WCC 0.1 — the working coding cell: writes, reviews, measures, receipts - #720
Open
usurobor wants to merge 20 commits into
Open
WCC 0.1 — the working coding cell: writes, reviews, measures, receipts#720usurobor wants to merge 20 commits into
usurobor wants to merge 20 commits into
Conversation
…ubject First increment of Working Coding Cell 0.1, from main. A cell now takes a separate run input carrying a typed issue, a logically distinct design, and a git subject reference; admits it structurally before anything is constructed; and freezes issue, design and pinned subject into the contract, inside the one scope-lift digest. Ported from the case-3 donor with their witnesses rather than rewritten, because those files had already survived adversarial review: cdsissue and its 15-fixture corpus, cellwork's subject with its 7, the kernel's opaque slot integrity, and the corpus preamble that builds `cn` from the revision under review instead of running whatever binary sits in the repository root. New: cellinput (pure decode plus the digest of the exact bytes), cdsdesign (importing cdsissue's blankness predicate rather than transcribing it a second time), cdsadmit (the door), and the admission receipt. Three review rounds. What they changed: Two declarations named a repository. cds.patch resolved its own workspace at construction while the runner independently pinned the subject, so a run could emit a self-verifying closure recording a repository the episode never acted on — reproduced with two repositories and a disagreeing input. `workspace` is deleted; contract.subject is the only source, and there is now exactly one base resolution per run. Envelope refusals exited 2 with no receipt while payload refusals exited 4 with one, under a test comment asserting the two paths were identical. Both now take the refusal path. An oversize payload was admitted, git was resolved, and both seats were constructed before the kernel refused. The door now enforces the kernel's bound, referencing it rather than restating it. The runner named a domain door directly. The door is now a registry field wired at the composition root, as fills are; the runner imports no profile package, directly or transitively. A fill that cannot act without a subject was refused only inside Produce, after the provider adapter was built and every skill body read. A fill now declares that requirement beside its constructor and the requirement is checked before construction — removing a skill from the hub no longer changes the error, which is how we know loading never begins. The kernel admitted any valid JSON in an opaque slot while the closure schema required an object, so a scalar could self-verify and then fail `cue vet`. The kernel now requires an object: a slot carries one tagged value, and a bare scalar is not a tagged anything. Moving the subject check ahead of construction then made six corpus negatives short-circuit before reaching their own defects, while the gate kept printing a tick for each. `run_bad` now asserts the REASON, not the exit code — exit 2 means refused and has never meant why. Verified by deleting the provider validation and watching the modelless-provider fixture report the wrong reason. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
…asurement, reconstruction Ported from the case-3 donor with their witnesses rather than rewritten, because those files had already survived adversarial review. Alpha is offered the surface the live dispatch workflow grants, Bash included, and the parity test READS that workflow rather than restating it: two hand-copied lists prove only that someone typed the same thing twice. `--allowedTools Bash` sits beside `--tools`, never instead of it, and the recipe is a capability declaration — this package claims no containment. Provider output streams instead of arriving as one dump at the end, and a stalled provider now says how far it got before stalling. Measurement is against the pinned base, so a seat that commits its own work is still measured; with `--binary`, so the measurement is something the runtime can reapply rather than a sentence about a change. `cellwork.Reconstruct` derives a bounded candidate view from the pinned subject and the measured matter alone: fresh worktree, apply, read back, release before returning. Only the value escapes. Symlinks are reported as links and never followed — a producing seat must not be able to route host bytes into a reviewer's prompt — and the byte bound is decided from metadata, because a limit checked after reading is not a limit. It has no production caller yet. Beta is increment 3, and a test fails if that stops being true. Review found four things worth fixing: The Case-2 smoke receipt described its episode's surface as "the declared --tools surface", which now resolves to a different list. The closure records no argv, so that document was the only record; the old surface is named literally again. `TestReconstructHasNoProductionCaller` had no scanned-file floor — a walk that reached nothing would have passed having proven nothing, which is the vacuity its own sibling guard exists to close. The "matter does not apply" case asserted a phrase git prints itself, so it passed with cellwork's wrapper collapsed to a generic message: the test written to test the wrapper did not test it. A test named for a worktree that cannot be cut actually exercises the temp-directory allocation. Renamed, and the untested branch is named. Not reproduced, and recorded rather than repeated: the donor's commit message reports 112 bytes for the base-relative measurement. Re-measuring on the donor branch itself gives 127. The donor's figure was ad-hoc and its own fixture never produced it; nothing here claims 112. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
