design: CM execution model — JSON property graph and the coh runtime (M1 backbone)

[usurobor]

What changed

Adds research/cm-language/runtime/CM-EXECUTION-MODEL.md — the bounded design backbone for M1 — on its own review surface, cut from live main 274342f.

This document was previously committed onto agent/cm-developer-experience-note (PR #124), which coupled M0 promotion to a technical design still under active review. Per the accepted split, PR #124 is now vision-only again and this is the design's review surface.

Why

Shipping coh-min (#126/#127) produced five measured findings that turn M1 from "harvest three schemas from two runtimes" into a bounded ABI design step:

• schema.cue defines no #MeasurementReceipt and no #RunRequest; the two runtimes carry local contracts under two different format strings;
• the schema has an executable step type (#TypedStep) that neither runtime uses, while both independently invented the same private shape carrying the readiness-DAG edges the schema lacks;
• schema conformance is not runnability (see gate 9 below);
• result derivation is hardcoded in both runtimes; only the vocabulary is data;
• the portable safety invariant has no single definition either runtime can be checked against.

Iterations applied on top of the reviewed draft

Four corrections, accepted before this branch was cut:

• I1 — receipt discriminator bumped to tsc-measurement-receipt/0.2. The 0.1 string is already owned on main by the shipped coh-min receipt, whose core is structurally incompatible; reusing it would assert false compatibility and destroy format as a verifier discriminator. tsc-run-request/0.1 and tsc-sandbox-plan/0.1 keep their version — verified no live artifact claims either string.
• I2 — new acceptance gate 9, presence not merely exactness. A closed schema rejects extra fields but not absent ones: measured with cue v0.9.2, deleting format, procedure, or result_contract still passes cue vet -d '#NormalizedCMIR' while the runtime refuses all eight. Every canonical block must be provably required, runtime and verifier must independently refuse absence, and the negative fixture set must carry one missing-block case per canonical top-level block.
• I3 — fact-provenance invariant: any non-scheduler fact the result rule reads must originate in a declared typed step output or evidence predicate; scheduler facts are limited to status, principled skip/refusal/failure, and bounds/coverage. The Ascent-0 consequence is named in the implementation order — separating, pass count, tested-fiber size and the fiber/candidate counts must be republished through their producing steps' typed ports, which is the bulk of that step's work.
• I4 — canonical subject-snapshot construction and digest algorithms are deferred with a fail-closed boundary: a subject kind is executable only when it names a versioned snapshot/digest scheme; unknown schemes refuse.

Impact

Documentation only. Defines no schema, changes no code, freezes no ABI, and dispatches no implementation. The document is a review candidate until accepted through the project-native review path.

Validation

• one-file diff from main 274342f
• 642 → 696 lines; the four iterations are the only substantive additions to the reviewed draft
• format strings audited against live artifacts (tsc-run-request / tsc-sandbox-plan unused; tsc-measurement-receipt/0.1 and tsc-cm-ir/0.1 in live use, both correctly superseded)

Not in scope

.cm surface syntax and compiler, package registry and distribution, remote provider transport, cache semantics, the complete Core warrant-obligation catalog, and signature policy — all listed as deferred and fail-closed until versioned.

---

Generated by Claude Code

[usurobor]

Closing: superseded by the cohering reset.

main has been replaced with a parentless root from reset/cohering-foundation, which returns TSC to its original question — whether an LLM can be taught the generative operation of cohering. The CM execution model designed here belongs to the runtime direction that reset stopped.

This PR's base commit is no longer reachable from main. The full prior history, including this branch's base and every merged runtime cycle (#124, #126, #127, #129), is preserved at archive/cm-runtime-line (afbd065). Nothing is lost; it is simply no longer the project's direction.

The design work itself was sound and the branch remains at ecf3fbd. If a future plan justifies a runtime, this is the document to start from — but under the new plan's AC6, such machinery has to prove the first proof needs it before it returns.

---

Generated by Claude Code