From f108291b7f6e7c778e4005bd37e54754607b627a Mon Sep 17 00:00:00 2001 From: claude Date: Sun, 26 Jul 2026 14:03:09 +0200 Subject: [PATCH] =?UTF-8?q?audit:=20harvest=202026-07-26=20cycle=20close?= =?UTF-8?q?=20=E2=80=94=20intake=20enumeration=20completed,=20ledger=20not?= =?UTF-8?q?es,=20stale=20comments?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Architect drift review (scope 77ad046..HEAD): What holds — the #343 reference-semantics hash is code-backed on both output surfaces (record line + trace index), the RiskRegime::Fixed stamp/re-derive lockstep is complete both ways, and both new guide examples build against the binary. Drift resolved in this commit: C24's root-name-gated intake enumeration gains the introspect --taps FILE branch plus its missing per-site pin (byte-identical refusal to the register sibling — the #331 class-enumeration lesson applied); C27 gains the #337 realization note (positive discovery view closes the recovery-only gap); C12's inline-hash sentence updated to the topo parameter; five stale dispatch_run comments reworded to name exec_blueprint_leg as the surviving owner. Remaining drift routed: the unpinned guide op-scripts are a durable debt class, filed as #344 (idea) rather than swept here. Regression gate: aura-bench all five fingerprints OK (report-only deltas within noise on a loaded box; no baseline move, nothing to ratify). refs #337 refs #343 --- crates/aura-cli/src/graph_construct.rs | 6 ++-- crates/aura-cli/src/main.rs | 31 ++++++++++++-------- crates/aura-cli/tests/graph_construct.rs | 26 ++++++++++++++++ docs/design/contracts/c12-atomic-sim-unit.md | 11 +++++-- docs/design/contracts/c24-blueprint-data.md | 8 +++-- docs/design/contracts/c27-declared-taps.md | 13 ++++++++ 6 files changed, 74 insertions(+), 21 deletions(-) diff --git a/crates/aura-cli/src/graph_construct.rs b/crates/aura-cli/src/graph_construct.rs index abe0a54..b7d9edf 100644 --- a/crates/aura-cli/src/graph_construct.rs +++ b/crates/aura-cli/src/graph_construct.rs @@ -966,9 +966,11 @@ pub(crate) fn composite_from_any(text: &str, env: &aura_runner::project::Env) -> /// `run_signal_r`/`run_measurement` -> `bind_tap_plan` -> /// `TraceStore::begin_run`. /// -/// (The quintet's other direct callers — `dispatch_run`, +/// (The quintet's other direct callers — the now-retired `dispatch_run`, /// `validate_and_register_axes`, `run_blueprint_sweep`/`_walkforward`/`_mc`, -/// `list_blueprint_axes` — retired with the quintet, #319 Task 8.) +/// `list_blueprint_axes` — none of these functions survives in the tree +/// today; all were retired together with the quintet, #319 Task 8. +/// `exec_blueprint_leg` above is the only direct caller left.) /// /// This shares the identical `name_gate` + `name_gate_fault_prose` /// primitives this wrapper uses, so the refusal wording is byte-identical diff --git a/crates/aura-cli/src/main.rs b/crates/aura-cli/src/main.rs index 93884bf..ef3a006 100644 --- a/crates/aura-cli/src/main.rs +++ b/crates/aura-cli/src/main.rs @@ -1178,12 +1178,13 @@ fn panic_refusal_prose(msg: &str) -> String { } /// The `exec` blueprint leg (#319): a synthetic single run of a fully-bound -/// blueprint envelope, composed 1:1 from `dispatch_run`'s `.json`-branch -/// building blocks — same intake gate, same shape dispatch (a `bias` output -/// → the strategy path; else ≥1 declared tap → a bare measurement run; else -/// refuse), same tap plan, same `run_signal_r`/`run_measurement` calls and -/// record-line serializer, so the record line stays byte-identical to -/// `run`'s. `--override` (Task 3, the #246 reopen residue) rides the +/// blueprint envelope — the sole surviving heir of the retired `dispatch_run`'s +/// `.json`-branch (and of the retired `run` verb it served, both gone with the +/// #319 sugar retirement): same intake gate, same shape dispatch (a `bias` +/// output → the strategy path; else ≥1 declared tap → a bare measurement run; +/// else refuse), same tap plan, same `run_signal_r`/`run_measurement` calls +/// and record-line serializer, so the record line stays byte-identical to +/// what `run` used to emit. `--override` (Task 3, the #246 reopen residue) rides the /// strategy path only — a measurement blueprint refuses it with one prose /// line (its `param_space()` is not wrap_r-wrapped, so the strategy path's /// probe/reopen recipe below does not apply to it materially). `run`'s @@ -1209,8 +1210,10 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au eprintln!