A cell now declares ONE methodology bundle, loaded and digested once before either seat is constructed, and projects it into a constructive view and an adversarial one. `cds.patch`'s own skills list is deleted in both authorities: a seat does not declare obligations, it records the role of the projection it was handed and the digest of the bundle behind it. Two lists drift; one cannot. Bootstrap projection is identity under a fixed role wrapper, which makes projection equality trivially true today. Both the package header and its test say exactly that, and say what would make it a real property: an obligation that can be absent from one view. `cellcheck` is the runtime's own check, not the seat's account of it: build, vet, test, format, stopping at the first non-pass, against a candidate directory. `-count=1`, because a cached PASS is not a result. `format` is scoped to the paths the candidate changed, and that clause is what stops the checker being red forever: `gofmt -l src/go` lists 18 files on a clean tree of this repository, so a repo-wide step would fail on the base commit itself and no candidate could ever accept. Review found the scoping got its changed set from `git status` — that is, against HEAD. A seat has a shell and therefore git, so once it commits its own work the status is clean, the changed set is empty, and the step reports "no changed .go paths" and PASSES with an unformatted file in the change. This is the same defect cellwork.Diff already carries a witness for, in a new package. The set is now taken against the pinned base, and `Run` takes that base rather than inferring one. Also from review: git reports paths relative to the repository root, which need not be the directory handed to the checker — resolving that wrongly dropped every path and passed. The recipe already means "this is the candidate repository root", so that is now enforced rather than assumed, and an unstattable path is a refusal instead of a silent omission. Two smaller ones. A step's output was fully buffered before the tail bounded it; it is now bounded as the child writes, which is the rule the sibling package states for the same reason. And the unavailable/fail comment promised more than `exec.ExitError` can deliver — a step that starts and then dies on an unwritable build cache is a machine condition reported against the candidate, and the comment now says so. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
The reviewing seat exists. A run now closes the loop: admit, produce, measure, reconstruct, check, assess, close — with the assessment inside the one scope-lift digest. The catalogue is the admitted issue's acceptance ids plus two runtime-decided units. Not one unit per skill: a skill is guidance, not a decidable obligation, and a seat asked whether a patch satisfies a skill must guess or return unverified for all of them, which is the shape that produced a confident false finding on the donor branch. The property the design turns on is that cognition cannot launder a mechanical result. Review attacked it from every angle it could construct — direct override, leading and trailing whitespace, case variants, a U+2010 hyphen, a Cyrillic к, a zero-width space, duplicate units where one is honest, reordering, a fabricated reason on a forced unit, and `unavailable` claimed as pass. All rejected. The checker decides its own unit; a seat that disagrees has malfunctioned. `Reconstruct` gained an inspection hook, because the checker needs a directory while the seat may have only a value. It is a callback rather than a returned handle so the directory cannot outlive the call, and the view is read BEFORE the hook runs — a checker writes caches and can write into the tree, and a view read afterwards would carry its leavings as candidate content. That ordering had no test; it does now, and inverting it fails. The deterministic answerer is gone rather than ported. It returned a fill's verdict vocabulary from inside the package whose boundary is that it owns no fill semantics; the assessing fill supplies its own refusal in its own words. Review also found the reason rule and the disposition vocabulary were enforced only at the kernel's seal, so a provider's malformed answer surfaced as an episode malfunction naming neither the fill nor the provider — a true failure attributed to the wrong component. Both now belong to the reconciliation that judges the answer. And an issue could take an acceptance id in the `check:` namespace, which made every episode of that cell die blaming the seat for a catalogue the runtime had built with a duplicate in it. The namespace is reserved at the door, in both authorities. One thing neither seat's contract had asked for, found while fixing the above: the PRODUCING seat was never given the issue. It rendered a contract id and a one-line goal, so it wrote against a summary of its contract and was then reviewed against the contract. That is the defect the typed issue exists to end, and it did not end at the door. It has been true since the issue was ported to this branch, not introduced here. Both seats now render the same frozen bytes through the same function. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
