diff --git a/Makefile b/Makefile index d100d6c..7e228d3 100644 --- a/Makefile +++ b/Makefile @@ -5,9 +5,9 @@ PYTHON ?= python verify: $(PYTHON) -m oic.cli validate-schema $(PYTHON) -m oic.cli verify-bootstrap + $(PYTHON) scripts/verify_code_start_gate.py @set +e; $(PYTHON) -m oic.cli verify-manifest --all; code=$$?; set -e; \ test $$code -eq 3; echo "PASS manifest remains explicitly INCOMPLETE (exit 3)" falsify: $(PYTHON) scripts/falsify_infrastructure.py - diff --git a/adr/ADR-013.md b/adr/ADR-013.md index 56d5cd7..c6ad37f 100644 --- a/adr/ADR-013.md +++ b/adr/ADR-013.md @@ -3,7 +3,7 @@ **Status:** Proposed **Work order:** OIC-WO-002 **Architecture authority:** GPT-5.6 Thinking. **Final design authority:** Arkadiy Miteiko / Veraxis. -**Scope:** architecture, proposed schemas, and conformance fixtures only. No ZTL call, no VEIP call, no admission, no envelope generation, no Rego, no runtime execution. The semantic implementation gate remains **BLOCKED**. +**Scope:** architecture, proposed schemas, and conformance fixtures only. No ZTL call, no VEIP call, no envelope generation, no Rego, no runtime execution. The exact ZTL profile is owner-admitted for bounded code start; the semantic code-start gate remains **NOT OPEN** pending separate exact-head review. --- @@ -277,8 +277,9 @@ Schema but fails a semantic conformance rule is invalid.** The eight rules are d machine-readably in the canonical mapping and are executable through a **test-only** validator kept deliberately outside `src/oic`. -**W-17.** This contract's `MEASURED` labels reference evidence still in **draft** PR #18. -**PR #16 must not merge before PR #18.** +**W-17.** This contract's `MEASURED` labels reference checked-in evidence on `main`. Owner +decision OIC-OWNER-DECISION-003 admits the exact profile/tag/commit/fixture-index tuple for +bounded code start only. Tier-1 reproduction remains **NOT ESTABLISHED**. **Pin correction.** The commit this profile previously pinned, `e819dec7e89d2dc67d6371e1eedb8e7aae854602`, predated the declared `ztljudge.judge` @@ -287,8 +288,8 @@ under that entrypoint could actually have been reproduced. The proposed profile corrected to the signed `veraxis-ztl-input-v0.2-signed` pin, `56e1ff0510c62b04dbd85bbe08b7a6deacbf276b`, and its conformance fixture set to `interface-freeze-v0.2/` (13 reachable, 3 not-reachable, 16 total). This corrects the -**proposed** profile's evidence pin; it does not admit a v0.2 semantic profile — -`kernel_profile_id` remains `ztl-v0.1` and no profile version field exists to bump. +profile's evidence pin; it does not create a v0.2 semantic profile — `kernel_profile_id` +remains `ztl-v0.1` and version remains `0.1.0`. On PR #18's eventual merge this work still rebases onto the resulting `main` and re-verifies every `MEASURED` label against the checked-in (not draft-branch) evidence, in @@ -495,9 +496,10 @@ Not decided here. The eventual handoff must bind **at least**: - evaluation input hash; - authority and admission versions. -**Final VEIP transition names and event schemas are deliberately not decided in this PR.** -Arkadiy Miteiko is interim VEIP contract owner (OIC-OWNER-DECISION-002 §5); the schema is -deferred to OIC-GC-004. +**Final VEIP transition names and event schemas remain deliberately undecided.** The +bounded, non-executable record in `docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json` +expresses the minimum handoff only; it creates no lifecycle authority or runtime adapter. +Final transition names and executable event schemas remain deferred to OIC-GC-004. ### 4.4 The two directions that must not cross @@ -522,8 +524,8 @@ emits a lifecycle event has crossed the other way. ## 6. Compatibility impact and migration **Nothing in `schemas/draft/` is modified by this ADR.