("aura: {path}: {msg}"); std::process::exit(2); }); - // Same root-name gate as `dispatch_run`'s FILE intake (#331 delta - // re-review): `signal.name()` feeds `bind_tap_plan` -> `TraceStore::begin_run` + // This leg's own root-name gate at its FILE intake (#331 delta re-review; + // inherited from the retired `dispatch_run`'s identical gate before #319 + // retired it — `exec_blueprint_leg` is the sole surviving caller now): + // `signal.name()` feeds `bind_tap_plan` -> `TraceStore::begin_run` // unsanitized (`trace_store.rs`). if let Err(msg) = graph_construct::gate_authored_root_name(signal.name()) { eprintln!("aura: {path}: {msg}"); @@ -1261,9 +1264,10 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au eprintln!("aura: {e}"); std::process::exit(1); }); - // Refuse an open (free-knob) blueprint at the dispatch boundary, - // mirroring `dispatch_run`'s own closed-blueprint guard (#176): exec - // bootstraps over the EMPTY point, so a free knob would panic in + // Refuse an open (free-knob) blueprint at the dispatch boundary — this + // leg's own closed-blueprint guard now (#176; inherited from the + // retired `dispatch_run`'s identical guard before #319 retired it): + // exec bootstraps over the EMPTY point, so a free knob would panic in // `compile_with_params` — reject it clean instead. The guard now // runs on the REOPENED probe (#319 Task 3): its space must equal // exactly the override set (empty when there is none), never leave @@ -1342,8 +1346,9 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au } // Measurement path (#319 Task 2b): wrap_r-free closed guard via the // signal's own open knobs (`blueprint_axis_probe` would weld wrap_r - // and panic on a no-`bias` signal) — verbatim from `dispatch_run`'s - // measurement arm. + // and panic on a no-`bias` signal) — this leg's own guard now, + // carried forward verbatim from the retired `dispatch_run`'s + // measurement arm before #319 retired it. if !signal.param_space().is_empty() { eprintln!( "aura: run requires a closed blueprint (no free parameters); {} free knob(s) — \ diff --git a/crates/aura-cli/tests/graph_construct.rs b/crates/aura-cli/tests/graph_construct.rs index 513ceae..8a5b52f 100644 --- a/crates/aura-cli/tests/graph_construct.rs +++ b/crates/aura-cli/tests/graph_construct.rs @@ -1201,6 +1201,32 @@ fn graph_build_and_register_refuse_a_hand_crafted_envelope_with_a_bad_root_name( assert_eq!(err2, err, "both file-consuming envelope intakes share the identical fault prose"); } +/// (#331 spec test 10's missing sibling, harvest audit item 1): `introspect +/// --taps ` (#337) reads its FILE branch through the same +/// `composite_from_authored_text` choke point as `register` and `introspect +/// --content-id ` (C24's name-op clause), so a hand-crafted envelope +/// with a shape-violating root name refuses there too, with the identical +/// `name_gate_fault_prose` text — the per-site pin the C24 enumeration's +/// addition of `--taps` to its gated-intake list otherwise leaves unpinned. +#[test] +fn graph_introspect_taps_refuses_a_hand_crafted_envelope_with_a_bad_root_name() { + let dir = temp_cwd("taps-bad-root-name"); + let (envelope_bytes, _e, built) = run(&["graph", "build"], SIGNAL_DOC_DESCRIBED); + assert!(built, "graph build produces the envelope"); + let bad = envelope_bytes.replacen("\"name\":\"graph\"", "\"name\":\"../x\"", 1); + assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}"); + let file = dir.join("bad-root-name.json"); + std::fs::write(&file, &bad).expect("write envelope fixture"); + + let (out, err, code) = run_in(&dir, &["graph", "register", file.to_str().unwrap()]); + assert_eq!(code, Some(1), "a shape-violating root name refuses (not a panic): {out} {err}"); + + let (out2, err2, code2) = + run_in(&dir, &["graph", "introspect", "--taps", file.to_str().unwrap()]); + assert_eq!(code2, Some(1), "--taps refuses too: {out2} {err2}"); + assert_eq!