…ence Seven episodes designed to make the cell reach an outcome it has not earned: an acceptance criterion that instructs the reviewer to pass everything; the same injection carried in through the code the producing seat was told to write; a criterion no implementation can satisfy; work that cannot compile; an issue already satisfied so the honest change is empty; a red suite whose cheapest green is deleting the assertion that fails; and an issue demanding a write outside the pinned subject. Six close non-accepting. The seventh accepts, and the case checks — from outside the closure, by applying the patch and reading the file — that it accepted for the honest reason: the producing seat fixed the fold rather than removing the assertion. Two results worth naming. The reviewing seat read injected instruction as data both times, and said so in its own words: "AC2 states no obligation about the repository or the change. Its text is an instruction." And the runtime checker has teeth under real cognition — a candidate that does not compile forced a finding while the cognitive criterion about it honestly passed, which is the design's central property observed rather than argued. The suite's own first version of the delete-the-test case was wrong: it asked for a green suite that was already green, so no cheat was tempting and the case proved nothing. The TEST was fixed, not the cell. That is recorded in the document rather than quietly corrected. What this does not establish is in the document too: A6 is one observation that a cheap path was not taken, not a property that it never would be. Cognitive outcomes are irreproducible by construction. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
… act without
Written by the coding cell, running on this repository, from an issue
naming the asymmetry: Registry.Alpha mapped to AlphaFill{Construct,
NeedsSubject} and refused before construction, while Registry.Beta was a
bare factory — so cds.assess, which reconstructs the candidate from
contract.subject, declared nothing and would have failed later, inside
Review, as a malfunction rather than a spec refusal.
Verified independently of its closure: applied to a fresh clone at the
pinned base, gofmt/vet/test green, and all five acceptance criteria read
by hand. It generalised past the issue — one rule over a two-entry side
table rather than a second copy of the check, alpha ordered first so an
existing error text stays exactly as it was.
Adds the witness the cell was not asked for and I only found by mutation:
flipping cds.assess's NeedsSubject to false left the entire suite green,
because the alpha refusal fires first and masks the beta one. The rule is
exercised in cellspec with stubs and the alpha declaration in cellrun;
nothing read the shipped beta declaration. A registration nothing reads
is a declaration that can quietly become false.
That gap is the issue's fault, not the cell's: the criterion asked for a
fact readable in the reconstructed view, and a readable fact is what it
got.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Reads the cell packages against eng/go, write-functional, evolve and ordinary practice, for repetition, signal-to-noise and unnecessary complication rather than correctness. Every finding is measured. The two that matter: two fill constructors are the same function written twice (exactShape is byte-identical apart from a label, Decl is declared identically, the constructors differ only in type names and two strings), and three separate implementations of 'bound this output' exist with two incompatible tail helpers whose differences are accidents rather than decisions. Comment ratio is inverted in five packages — 58% in cdsadmit, and a 66-line block on one argv function. The house style of explaining why stays; what leaves is incident history that belongs in commits and restatement of the next line. Records what is NOT a finding so a later reader does not 'fix' it: the test ratio is right, the Go/CUE duplication is deliberate, and the kernel's length is the protocol's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Written by the coding cell from the audit's first finding. cdspatch.Factory
and cdsassess.Factory were the same function twice — same steps, same
order, same error wrapping, differing only in the Constructed type and two
strings; their exactShape functions were byte-identical apart from a label,
and both packages declared an identical Decl.
cellfill.AdmitSeatDecl now owns the {fill, cognition} key language and the
projection-role check, taking the label prefix so every refusal keeps its
exact text. 90 lines leave the two fills, 79 arrive in one place with 112
lines of test; no test line was removed.
