC-5, NFR-005-AC-1 | 🚧 blocked on selected shared retention contract | +| TC-068 | Quarantine stale outputs and force skipped, crashed, timed-out, malformed and partial producer/package executions | Integration | P0 | FR-014-AC-5, FR-016-AC-5 | 🚧 planned | +| TC-069 | Mutate repository/Git/materialized/admitted-root/path/mount identities and probe symlink escape/cycle/race/special/mount/bound cases | Property | P0 | FR-014-AC-6 | 🚧 planned | +| TC-070 | Mutate supersession topology/bounds, conditional/deferred transitions and concurrent review/decision successors | Property | P0 | FR-015-AC-6, FR-017-AC-7 | 🚧 planned | +| TC-071 | Race non-identical package writers and retry identical/different attempt identities | Integration | P0 | FR-016-AC-6 | 🚧 blocked on accepted shared contract | +| TC-072 | An independent rights reviewer reconciles the exact candidate's tracked source, package contents, dependency closure and generated/embedded third-party material against identity-bound authoritative license and reuse-right sources | Analysis | P0 | FR-016-AC-7, IT-002-SC-07 | 🚧 planned | +| TC-073 | Mutate reviewer/decision policy, actor, contributor, conflict, delegation, revocation, quorum, head/base/configuration and evidence bindings | Property | P0 | FR-017-AC-5, FR-017-AC-6, NFR-005-AC-2 | 🚧 blocked on authoritative policy/event source | + +## Planned Suite Allocation + +| Test Cases | Planned Suites | +|---|---| +| TC-059, TC-060, TC-062, TC-069, TC-073 | SUITE-009 and, for real shared boundaries, SUITE-011 | +| TC-063, TC-064, TC-066 | SUITE-009 | +| TC-070 | SUITE-009 and SUITE-012 | +| TC-065, TC-068 | SUITE-010 and, for package failures, SUITE-012 | +| TC-061, TC-071 | SUITE-012 | +| TC-067 | SUITE-011 | +| TC-072 | SUITE-013 | + +## Matrix Design Coverage + +| Required design rule | Coverage | +|---|---| +| Every acceptance criterion mapped | FR/StR/NFR tables map every criterion to TC-059 through TC-073. | +| Relevant option permutations | TC-061 varies intended use/deployed configuration; TC-062 varies evidence stage and decision disposition. | +| Boundary conditions | TC-059 fixes the complete population; TC-060/069 change one identity/materialization axis; TC-067 crosses transient/durable and current/expired boundaries. | +| Error conditions | TC-063/068 cover missing, stale, omitted, crashed, partial and unsupported results; TC-066 covers unavailable shared capabilities. | +| State transitions | TC-062/063/070 cover promotion, decision, expiry, invalidation, conflict and supersession transitions. | +| Edge cases | TC-060/063/067/068/069/070 cover substitution, self-review, workspace loss, stale output, source indirection, cycles/forks, unavailable handles, limitation omission and silent restamping. | + +## Integration Test Matrix + +| Integration ID | Purpose | Type | Target | Test Cases | Status | +|---|---|---|---|---|---| +| IT-001 | Source-grounded handoff through real released Engineering Assurance, Quire and Quoin | service | shared assurance stack | TC-059, TC-060, TC-062, TC-063, TC-066 through TC-070, TC-073 | 🚧 blocked on tl-syntax#16 release set and authoritative policy/event source | +| IT-002 | Lossless future integrator-package handoff without transferred qualification | service | Engineering Assurance integrator package | TC-061, TC-062, TC-063, TC-066, TC-068, TC-070 through TC-072 | 🚧 blocked on accepted shared contract | + +## Evidence Limits + +Every row is planned or explicitly blocked. This matrix claims no executed M6 +test, complete source release, qualified record, shared package, hosted run, +signed tag, publication or human decision. Existing v0.1 tests do not +automatically back these new criteria. A TC row passes only when every named +subcase and conjunct succeeds; a skipped, unavailable or partially executed +subcase is reported separately and leaves the row non-passing. diff --git a/spec/source-readiness.md b/spec/source-readiness.md new file mode 100644 index 0000000..a28c9ac --- /dev/null +++ b/spec/source-readiness.md @@ -0,0 +1,195 @@ +--- +id: MRS-004 +title: Progressive tl-syntax source-readiness and integrator boundary +type: MasterRequirements +relationships: + - target: ix://agent-ix/tl-syntax/MRS-001 + type: depends_on + - target: ix://agent-ix/tl-syntax/issues/34 + type: references + - target: ix://agent-ix/quire-contract-ir/PGM-01 + type: depends_on +--- + +# Progressive tl-syntax source-readiness and integrator boundary + +## Purpose + +This specification defines progressive readiness facts for a human decision +about one exact tl-syntax Rust source candidate and configuration, plus a +deferred boundary for transferring those facts to a future shared integrator +package. It extends the v0.1 source-release boundary without retroactively +blocking useful pre-stable delivery. + +“Source” means the Rust repository candidate. Native Quire remains the sole +editable formal-clause language. TL text and formula documents are internal +interchange/evaluator inputs and never a second user-authored Quire source +profile. + +## Scope + +### In Scope + +- Exact candidate, source-population, crate, configuration, toolchain, profile, + corpus, shared-contract and producer identities. +- Distinct developer observation, source-release input, human decision and + integrator-adoption stages. +- Review, evidence/counterevidence, limitation, exception, retention, + supersession and human-authority rules. +- A future shared-contract package containing reusable source facts and still- + open adopter obligations. +- Reproducibility controls and a complete executable-path disposition. + +### Out of Scope + +- Native Quire language qualification or an editable TL/FRETish source path. +- Automatic release/publication decisions, crates.io publication, universal + trusted-tool status, certification, accreditation, authorization or + non-repudiation. +- Qualification of tl-parse, tl-rewrite, tl-mltl, R2U2/C2PO, another monitor, + a consuming system or an integrator's intended use. +- A repository-local source parser, compatibility matrix, generic runner, + evidence schema/store, aggregate score, approval workflow or substitute for + an unavailable shared capability. + +## System Overview + +### System Description + +tl-syntax supplies domain results and exact component-owned assumptions/ +limitations. Released Engineering Assurance, Quire and Quoin contracts supply +shared compatibility, source grounding, retention and orchestration. Independent +reviewers assess the exact head and evidence set. Only the declared human +release owner decides the source release. A later integrator supplies a distinct +intended use, deployment/configuration and validation decision. + +### Intended Users + +The human tl-syntax release owner, independent specification/code/gap reviewers, +TL ecosystem maintainers, native Quire bridge maintainers and future +consuming-system integrators. + +## Lifecycle Vocabulary + +| Stage | Meaning | Authority limit | +|---|---|---| +| Developer observation | One attributable local or hosted result for an exact revision/configuration | No retention, independence, release or adopter inference unless separately established | +| Source-release input | Candidate-bound fact selected for review and retained through shared contracts | Does not approve release | +| Human source-release decision | Attributed accepted/rejected/deferred/conditional/open/conflict disposition for the exact candidate | Does not publish or qualify downstream use | +| Integrator-adoption input | Reusable source facts plus adopter intended use/configuration and open validation fields | Does not inherit source-release acceptance as adopter acceptance | +| Use-specific qualification | Separately scoped producer/system decision under Engineering Assurance | Outside this component profile until its shared contract and owner decision exist | + +## Closed Result Vocabularies + +The following closed types are distinct even where a label is linguistically +similar. No implementation may store them in one untyped status field. + +| Type | Values | +|---|---| +| `ExecutionOutcome` | `succeeded`, `skipped`, `spawn-failed`, `completed-nonzero`, `signalled`, `timed-out`, `truncated`, `invalid-output` | +| `ReadinessState` | `pass`, `fail`, `unavailable`, `unsupported`, `inconclusive`, `not-computed`, `malformed`, `partial`, `stale`, `suspect`, `vacuous`, `tampered`, `incomplete`, `conflict`, `refused` | +| `ReviewRelation` | `current`, `open`, `invalid`, `conflict` | +| `DecisionEventAdmission` | `admitted`, `refused` | +| `DecisionDisposition` | `accepted`, `rejected`, `deferred`, `conditional`, `open`, `conflict` | +| `PackageResult` | `published`, `failed`, `unavailable`, `unsupported`, `incomplete`, `refused`, `conflict`; every non-published result carries its exact cause | +| `RetentionState` | `transient`, `retained-current`, `unavailable`, `expired`, `deleted`, `tampered`, `refused`, `unsupported` | +| `LicenseResolution` | `complete`, `incomplete`, `conflict`, `refused`; `complete` contains one normalized SPDX expression and its complete authoritative source set | +| `TypedDecode` | `decoded(T)`, `unsupported { raw }`, `refused { raw, cause }`; the non-decoded variants do not construct a value of `T` | + +Execution mapping is total and non-improving: `skipped` maps to `not-computed`; +`spawn-failed` to `unavailable`; `completed-nonzero`, `signalled` and +`timed-out` to `fail`; and `truncated`/`invalid-output` to `malformed`. +`succeeded` only admits fresh output for domain interpretation and does not +itself map to `pass`. Every serialized occurrence of every closed result type is +decoded through `TypedDecode`: an unknown enum value produces `unsupported` +and preserves the raw value, while a malformed known encoding produces +`refused` and preserves its raw bytes and cause. Review/event/package/decision/ +license states never implicitly map into another type, and a decode failure is +never injected into the domain enum it failed to construct. + +For package execution, `skipped` maps to `incomplete`, `spawn-failed` to +`unavailable`, `completed-nonzero`/`signalled`/`timed-out` to `failed`, and +`truncated`/`invalid-output` to `refused`; each result retains the exact +`ExecutionOutcome`. For retention, workspace-only bytes are `transient`, a +fresh successful exact retrieval is `retained-current`, denied/missing backend +or handle is `unavailable`, elapsed lifecycle is `expired`, confirmed governed +removal is `deleted`, content/binding mismatch is `tampered`, malformed known +input is `refused`, and an unknown enum value is `unsupported`. + +## Requirements Architecture + +[StR-004](./requirements/StR-004-progressive-source-readiness.md) states the +stakeholder need. [FR-014](./requirements/FR-014-bind-source-readiness-candidate.md) +binds the candidate/configuration; +[FR-015](./requirements/FR-015-preserve-readiness-stages.md) separates evidence +stages; [FR-016](./requirements/FR-016-emit-integrator-readiness-package.md) +defines the deferred package boundary; +[FR-017](./requirements/FR-017-require-human-source-release-decision.md) keeps +human authority exact; and +[FR-018](./requirements/FR-018-classify-qualification-execution-paths.md) +governs executable-path ownership. [NFR-004](./requirements/NFR-004-reproduce-source-readiness-observations.md) +constrains reproducibility, while +[NFR-005](./requirements/NFR-005-preserve-readiness-authority-and-retention.md) +constrains authority and retention truth. AP-002, AD-002 and MP-002 record assurance scope, +architecture and observation meaning. [TM-004](./source-readiness-test-matrix.md) +allocates planned evidence. + +## Dependency Map + +The internal hard-prerequisite graph is acyclic: + +```text +MRS-001 + PGM-01 + NFR-003 + FR-006 + -> FR-018 executable-path classification + -> FR-014 candidate/configuration binding + -> FR-015 stage and lifecycle preservation + -> FR-017 review and human-decision relation + -> FR-016 deferred integrator package +``` + +NFR-004 and NFR-005 are cross-cutting controls designed with FR-018 and gate +completion of every functional requirement they constrain. AP-002 selects the +review boundary; MP-002 operationalizes the NFR observations and does not +precede or redefine either NFR. Specification/review can finish while an +implementation node remains unavailable at an external resume condition. + +## Dependencies and Resume Conditions + +- Specification and composite review may proceed now. +- Actual v0.1 source-release evidence remains provisional until the exact M0 + candidate, required independent reviews, human Task-007 decision and signed + tag/checksum exist in the order governed by `quire-contract-ir#4`/PGM-01. +- Authoritative source-path/scope sealing remains blocked on `tl-syntax#16`: + resume only after an immutable, reviewed and human-accepted Engineering + Assurance release names the Quire 0.32 source-grounded export and exact + compatible artifacts. +- Use-specific qualified records remain blocked on + `engineering-assurance#11`; reusable bounded Rust producer execution remains + owned by `engineering-assurance#34` when required. +- Executable-language disposition remains owned by `quire-research#64`. +- Quire status-classification and Quoin binary-attachment/non-release-build + gaps remain conditional blockers for claims that depend on those capabilities. +- The packaged Engineering Assurance matrix is bound by its exact immutable + package/version and package-integrity mechanism, not by a self-digest. Every + externally consumed artifact still requires its own declared digest; until + this distinction is exercised, a complete shared-artifact claim is unavailable. +- Existing documentation disagrees about whether Quoin evidence survives only + in ignored `target/` state or in a repository evidence area. Durable-retention + claims remain unavailable until the selected released Quoin backend, handle, + retrieval and lifecycle rule are named and exercised; prose or a digest is + not a substitute. +- Historical plans and reviews remain records of their original campaigns, not + current M6 evidence or authority. PLAN-007 will carry the current dependency + and resume-state addendum without rewriting those archival claims. +- Hosted CI remains manual-only and is evidence only when a human dispatches and + identifies its exact run; this specification dispatches nothing. + +## References + +- [M6 parent](https://github.com/agent-ix/tl-syntax/issues/31) and + [specification ticket](https://github.com/agent-ix/tl-syntax/issues/34). +- [Cross-repository source-release campaign](https://github.com/agent-ix/quire-contract-ir/issues/4). +- [Source-grounding consumer gate](https://github.com/agent-ix/tl-syntax/issues/16). +- [Use-specific qualification](https://github.com/agent-ix/engineering-assurance/issues/11) + and [Rust producer execution](https://github.com/agent-ix/engineering-assurance/issues/34). +- [Executable-language boundary](https://github.com/agent-ix/quire-research/issues/64). diff --git a/spec/spec.md b/spec/spec.md index 3f0a87a..538617c 100644 --- a/spec/spec.md +++ b/spec/spec.md @@ -38,6 +38,11 @@ without redefining or weakening it. - Formula rewriting or normalization. - Finite-trace evaluation and horizon computation algorithms. - Production stream monitoring. +- A user-authored TL or FRETish source language; native Quire is the sole + editable formal-clause authority. +- Automatic release approval, tool certification, consuming-system + qualification, monitor qualification, crates.io publication, or a local + evidence/approval framework. ## System Overview @@ -69,8 +74,11 @@ inspection evidence. - [tl-syntax epic](https://github.com/agent-ix/tl-syntax/issues/5). - [Contract-derived verification program](https://github.com/agent-ix/quire-contract-ir/issues/1). -- [FRETish temporal frontend](https://github.com/agent-ix/quire-contract-ir/issues/57). +- [Native Quire typed-predicate bridge](https://github.com/agent-ix/quire-contract-ir/issues/63). +- [Export-only FRETish mapping](https://github.com/agent-ix/quire-contract-ir/issues/57). - [Typed signal and source-context child](https://github.com/agent-ix/tl-syntax/issues/15). +- [Progressive source-readiness child](https://github.com/agent-ix/tl-syntax/issues/34). +- [Progressive source-readiness specification](./source-readiness.md). - [PGM-01 governance gate](https://github.com/agent-ix/quire-contract-ir/issues/3), identified as `ix://agent-ix/quire-contract-ir/PGM-01`. - Cargo package manifest and repository contribution policy. diff --git a/tests/shared_assurance.rs b/tests/shared_assurance.rs index 243dbe9..9770dfb 100644 --- a/tests/shared_assurance.rs +++ b/tests/shared_assurance.rs @@ -390,7 +390,7 @@ fn git_files(root: &Path, arguments: &[&str]) -> CensusResult> .collect()) } -const EXPECTED_LIVE_TRACKED: [&str; 84] = [ +const EXPECTED_LIVE_TRACKED: [&str; 99] = [ ".agent/rules/writing_rust.md", ".github/CODEOWNERS", ".github/workflows/ci.yml", @@ -440,10 +440,15 @@ const EXPECTED_LIVE_TRACKED: [&str; 84] = [ "scripts/validate_corpus.py", "spec/assurance/AA-001.md", "spec/assurance/AD-001.md", + "spec/assurance/AD-002-source-readiness-boundary.md", "spec/assurance/AP-001.md", + "spec/assurance/AP-002-progressive-source-readiness.md", "spec/assurance/CAC-001.md", "spec/assurance/MP-001.md", + "spec/assurance/MP-002-source-readiness-obligation-state.md", "spec/evidence/suites.md", + "spec/integration/IT-001-shared-source-readiness-handoff.md", + "spec/integration/IT-002-integrator-package-handoff.md", "spec/requirements/FR-001-inclusive-intervals.md", "spec/requirements/FR-002-validated-formula.md", "spec/requirements/FR-003-identities-and-profiles.md", @@ -451,12 +456,22 @@ const EXPECTED_LIVE_TRACKED: [&str; 84] = [ "spec/requirements/FR-005-conformance-corpus.md", "spec/requirements/FR-006-shared-assurance-intake.md", "spec/requirements/FR-007-typed-signal-context.md", + "spec/requirements/FR-014-bind-source-readiness-candidate.md", + "spec/requirements/FR-015-preserve-readiness-stages.md", + "spec/requirements/FR-016-emit-integrator-readiness-package.md", + "spec/requirements/FR-017-require-human-source-release-decision.md", + "spec/requirements/FR-018-classify-qualification-execution-paths.md", "spec/requirements/NFR-001-no-std-feature-boundary.md", "spec/requirements/NFR-002-determinism-and-integrity.md", "spec/requirements/NFR-003-qualification-integrity.md", + "spec/requirements/NFR-004-reproduce-source-readiness-observations.md", + "spec/requirements/NFR-005-preserve-readiness-authority-and-retention.md", "spec/requirements/StR-001-embedded-consumers.md", "spec/requirements/StR-002-temporal-interoperability.md", "spec/requirements/StR-003-formal-temporal-frontends.md", + "spec/requirements/StR-004-progressive-source-readiness.md", + "spec/source-readiness-test-matrix.md", + "spec/source-readiness.md", "spec/spec.md", "spec/test-matrix.md", "src/bounded_string.rs", @@ -871,7 +886,9 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { ("examples", 1), ("fuzz", 4), ("scripts", 7), - ("spec", 21), + // Issue #34 adds fifteen live source-readiness specification and + // assurance artifacts; SpecReviews/plans remain archival exclusions. + ("spec", 36), ("src", 8), ("tests", 8), ] From c230f2b5a81dd8fedff86451ec9e078f547d0fc0 Mon Sep 17 00:00:00 2001 From: Agent IX Date: Thu, 10 Sep 2026 14:12:15 -0700 Subject: [PATCH 2/9] spec: review and plan source-readiness work --- .../index.md | 19 ++ .../log.md | 10 ++ .../plan.md | 170 ++++++++++++++++++ .../tasks/Task-001-m6-specification-review.md | 49 +++++ .../tasks/Task-002-prerequisite-admission.md | 52 ++++++ ...Task-003-executable-path-classification.md | 41 +++++ .../tasks/Task-004-candidate-binding.md | 47 +++++ .../Task-005-lifecycle-decision-admission.md | 51 ++++++ ...k-006-real-source-grounding-integration.md | 66 +++++++ .../tasks/Task-007-integrator-package.md | 53 ++++++ .../tasks/Task-008-final-assurance.md | 78 ++++++++ ...R-058-source-readiness-base-spec-review.md | 23 +++ ...ce-readiness-failure-domain-spec-review.md | 22 +++ ...-source-readiness-integrity-spec-review.md | 23 +++ ...source-readiness-dependency-spec-review.md | 23 +++ ...2-source-readiness-evidence-spec-review.md | 23 +++ ...e-readiness-risk-complexity-spec-review.md | 22 +++ ...ce-readiness-scope-boundary-spec-review.md | 22 +++ ...-readiness-ears-conformance-spec-review.md | 22 +++ tests/shared_assurance.rs | 1 + 20 files changed, 817 insertions(+) create mode 100644 plan/Plan-007-source-qualification-readiness/index.md create mode 100644 plan/Plan-007-source-qualification-readiness/log.md create mode 100644 plan/Plan-007-source-qualification-readiness/plan.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-001-m6-specification-review.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-002-prerequisite-admission.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-003-executable-path-classification.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-004-candidate-binding.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-005-lifecycle-decision-admission.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-006-real-source-grounding-integration.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-007-integrator-package.md create mode 100644 plan/Plan-007-source-qualification-readiness/tasks/Task-008-final-assurance.md create mode 100644 spec/reviews/SR-058-source-readiness-base-spec-review.md create mode 100644 spec/reviews/SR-059-source-readiness-failure-domain-spec-review.md create mode 100644 spec/reviews/SR-060-source-readiness-integrity-spec-review.md create mode 100644 spec/reviews/SR-061-source-readiness-dependency-spec-review.md create mode 100644 spec/reviews/SR-062-source-readiness-evidence-spec-review.md create mode 100644 spec/reviews/SR-063-source-readiness-risk-complexity-spec-review.md create mode 100644 spec/reviews/SR-064-source-readiness-scope-boundary-spec-review.md create mode 100644 spec/reviews/SR-065-source-readiness-ears-conformance-spec-review.md diff --git a/plan/Plan-007-source-qualification-readiness/index.md b/plan/Plan-007-source-qualification-readiness/index.md new file mode 100644 index 0000000..423e845 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/index.md @@ -0,0 +1,19 @@ +--- +type: index +title: "Plan-007 — Progressive source-qualification readiness" +description: "Contents of the Plan-007 source-qualification-readiness bundle." +okf_version: "0.1" +--- +# Plan-007 — Progressive source-qualification readiness + +## Contents + +* [Plan-007: Progressive source-qualification readiness](./plan.md) - Requirements, dependency graph, tests, tracks and gates. +* [Task-001: M6 specification and review](./tasks/Task-001-m6-specification-review.md) - Frozen reviewed source-readiness contract. +* [Task-002: Prerequisite admission](./tasks/Task-002-prerequisite-admission.md) - External identity ledger and no-workaround gate. +* [Task-003: Executable-path classification](./tasks/Task-003-executable-path-classification.md) - Complete census and Rust/shared parity. +* [Task-004: Candidate binding](./tasks/Task-004-candidate-binding.md) - Immutable subject and fresh producer output. +* [Task-005: Lifecycle and decision admission](./tasks/Task-005-lifecycle-decision-admission.md) - Retention, history, review and human authority. +* [Task-006: Real source-grounding integration](./tasks/Task-006-real-source-grounding-integration.md) - IT-001 shared-contract gate. +* [Task-007: Integrator package](./tasks/Task-007-integrator-package.md) - IT-002 publication and rights handoff. +* [Task-008: Final assurance](./tasks/Task-008-final-assurance.md) - Independent review, gap analysis and human gate. diff --git a/plan/Plan-007-source-qualification-readiness/log.md b/plan/Plan-007-source-qualification-readiness/log.md new file mode 100644 index 0000000..7bb9fbb --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/log.md @@ -0,0 +1,10 @@ +--- +type: log +title: "Plan-007 — Update Log" +description: "Chronological log of the progressive source-qualification-readiness plan." +--- +# Plan-007 — Update Log + +## History + +* **2026-09-10** — Created from reviewed M6 specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`; decomposed into eight tasks across specification, external-gate, critical-path, post-gate and final-assurance tracks. Task-001 is complete; all implementation tasks remain blocked on merge and their declared shared prerequisites. diff --git a/plan/Plan-007-source-qualification-readiness/plan.md b/plan/Plan-007-source-qualification-readiness/plan.md new file mode 100644 index 0000000..a1d97aa --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/plan.md @@ -0,0 +1,170 @@ +--- +id: Plan-007 +title: "tl-syntax — progressive source-qualification readiness" +type: Plan +status: active +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: references + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/IT-001 + type: references + - target: ix://agent-ix/tl-syntax/IT-002 + type: references +--- +# Implementation Plan: Progressive source-qualification readiness + +This TDD plan advances M6 only through released shared contracts and attributed +human decisions. It does not qualify native Quire, a monitor, or an integrating +system, and it does not turn tl-syntax into a user-authored language. + +## Requirements Summary + +### Stakeholder Requirements + +- [ ] **StR-004**: Supply attributable, progressively reviewable source-readiness facts without claiming downstream qualification. + +### Functional Requirements + +- [ ] **FR-014**: Bind every fact to one immutable candidate/configuration and fresh producer execution. +- [ ] **FR-015**: Preserve lifecycle stages, authority, retention and supersession without promotion. +- [ ] **FR-016**: Emit a lossless integrator package only through the accepted shared contract. +- [ ] **FR-017**: Admit an exact, policy-authorized human source-release disposition. +- [ ] **FR-018**: Classify every executable readiness path and remove stable reliance on legacy paths. + +### Non-Functional and Integration Requirements + +- [ ] **NFR-004**: Reproduce deterministic observations and preserve every volatile field. +- [ ] **NFR-005**: Preserve authority, limitation and retention truth. +- [ ] **IT-001**: Exercise the real source-grounding handoff. +- [ ] **IT-002**: Exercise the real integrator-package round trip. + +## Dependency Graph + +- `M6 specification + review -> every implementation task` + Reason: the specification snapshot and SR-058 through SR-065 establish the + boundary and test vocabulary before code is authorized. +- `external prerequisite admission -> FR-014, FR-015, FR-016, FR-017, FR-018` + Reason: source export/matrix, retention, decision policy, package format and + LR08 ownership are shared enablement and cannot be reconstructed locally. +- `FR-018 -> FR-014` + Reason: the complete executable-path census and Rust/shared disposition must + be known before a stable source subject can be declared complete. +- `FR-014 -> FR-015 -> FR-017` + Reason: lifecycle facts need an exact candidate, and a decision needs exact + staged facts, reviews and limitations. +- `FR-014 + FR-015 + FR-017 -> IT-001` + Reason: the real shared handoff consumes candidate, lifecycle and authority + records together. +- `FR-014 + FR-015 + FR-017 + IT-001 -> FR-016 -> IT-002` + Reason: package publication follows verified source facts and human decision; + its real reader is the only admitted integration oracle. +- `NFR-004 + NFR-005 -> every implementation and integration task` + Reason: reproducibility, non-promotion, retention and authority are + cross-cutting correctness properties. + +The principal seams are the existing Rust shared-assurance intake in +`tests/shared_assurance.rs`, future Rust source-readiness modules, the released +Quire/Engineering Assurance export, Quoin retention handles, and the future +Engineering Assurance integrator package. Markdown parsing and local contract +copies are outside every seam. + +## Test Plan + +### Candidate and Execution Properties + +- [ ] **TC-059**: Reproduce exact candidate/configuration identity. +- [ ] **TC-060**: Reject one-axis candidate, source, configuration and contract mutations. +- [ ] **TC-064**: Census and classify every executable entry point exactly once. +- [ ] **TC-065**: Require positive and forced-failure parity before legacy removal. +- [ ] **TC-068**: Exercise every producer/package execution outcome with stale output present. +- [ ] **TC-069**: Reject source-root, path, mount and symlink boundary failures. + +### Lifecycle and Authority Properties + +- [ ] **TC-062**: Preserve four stages and all six decision dispositions. +- [ ] **TC-063**: Prove omissions and non-success states cannot improve readiness. +- [ ] **TC-066**: Prove absent shared capability stays unavailable with no local substitute. +- [ ] **TC-067**: Exercise every retention state and retrieval failure. +- [ ] **TC-070**: Exercise bounded supersession and decision transition topology. +- [ ] **TC-073**: Mutate every review/decision policy and identity binding. + +### Real Shared Integrations + +- [ ] **TC-061**: Round-trip source facts and distinct adopter subjects through the real package. +- [ ] **TC-071**: Exercise idempotent retries and racing package writers. +- [ ] **TC-072**: Complete independent, candidate-bound license/reuse-right analysis. + +## Remaining Work + +### Track S: Specification gate + +- **S1 = Task-001** M6 specification and composite review — Done; exit: the exact snapshot is strict-valid with no review-owned finding. + +### Track G: External admission gate + +- **G1 = Task-002** prerequisite ledger and no-workaround gate — Blocked; exit: each consumed release, policy, authority and backend has an immutable compatible identity. + +### Track A: Critical path (serial) + +- **A1 = Task-003** executable-path inventory and Rust/shared parity — Hard; exit: every entry point has one reviewed class and every stable-required legacy behavior has parity. +- **A2 = Task-004** candidate binding and producer freshness — Hard; exit: identity races, stale output and path escapes fail closed. +- **A3 = Task-005** lifecycle, retention and human decision admission — Hard; exit: state/history/authority transitions are total and non-promoting. +- **Gate = Task-006** real source-grounding integration — Hard; measures lossless shared handoff; pass: every IT-001 subcase and load-bearing negative mutation succeeds at the exact candidate. + +### Track C: Post-gate package work + +- **C1 = Task-007** integrator package and rights handoff — Hard; exit: the real reader preserves every fact and concurrent/invalid publication exposes nothing favorable. + +### Track J: Final assurance + +- **J1 = Task-008** independent code/gap review and human release gate — Medium; exit: all planned rows are genuinely backed and an authorized human disposition is recorded or remains explicitly open. + +## Parallel Execution Summary + +```text +Track S: Task-001 (done) +Track G: Task-002 [external prerequisites] +Track A: Task-003 -> Task-004 -> Task-005 -> Task-006 +Track C: Task-007 +Track J: Task-008 +``` + +## Task File Mapping + +| Task | Track | Owns (references) | Verified by (verifies) | Status | +| --- | --- | --- | --- | --- | +| Task-001 | S | StR-004, FR-014..FR-018, NFR-004..NFR-005 | TC-066 | done | +| Task-002 | G | FR-014..FR-018, NFR-005 | TC-066, TC-067, TC-073 | blocked | +| Task-003 | A | FR-018 | TC-064..TC-066 | blocked | +| Task-004 | A | FR-014, NFR-004 | TC-059, TC-060, TC-068, TC-069 | blocked | +| Task-005 | A | FR-015, FR-017, NFR-005 | TC-062, TC-063, TC-067, TC-070, TC-073 | blocked | +| Task-006 | A | IT-001, FR-014, FR-015, FR-017, FR-018 | TC-059, TC-060, TC-062, TC-063, TC-066..TC-070, TC-073 | blocked | +| Task-007 | C | FR-016, IT-002 | TC-061, TC-063, TC-066, TC-068, TC-070..TC-072 | blocked | +| Task-008 | J | StR-004, NFR-004, NFR-005 | TC-059..TC-073 | blocked | + +## Coordination Rules + +- Freeze MRS-004, TM-004 and the closed vocabularies after merge; a semantic + change requires a new specification review before downstream code. +- Task-002 is an admission gate, not permission to vendor, mirror, branch-pin or + locally emulate missing shared capabilities. +- Keep one writer for shared census, state and fixture files; downstream tasks + rebase after each predecessor merges. +- Do not dispatch hosted CI without explicit authorization. Local evidence must + state its exact environment and may not imply hosted execution. +- No task may present tl-syntax as an editable Quire alternative or infer a + release/qualification decision from passing automation. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-001-m6-specification-review.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-001-m6-specification-review.md new file mode 100644 index 0000000..dbaacdf --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-001-m6-specification-review.md @@ -0,0 +1,49 @@ +--- +id: Task-001 +title: "M6 source-readiness specification and composite review" +type: Task +status: done +track: S +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/StR-004 + type: references + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies +--- +# Task-001: M6 source-readiness specification and composite review + +## Scope + +Define the source-readiness boundary, closed result domains, acceptance matrix, +assurance records and real-integration scenarios before implementation. + +## Subtasks + +- [x] Author MRS-004, TM-004 and their requirement/assurance/integration artifacts. +- [x] Run base, failure-domain, integrity, dependency, evidence, risk, scope and EARS reviews. +- [x] Correct every review-owned finding and validate the exact snapshot strictly. + +## Deliverables + +- Specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40` +- SR-058 through SR-065 + +## Notes + +- TC-066 is the boundary criterion this task defines and reviews; its executable evidence remains downstream. +- Completion of this authoring task does not mark any TM-004 implementation row covered. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-002-prerequisite-admission.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-002-prerequisite-admission.md new file mode 100644 index 0000000..c749a0c --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-002-prerequisite-admission.md @@ -0,0 +1,52 @@ +--- +id: Task-002 +title: "Admit external prerequisites without local substitutes" +type: Task +status: blocked +track: G +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/Task-001 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-002: Admit external prerequisites without local substitutes + +## Scope + +Maintain the immutable compatibility/authority ledger and admit each external +capability only when its released identity satisfies MRS-004. + +## Subtasks + +- [ ] Admit a released matrix selecting the source-grounded Quire export. +- [ ] Select the Quoin retention contract, backend/operator and lifecycle. +- [ ] Select the immutable reviewer/decision policy and authoritative event source. +- [ ] Admit the Engineering Assurance Rust runner and integrator-package contracts. +- [ ] Record LR08 executable-language dispositions and refuse local workarounds. + +## Deliverables + +- Candidate-bound prerequisite ledger with release identities, digests and resume decisions + +## Notes + +- Blocked on tl-syntax#16, engineering-assurance#11/#34, the retention/operator selection, policy/event source, integrator-package release and quire-research#64. +- Individual downstream work may resume only when every prerequisite it consumes is admitted; a partial ledger is not a global pass. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-003-executable-path-classification.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-003-executable-path-classification.md new file mode 100644 index 0000000..8a591ce --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-003-executable-path-classification.md @@ -0,0 +1,41 @@ +--- +id: Task-003 +title: "Classify executable paths and prove Rust/shared parity" +type: Task +status: blocked +track: A +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/Task-002 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/TC-064 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-065 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies +--- +# Task-003: Classify executable paths and prove Rust/shared parity + +## Scope + +Build the complete executable-entry-point inventory and migrate stable-required +first-party behavior to Rust or a released shared capability. + +## Subtasks + +- [ ] Write failing exact-census/classifier tests before the classifier. +- [ ] Inventory scripts, build steps, nested interpreters and generated commands. +- [ ] Record owner, authority, pre-stable disposition, parity evidence and resume condition. +- [ ] Demonstrate positive and forced-failure parity before removing each legacy path. + +## Deliverables + +- Rust executable census/classifier and reviewed disposition inventory +- TC-064 through TC-066 evidence + +## Notes + +- Blocked until the current specification is independently reviewed/merged and the consumed LR08/shared-runner entries are admitted by Task-002. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-004-candidate-binding.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-004-candidate-binding.md new file mode 100644 index 0000000..4595dc2 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-004-candidate-binding.md @@ -0,0 +1,47 @@ +--- +id: Task-004 +title: "Bind immutable candidates and fresh producer results" +type: Task +status: blocked +track: A +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/Task-002 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-003 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/TC-059 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-060 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-069 + type: verifies +--- +# Task-004: Bind immutable candidates and fresh producer results + +## Scope + +Implement candidate/configuration identity, source traversal and producer- +freshness projection through released source-grounding contracts. + +## Subtasks + +- [ ] Write property tests for every identity axis and source-walk boundary. +- [ ] Implement immutable-root binding and bounded symlink traversal in Rust. +- [ ] Implement total execution/decode mappings and stale-output quarantine. +- [ ] Prove deterministic equality and one-axis isolation. + +## Deliverables + +- Rust candidate/source binding and producer adapter +- TC-059, TC-060, TC-068 and TC-069 evidence + +## Notes + +- No Markdown parser, branch-head contract or repository-local compatibility map is admissible. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-005-lifecycle-decision-admission.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-005-lifecycle-decision-admission.md new file mode 100644 index 0000000..3bca891 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-005-lifecycle-decision-admission.md @@ -0,0 +1,51 @@ +--- +id: Task-005 +title: "Preserve lifecycle, retention and human decision authority" +type: Task +status: blocked +track: A +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/Task-002 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-004 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-062 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-005: Preserve lifecycle, retention and human decision authority + +## Scope + +Implement stage/history projection, retention verification, bounded +supersession and policy-backed decision admission without automated promotion. + +## Subtasks + +- [ ] Write state-machine properties for stage, retention and decision domains. +- [ ] Implement bounded same-subject supersession/conflict traversal. +- [ ] Verify real retention handles and map every retrieval failure. +- [ ] Admit complete decision-event sets against policy, quorum and independence facts. + +## Deliverables + +- Rust lifecycle/retention/decision adapters +- TC-062, TC-063, TC-067, TC-070 and TC-073 evidence + +## Notes + +- Blocked until Task-002 selects the retention backend/operator and authoritative policy/event source. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-006-real-source-grounding-integration.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-006-real-source-grounding-integration.md new file mode 100644 index 0000000..682d872 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-006-real-source-grounding-integration.md @@ -0,0 +1,66 @@ +--- +id: Task-006 +title: "Exercise the real shared source-grounding handoff" +type: Task +status: blocked +track: A +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/Task-002 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-004 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-005 + type: depends_on + - target: ix://agent-ix/tl-syntax/IT-001 + type: references + - target: ix://agent-ix/tl-syntax/FR-014 + type: references + - target: ix://agent-ix/tl-syntax/FR-015 + type: references + - target: ix://agent-ix/tl-syntax/FR-017 + type: references + - target: ix://agent-ix/tl-syntax/FR-018 + type: references + - target: ix://agent-ix/tl-syntax/TC-059 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-060 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-062 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-069 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-006: Exercise the real shared source-grounding handoff + +## Scope + +Run IT-001 through the exact released Engineering Assurance, Quire and Quoin +contracts with no mock reader or local substitute. + +## Subtasks + +- [ ] Write blocked integration fixtures against the released schemas/readers. +- [ ] Exercise valid, missing, stale, malformed, unavailable and conflict paths. +- [ ] Falsify each P0 claim with a load-bearing mutation. +- [ ] Record exact tool, source, configuration and environment identities. + +## Deliverables + +- Real Rust/shared-contract IT-001 harness and evidence + +## Notes + +- Blocked on the tl-syntax#16 accepted release set and completion of Tasks 004–005. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-007-integrator-package.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-007-integrator-package.md new file mode 100644 index 0000000..d14c302 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-007-integrator-package.md @@ -0,0 +1,53 @@ +--- +id: Task-007 +title: "Publish and verify the shared integrator package" +type: Task +status: blocked +track: C +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/Task-002 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-006 + type: depends_on + - target: ix://agent-ix/tl-syntax/FR-016 + type: references + - target: ix://agent-ix/tl-syntax/IT-002 + type: references + - target: ix://agent-ix/tl-syntax/TC-061 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-071 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-072 + type: verifies +--- +# Task-007: Publish and verify the shared integrator package + +## Scope + +Implement atomic/idempotent package publication and prove lossless separation +of source-release facts from adopter-owned validation and acceptance. + +## Subtasks + +- [ ] Write real writer/strict-reader round-trip and mutation tests. +- [ ] Implement candidate-bound temporary output and atomic visibility. +- [ ] Exercise retry identity and non-identical writer races. +- [ ] Complete the independent exact-population license/reuse-right review. + +## Deliverables + +- Rust adapter to the released integrator-package contract +- IT-002 and TC-061/063/066/068/070/071/072 evidence + +## Notes + +- Blocked until Engineering Assurance releases and accepts the real package contract; no local schema or mock can close this task. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-008-final-assurance.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-008-final-assurance.md new file mode 100644 index 0000000..1b8b708 --- /dev/null +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-008-final-assurance.md @@ -0,0 +1,78 @@ +--- +id: Task-008 +title: "Close implementation evidence and human source-release gate" +type: Task +status: blocked +track: J +priority: P0 +relationships: + - target: ix://agent-ix/tl-syntax/Task-003 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-004 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-005 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-006 + type: depends_on + - target: ix://agent-ix/tl-syntax/Task-007 + type: depends_on + - target: ix://agent-ix/tl-syntax/StR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-004 + type: references + - target: ix://agent-ix/tl-syntax/NFR-005 + type: references + - target: ix://agent-ix/tl-syntax/TC-059 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-060 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-061 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-062 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-063 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-064 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-065 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-066 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-067 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-068 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-069 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-070 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-071 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-072 + type: verifies + - target: ix://agent-ix/tl-syntax/TC-073 + type: verifies +--- +# Task-008: Close implementation evidence and human source-release gate + +## Scope + +Run the final exact-head assurance suite, independent code review and gap +analysis, then preserve the authorized human source-release disposition. + +## Subtasks + +- [ ] Prove every TM-004 row is backed by real exact-head evidence. +- [ ] Run independent code review and full semantic gap analysis. +- [ ] Resolve or explicitly accept every finding/limitation through the bound policy. +- [ ] Record accepted/rejected/deferred/conditional/open/conflict without inferring publication or downstream qualification. + +## Deliverables + +- Exact-head code-review and gap-analysis artifacts +- Complete matrix evidence and attributed human decision state + +## Notes + +- Passing automation cannot complete the human gate. +- Hosted CI remains undispatched unless separately authorized. diff --git a/spec/reviews/SR-058-source-readiness-base-spec-review.md b/spec/reviews/SR-058-source-readiness-base-spec-review.md new file mode 100644 index 0000000..d0bfa04 --- /dev/null +++ b/spec/reviews/SR-058-source-readiness-base-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-058 +title: "Base review of progressive tl-syntax source readiness" +type: SpecReview +analysis: base +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The complete M6 source-readiness profile was reviewed at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Quire validated 120/120 documents +with zero grammar findings. The profile treats tl-syntax only as internal Rust +syntax/evaluator infrastructure: native Quire remains the sole editable formal- +clause language, and every downstream package or qualification decision remains +outside this crate's authority. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-5801 | low | No new base defect remains; M6's implementation and evidence rows are explicitly planned or blocked and must not be represented as current coverage. | MRS-004, TM-004 | diff --git a/spec/reviews/SR-059-source-readiness-failure-domain-spec-review.md b/spec/reviews/SR-059-source-readiness-failure-domain-spec-review.md new file mode 100644 index 0000000..38a9682 --- /dev/null +++ b/spec/reviews/SR-059-source-readiness-failure-domain-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-059 +title: "Failure-domain review of progressive tl-syntax source readiness" +type: SpecReview +analysis: failure-domain +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +Candidate substitution, stale producer output, symlink escape, typed decode, +retention failure, event conflict, supersession topology, partial publication, +retry and license-authority failures were reviewed at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. The specified state domains are +closed and non-promoting, with explicit traversal/resource bounds. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-5901 | medium | Real failure-path evidence cannot exist until the released source-grounding, retention, reviewer-policy and integrator-package dependencies are selected; the correct current result is unavailable or blocked, not a local substitute. | tl-syntax#16, FR-014-AC-4, FR-015-AC-5, FR-016-AC-4, FR-017-AC-6 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-060-source-readiness-integrity-spec-review.md b/spec/reviews/SR-060-source-readiness-integrity-spec-review.md new file mode 100644 index 0000000..571d282 --- /dev/null +++ b/spec/reviews/SR-060-source-readiness-integrity-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-060 +title: "Integrity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: integrity +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The requirements, closed vocabularies, acceptance criteria, integration +scenarios and matrix were cross-checked at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. All review-owned cardinality, +atomicity, transition, decode and failure-mapping findings were corrected before +this artifact was authored. The planned rows remain truthfully unbacked. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6001 | medium | Quire reports the M6 rows as unbacked exactly as authored; no completion status may advance until real symbols and evidence bind TC-059 through TC-073 and the blocked integrations. | TM-004, IT-001, IT-002 | correct-requirement-no-evidence | +| FND-6002 | low | The installed shared module expects a `Status` column while both matrices author `Coverage Status`, so its status classifier is skipped; this does not hide a current M6 status lie, but the upstream declaration must be reconciled before that classifier is relied upon. | TM-001, TM-004, quoin#363, quoin#364 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-061-source-readiness-dependency-spec-review.md b/spec/reviews/SR-061-source-readiness-dependency-spec-review.md new file mode 100644 index 0000000..2da6094 --- /dev/null +++ b/spec/reviews/SR-061-source-readiness-dependency-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-061 +title: "Dependency review of progressive tl-syntax source readiness" +type: SpecReview +analysis: dependency +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AD-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The M6 dependency graph was checked for ownership and cycles at specification +commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Local work orders executable- +path classification before source binding, stage preservation and human +decision admission; package publication follows all of them. External +enablement remains separate from feature implementation. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6101 | medium | IT-001 remains blocked until tl-syntax#16 has a compatible released Engineering Assurance matrix accepting the source-grounded Quire release; branch pins and repository-local mappings are inadmissible. | tl-syntax#16, FR-014, IT-001 | correct-requirement-no-evidence | +| FND-6102 | medium | Decision admission, durable retention and integrator packaging remain blocked on an immutable reviewer/decision policy, a selected retention backend/operator, and accepted shared contracts from Engineering Assurance and Quoin. | FR-015, FR-016, FR-017, engineering-assurance#11, engineering-assurance#34 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-062-source-readiness-evidence-spec-review.md b/spec/reviews/SR-062-source-readiness-evidence-spec-review.md new file mode 100644 index 0000000..79ace3d --- /dev/null +++ b/spec/reviews/SR-062-source-readiness-evidence-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-062 +title: "Evidence-method review of progressive tl-syntax source readiness" +type: SpecReview +analysis: evidence +scope: "TM-004, FR-014..FR-018, NFR-004..NFR-005, IT-001..IT-002, spec/evidence/suites.md" +review_set: all +--- + +## Summary + +Quoin's catalog advisor evaluated 100 obligations at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. It reported no M6 mismatch, +uncatalogued obligation or inconclusive recommendation. TM-004 allocates every +new criterion to TC-059 through TC-073 and SUITE-009 through SUITE-013 without +claiming that the planned producers exist. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6201 | low | Four legacy metric methods remain advisory mismatches: NFR-001-M-1, NFR-001-M-2, NFR-002-M-2 and NFR-003-M-7. They require an owner decision and are not silently rewritten by M6. | NFR-001-M-1, NFR-001-M-2, NFR-002-M-2, NFR-003-M-7 | correct-requirement-no-evidence | +| FND-6202 | medium | SUITE-009 through SUITE-013 are planned identities; IT-001, IT-002, durable-retention and policy/event evidence cannot run until their declared external prerequisites are available. | spec/evidence/suites.md, IT-001, IT-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-063-source-readiness-risk-complexity-spec-review.md b/spec/reviews/SR-063-source-readiness-risk-complexity-spec-review.md new file mode 100644 index 0000000..1857f0d --- /dev/null +++ b/spec/reviews/SR-063-source-readiness-risk-complexity-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-063 +title: "Risk-complexity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: risk-complexity +scope: "MRS-004, TM-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The M6 profile was assessed at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Its highest-risk seams are mutable +source identity, external-process freshness, review/event concurrency, durable +retention, and atomic package publication. The specification bounds these seams +and requires load-bearing negative mutations before evidence admission. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-6301 | medium | Implementation must not begin at a blocked shared seam or collapse the typed failure domains; each P0 suite needs a demonstrated negative mutation before its positive output is admissible. | AP-002, TC-060, TC-063, TC-068..TC-073 | diff --git a/spec/reviews/SR-064-source-readiness-scope-boundary-spec-review.md b/spec/reviews/SR-064-source-readiness-scope-boundary-spec-review.md new file mode 100644 index 0000000..27c47e6 --- /dev/null +++ b/spec/reviews/SR-064-source-readiness-scope-boundary-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-064 +title: "Scope-boundary review of progressive tl-syntax source readiness" +type: SpecReview +analysis: scope-boundary +scope: "MRS-004, StR-003, StR-004, FR-014..FR-018, NFR-004..NFR-005, AD-002" +review_set: all +--- + +## Summary + +The owner ruling and per-lane notice were applied at specification commit +`767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. Native Quire is the sole editable +formal-clause source profile. tl-syntax owns parser-independent Rust syntax +values and local source-readiness projection only; shared compatibility, +retention, qualification and human authority remain with their declared owners. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6401 | medium | LR08 inventory and shared Rust producer execution remain cross-repository responsibilities; tl-syntax may enumerate and classify its paths but may not invent a local runner, source language, evidence store or qualification framework. | quire-research#64, engineering-assurance#34, FR-018, AD-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-065-source-readiness-ears-conformance-spec-review.md b/spec/reviews/SR-065-source-readiness-ears-conformance-spec-review.md new file mode 100644 index 0000000..c2c7988 --- /dev/null +++ b/spec/reviews/SR-065-source-readiness-ears-conformance-spec-review.md @@ -0,0 +1,22 @@ +--- +id: SR-065 +title: "EARS-conformance review of progressive tl-syntax source readiness" +type: SpecReview +analysis: ears-conformance +scope: "StR-003, StR-004, FR-014..FR-018, NFR-003..NFR-005" +review_set: all +--- + +## Summary + +Quire strict validation and a semantic EARS/atomicity pass were run against +specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`. +Event, state, unwanted-condition and optional-feature triggers match their +intended semantics; accountable subjects, observable responses and separately +scoped obligations remain explicit. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-6501 | low | No remaining M6 EARS or atomicity defect was found; the requirement-bearing corpus is grammar-clean under the pinned Quire engine. | StR-003, StR-004, FR-014..FR-018, NFR-003..NFR-005 | diff --git a/tests/shared_assurance.rs b/tests/shared_assurance.rs index 9770dfb..0a4124f 100644 --- a/tests/shared_assurance.rs +++ b/tests/shared_assurance.rs @@ -505,6 +505,7 @@ fn is_archival_record(relative: &str) -> bool { || relative == "spec/.gitkeep" || relative.starts_with("spec/reviews/") || relative.starts_with("spec/plans/") + || relative.starts_with("plan/") } fn source_sets(root: &Path) -> CensusResult<(BTreeSet, BTreeSet)> { From 7698295590c7f8e5408365b0cada4ee1b9451cd3 Mon Sep 17 00:00:00 2001 From: Agent IX Date: Sat, 12 Sep 2026 23:37:51 -0700 Subject: [PATCH 3/9] Make PLAN-007 independently executable --- .../index.md | 16 +++---- .../log.md | 8 +++- .../plan.md | 44 +++++++++---------- ...md => Task-009-m6-specification-review.md} | 9 +++- ....md => Task-010-prerequisite-admission.md} | 16 +++++-- ...ask-011-executable-path-classification.md} | 14 ++++-- ...nding.md => Task-012-candidate-binding.md} | 13 ++++-- ... Task-013-lifecycle-decision-admission.md} | 16 ++++--- ...-014-real-source-grounding-integration.md} | 18 +++++--- ...kage.md => Task-015-integrator-package.md} | 13 ++++-- ...surance.md => Task-016-final-assurance.md} | 19 +++++--- .../AD-002-source-readiness-boundary.md | 7 +-- ...-classify-qualification-execution-paths.md | 5 ++- spec/source-readiness-test-matrix.md | 2 +- spec/source-readiness.md | 5 ++- 15 files changed, 130 insertions(+), 75 deletions(-) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-001-m6-specification-review.md => Task-009-m6-specification-review.md} (84%) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-002-prerequisite-admission.md => Task-010-prerequisite-admission.md} (69%) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-003-executable-path-classification.md => Task-011-executable-path-classification.md} (68%) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-004-candidate-binding.md => Task-012-candidate-binding.md} (72%) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-005-lifecycle-decision-admission.md => Task-013-lifecycle-decision-admission.md} (70%) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-006-real-source-grounding-integration.md => Task-014-real-source-grounding-integration.md} (74%) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-007-integrator-package.md => Task-015-integrator-package.md} (74%) rename plan/Plan-007-source-qualification-readiness/tasks/{Task-008-final-assurance.md => Task-016-final-assurance.md} (75%) diff --git a/plan/Plan-007-source-qualification-readiness/index.md b/plan/Plan-007-source-qualification-readiness/index.md index 423e845..caa016c 100644 --- a/plan/Plan-007-source-qualification-readiness/index.md +++ b/plan/Plan-007-source-qualification-readiness/index.md @@ -9,11 +9,11 @@ okf_version: "0.1" ## Contents * [Plan-007: Progressive source-qualification readiness](./plan.md) - Requirements, dependency graph, tests, tracks and gates. -* [Task-001: M6 specification and review](./tasks/Task-001-m6-specification-review.md) - Frozen reviewed source-readiness contract. -* [Task-002: Prerequisite admission](./tasks/Task-002-prerequisite-admission.md) - External identity ledger and no-workaround gate. -* [Task-003: Executable-path classification](./tasks/Task-003-executable-path-classification.md) - Complete census and Rust/shared parity. -* [Task-004: Candidate binding](./tasks/Task-004-candidate-binding.md) - Immutable subject and fresh producer output. -* [Task-005: Lifecycle and decision admission](./tasks/Task-005-lifecycle-decision-admission.md) - Retention, history, review and human authority. -* [Task-006: Real source-grounding integration](./tasks/Task-006-real-source-grounding-integration.md) - IT-001 shared-contract gate. -* [Task-007: Integrator package](./tasks/Task-007-integrator-package.md) - IT-002 publication and rights handoff. -* [Task-008: Final assurance](./tasks/Task-008-final-assurance.md) - Independent review, gap analysis and human gate. +* [Task-009: M6 specification and review](./tasks/Task-009-m6-specification-review.md) - Frozen reviewed source-readiness contract; tracked by tl-syntax#34. +* [Task-010: Prerequisite admission](./tasks/Task-010-prerequisite-admission.md) - External identity ledger and no-workaround gate; tracked by tl-syntax#45. +* [Task-011: Executable-path classification](./tasks/Task-011-executable-path-classification.md) - Complete census and Rust/shared parity; tracked by tl-syntax#46. +* [Task-012: Candidate binding](./tasks/Task-012-candidate-binding.md) - Immutable subject and fresh producer output; tracked by tl-syntax#47. +* [Task-013: Lifecycle and decision admission](./tasks/Task-013-lifecycle-decision-admission.md) - Retention, history, review and human authority; tracked by tl-syntax#48. +* [Task-014: Real source-grounding integration](./tasks/Task-014-real-source-grounding-integration.md) - IT-001 shared-contract gate; tracked by tl-syntax#49. +* [Task-015: Integrator package](./tasks/Task-015-integrator-package.md) - IT-002 publication and rights handoff; tracked by tl-syntax#50. +* [Task-016: Final assurance](./tasks/Task-016-final-assurance.md) - Independent review, gap analysis and human gate; tracked by tl-syntax#51. diff --git a/plan/Plan-007-source-qualification-readiness/log.md b/plan/Plan-007-source-qualification-readiness/log.md index 7bb9fbb..b1d5aec 100644 --- a/plan/Plan-007-source-qualification-readiness/log.md +++ b/plan/Plan-007-source-qualification-readiness/log.md @@ -7,4 +7,10 @@ description: "Chronological log of the progressive source-qualification-readines ## History -* **2026-09-10** — Created from reviewed M6 specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`; decomposed into eight tasks across specification, external-gate, critical-path, post-gate and final-assurance tracks. Task-001 is complete; all implementation tasks remain blocked on merge and their declared shared prerequisites. +* **2026-09-10** — Created from reviewed M6 specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40`; decomposed into eight tasks across specification, external-gate, critical-path, post-gate and final-assurance tracks. The then-named Task-001 is complete; all implementation tasks remain blocked on merge and their declared shared prerequisites. +* **2026-09-13** — Independent review renumbered the bundle to repository-unique + Task-009 through Task-016, mapped the completed specification task to #34, + created implementation tickets #45 through #51, and recorded exact owners, + consumers, evidence methods and resume conditions. Engineering Assurance #34 + is merged but remains unavailable here until an immutable compatible release + carries that contract. diff --git a/plan/Plan-007-source-qualification-readiness/plan.md b/plan/Plan-007-source-qualification-readiness/plan.md index a1d97aa..3eecd29 100644 --- a/plan/Plan-007-source-qualification-readiness/plan.md +++ b/plan/Plan-007-source-qualification-readiness/plan.md @@ -112,55 +112,55 @@ copies are outside every seam. ### Track S: Specification gate -- **S1 = Task-001** M6 specification and composite review — Done; exit: the exact snapshot is strict-valid with no review-owned finding. +- **S1 = Task-009** M6 specification and composite review — Done; exit: the exact snapshot is strict-valid with no review-owned finding. ### Track G: External admission gate -- **G1 = Task-002** prerequisite ledger and no-workaround gate — Blocked; exit: each consumed release, policy, authority and backend has an immutable compatible identity. +- **G1 = Task-010** prerequisite ledger and no-workaround gate — Blocked; exit: each consumed release, policy, authority and backend has an immutable compatible identity. ### Track A: Critical path (serial) -- **A1 = Task-003** executable-path inventory and Rust/shared parity — Hard; exit: every entry point has one reviewed class and every stable-required legacy behavior has parity. -- **A2 = Task-004** candidate binding and producer freshness — Hard; exit: identity races, stale output and path escapes fail closed. -- **A3 = Task-005** lifecycle, retention and human decision admission — Hard; exit: state/history/authority transitions are total and non-promoting. -- **Gate = Task-006** real source-grounding integration — Hard; measures lossless shared handoff; pass: every IT-001 subcase and load-bearing negative mutation succeeds at the exact candidate. +- **A1 = Task-011** executable-path inventory and Rust/shared parity — Hard; exit: every entry point has one reviewed class and every stable-required legacy behavior has parity. +- **A2 = Task-012** candidate binding and producer freshness — Hard; exit: identity races, stale output and path escapes fail closed. +- **A3 = Task-013** lifecycle, retention and human decision admission — Hard; exit: state/history/authority transitions are total and non-promoting. +- **Gate = Task-014** real source-grounding integration — Hard; measures lossless shared handoff; pass: every IT-001 subcase and load-bearing negative mutation succeeds at the exact candidate. ### Track C: Post-gate package work -- **C1 = Task-007** integrator package and rights handoff — Hard; exit: the real reader preserves every fact and concurrent/invalid publication exposes nothing favorable. +- **C1 = Task-015** integrator package and rights handoff — Hard; exit: the real reader preserves every fact and concurrent/invalid publication exposes nothing favorable. ### Track J: Final assurance -- **J1 = Task-008** independent code/gap review and human release gate — Medium; exit: all planned rows are genuinely backed and an authorized human disposition is recorded or remains explicitly open. +- **J1 = Task-016** independent code/gap review and human release gate — Medium; exit: all planned rows are genuinely backed and an authorized human disposition is recorded or remains explicitly open. ## Parallel Execution Summary ```text -Track S: Task-001 (done) -Track G: Task-002 [external prerequisites] -Track A: Task-003 -> Task-004 -> Task-005 -> Task-006 -Track C: Task-007 -Track J: Task-008 +Track S: Task-009 (done) +Track G: Task-010 [external prerequisites] +Track A: Task-011 -> Task-012 -> Task-013 -> Task-014 +Track C: Task-015 +Track J: Task-016 ``` ## Task File Mapping | Task | Track | Owns (references) | Verified by (verifies) | Status | | --- | --- | --- | --- | --- | -| Task-001 | S | StR-004, FR-014..FR-018, NFR-004..NFR-005 | TC-066 | done | -| Task-002 | G | FR-014..FR-018, NFR-005 | TC-066, TC-067, TC-073 | blocked | -| Task-003 | A | FR-018 | TC-064..TC-066 | blocked | -| Task-004 | A | FR-014, NFR-004 | TC-059, TC-060, TC-068, TC-069 | blocked | -| Task-005 | A | FR-015, FR-017, NFR-005 | TC-062, TC-063, TC-067, TC-070, TC-073 | blocked | -| Task-006 | A | IT-001, FR-014, FR-015, FR-017, FR-018 | TC-059, TC-060, TC-062, TC-063, TC-066..TC-070, TC-073 | blocked | -| Task-007 | C | FR-016, IT-002 | TC-061, TC-063, TC-066, TC-068, TC-070..TC-072 | blocked | -| Task-008 | J | StR-004, NFR-004, NFR-005 | TC-059..TC-073 | blocked | +| Task-009 | S | StR-004, FR-014..FR-018, NFR-004..NFR-005 | TC-066 | done | +| Task-010 | G | FR-014..FR-018, NFR-005 | TC-066, TC-067, TC-073 | blocked | +| Task-011 | A | FR-018 | TC-064..TC-066 | blocked | +| Task-012 | A | FR-014, NFR-004 | TC-059, TC-060, TC-068, TC-069 | blocked | +| Task-013 | A | FR-015, FR-017, NFR-005 | TC-062, TC-063, TC-067, TC-070, TC-073 | blocked | +| Task-014 | A | IT-001, FR-014, FR-015, FR-017, FR-018 | TC-059, TC-060, TC-062, TC-063, TC-066..TC-070, TC-073 | blocked | +| Task-015 | C | FR-016, IT-002 | TC-061, TC-063, TC-066, TC-068, TC-070..TC-072 | blocked | +| Task-016 | J | StR-004, NFR-004, NFR-005 | TC-059..TC-073 | blocked | ## Coordination Rules - Freeze MRS-004, TM-004 and the closed vocabularies after merge; a semantic change requires a new specification review before downstream code. -- Task-002 is an admission gate, not permission to vendor, mirror, branch-pin or +- Task-010 is an admission gate, not permission to vendor, mirror, branch-pin or locally emulate missing shared capabilities. - Keep one writer for shared census, state and fixture files; downstream tasks rebase after each predecessor merges. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-001-m6-specification-review.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md similarity index 84% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-001-m6-specification-review.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md index dbaacdf..a28c9da 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-001-m6-specification-review.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md @@ -1,10 +1,15 @@ --- -id: Task-001 +id: Task-009 title: "M6 source-readiness specification and composite review" type: Task status: done track: S priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: specification-and-composite-review +github_issue: ix://agent-ix/tl-syntax/issues/34 +resume_conditions: [] relationships: - target: ix://agent-ix/tl-syntax/StR-004 type: references @@ -25,7 +30,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-066 type: verifies --- -# Task-001: M6 source-readiness specification and composite review +# Task-009: M6 source-readiness specification and composite review ## Scope diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-002-prerequisite-admission.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-010-prerequisite-admission.md similarity index 69% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-002-prerequisite-admission.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-010-prerequisite-admission.md index c749a0c..aa603f8 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-002-prerequisite-admission.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-010-prerequisite-admission.md @@ -1,12 +1,17 @@ --- -id: Task-002 +id: Task-010 title: "Admit external prerequisites without local substitutes" type: Task status: blocked track: G priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: released-contract-admission +github_issue: ix://agent-ix/tl-syntax/issues/45 +resume_conditions: [ix://agent-ix/tl-syntax/issues/16, ix://agent-ix/quire-research/issues/64, ix://agent-ix/engineering-assurance/issues/11] relationships: - - target: ix://agent-ix/tl-syntax/Task-001 + - target: ix://agent-ix/tl-syntax/Task-009 type: depends_on - target: ix://agent-ix/tl-syntax/FR-014 type: references @@ -27,7 +32,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-073 type: verifies --- -# Task-002: Admit external prerequisites without local substitutes +# Task-010: Admit external prerequisites without local substitutes ## Scope @@ -48,5 +53,8 @@ capability only when its released identity satisfies MRS-004. ## Notes -- Blocked on tl-syntax#16, engineering-assurance#11/#34, the retention/operator selection, policy/event source, integrator-package release and quire-research#64. +- Blocked on tl-syntax#16, engineering-assurance#11, an immutable release + containing the merged engineering-assurance#34 producer boundary, the + retention/operator selection, policy/event source, integrator-package release + and quire-research#64. - Individual downstream work may resume only when every prerequisite it consumes is admitted; a partial ledger is not a global pass. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-003-executable-path-classification.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-011-executable-path-classification.md similarity index 68% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-003-executable-path-classification.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-011-executable-path-classification.md index 8a591ce..8fb3605 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-003-executable-path-classification.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-011-executable-path-classification.md @@ -1,12 +1,17 @@ --- -id: Task-003 +id: Task-011 title: "Classify executable paths and prove Rust/shared parity" type: Task status: blocked track: A priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: integration-and-property-test +github_issue: ix://agent-ix/tl-syntax/issues/46 +resume_conditions: [ix://agent-ix/tl-syntax/issues/34, ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/quire-research/issues/64] relationships: - - target: ix://agent-ix/tl-syntax/Task-002 + - target: ix://agent-ix/tl-syntax/Task-010 type: depends_on - target: ix://agent-ix/tl-syntax/FR-018 type: references @@ -17,7 +22,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-066 type: verifies --- -# Task-003: Classify executable paths and prove Rust/shared parity +# Task-011: Classify executable paths and prove Rust/shared parity ## Scope @@ -38,4 +43,5 @@ first-party behavior to Rust or a released shared capability. ## Notes -- Blocked until the current specification is independently reviewed/merged and the consumed LR08/shared-runner entries are admitted by Task-002. +- Blocked until the current specification is independently reviewed/merged and + the consumed LR08/shared-runner entries are admitted by Task-010. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-004-candidate-binding.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md similarity index 72% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-004-candidate-binding.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md index 4595dc2..995c35c 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-004-candidate-binding.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md @@ -1,14 +1,19 @@ --- -id: Task-004 +id: Task-012 title: "Bind immutable candidates and fresh producer results" type: Task status: blocked track: A priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: property-and-integration-test +github_issue: ix://agent-ix/tl-syntax/issues/47 +resume_conditions: [ix://agent-ix/tl-syntax/issues/34, ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/46] relationships: - - target: ix://agent-ix/tl-syntax/Task-002 + - target: ix://agent-ix/tl-syntax/Task-010 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-003 + - target: ix://agent-ix/tl-syntax/Task-011 type: depends_on - target: ix://agent-ix/tl-syntax/FR-014 type: references @@ -23,7 +28,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-069 type: verifies --- -# Task-004: Bind immutable candidates and fresh producer results +# Task-012: Bind immutable candidates and fresh producer results ## Scope diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-005-lifecycle-decision-admission.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md similarity index 70% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-005-lifecycle-decision-admission.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md index 3bca891..b4cdc4d 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-005-lifecycle-decision-admission.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md @@ -1,14 +1,19 @@ --- -id: Task-005 +id: Task-013 title: "Preserve lifecycle, retention and human decision authority" type: Task status: blocked track: A priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: state-machine-and-integration-test +github_issue: ix://agent-ix/tl-syntax/issues/48 +resume_conditions: [ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/47] relationships: - - target: ix://agent-ix/tl-syntax/Task-002 + - target: ix://agent-ix/tl-syntax/Task-010 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-004 + - target: ix://agent-ix/tl-syntax/Task-012 type: depends_on - target: ix://agent-ix/tl-syntax/FR-015 type: references @@ -27,7 +32,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-073 type: verifies --- -# Task-005: Preserve lifecycle, retention and human decision authority +# Task-013: Preserve lifecycle, retention and human decision authority ## Scope @@ -48,4 +53,5 @@ supersession and policy-backed decision admission without automated promotion. ## Notes -- Blocked until Task-002 selects the retention backend/operator and authoritative policy/event source. +- Blocked until Task-010 selects the retention backend/operator and + authoritative policy/event source. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-006-real-source-grounding-integration.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-014-real-source-grounding-integration.md similarity index 74% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-006-real-source-grounding-integration.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-014-real-source-grounding-integration.md index 682d872..bf01572 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-006-real-source-grounding-integration.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-014-real-source-grounding-integration.md @@ -1,16 +1,21 @@ --- -id: Task-006 +id: Task-014 title: "Exercise the real shared source-grounding handoff" type: Task status: blocked track: A priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: real-shared-contract-integration-test +github_issue: ix://agent-ix/tl-syntax/issues/49 +resume_conditions: [ix://agent-ix/tl-syntax/issues/16, ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/47, ix://agent-ix/tl-syntax/issues/48] relationships: - - target: ix://agent-ix/tl-syntax/Task-002 + - target: ix://agent-ix/tl-syntax/Task-010 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-004 + - target: ix://agent-ix/tl-syntax/Task-012 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-005 + - target: ix://agent-ix/tl-syntax/Task-013 type: depends_on - target: ix://agent-ix/tl-syntax/IT-001 type: references @@ -43,7 +48,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-073 type: verifies --- -# Task-006: Exercise the real shared source-grounding handoff +# Task-014: Exercise the real shared source-grounding handoff ## Scope @@ -63,4 +68,5 @@ contracts with no mock reader or local substitute. ## Notes -- Blocked on the tl-syntax#16 accepted release set and completion of Tasks 004–005. +- Blocked on the tl-syntax#16 accepted release set and completion of Tasks + 012–013. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-007-integrator-package.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-015-integrator-package.md similarity index 74% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-007-integrator-package.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-015-integrator-package.md index d14c302..db43551 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-007-integrator-package.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-015-integrator-package.md @@ -1,14 +1,19 @@ --- -id: Task-007 +id: Task-015 title: "Publish and verify the shared integrator package" type: Task status: blocked track: C priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: real-writer-reader-integration-and-analysis +github_issue: ix://agent-ix/tl-syntax/issues/50 +resume_conditions: [ix://agent-ix/tl-syntax/issues/45, ix://agent-ix/tl-syntax/issues/49, ix://agent-ix/engineering-assurance/issues/11] relationships: - - target: ix://agent-ix/tl-syntax/Task-002 + - target: ix://agent-ix/tl-syntax/Task-010 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-006 + - target: ix://agent-ix/tl-syntax/Task-014 type: depends_on - target: ix://agent-ix/tl-syntax/FR-016 type: references @@ -29,7 +34,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-072 type: verifies --- -# Task-007: Publish and verify the shared integrator package +# Task-015: Publish and verify the shared integrator package ## Scope diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-008-final-assurance.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-016-final-assurance.md similarity index 75% rename from plan/Plan-007-source-qualification-readiness/tasks/Task-008-final-assurance.md rename to plan/Plan-007-source-qualification-readiness/tasks/Task-016-final-assurance.md index 1b8b708..c058df9 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-008-final-assurance.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-016-final-assurance.md @@ -1,20 +1,25 @@ --- -id: Task-008 +id: Task-016 title: "Close implementation evidence and human source-release gate" type: Task status: blocked track: J priority: P0 +owner_repository: agent-ix/tl-syntax +consumer_repositories: [agent-ix/tl-syntax] +evidence_method: rust-review-gap-analysis-and-human-decision +github_issue: ix://agent-ix/tl-syntax/issues/51 +resume_conditions: [ix://agent-ix/tl-syntax/issues/46, ix://agent-ix/tl-syntax/issues/47, ix://agent-ix/tl-syntax/issues/48, ix://agent-ix/tl-syntax/issues/49, ix://agent-ix/tl-syntax/issues/50] relationships: - - target: ix://agent-ix/tl-syntax/Task-003 + - target: ix://agent-ix/tl-syntax/Task-011 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-004 + - target: ix://agent-ix/tl-syntax/Task-012 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-005 + - target: ix://agent-ix/tl-syntax/Task-013 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-006 + - target: ix://agent-ix/tl-syntax/Task-014 type: depends_on - - target: ix://agent-ix/tl-syntax/Task-007 + - target: ix://agent-ix/tl-syntax/Task-015 type: depends_on - target: ix://agent-ix/tl-syntax/StR-004 type: references @@ -53,7 +58,7 @@ relationships: - target: ix://agent-ix/tl-syntax/TC-073 type: verifies --- -# Task-008: Close implementation evidence and human source-release gate +# Task-016: Close implementation evidence and human source-release gate ## Scope diff --git a/spec/assurance/AD-002-source-readiness-boundary.md b/spec/assurance/AD-002-source-readiness-boundary.md index f7e5119..c0dee07 100644 --- a/spec/assurance/AD-002-source-readiness-boundary.md +++ b/spec/assurance/AD-002-source-readiness-boundary.md @@ -118,9 +118,10 @@ missing, the guarantee remains unavailable rather than falling back locally. and a repository-local compatibility fixture are not substitutes. - The general shared integrator-package contract is not yet selected; IT-002 remains blocked on a real accepted Rust-consumable release. -- `agent-ix/engineering-assurance#11/#34` must reconcile use-specific - qualification and bounded Rust producer execution; tl-syntax must not fill - that gap locally. +- `agent-ix/engineering-assurance#11` still owns use-specific qualification; + engineering-assurance#34 delivered bounded Rust producer execution, but no + immutable compatible release available to this plan contains it yet. + tl-syntax must not fill either remaining admission gap locally. - Existing Python/shell/Make/inline-workflow paths require the LR08 inventory, Rust parity or explicit owner disposition before stable qualification use. - Quire status-column classification and Quoin binary-attachment/non-release- diff --git a/spec/requirements/FR-018-classify-qualification-execution-paths.md b/spec/requirements/FR-018-classify-qualification-execution-paths.md index 5d3c6db..ae1df5f 100644 --- a/spec/requirements/FR-018-classify-qualification-execution-paths.md +++ b/spec/requirements/FR-018-classify-qualification-execution-paths.md @@ -85,6 +85,7 @@ deciding a stable candidate. - `agent-ix/quire-research#64` owns the cross-repository policy/catalog; tl-syntax owns exhaustive local enumeration, classification, refusal and bounded legacy disposition. -- `agent-ix/engineering-assurance#34` owns the planned reusable Rust producer- - execution boundary. +- `agent-ix/engineering-assurance#34` delivered the reusable Rust producer- + execution boundary; Task-010 must still admit an immutable compatible release + that contains it before this repository consumes it. - `agent-ix/tl-syntax#16` owns the source-grounded shared-contract migration. diff --git a/spec/source-readiness-test-matrix.md b/spec/source-readiness-test-matrix.md index 71ba634..4f2367b 100644 --- a/spec/source-readiness-test-matrix.md +++ b/spec/source-readiness-test-matrix.md @@ -77,7 +77,7 @@ relationships: ## Integration Test Matrix -| Integration ID | Purpose | Type | Target | Test Cases | Status | +| Test ID | Purpose | Type | Target | Test Cases | Status | |---|---|---|---|---|---| | IT-001 | Source-grounded handoff through real released Engineering Assurance, Quire and Quoin | service | shared assurance stack | TC-059, TC-060, TC-062, TC-063, TC-066 through TC-070, TC-073 | 🚧 blocked on tl-syntax#16 release set and authoritative policy/event source | | IT-002 | Lossless future integrator-package handoff without transferred qualification | service | Engineering Assurance integrator package | TC-061, TC-062, TC-063, TC-066, TC-068, TC-070 through TC-072 | 🚧 blocked on accepted shared contract | diff --git a/spec/source-readiness.md b/spec/source-readiness.md index a28c9ac..00e7df8 100644 --- a/spec/source-readiness.md +++ b/spec/source-readiness.md @@ -164,8 +164,9 @@ implementation node remains unavailable at an external resume condition. Assurance release names the Quire 0.32 source-grounded export and exact compatible artifacts. - Use-specific qualified records remain blocked on - `engineering-assurance#11`; reusable bounded Rust producer execution remains - owned by `engineering-assurance#34` when required. + `engineering-assurance#11`. Engineering-assurance#34 delivered reusable + bounded Rust producer execution, but M6 may consume it only after an immutable + compatible release containing that contract is admitted by Task-010. - Executable-language disposition remains owned by `quire-research#64`. - Quire status-classification and Quoin binary-attachment/non-release-build gaps remain conditional blockers for claims that depend on those capabilities. From 69cdd585f0104b9e633983043fb08ca397ae48a8 Mon Sep 17 00:00:00 2001 From: Agent IX Date: Sat, 12 Sep 2026 23:39:50 -0700 Subject: [PATCH 4/9] Close M6 snapshot and event races --- .../tasks/Task-012-candidate-binding.md | 2 ++ .../Task-013-lifecycle-decision-admission.md | 2 ++ .../AP-002-progressive-source-readiness.md | 3 +++ .../IT-001-shared-source-readiness-handoff.md | 12 +++++++---- .../FR-014-bind-source-readiness-candidate.md | 15 ++++++++++---- ...7-require-human-source-release-decision.md | 20 ++++++++++++++++--- spec/source-readiness-test-matrix.md | 4 ++-- 7 files changed, 45 insertions(+), 13 deletions(-) diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md index 995c35c..e8d5f43 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-012-candidate-binding.md @@ -39,6 +39,8 @@ freshness projection through released source-grounding contracts. - [ ] Write property tests for every identity axis and source-walk boundary. - [ ] Implement immutable-root binding and bounded symlink traversal in Rust. +- [ ] Consume the same descriptor-backed snapshots used for identity; refuse + pathname reopen and change-then-restore races. - [ ] Implement total execution/decode mappings and stale-output quarantine. - [ ] Prove deterministic equality and one-axis isolation. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md index b4cdc4d..39b9c46 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-013-lifecycle-decision-admission.md @@ -45,6 +45,8 @@ supersession and policy-backed decision admission without automated promotion. - [ ] Implement bounded same-subject supersession/conflict traversal. - [ ] Verify real retention handles and map every retrieval failure. - [ ] Admit complete decision-event sets against policy, quorum and independence facts. +- [ ] Refuse incomplete/cross-snapshot event enumeration and bind expiry to the + verified authoritative evaluation-time contract. ## Deliverables diff --git a/spec/assurance/AP-002-progressive-source-readiness.md b/spec/assurance/AP-002-progressive-source-readiness.md index 4c26757..9c516f6 100644 --- a/spec/assurance/AP-002-progressive-source-readiness.md +++ b/spec/assurance/AP-002-progressive-source-readiness.md @@ -103,6 +103,9 @@ schema has no acceptance-criterion criticality column. descendant mount crossing is refused. - A supersession traversal admits at most 4,096 facts, 8,192 directed edges and depth 4,096. +- A decision-event intake admits at most 4,096 events from one immutable + authoritative-source query snapshot. Pagination may not mix snapshot/cursor + identities, omit or duplicate an event, or select a favorable prefix. - A value at a bound is admitted; the first value above it produces the typed non-success required by FR-014 or FR-015 without exposing a partial result. diff --git a/spec/integration/IT-001-shared-source-readiness-handoff.md b/spec/integration/IT-001-shared-source-readiness-handoff.md index 629f488..f031c53 100644 --- a/spec/integration/IT-001-shared-source-readiness-handoff.md +++ b/spec/integration/IT-001-shared-source-readiness-handoff.md @@ -59,14 +59,18 @@ producer input. 4. Repeat each one-axis missing, stale, incompatible and substituted input case. - IT-001-SC-04: each case refuses or remains unavailable/incomplete and cannot reuse the healthy result. 5. Quarantine prior output, force skip/crash/timeout/partial-output outcomes, - and mutate one bound source/configuration identity during a run. - - IT-001-SC-05: no stale output is accepted and every mid-run mutation refuses the observation. + mutate one bound source/configuration identity during a run, restore it + before completion, and replace a pathname after its bytes are observed. + - IT-001-SC-05: no stale output is accepted; mid-run and change-then-restore mutations refuse the observation; and the exact descriptor-backed bytes identified before execution are the bytes consumed without pathname reopen. 6. Substitute repository/Git object identity and each applicable symlink, submodule, Git LFS, generated or fetched-input identity. - IT-001-SC-06: each changed materialized input creates a new subject or an explicit unavailable result. 7. Mutate the selected reviewer/decision policy and each actor, contributor, - conflict, delegation, revocation, quorum and review-subject binding. - - IT-001-SC-07: an unverifiable event is refused while the disposition stays open; insufficient quorum stays open without a local policy registry. + conflict, delegation, revocation, quorum and review-subject binding. Split, + duplicate, reorder or omit event pages; change their snapshot/cursor identity; + exceed the event bound; and vary the evaluation instant/time authority at, + below and above an expiry. + - IT-001-SC-07: an unverifiable event is refused while the disposition stays open; insufficient quorum or an incomplete/non-atomic event population stays open without a local policy registry; and expiry changes state only under the bound verified time authority and canonical ordering. 8. Retrieve every claimed durable handle after deleting only the disposable producer workspace, then substitute returned bytes, media type, subject, lifecycle and handle binding. diff --git a/spec/requirements/FR-014-bind-source-readiness-candidate.md b/spec/requirements/FR-014-bind-source-readiness-candidate.md index 34e9820..d9fe4da 100644 --- a/spec/requirements/FR-014-bind-source-readiness-candidate.md +++ b/spec/requirements/FR-014-bind-source-readiness-candidate.md @@ -36,6 +36,9 @@ configuration through released shared-assurance contracts. - For every executed producer: executable bytes, invocation identity/run nonce, arguments/environment, start and completion facts, process outcome and fresh output identity. +- For every opened source or producer input: the released-contract snapshot or + capability identity whose exact bytes are hashed and consumed without a + pathname reopen. ## Outputs @@ -54,8 +57,12 @@ configuration through released shared-assurance contracts. - tl-syntax shall refuse a dirty or incompletely enumerated live source population instead of describing it as the reviewed candidate. - tl-syntax shall execute against immutable isolated candidate/configuration - bytes or revalidate every bound identity before and after each producer and - shared handoff. + snapshots. A before/after pathname recheck alone is not evidence of + immutability because an input can change and return to its original identity + between checks. +- The same descriptor-backed snapshot or capability whose bytes and metadata + establish a bound identity shall be the input exposed to each producer and + shared handoff; reopening the original pathname after observation is refused. - If any bound identity changes during execution, then the tl-syntax Rust readiness projection shall produce `refused`. - tl-syntax shall quarantine or remove prior producer outputs before invocation. @@ -105,8 +112,8 @@ configuration through released shared-assurance contracts. | FR-014-AC-2 | Mutating any identity or digest changes the readiness subject; omitting a required candidate identity is refused, while absence/incompatibility of a required shared capability is unavailable, and no prior result is reused. | Test (TC-060) | | FR-014-AC-3 | Dirty, untracked-live, mutable-ignore, incomplete-census and unavailable-enumeration cases cannot be represented as a clean reviewed candidate. | Test (TC-060) | | FR-014-AC-4 | Absence of a compatible released source-grounding contract remains unavailable and creates no local parser, schema, matrix or branch-head substitute. | Test (TC-066) | -| FR-014-AC-5 | Every `ExecutionOutcome` value in MRS-004 is exercised with a valid stale output present; no non-`succeeded` value yields a current successful domain output, every accepted output binds fresh invocation/executable/termination facts, and a mid-run source/configuration mutation is refused. | Test (TC-068) | -| FR-014-AC-6 | Candidate identity includes repository/Git/materialized-source/admitted-root identities; material or root/path/mount substitution/race is detected or unavailable, symlink chains below/at AP-002's bound terminate, and dangling/cyclic/out-of-root/special/mount-crossing/over-bound paths are refused. | Test (TC-069) | +| FR-014-AC-5 | Every `ExecutionOutcome` value in MRS-004 is exercised with a valid stale output present; no non-`succeeded` value yields a current successful domain output, every accepted output binds fresh invocation/executable/termination facts, and mid-run plus change-then-restore source/configuration mutations are refused. | Test (TC-068) | +| FR-014-AC-6 | Candidate identity includes repository/Git/materialized-source/admitted-root identities; the exact descriptor-backed bytes that are identified are consumed without pathname reopen; material or root/path/mount substitution/race is detected or unavailable; symlink chains below/at AP-002's bound terminate; and dangling/cyclic/out-of-root/special/mount-crossing/over-bound paths are refused. | Test (TC-069) | ## Dependencies diff --git a/spec/requirements/FR-017-require-human-source-release-decision.md b/spec/requirements/FR-017-require-human-source-release-decision.md index dbcb452..351f3c8 100644 --- a/spec/requirements/FR-017-require-human-source-release-decision.md +++ b/spec/requirements/FR-017-require-human-source-release-decision.md @@ -30,7 +30,10 @@ configuration after the required independent reviews and limitation inspection. version, authorized actors/quorum, candidate author/contributor set, conflict disclosures and current delegation/revocation facts. - Zero or more authenticated decision events for the exact subject lineage from - the authoritative event source, including every current concurrent successor. + the authoritative event source, including every current concurrent successor, + one immutable query snapshot/cursor identity and a completeness result. +- The decision-evaluation instant, named clock/time authority and the released + contract's canonical timestamp/ordering rules used for expiry decisions. ## Outputs @@ -46,6 +49,11 @@ configuration after the required independent reviews and limitation inspection. admission adapter shall keep the disposition `open`. - The tl-syntax Rust admission adapter shall aggregate the complete event set for the exact subject lineage through the AP-002 node, edge and depth bounds. +- The event set shall come from one immutable source snapshot. Duplicate, + missing, reordered or cross-snapshot pages, a changed cursor/snapshot identity, + an incomplete enumeration or an over-bound population shall keep the current + disposition `open` and retain the exact non-success limitation; no observed + favorable subset is admissible. - If an event is stale or bound to the wrong actor/subject, then the tl-syntax Rust admission adapter shall set its `DecisionEventAdmission` to `refused`. - If current events are ambiguous or contradictory, then the tl-syntax Rust @@ -61,6 +69,12 @@ configuration after the required independent reviews and limitation inspection. preserve `conditional` until a new authorized decision is recorded. - If a condition expires, then the tl-syntax Rust admission adapter shall mark the prior conditional decision stale and set the current disposition `open`. + Expiry occurs exactly when a verified evaluation instant is equal to or later + than the bound expiry under the released contract's canonical ordering. +- If the evaluation instant, clock/time authority or canonical ordering cannot + be verified, then the tl-syntax Rust admission adapter shall preserve the + historical event and keep the current disposition `open` rather than guess + whether it expired. - The tl-syntax Rust admission adapter shall require a new decision when the candidate, configuration, applicable profile, material limitation, required review or shared-contract identity changes. @@ -99,12 +113,12 @@ configuration after the required independent reviews and limitation inspection. | ID | Criteria | Verification | |---|---|---| | FR-017-AC-1 | Accepted/rejected/deferred/conditional/open/conflict remain distinct exact-subject dispositions; event-backed states retain identity/rationale/exception/expiry, `open` requires no absent event fields, and `conflict` retains the complete event set. | Test (TC-062) | -| FR-017-AC-2 | An absent required review/decision leaves the disposition `open`; a stale or wrong-actor/subject event is `refused` while the disposition stays `open`; an ambiguous/contradictory current set produces `conflict`, and none is inferred as accepted. | Test (TC-063) | +| FR-017-AC-2 | An absent required review/decision or an incomplete, cross-snapshot, changed-cursor or over-bound event enumeration leaves the disposition `open`; a stale or wrong-actor/subject event is `refused` while the disposition stays `open`; an ambiguous/contradictory complete current set produces `conflict`, and none is inferred as accepted. | Test (TC-063) | | FR-017-AC-3 | Every material candidate/configuration/profile/limitation/shared-contract change requires a new review/decision relation and preserves the historical disposition. | Test (TC-063) | | FR-017-AC-4 | A source-release acceptance grants neither publication nor integrator/system/monitor qualification. | Test (TC-066) | | FR-017-AC-5 | Each required review binds an attributable independent reviewer, exact head/base/configuration/evidence set, finding dispositions and accepted limitations; self-review or any bound-identity change leaves the review requirement open. | Test (TC-073) | | FR-017-AC-6 | Independence and authority are evaluated against an exact policy/version, author/contributor set, conflicts, delegations, revocations and quorum; an unverifiable event is `refused`, and an insufficient quorum leaves the disposition `open`. | Test (TC-073) | -| FR-017-AC-7 | Conditional decisions retain condition owner/evidence/expiry; unresolved and satisfied conditions stay `conditional` until a new authorized decision, expiry reopens the disposition, deferred decisions retain owner/resume/expiry until a new authorized decision, and concurrent/contradictory successors produce `conflict` until explicitly resolved. | Test (TC-070) | +| FR-017-AC-7 | Conditional decisions retain condition owner/evidence/expiry; unresolved and satisfied conditions stay `conditional` until a new authorized decision; expiry reopens the disposition only at a verified equal-or-later instant under the bound clock/time authority and canonical ordering; deferred decisions retain owner/resume/expiry until a new authorized decision; and concurrent/contradictory successors produce `conflict` until explicitly resolved. | Test (TC-070) | ## Dependencies diff --git a/spec/source-readiness-test-matrix.md b/spec/source-readiness-test-matrix.md index 4f2367b..5be399d 100644 --- a/spec/source-readiness-test-matrix.md +++ b/spec/source-readiness-test-matrix.md @@ -45,12 +45,12 @@ relationships: | TC-065 | Demonstrate positive and forced-failure parity for each replaced executable path | Integration | P0 | FR-018-AC-3 | 🚧 blocked on reviewed replacements | | TC-066 | Prove authority, language, certification and no-local-substitute boundaries | Integration | P0 | FR-014-AC-4, FR-015-AC-4, FR-016-AC-4, FR-017-AC-4, FR-018-AC-4, NFR-004-AC-4, NFR-005-AC-4, StR-004-VC-3 | 🚧 planned | | TC-067 | Mutate evidence lifecycle/content binding and exercise durable-handle retrieval after disposable workspace deletion | Integration | P0 | FR-015-AC-5, NFR-005-AC-1 | 🚧 blocked on selected shared retention contract | -| TC-068 | Quarantine stale outputs and force skipped, crashed, timed-out, malformed and partial producer/package executions | Integration | P0 | FR-014-AC-5, FR-016-AC-5 | 🚧 planned | +| TC-068 | Quarantine stale outputs; force skipped, crashed, timed-out, malformed and partial producer/package executions; and reject change-then-restore input mutation | Integration | P0 | FR-014-AC-5, FR-016-AC-5 | 🚧 planned | | TC-069 | Mutate repository/Git/materialized/admitted-root/path/mount identities and probe symlink escape/cycle/race/special/mount/bound cases | Property | P0 | FR-014-AC-6 | 🚧 planned | | TC-070 | Mutate supersession topology/bounds, conditional/deferred transitions and concurrent review/decision successors | Property | P0 | FR-015-AC-6, FR-017-AC-7 | 🚧 planned | | TC-071 | Race non-identical package writers and retry identical/different attempt identities | Integration | P0 | FR-016-AC-6 | 🚧 blocked on accepted shared contract | | TC-072 | An independent rights reviewer reconciles the exact candidate's tracked source, package contents, dependency closure and generated/embedded third-party material against identity-bound authoritative license and reuse-right sources | Analysis | P0 | FR-016-AC-7, IT-002-SC-07 | 🚧 planned | -| TC-073 | Mutate reviewer/decision policy, actor, contributor, conflict, delegation, revocation, quorum, head/base/configuration and evidence bindings | Property | P0 | FR-017-AC-5, FR-017-AC-6, NFR-005-AC-2 | 🚧 blocked on authoritative policy/event source | +| TC-073 | Mutate reviewer/decision policy, actor, contributor, conflict, delegation, revocation, quorum, event snapshot/cursor/completeness, evaluation time authority, head/base/configuration and evidence bindings | Property | P0 | FR-017-AC-2, FR-017-AC-5, FR-017-AC-6, FR-017-AC-7, NFR-005-AC-2 | 🚧 blocked on authoritative policy/event source | ## Planned Suite Allocation From 33678fa735d6716999773abc348adab2db315a6f Mon Sep 17 00:00:00 2001 From: Agent IX Date: Sat, 12 Sep 2026 23:41:09 -0700 Subject: [PATCH 5/9] Keep executables visible in source census --- tests/shared_assurance.rs | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-) diff --git a/tests/shared_assurance.rs b/tests/shared_assurance.rs index 4de8b26..89602b7 100644 --- a/tests/shared_assurance.rs +++ b/tests/shared_assurance.rs @@ -509,9 +509,10 @@ const FORBIDDEN: [&str; 5] = [ fn is_archival_record(relative: &str) -> bool { relative == "tests/shared_assurance.rs" || relative == "spec/.gitkeep" - || relative.starts_with("spec/reviews/") - || relative.starts_with("spec/plans/") - || relative.starts_with("plan/") + || (relative.ends_with(".md") + && (relative.starts_with("spec/reviews/") + || relative.starts_with("spec/plans/") + || relative.starts_with("plan/"))) } fn source_sets(root: &Path) -> CensusResult<(BTreeSet, BTreeSet)> { @@ -801,6 +802,7 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { std::env::temp_dir().join(format!("tl-syntax-source-census-fixture-{process}")), ); fs::create_dir_all(fixture.path().join("src")).expect("create tracked fixture area"); + fs::create_dir_all(fixture.path().join("plan")).expect("create plan fixture area"); fs::create_dir_all(fixture.path().join("tests/proptest-regressions")) .expect("create ignored fixture area"); fs::write(fixture.path().join(".gitignore"), "proptest-regressions/\n") @@ -810,6 +812,13 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { "pub const TRACKED: bool = true;\n", ) .expect("write tracked fixture"); + fs::write( + fixture.path().join("plan/record.md"), + "# Inert plan record\n", + ) + .expect("write archival plan fixture"); + fs::write(fixture.path().join("plan/run"), "#!/bin/sh\nexit 0\n") + .expect("write executable plan fixture"); fs::write( fixture.path().join("tests/untracked.rs"), "pub const FORBIDDEN_REFERENCE: &str = \"legacy_evidence_view\";\n", @@ -829,7 +838,13 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { .expect("initialize source-census fixture repository"); assert!(initialized.success(), "fixture git init failed"); let staged = Command::new("git") - .args(["add", ".gitignore", "src/tracked.rs"]) + .args([ + "add", + ".gitignore", + "src/tracked.rs", + "plan/record.md", + "plan/run", + ]) .current_dir(fixture.path()) .status() .expect("stage source-census fixture"); @@ -839,12 +854,18 @@ fn live_source_enumeration_has_an_exact_fail_closed_partition() { source_sets(fixture.path()).expect("enumerate source-census fixture"); assert_eq!( fixture_tracked, - BTreeSet::from([".gitignore".to_owned(), "src/tracked.rs".to_owned()]) + BTreeSet::from([ + ".gitignore".to_owned(), + "plan/run".to_owned(), + "src/tracked.rs".to_owned(), + ]), + "Markdown plan records are archival, but a tracked executable under plan/ must remain live" ); assert_eq!( fixture_scanned, BTreeSet::from([ ".gitignore".to_owned(), + "plan/run".to_owned(), "src/tracked.rs".to_owned(), "tests/untracked.rs".to_owned(), ]), From 9e5856c86c788f29453cadd7475017ed675458dd Mon Sep 17 00:00:00 2001 From: Agent IX Date: Sat, 12 Sep 2026 23:47:45 -0700 Subject: [PATCH 6/9] Record independent M6 source-readiness reviews --- .../log.md | 4 +++ .../tasks/Task-009-m6-specification-review.md | 3 +- ...-readiness-independent-base-spec-review.md | 26 ++++++++++++++++ ...-independent-failure-domain-spec-review.md | 23 ++++++++++++++ ...iness-independent-integrity-spec-review.md | 23 ++++++++++++++ ...ness-independent-dependency-spec-review.md | 23 ++++++++++++++ ...diness-independent-evidence-spec-review.md | 25 +++++++++++++++ ...independent-risk-complexity-spec-review.md | 23 ++++++++++++++ ...-independent-scope-boundary-spec-review.md | 23 ++++++++++++++ ...-readiness-independent-ears-spec-review.md | 21 +++++++++++++ ...ource-readiness-census-rust-code-review.md | 31 +++++++++++++++++++ 11 files changed, 224 insertions(+), 1 deletion(-) create mode 100644 spec/reviews/SR-066-source-readiness-independent-base-spec-review.md create mode 100644 spec/reviews/SR-067-source-readiness-independent-failure-domain-spec-review.md create mode 100644 spec/reviews/SR-068-source-readiness-independent-integrity-spec-review.md create mode 100644 spec/reviews/SR-069-source-readiness-independent-dependency-spec-review.md create mode 100644 spec/reviews/SR-070-source-readiness-independent-evidence-spec-review.md create mode 100644 spec/reviews/SR-071-source-readiness-independent-risk-complexity-spec-review.md create mode 100644 spec/reviews/SR-072-source-readiness-independent-scope-boundary-spec-review.md create mode 100644 spec/reviews/SR-073-source-readiness-independent-ears-spec-review.md create mode 100644 spec/reviews/SR-074-source-readiness-census-rust-code-review.md diff --git a/plan/Plan-007-source-qualification-readiness/log.md b/plan/Plan-007-source-qualification-readiness/log.md index b1d5aec..9a7b520 100644 --- a/plan/Plan-007-source-qualification-readiness/log.md +++ b/plan/Plan-007-source-qualification-readiness/log.md @@ -14,3 +14,7 @@ description: "Chronological log of the progressive source-qualification-readines consumers, evidence methods and resume conditions. Engineering Assurance #34 is merged but remains unavailable here until an immutable compatible release carries that contract. +* **2026-09-13** — Independent SR-066 through SR-074 review at `33678fa` + closed pathname ABA/TOCTOU, event-population/time-authority and archival- + census bypass findings. All implementation tasks remain blocked; no TM-004 + row or human release decision advanced. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md index a28c9da..627d454 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md @@ -46,7 +46,8 @@ assurance records and real-integration scenarios before implementation. ## Deliverables - Specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40` -- SR-058 through SR-065 +- Author reviews SR-058 through SR-065 +- Independent exact-head reviews SR-066 through SR-074 ## Notes diff --git a/spec/reviews/SR-066-source-readiness-independent-base-spec-review.md b/spec/reviews/SR-066-source-readiness-independent-base-spec-review.md new file mode 100644 index 0000000..674e0f4 --- /dev/null +++ b/spec/reviews/SR-066-source-readiness-independent-base-spec-review.md @@ -0,0 +1,26 @@ +--- +id: SR-066 +title: "Independent base review of progressive tl-syntax source readiness" +type: SpecReview +analysis: base +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002, PLAN-007" +review_set: all +--- + +## Summary + +Independent review of exact snapshot +`33678fa` finds the M6 boundary implementable once its declared external +contracts and authorities are admitted. Native Quire remains the sole editable +formal-clause language; M6 prepares source facts and preserves a human decision +without claiming publication or downstream qualification. + +Quire reports 142/142 specification documents and 11/11 PLAN-007 documents +grammar-clean. All M6 implementation rows remain planned or explicitly blocked. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6601 | medium | PLAN-007 originally reused Task-001..Task-008, had no task tickets, and did not expose owner, consumer, evidence-method or resume metadata. It now uses repository-unique Task-009..Task-016 and maps #34 plus #45..#51. | PLAN-007 | missing-requirement | +| FND-6602 | low | No M6 implementation or source-release completion is present; accepting this specification may close #34 but cannot advance Task-010..Task-016 or any TM-004 row. | TM-004, PLAN-007 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-067-source-readiness-independent-failure-domain-spec-review.md b/spec/reviews/SR-067-source-readiness-independent-failure-domain-spec-review.md new file mode 100644 index 0000000..208369c --- /dev/null +++ b/spec/reviews/SR-067-source-readiness-independent-failure-domain-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-067 +title: "Independent failure-domain review of progressive tl-syntax source readiness" +type: SpecReview +analysis: failure-domain +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +Independent review at `33678fa` exercised candidate substitution, stale output, +path and symlink races, event-set incompleteness, expiry authority, retention, +supersession, concurrent publication, typed decode and license-resolution +failures. The closed outcomes remain non-promoting and resource-bounded. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6701 | high | FR-014 previously allowed before/after pathname revalidation, which cannot detect change-then-restore substitution and did not require the identified bytes to be the consumed bytes. It now requires one descriptor-backed snapshot/capability and refuses pathname reopen. | FR-014-AC-5, FR-014-AC-6, IT-001-SC-05 | wrong-requirement | +| FND-6702 | high | Decision intake previously lacked immutable event-population identity, completeness/bounds and an authoritative expiry instant, permitting a favorable page or guessed expiry. The requirement now keeps incomplete/cross-snapshot/over-bound input open and binds expiry to a verified time authority and canonical ordering. | FR-017-AC-2, FR-017-AC-7, AP-002, IT-001-SC-07 | missing-requirement | +| FND-6703 | medium | Real failure evidence is unavailable until the released source-grounding, retention, policy/event and integrator-package contracts are admitted; a mock or local substitute cannot resolve this finding. | Task-010, IT-001, IT-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-068-source-readiness-independent-integrity-spec-review.md b/spec/reviews/SR-068-source-readiness-independent-integrity-spec-review.md new file mode 100644 index 0000000..46235d8 --- /dev/null +++ b/spec/reviews/SR-068-source-readiness-independent-integrity-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-068 +title: "Independent integrity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: integrity +scope: "MRS-004, TM-004, StR-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, AD-002, MP-002, IT-001..IT-002, PLAN-007" +review_set: all +--- + +## Summary + +The exact `33678fa` requirements, matrices, scenarios and plan were checked for +atomicity, total state mappings, identity collisions, trace targets and truthful +status. Every M6 criterion is allocated to TC-059..TC-073, and every task has an +owner, ticket, evidence method and explicit resume set. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6801 | medium | TM-004 declared `Integration ID` where the installed trace model mints `Test ID`, so IT-001/IT-002 were not indexed. The header now matches the declared contract. | TM-004 | wrong-requirement | +| FND-6802 | medium | Task identity reuse made `ix://.../Task-NNN` dependencies ambiguous across plans. PLAN-007 now owns the unused Task-009..Task-016 range; active sibling branches were checked for collisions. | PLAN-007 | missing-requirement | +| FND-6803 | low | The repository-wide TestMatrix `Status` versus `Coverage Status` declaration conflict remains outside M6 and is tracked upstream; no M6 status is claimed complete, so it currently hides no completion lie. | TM-001, TM-002, TM-004 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-069-source-readiness-independent-dependency-spec-review.md b/spec/reviews/SR-069-source-readiness-independent-dependency-spec-review.md new file mode 100644 index 0000000..4f4e56c --- /dev/null +++ b/spec/reviews/SR-069-source-readiness-independent-dependency-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-069 +title: "Independent dependency review of progressive tl-syntax source readiness" +type: SpecReview +analysis: dependency +scope: "MRS-004, FR-014..FR-018, NFR-004..NFR-005, AD-002, IT-001..IT-002, PLAN-007" +review_set: all +--- + +## Summary + +The internal `33678fa` graph is acyclic: prerequisite admission precedes path +classification, candidate binding, lifecycle/decision admission, real shared +integration, package work and final assurance. GitHub tickets #45..#51 carry +that same order and remain open. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-6901 | medium | Engineering Assurance #34 is closed and PR #46 merged, so describing its implementation as open was stale. No current immutable release contains the merge, so Task-010 truthfully retains release admission as the blocker. | FR-018, AD-002, Task-010 | correct-requirement-no-evidence | +| FND-6902 | medium | Source grounding remains blocked on tl-syntax#16 and LR08 on quire-research#64; retention backend/operator, reviewer policy/event source and integrator-package contracts are still unselected. | Task-010, #45 | correct-requirement-no-evidence | +| FND-6903 | low | Partial prerequisite admission is intentionally per-consumer and cannot be interpreted as a global gate pass. | PLAN-007, Task-010 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-070-source-readiness-independent-evidence-spec-review.md b/spec/reviews/SR-070-source-readiness-independent-evidence-spec-review.md new file mode 100644 index 0000000..574a7a7 --- /dev/null +++ b/spec/reviews/SR-070-source-readiness-independent-evidence-spec-review.md @@ -0,0 +1,25 @@ +--- +id: SR-070 +title: "Independent evidence-method review of progressive tl-syntax source readiness" +type: SpecReview +analysis: evidence +scope: "TM-004, FR-014..FR-018, NFR-004..NFR-005, IT-001..IT-002, spec/evidence/suites.md" +review_set: all +--- + +## Summary + +At `33678fa`, using spec-artifacts-process +`737987b7131938203c2bda0f153f4bf15e8818bd`, Quoin advised on 48 M6 +obligations with zero mismatches, zero uncatalogued methods and zero +inconclusive recommendations. Quire coverage is 84/162 repository rows backed +and 0/15 for TM-004, exactly matching the planned state. Rust trace authoring +is 45/45 symbols tagged and bound. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7001 | medium | SUITE-009..SUITE-013 and TC-059..TC-073 are allocations, not current evidence. They may advance only when real symbols and admitted shared interfaces exist. | TM-004, spec/evidence/suites.md | correct-requirement-no-evidence | +| FND-7002 | low | TC-072 is attributable engineering analysis and intentionally mints no Rust source symbol; its candidate, population, reviewer, policy, source set and limitations must be recorded before FR-016-AC-7 can be backed. | TC-072, IT-002-SC-07 | correct-requirement-no-evidence | +| FND-7003 | low | Four legacy metric-method mismatches remain outside M6: NFR-001-M-1/M-2, NFR-002-M-2 and NFR-003-M-7. | SR-062 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-071-source-readiness-independent-risk-complexity-spec-review.md b/spec/reviews/SR-071-source-readiness-independent-risk-complexity-spec-review.md new file mode 100644 index 0000000..f6e6116 --- /dev/null +++ b/spec/reviews/SR-071-source-readiness-independent-risk-complexity-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-071 +title: "Independent risk-complexity review of progressive tl-syntax source readiness" +type: SpecReview +analysis: risk-complexity +scope: "MRS-004, TM-004, FR-014..FR-018, NFR-004..NFR-005, AP-002, IT-001..IT-002" +review_set: all +--- + +## Summary + +The highest-risk `33678fa` seams are descriptor-bound source identity, +producer freshness, authoritative event completeness/time, durable retention, +supersession topology and atomic package publication. The specification assigns +each to a bounded negative control and prevents unavailable shared capability +from becoming local implementation. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7101 | medium | Each P0 suite needs a demonstrated load-bearing mutation, including the new change-then-restore source and event-page/snapshot/time controls, before favorable evidence is admissible. | AP-002, TC-068, TC-073 | correct-requirement-no-evidence | +| FND-7102 | medium | Publication races and event snapshots require real shared coordination semantics; filesystem naming or fetch-until-empty loops are not equivalent implementations. | FR-016-AC-6, FR-017-AC-2 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-072-source-readiness-independent-scope-boundary-spec-review.md b/spec/reviews/SR-072-source-readiness-independent-scope-boundary-spec-review.md new file mode 100644 index 0000000..fbed796 --- /dev/null +++ b/spec/reviews/SR-072-source-readiness-independent-scope-boundary-spec-review.md @@ -0,0 +1,23 @@ +--- +id: SR-072 +title: "Independent scope-boundary review of progressive tl-syntax source readiness" +type: SpecReview +analysis: scope-boundary +scope: "MRS-004, StR-003, StR-004, FR-014..FR-018, NFR-004..NFR-005, AD-002, PLAN-007" +review_set: all +--- + +## Summary + +The exact `33678fa` allocation keeps tl-syntax responsible for Rust domain +values, candidate/source projection and consumer adapters. Engineering +Assurance, Quire, Quoin, the retention operator, GitHub facts and human policy +retain their named authority. No editable TL/FRETish source path, local evidence +store, compatibility map, approval registry or qualification claim is added. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7201 | medium | LR08 dispositions remain cross-repository work. tl-syntax may enumerate its paths and implement Rust domain logic but cannot invent a local general runner or broaden Quoin's sole non-Rust accommodation. | FR-018, AD-002, quire-research#64 | correct-requirement-no-evidence | +| FND-7202 | low | The future integrator package transfers source facts only; intended-use, deployment, monitor and adoption authority remain open adopter inputs. | FR-016, IT-002 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-073-source-readiness-independent-ears-spec-review.md b/spec/reviews/SR-073-source-readiness-independent-ears-spec-review.md new file mode 100644 index 0000000..b1ff5fe --- /dev/null +++ b/spec/reviews/SR-073-source-readiness-independent-ears-spec-review.md @@ -0,0 +1,21 @@ +--- +id: SR-073 +title: "Independent EARS review of progressive tl-syntax source readiness" +type: SpecReview +analysis: ears-conformance +scope: "StR-003, StR-004, FR-014..FR-018, NFR-003..NFR-005" +review_set: all +--- + +## Summary + +Quire strict validation at `33678fa` reports 142/142 specification documents +grammar-clean. An independent semantic pass checked the new immutable-snapshot, +event-completeness and expiry clauses: each has an explicit subject, trigger, +observable response and failure state without merging separate authorities. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7301 | low | No remaining M6 EARS or requirement-atomicity defect was found. The implementation-dependent clauses remain conditional on their named released contracts. | FR-014..FR-018, NFR-004..NFR-005 | correct-requirement-no-evidence | diff --git a/spec/reviews/SR-074-source-readiness-census-rust-code-review.md b/spec/reviews/SR-074-source-readiness-census-rust-code-review.md new file mode 100644 index 0000000..7641874 --- /dev/null +++ b/spec/reviews/SR-074-source-readiness-census-rust-code-review.md @@ -0,0 +1,31 @@ +--- +id: SR-074 +title: "Independent Rust review of the source-readiness census update" +type: SpecReview +analysis: code-review +scope: "tests/shared_assurance.rs diff from origin/main through 33678fa" +review_set: subset +--- + +## Summary + +The branch changes no production Rust API. The `tests/shared_assurance.rs` +source-census union was reviewed under `agent-skills/rust-review/SKILL.md` for +fail-closed behavior, test load-bearing value, panic scope, unsafe, blocking and +resource surfaces. The exact expected population and area counts pass; all +panics and filesystem/process operations remain test-only; no unsafe block, +async/lock change, wire conversion or production resource bound is introduced. + +At `33678fa`, the complete local `make ci` composite passes without hosted CI: +formatting, feature matrix, strict Clippy, 44 Rust tests plus one doctest, +corpus/digest/oracle gates, cargo-deny, fuzz-target build, unsafe audit, strict +spec validation, MSRV tests, rustdoc, pin checks, mutation probes and the shared +assurance chain. Cargo-deny reports only its pre-existing unused-license and +fuzz path-dependency warnings. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7401 | high | The branch initially excluded every path below top-level `plan/`, allowing executable source placed there to evade the live census. The exemption is now limited to Markdown plan/review records, and a tracked extensionless `plan/run` fixture proves the executable remains live. | `is_archival_record`, `live_source_enumeration_has_an_exact_fail_closed_partition` | implementation-bug-despite-evidence | +| FND-7402 | low | Review and plan Markdown remain deliberately archival so adding an independent review cannot invalidate the exact source population it reviewed. Executable content still belongs to the separate FR-018 exhaustive invocation census. | FR-018, source census | correct-requirement-no-evidence | From 9598fea21295ce2688e26eaddfd73ec85084b890 Mon Sep 17 00:00:00 2001 From: Agent IX Date: Sat, 12 Sep 2026 23:51:36 -0700 Subject: [PATCH 7/9] Align M6 matrix with landed status contract --- spec/source-readiness-test-matrix.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/source-readiness-test-matrix.md b/spec/source-readiness-test-matrix.md index 5be399d..e8bf167 100644 --- a/spec/source-readiness-test-matrix.md +++ b/spec/source-readiness-test-matrix.md @@ -11,7 +11,7 @@ relationships: ## Functional Requirement Coverage -| Functional Req | Acceptance Criteria | Test Cases | Coverage Status | +| Functional Req | Acceptance Criteria | Test Cases | Status | |---|---|---|---| | FR-014 | FR-014-AC-1 through FR-014-AC-6 | TC-059, TC-060, TC-066, TC-068, TC-069 | 🚧 planned | | FR-015 | FR-015-AC-1 through FR-015-AC-7 | TC-062, TC-063, TC-066, TC-067, TC-070 | 🚧 planned | @@ -21,7 +21,7 @@ relationships: ## Stakeholder Requirement Coverage -| Stakeholder Req | Trace to US/FR | Test/Validation | Coverage Status | +| Stakeholder Req | Trace to US/FR | Test/Validation | Status | |---|---|---|---| | StR-004 | StR-004-VC-1 through StR-004-VC-3 | TC-059, TC-061, TC-062, TC-066 | 🚧 planned | From 7a3d15b27436155f42e693b44b1a2f98e2ae9902 Mon Sep 17 00:00:00 2001 From: Agent IX Date: Sat, 12 Sep 2026 23:55:00 -0700 Subject: [PATCH 8/9] Record merged-head M6 review --- .../log.md | 6 +++ .../tasks/Task-009-m6-specification-review.md | 2 +- ...ource-readiness-merged-head-code-review.md | 39 +++++++++++++++++++ 3 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 spec/reviews/SR-075-source-readiness-merged-head-code-review.md diff --git a/plan/Plan-007-source-qualification-readiness/log.md b/plan/Plan-007-source-qualification-readiness/log.md index 9a7b520..9b3e36e 100644 --- a/plan/Plan-007-source-qualification-readiness/log.md +++ b/plan/Plan-007-source-qualification-readiness/log.md @@ -18,3 +18,9 @@ description: "Chronological log of the progressive source-qualification-readines closed pathname ABA/TOCTOU, event-population/time-authority and archival- census bypass findings. All implementation tasks remain blocked; no TM-004 row or human release decision advanced. +* **2026-09-13** — Merged current main at `5b1c134`, preserving its W/M source + and canonical-graph corpus additions alongside the narrowed archival census. + SR-075 records the exact `9598fea` candidate review: `make ci` passes with 75 + Rust tests and one doctest, Quire validates 163 specification and 11 plan + documents, and all 48 M6 obligations classify without an assurance mismatch. + TM-004 remains truthfully planned at 0 of 17 rows. diff --git a/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md index 627d454..f64f9e9 100644 --- a/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md +++ b/plan/Plan-007-source-qualification-readiness/tasks/Task-009-m6-specification-review.md @@ -47,7 +47,7 @@ assurance records and real-integration scenarios before implementation. - Specification commit `767dc92a97f1b3d9ffbb76467bdda9ecf2261e40` - Author reviews SR-058 through SR-065 -- Independent exact-head reviews SR-066 through SR-074 +- Independent exact-head reviews SR-066 through SR-075 ## Notes diff --git a/spec/reviews/SR-075-source-readiness-merged-head-code-review.md b/spec/reviews/SR-075-source-readiness-merged-head-code-review.md new file mode 100644 index 0000000..4d31eea --- /dev/null +++ b/spec/reviews/SR-075-source-readiness-merged-head-code-review.md @@ -0,0 +1,39 @@ +--- +id: SR-075 +title: "Exact-head review of source readiness after the W/M source merge" +type: SpecReview +analysis: code-review +scope: "origin/main 5b1c134 through candidate snapshot 9598fea" +review_set: subset +--- + +## Summary + +The current `origin/main` W/M source and canonical-graph corpus work was merged +into the source-readiness branch and reviewed together with the M6 changes under +`agent-skills/rust-review/SKILL.md`. The conflict resolution preserves the +landed W/M fixtures and counts while retaining the narrowed archival predicate: +the fail-closed source census now covers exactly 128 tracked live-source paths, +including 34 corpus, 42 specification, 9 production-source and 10 test paths. +The tracked extensionless `plan/run` control continues to prove that an +executable cannot hide below an archival directory. + +The landed matrix contract now uses the single `Status` column, and TM-004 was +aligned to it at `9598fea`. Strict Quire validation passes for all 163 +specification documents and all 11 plan documents. Coverage reports 99 of 165 +rows overall, 76 of 76 Rust rows covered and the 17 M6 rows truthfully planned +rather than implemented. Quoin classifies all 48 M6 obligations with zero +mismatches, uncatalogued methods or inconclusive recommendations. + +At the exact candidate snapshot `9598fea`, `make ci` passes formatting, the +feature matrix, strict Clippy, 75 Rust tests plus one doctest, corpus/digest/ +oracle gates, cargo-deny, fuzz-target build, unsafe audit, strict specification +validation, MSRV tests, rustdoc, pin checks, mutation probes and the shared +assurance chain. No hosted CI result is claimed. + +## Findings + +| ID | Severity | Summary | Refs | Escape Cause | +| --- | --- | --- | --- | --- | +| FND-7501 | medium | Merging current main initially required a manual source-census union. The resolved population preserves every landed W/M source and fixture as well as the M6 fail-closed archival control; the exact 128-path and per-area assertions pass. | `tests/shared_assurance.rs`, PR #43, SR-074 | implementation-bug-despite-evidence | +| FND-7502 | low | SR-068's matrix-header finding is superseded by the single `Status` contract landed on main. TM-004 now uses that contract, validates without identifier/status warnings and remains honestly planned at 0 of 17 rows. | TM-004, SR-068, `9598fea` | correct-requirement-no-evidence | From 96fed20b20a295b685d1db10bc14511ce413de9b Mon Sep 17 00:00:00 2001 From: Agent IX Date: Sun, 13 Sep 2026 08:42:38 -0700 Subject: [PATCH 9/9] docs(review): complete M6 gap analysis --- ...ource-readiness-merged-head-code-review.md | 18 +++++++ ...-plan-007-source-readiness-gap-analysis.md | 54 +++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 spec/reviews/SR-076-plan-007-source-readiness-gap-analysis.md diff --git a/spec/reviews/SR-075-source-readiness-merged-head-code-review.md b/spec/reviews/SR-075-source-readiness-merged-head-code-review.md index 4d31eea..b58a266 100644 --- a/spec/reviews/SR-075-source-readiness-merged-head-code-review.md +++ b/spec/reviews/SR-075-source-readiness-merged-head-code-review.md @@ -31,6 +31,24 @@ oracle gates, cargo-deny, fuzz-target build, unsafe audit, strict specification validation, MSRV tests, rustdoc, pin checks, mutation probes and the shared assurance chain. No hosted CI result is claimed. +## Verdict + +**PASS** — no unresolved Rust or code/test-alignment defect was found in the +specification-only M6 PR after the current-main integration. + +## Assurance Context + +- **Profiles:** AP-001 and proposed AP-002, both profile version 0.2; AP-002 + requires specification review, independent code review and gap analysis. +- **Baseline:** PR #39 head `7a3d15b27436155f42e693b44b1a2f98e2ae9902` + over `origin/main` `5b1c134`; reviewed executable candidate `9598fea` plus + the final review/task-status record. +- **Impact evaluated:** live-source omission, candidate/configuration + substitution, automated authority promotion and limitation loss. +- **Decision boundary:** the PR defines M6 and its routing only. It implements + none of the 17 M6 rows and records no human source-release decision. +- **Active exceptions:** none. + ## Findings | ID | Severity | Summary | Refs | Escape Cause | diff --git a/spec/reviews/SR-076-plan-007-source-readiness-gap-analysis.md b/spec/reviews/SR-076-plan-007-source-readiness-gap-analysis.md new file mode 100644 index 0000000..db41973 --- /dev/null +++ b/spec/reviews/SR-076-plan-007-source-readiness-gap-analysis.md @@ -0,0 +1,54 @@ +--- +id: SR-076 +title: "Gap analysis — PLAN-007 progressive source readiness" +type: SpecReview +analysis: gap-analysis +scope: "plan/Plan-007-source-qualification-readiness/, spec/source-readiness-test-matrix.md, source and tests at 7a3d15b" +review_set: subset +relationships: + - { target: ix://agent-ix/tl-syntax/PLAN-007, type: reviews } + - { target: ix://agent-ix/tl-syntax/TM-004, type: references } +--- + +# Gap analysis — PLAN-007 progressive source readiness + +## Summary + +PLAN-007's specification/review task is done, while all seven implementation, +integration, package and final-assurance tasks remain blocked on their declared +shared contracts and human authorities. Quire reports 99 of 165 repository rows +backed and all 17 M6 rows truthfully planned and unbacked. + +## Verdict + +**FAIL** — 1 of 8 PLAN-007 tasks is done and 17 M6 rows lack executable backing. +This is the expected readiness state for the specification deliverable and +prevents any source-qualification or release claim. + +## Findings + +| ID | Severity | Summary | Refs | +| --- | --- | --- | --- | +| FND-7601 | high | Task-010 through Task-016 are blocked, so PLAN-007 is incomplete. The blockers include released source-grounding and LR08 contracts, retention/operator selection, authoritative decision events, real integration and human final assurance. | PLAN-007; Task-010 through Task-016 | +| FND-7602 | high | TM-004 has 0/17 rows backed. No planned M6 test or integration row is marked implemented, yielding 99/165 repository-wide backing. | TM-004; TC-059 through TC-073; IT-001; IT-002 | +| FND-7603 | medium | Engineering Assurance #34 is merged but no admitted immutable compatible release carries it; LR08 and retention/event/integrator-package contracts remain unresolved. Local substitutes are explicitly forbidden. | Task-010; FR-018; AD-002; quire-research#64 | + +## Coverage + +- Target plan: `plan/Plan-007-source-qualification-readiness/`. +- Tasks done: 1 / 8; blocked: 7 / 8. +- Repository rows backed: 99 / 165. +- M6 rows backed: 0 / 17. +- Rust binding census: 76 / 76 / 76 candidates, tagged and bound; no symbol is + presented as M6 implementation evidence. +- Changed production stubs: 0; the PR changes no production Rust. +- Reverse trace: every M6 criterion has a planned TC/IT owner and PLAN-007 task; + no planned row claims executable completion. +- Optional semantic intent/test/code review: not run because no explicit opt-in + was given. The comprehensive M6 specification lenses are recorded separately. + +## Disposition + +The specification is ready for its human acceptance gate. Keep Task-010 through +Task-016 and their GitHub issues blocked until each named resume condition is +actually satisfied.