(err2, err, "--taps shares the identical fault prose with register/--content-id"); +} + /// Property (#202, the same on-ramp seam at the sibling verb): `aura graph /// introspect --params` accepts an op-script exactly as it accepts a blueprint /// envelope — the raw axis namespace it prints for the op-script equals the one it diff --git a/docs/design/contracts/c12-atomic-sim-unit.md b/docs/design/contracts/c12-atomic-sim-unit.md index 14bc030..1032f70 100644 --- a/docs/design/contracts/c12-atomic-sim-unit.md +++ b/docs/design/contracts/c12-atomic-sim-unit.md @@ -16,9 +16,14 @@ semantics, not the reopened topology's (#343, revised; full clause in [C24](c24-blueprint-data.md)'s "Reproduction identity"). Identity is untouched: `content_id_of` (`crates/aura-research/src/lib.rs`) is the one hashing primitive, read directly off the authored document by `aura_runner::member`'s `run_signal_r`/`run_blueprint_member` — where the -manifest's `topology_hash` is computed inline (#319 Task 9 retired the -CLI-side wrapper that used to duplicate this one call) — never a re-opened -probe, and each member manifest records its per-cell bindings (#246, ratified +manifest's `topology_hash` is computed inline by default (`run_signal_r`'s +`topo: Option<&str>` parameter's `None` arm, every caller but one; #319 Task 9 +retired the CLI-side wrapper that used to duplicate this one call), or +supplied by the caller as a ready reference-semantics hash (`Some`, #343 +revised — `exec`'s override branch passes the loaded base document's own id, +computed before `reopen_all`, so the SAME value reaches both the record line +and the trace-store persistence) — never a re-opened probe either way, and +each member manifest records its per-cell bindings (#246, ratified 2026-07-12; the restriction this amends — axes bind only open knobs — was an implementation consequence of `bind()` shrinking the param surface, not a recorded decision). Raw data is shared read-only across sims via `Arc<[T]>` (the diff --git a/docs/design/contracts/c24-blueprint-data.md b/docs/design/contracts/c24-blueprint-data.md index 63e4510..3cd1c09 100644 --- a/docs/design/contracts/c24-blueprint-data.md +++ b/docs/design/contracts/c24-blueprint-data.md @@ -227,9 +227,11 @@ replayed in order; nodes are referenced **by identifier**, ports as dotted `..`) applied at this op intake **plus every CLI intake that reads an authored blueprint envelope from a file** — `graph register`, `introspect --content-id `, the bare graph-file viewer, `introspect --params - `'s file branch, and `exec`'s blueprint leg (#319; its narrower, - envelope-only grammar shares the same `gate_authored_root_name` call - directly rather than through the shape-discriminating wrapper) — one + `'s file branch, `introspect --taps `'s file branch (#337, + same `composite_from_authored_text` route), and `exec`'s blueprint leg + (#319; its narrower, envelope-only grammar shares the same + `gate_authored_root_name` call directly rather than through the + shape-discriminating wrapper) — one class of intake, one gate. The refusal's core sentence (`name_gate_fault_prose`) is byte-uniform across every one of these sites; only the leading context prefix varies — `exec` and the bare diff --git a/docs/design/contracts/c27-declared-taps.md b/docs/design/contracts/c27-declared-taps.md index 79267f2..853020a 100644 --- a/docs/design/contracts/c27-declared-taps.md +++ b/docs/design/contracts/c27-declared-taps.md @@ -96,6 +96,19 @@ The chain-pruning benefit — a sweep paying zero for the study wires behind an unbound tap — is **deferred to the future DCE cycle** ([C23](c23-graph-compilation.md)); the mechanism ships now, verified sound. +**#337 (2026-07-26 harvest) ships the positive discovery view**: +`Composite::declared_taps()` (`crates/aura-engine/src/blueprint.rs`) walks the +blueprint depth-first collecting `(tap name, source wire, column kind)`, bare +at every depth, bounds-total over an invalid wire; `graph introspect --taps +` renders one row per declared tap (a tap-less blueprint is a +stderr-noted listing, exit 0). This closes the **recovery-only** discovery +gap: before #337, the only way to learn a blueprint's declared tap names was +provoking `bind_tap_plan`'s `UnknownTap` refusal roster (#333) — a real name +surfaced only as the side effect of naming a wrong one first. The refusal +roster itself is unchanged and remains the **recovery** half (what to do once +a tap name is already wrong); `--taps` is the **discovery** half (learning the +right names up front). + ## See also - [C26](c26-input-binding.md) — the input-side twin (`input_roles`); `check_root_roles_bound`, the mandatory-input counterpart - [C23](c23-graph-compilation.md) — compilation/lowering and the deferred DCE cycle the tap design anticipates