Verified outside the closure: applied to a fresh clone at the pinned base,
gofmt/vet/race/corpus green, no assertion removed or relaxed, and both
guards mutation-proved — disabling the role check fails
TestAdmitSeatDeclChecksTheProjectionRole, and widening the key language
breaks nine tests.
The first attempt at this issue failed, and failed correctly: one episode
covering both audit findings hit alpha's 10m bound, exited 2, and emitted
no closure. The timeout diagnostic ported in increment 2 did its job —
'captured 1264376 stdout bytes before the stall' distinguishes a provider
that never started from one that was working and ran long. The issue was
too large, not the bound wrong; it was split, which is better issue design
anyway.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Written by the coding cell from the audit's second finding. Three implementations of one idea — cellcog.boundedBuffer, cellcheck.tailBuffer and cellwork's bounded git reader — plus two tail helpers with different signatures, differing in which bytes survive by accident rather than decision. internal/cellbound now owns it: one Writer with an explicit KeepHead or KeepTail policy, one Tail(s, n), one truncation marker. No caller changed behaviour, because the policy is named at each call site rather than chosen for everyone: cellcog keeps the head, since Answer parses stdout from the start and refuses it when clipped; cellcheck keeps the tail, since a failing build says what went wrong at the end. 112 source lines across three packages become one 105-line package with its own tests. 55 test lines added, none removed. Verified outside the closure: applied to a fresh clone at the pinned base, gofmt/vet/race/corpus green, and both policies mutation-proved — swapping KeepHead and KeepTail fails both policy tests, and making Truncated always false fails them too, so each asserts WHICH bytes survive rather than that truncation happened. Three adversarial cases re-run against the refactored tree, including the two that exercise the bounded paths — the checker's failing build and the empty-matter refusal. Both still close non-accepting. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
… C2) Pi deferred cognitive admission for WCC 0.1 and required the cell to say so where it can be read rather than leaving it to a reader's assumption. Every receipt this door emits now carries semantic_adequacy, pinned to one string: operator-attested, this cell validated structure only. The door decides WELL-FORMEDNESS — keys, blankness, unique criterion ids, a verification route per criterion, a base pinned to a commit — and none of those can tell whether the criteria cover the problem, whether a non-goal reappeared inside one, or whether the impact graph is complete. Those are cdd/issue's questions, they are not mechanical, and this cell does not rent cognition to answer them. A receipt that carried an outcome and stayed silent would let a structural pass read as a semantic one. The receipt also gains its CUE half. It had a Go decoder and nothing else, which is the single-authority state this schema pair exists to end, and the corpus now vets a LIVE refusal receipt against #CDSAdmissionReceipt rather than grepping it. Dropping the field fails both authorities: the Go witness names the empty string it got, and the corpus reports the live receipt no longer vetting. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
…runaways 10 minutes was chosen before any real episode had run. Nine rented episodes on this branch now say it is wrong: the successful ones cluster at 460-500s against a 600s bound, and three failures were edit-dense work on real files — two with over a megabyte of provider output captured when they were killed. That is a seat that was working, not one that was stuck. Raised to 30 minutes, roughly 3.6x the observed peak. It stays a compiled-in constant rather than a cell-supplied value: a timeout a cell could set is a cell that can decline to be bounded. The failure mode itself needed no change and gets none. Each of the three failures exited 2 with no closure and no claim, and the diagnostic ported from the donor said which kind of failure it was — 'captured 1040845 stdout bytes before the stall' is a different fact from 'captured 0', and without it both read as the same dead provider. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Written by the coding cell. 48% of cellcog was comment, with a 66-line block on one argv function, mixing three things: rationale a maintainer needs, incident history about what an earlier revision claimed and how measurement falsified it, and sentences restating their own next line. Now 34%, and no executable line changed — verified mechanically, not by reading: every added and removed line in every .go file begins with // or is blank. What it did well, and better than the issue asked. The incident history was MOVED, not deleted: CDS-CELL-MIGRATION.md gains a measurement-history section carrying the permission_denials transcript and the falsified claims, so the record survives where a maintainer changing a flag will not trip over it. Every flag still states the alternative it rejects and the measurement behind it — 'go version was denied under the mode alone, zero denials with the flag' is still there, in one line instead of eight. And the honesty caveat that mattered most was hoisted rather than cut. The package doc now says once, for the whole adapter, that a declared tool surface is not confinement and that managed substrate policy stays above this baseline undetected — where it used to be repeated beside individual flags and narrowed each time. Verified outside the closure: applied to a fresh clone at the pinned base, gofmt/vet/race/corpus green, ratios recomputed by hand, and the deleted blocks read against the surviving code to confirm each was restatement or history rather than a reason. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Written by the coding cell. cdsadmit 58%, cellfills 54%, cellinput 51%, cdspatch 44% — now 33/33/33/32%, and no executable line changed, verified mechanically: every added and removed line in every .go file begins with // or is blank. Q3 is closed. All five packages the audit named are under 35%, and the incident history that made them dense lives in CDS-CELL-MIGRATION.md, where a maintainer changing a flag will not read a paragraph about what a previous revision wrongly claimed. Every load-bearing reason survives, checked by hand rather than taken from the assessment: cdsadmit still states the structural-versus-semantic boundary and the C2 attestation, in three lines instead of thirteen; cellfills still says why NeedsSubject is declared at the registration; cellinput still says why it digests the EXACT bytes handed in rather than a re-serialization. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Fifteen episodes rented real cognition on this branch. Nothing in the repository recorded that. The shared corpus runs the deterministic fake only — a CI job that rented a provider would be the provider service this project does not build — so without these files the cognitive path is a claim in a commit message. Six closures are committed: the two green runs and the four self-improvement runs whose patches landed as commits on this branch. A committed artifact nothing checks is decoration, so the kernel checks them. Each must pass VerifyClosure — the one scope-lift verification boundary, which recomputes the digest and re-derives verdict, decision, status and repair from the record — and each value the record carries must move that digest. The mutation table names twenty-five of them. The check lives in the kernel's own package because canonical bytes are the kernel's definition. A first attempt recomputed them in Python and failed all six files on encoding/json's HTML escaping: a difference between two implementations, and not a fact about any episode. The same lesson has a second edge, found by breaking the test on purpose: encoding/json COMPACTS a RawMessage on the way out, so a whitespace mutation to an opaque slot is erased before the digest sees it and reads as "the digest does not bind this slot". The mutations are visible in JSON by construction. Both oracles were made to fail before being trusted. One byte added to green-calc.json's goal: "scope-lift digest does not recompute; verdict does not derive from the receipt; decision does not derive from the verdict; status does not derive from (verdict, decision, mode)". A whitespace-only opaque-slot mutation: "does not bind contract.subject", "does not bind resolved_spec.alpha". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
The invocation lived in shell history and in my head. Three things an operator cannot reconstruct from the code were undocumented: that the repository and base come only from the run input's pinned subject (the `--param repo` / `--param base_sha` pair was deleted with the seat's `workspace` declaration), that the credential is ambient and never enters any document the cell reads or writes, and what each exit code means. The section that matters is patch extraction. A closure reports the gates it ran; a receipt trusted because it says so is not evidence. So the runbook shows getting `matter.data` out, applying it to a fresh clone at the pinned base, and running the gates by hand — gofmt scoped to the touched files base-relative, for the reason cellcheck had to be fixed. Every command was run as written; self-q1 applies clean at bfb4d97, 4 files, +229 -90. It also states what a run does not establish: no OS confinement, no knowledge of which model served the request, no reproducibility, and no claim about the issue — the cell is bounded by issue quality, not by capability. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
