Release retained portable runs on declared readback and settled successors (retained.qnt + production replay) - #389
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…oncile; pure supersession cores Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…path; close the D1/D2 plan rows Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…adback-successors # Conflicts: # docs/assurance.md # verification/quint/models.json
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…remeasure the package - The Quint manifest check required the literal parseItfTrace call; the retained replay uses quintTraceCache, the shared wrapper that performs the same parse. Accept either path. - The successor-intent test asserted the source's recovery capsule stayed byte-identical after a settled successor; supersession now releases that capsule while the indeterminate ledger keeps fencing, which is the claim's intended outcome. Assert supersededBy and the capsule's release instead. - Remeasure the package: 23,516,304 unpacked bytes on this branch across the unchanged 596-file inventory, restoring the reviewed allowance.
…adback-successors # Conflicts: # docs/assurance.md
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An indeterminate portable write's intent fence used to wait on retention material that only the operator could clear, and an elected duplicate successor left its source run's ledger and plugin bundle pinned forever. The portable readback-successor path now lets the fence open on a not-applied observation Ghostget itself obtains from the plugin's declared readback — bound to the run, its intent, auth realm, and manifest — and supersedes a source whose successor settled, releasing its recovery material and unpinning its bundle while the indeterminate ledger still fences the intent.
Claims moved
portable-retained-release(new)retained.qntmodels the retained-release protocol, checksretainedSafetyover 2,000 simulated samples of up to 12 steps and Apalache to length 8, and replays 300 seeded traces through the production supersession coresEvidence and how the evidence fails when broken
stepUntruthfulReadbacklets the plugin's readback claim anything;stepSupersedeReleasesLedgerreleases the intent ledger on supersession. Both violateretainedSafetyunderquint runand Apalache.scripts/verification-retained-replay.test.tsdrives the production reconcile/supersession code through every seeded trace (replay.target: production), so a model/production divergence in fence opening, supersession, or ledger retention fails the test file.src/provider-plugin-portable-runtime.test.ts(+569) exercises the declared readback, the bound-to-run observation, and supersession release;src/provider-plugin-package.test.tsandsrc/provider-plugin-protocol.test.tspin the new protocol surface;src/run-journal.test.tscovers the retained-release journal fields.Defects found
guard undeclared reconcile) with a regression test (test the undeclared-plugin path).kb/plans/formal-verification-assurance.md.Package budget
The new protocol/runtime code ships in
src/, sobun run verify:packageon this head is the budget check; the stored assertions are unchanged.CI cost
The Required verification job gains one model (
retained.qnt: Apalache length 8, 2,000 samples × 12 steps) and one replay file (300 traces through production). Nightly gets the same model at its CI bounds; no nightly deepening was recorded.Not covered
🤖 Generated with Claude Code