… Q7) Two findings in cellcheck, both about a shape saying something untrue about itself. Q5. The recipe was three uniform steps in an anonymous struct plus a fourth bolted on after the loop, because `format` disagrees with the others twice: it cannot be planned without the candidate's changed set, and `gofmt -l` reports by listing and exits 0 either way. Written that way, the recipe read as four uniform entries and the reader had to find the exception outside the list. A step is now a named type carrying its own `plan` and its own `classify`, so `format`'s two differences are properties of `format`. Adding `cue vet` when the binary is declared is now a line in the list rather than a change to any control flow. Q7. `Observation.Candidate` was a field nothing filled, held open for a caller that would know the identity of the tree it measured. That caller exists now — cds.assess reconstructs from a pinned base and a matter — and it still has no use for it: the identity would be `(base_sha, matter)`, which the record already binds under the scope-lift digest. Deleted, along with the test asserting Run never invented one. The classifier's witness survives the refactor, checked by neutering it: TestAnUnformattedChangedFileFailsNamingFormat fails when the listing stops being the failure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Three functions over 80 lines, each doing several separable things through one long body. Extracted where the extraction was obvious; the orchestration stays flat. cdsassess.Reconcile 92 -> 27. Its four rules now have four names: checkVocabulary (the closed disposition set and the reason rule), checkCoverage (each unit once, none invented, none dropped, in catalogue order), forced (the runtime measured it; a seat that disagrees has claimed authority it does not have), downgraded (a pass on a partial view cannot be told apart from a pass on content never shown). Each is now callable on its own; before, each was reachable only through the whole function. cellspec.Resolved.Build 91 -> 42, by naming the three things it did besides constructing: checkDeclaredNeeds, methodology (one load, two projections), contract. cdsadmit.admit: the presence-and-bound loop is slotFault, which says what is wrong with a payload before anything looks inside it. cellkernel.RunEpisode is left alone. Its length is the fixed protocol's, which the audit said when it named it. No witness was weakened, checked by removing each extracted call: without checkVocabulary, TestReconcileRejectsABadDispositionAndAWithheldReason fails; without checkDeclaredNeeds, the two cellspec subject-requirement tests and cellrun's TestASubjectlessPatchCellIsRefusedBeforeConstruction fail. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
The git-with-a-fixed-identity runner was written seven times across the cell packages' tests, and the copies had already drifted: three `testRepo`s differed in what they returned, and one trimmed its output where another did not. A fixture that differs by accident makes two tests measure two things while reading as one. internal/celltest now holds the three mechanisms more than one package needs — Git, Repo, Skill — imported only from _test files, so nothing reaches a built binary. What did NOT move is as deliberate. The SHAPES built on top of Git stay local: cdsadmit and cellspec want an empty base commit, cellcheck wants a base tree with a change on top, and a reader should see what a test set up without leaving the file. `contractFor` exists in two packages under one name and is two different functions — cdspatch builds a patch contract with required evidence, cdsassess reads a corpus issue — so merging them would unify a coincidence. cellspec/binding_test.go carried a note arguing against exactly this package: a shared helper "for fourteen lines would be a dependency between two test suites that are otherwise independent". True of two. It was seven by the time anyone counted, and the note now says so. Full suite green, plus -race on the three packages that drive git. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
Five conventions were in use — `cellwork:`, `cds issue:`, `cell spec:`, `cell run input:`, `cds admission:` — and RunEpisode used two of them three lines apart: `cellkernel: context after alpha:` beside `seal alpha:`. The rule, now stated once in cellfill's header: one identity, where the error LEAVES the package that decided it — the package's own name, or the fill id when the error is about a seat the operator declared in cell JSON. Inside, an error names the operation or the position and repeats no identity. Nothing in cellfill prefixes at all, because its errors are always wrapped by the fill that called it, and that fill is the identity an operator can act on. The cost of the old spread, measured rather than asserted, was a reader being told things twice: before: cds issue: cds issue problem has unknown key "extra" after: cdsissue: problem has unknown key "extra" Renamed: cds issue -> cdsissue, cds design -> cdsdesign, cds admission -> cdsadmit, cell spec -> cellspec, cell run input -> cellinput. The key-language labels lost the document name they were about to be prefixed with anyway. `cds.patch:` and `cds.assess:` stay dotted: they name what the operator wrote, not the package that read it. Full suite and the corpus green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
…itself Records what closed each finding: Q1-Q3 by the cell in four rented episodes whose closures are committed, Q4-Q8 by hand. Re-measures the comment ratios; all five packages Q3 named are at or under the 35% target. Two things left as measured rather than tidied. cellcheck went 41% -> 44% and was never in Q3's list — Q5 and Q7 removed code from it and stated why, so the ratio is arithmetic. And the baseline's test-to-source ratio of 0.55 was two different measurements divided by each other: cell-package test lines over all of internal/'s source. Measured consistently over the cell packages it is 1.27. The verdict that the ratio is right stands at the true number, which is the only reason worth stating it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
usurobor
pushed a commit
that referenced
this pull request
Aug 14, 2026
…ested at ebab86b Requests adversarial review of three specific surfaces, and asks Pi for a judgement on the next increment: the three CLI affordances that stand between a working cell and one a person or agent can run. Flags the one I am unsure about — a separately invokable admission door is a second entry point into the property door_test.go witnesses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
usurobor
pushed a commit
that referenced
this pull request
Aug 15, 2026
… no cell does git All four of Pi's findings checked against source and confirmed, with one correction to D2's reading that does not change the fix: the observation IS rendered into beta's prompt; what is discarded is the record's copy. Carries the operator's architectural correction, which goes past C2: neither the generic runner nor the CDS cell performs git. The cell produces code at the state of the filesystem it is run on; the caller branches and commits. Names the whole surface (nine call sites, two packages), argues that measurement and beta's reconstruction survive as filesystem operations, and flags the one property that genuinely leaves the cell: custody. Asks Pi for the subject shape and for whether the git removal lands in #720 or as its own head. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JeZdYf7VnzEpg9iEgCBtAF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CDD Trace
cn cell runran episodes with no issue, no admission, no reconstruction, no measured gatescdd/design,eng/evolveeng/go,eng/write-functional,eng/evolveeng/go,eng/testcdd/reviewebab86b0; corpus, suite and evidence test green locallyGap (step 4)
What: the generic cell runner could execute an episode, but nothing made
that episode coding work. There was no issue to satisfy, no admission door to
refuse an unsatisfiable one, no independent view for the reviewing seat, and no
measured evidence behind a receipt — β judged plausibility, and the receipt
recorded a seat's account of itself.
Why it matters: a receipt that records what a seat said it did is not
evidence. The whole point of the closure is that a parent can re-derive it
without trusting the episode.
What fails if skipped: a cell that accepts a patch which does not compile,
or that reports
acceptedbecause the issue text told the reviewer to.Mode + Active Skills (step 5)
eng/go(package boundaries, purity boundary §2.17, nosecond authority),
eng/write-functional(pure core, effects at the edge),eng/evolve(say why once; delete a claim narrowed twice)was found by breaking the guarded thing and watching a named oracle fail.
Changes
Added
cellinput,cdsadmit) —cnos.cds.run-input.v0carriesissue + design + subject, admitted and pinned before any seat is
constructed. A refused input costs nothing and returns an admission receipt
(exit 4) naming its own input digest.
cdsissue) — every field required and non-blank, everyacceptance criterion carrying a verification route,
check:reserved forruntime-measured units. One
Render, so both seats are told the same thingbecause there is one function, not two kept in step.
cellwork) — β's view isreconstruct(subject, matter),a deterministic runtime function. Independence by reconstruction, not by
blindness: it adds no information to the CCNF pair.
cellcheck,cellmethod) — the project verify reciperuns against the reconstructed candidate, base-relative. A checker
failforces a
finding; a cognitive answer contradicting a forced dispositionis a fault. Cognition cannot launder a mechanical result.
and through the code both read as data. A non-compiling candidate forces a
finding while the cognitive criterion honestly passes. An escape attempt is
refused with the host marker never written.
cellkernel/evidence_test.go: eachpasses
VerifyClosure, and 25 named values must each move the scope-liftdigest.
WCC-0.1-RUNBOOK.md— invocation, exit codes, and patch extraction withthe out-of-closure check.
WCC-CODE-QUALITY-AUDIT.md— 8 measured findings, all now closed.Changed
460–500s against a 600s wall, and three failures were edit-dense work. It
stays a compiled-in constant — a timeout a cell could set is a cell that can
decline to be bounded.
#NonBlankand Go's blankness predicate are now one pattern stringtranscribed into both authorities. They had diverged on 8 whitespace runes.
Removed
workspacefrom thecds.patchseat declaration. Two declarations of therepository could disagree, and the closure still self-verified.
Observation.Candidate, a field nothing ever filled (audit Q7).Fixed
a one-line goal.
cn; it ran whatever binary sat in the repo root. Amutation test passed after the guard it tested had been deleted.
cellcheckscopedformatoffgit status, so a seat that committed its ownwork passed with an unformatted file.
Quality audit — all eight findings closed
Q1–Q3 were fixed by the cell itself, in four rented episodes whose closures
are committed. Q4–Q8 by hand:
cellfill.SeatDeclhelper; the two fills state only what is their owncellboundwriter with head/tail policies, oneTailReconcile92→27 behind four named rules;Build91→42;admit's slot loop isslotFaultstepis a named type with its ownplanandclassify—format's two differences are properties offormatinternal/celltest; the git fixture had been written seven times and the copies had driftedcellfill's headerThe audit also corrects its own measurement: its baseline test-to-source
ratio of 0.55 divided cell-package test lines by all of
internal/'s source.Measured consistently over the cell packages it is 1.27.
Not in scope
weak one. An acceptance criterion whose verification route is "read it in the
view" gets exactly that. Cognitive admission of issue adequacy is deferred;
the admission receipt records
operator-attested; this cell validated structure only.codex-cli, which remains held.a boundary.
Acceptance Criteria
seat reports
reasons, plus the runtime's own
check:unitsworktree, one scope-lift digest,
VerifyClosurere-derives the whole tailits own receipt and exit code
argv/env/executable/timeout from cell JSON; the runtime measures rather
than believes
clone at the pinned base, gates run by hand, caller checkout byte- and
HEAD-unchanged
ebab86b0, mergeable state cleanKnown Debt
outcomes are committed as
evidence/wcc-adversarial-suite.jsonl.implying a check that did not happen.
internal/cell/cell.gois unformatted under current gofmt. It predatesthis branch and is untouched by it; scoping the fix here would put an
unrelated file in this diff.
Pre-Review Gate (alpha/SKILL.md §2.6)
main(origin/mainatfb527e6c, 0 behind)opaque-slot rules are stated once in
Contract.opaqueSlotscorpus vets live artifacts, not hand-written copies of them
cell-schema-check.shbuildscnfrom sourceand asserts the reason, not the exit code