** The proposals live in -`schemas/proposed/` and are inert until an owner decision admits them. `STATUS.md` is -unchanged and the semantic gate remains BLOCKED. +`schemas/proposed/` and remain inert. The exact ZTL input profile is admitted only for +bounded code start; the semantic code-start gate remains **NOT OPEN**. Three migrations are *proposed*, not applied: diff --git a/benchmarks/preflight/code-start-v0.1/PROVENANCE.json b/benchmarks/preflight/code-start-v0.1/PROVENANCE.json new file mode 100644 index 0000000..87bc779 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/PROVENANCE.json @@ -0,0 +1,8 @@ +{ + "receipts": [ + {"source_id": "CA-3", "sha256": "6e89ad25847944ca2bd72bcbf02ec3d2942a234d373b6c10db44307e0fbdf2c3", "provenance": "OIC-CA-FREEZE-CA-3-v0.1"}, + {"source_id": "SYN-NS-GOV-1", "sha256": "b882459931ddf06fb647e6885c1ced368b4a5f45b6441df618484a30473a2a24", "provenance": "DETERMINISTIC_REPOSITORY_GENERATION"}, + {"source_id": "SYN-NS-PROC-1", "sha256": "cfb578274460cc17492f4b25a4db6893ce87a527e1207fe6a52b6384125ec073", "provenance": "DETERMINISTIC_REPOSITORY_GENERATION"}, + {"source_id": "SYN-NS-AMEND-2", "sha256": "8e197bc9e01554853163dfb5f84ad807893f678b26673737c8a72ddf0c8daf47", "provenance": "DETERMINISTIC_REPOSITORY_GENERATION"} + ] +} diff --git a/benchmarks/preflight/code-start-v0.1/SOURCE-SET.json b/benchmarks/preflight/code-start-v0.1/SOURCE-SET.json new file mode 100644 index 0000000..592917e --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/SOURCE-SET.json @@ -0,0 +1,46 @@ +{ + "scope": "SEMANTIC_CODE_START_PREREQUISITES_ONLY", + "global_manifest_status": "INCOMPLETE", + "sources": [ + { + "source_id": "CA-3", + "path": "benchmarks/corpus/canada/freeze-v0.1/sources/CA-3.xml", + "sha256": "6e89ad25847944ca2bd72bcbf02ec3d2942a234d373b6c10db44307e0fbdf2c3", + "origin_classification": "REAL_PUBLIC_CANADIAN_SOURCE_UNOFFICIAL_COPY", + "benchmark_authority": "BOUNDED_TEST_INPUT_ONLY", + "effective_state": "NOT_ESTABLISHED_NO_DATE_INVENTED", + "rights_basis": "Reproduction of Federal Law Order (SI/97-5), subject to due diligence and no representation as an official version", + "rights_limitations": "Unofficial copy; third-party material, insignia, personal-information, and broader corpus clearance remain source-specific and unchanged", + "receipt": "benchmarks/corpus/canada/freeze-v0.1/receipts/CA-3.receipt.json" + }, + { + "source_id": "SYN-NS-GOV-1", + "path": "benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt", + "sha256": "b882459931ddf06fb647e6885c1ced368b4a5f45b6441df618484a30473a2a24", + "origin_classification": "SYNTHETIC_FICTIONAL", + "benchmark_authority": "SYNTHETIC_BENCHMARK_ONLY", + "issuer": "Veraxis synthetic fixture generator", + "effective_state": "SYNTHETIC_CURRENT" + }, + { + "source_id": "SYN-NS-PROC-1", + "path": "benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt", + "sha256": "cfb578274460cc17492f4b25a4db6893ce87a527e1207fe6a52b6384125ec073", + "origin_classification": "SYNTHETIC_FICTIONAL", + "benchmark_authority": "SYNTHETIC_BENCHMARK_ONLY", + "issuer": "Veraxis synthetic fixture generator", + "effective_state": "SYNTHETIC_SUPERSEDED", + "superseded_by": "SYN-NS-AMEND-2" + }, + { + "source_id": "SYN-NS-AMEND-2", + "path": "benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt", + "sha256": "8e197bc9e01554853163dfb5f84ad807893f678b26673737c8a72ddf0c8daf47", + "origin_classification": "SYNTHETIC_FICTIONAL", + "benchmark_authority": "SYNTHETIC_BENCHMARK_ONLY", + "issuer": "Veraxis synthetic fixture generator", + "effective_state": "SYNTHETIC_CURRENT", + "supersedes": "SYN-NS-PROC-1" + } + ] +} diff --git a/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt new file mode 100644 index 0000000..cfd9030 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt @@ -0,0 +1,16 @@ +SYNTHETIC — FICTIONAL TEST/BENCHMARK AUTHORITY ONLY +Document: Northstar Test Institution Operating Procedure Amendment +Version: 2.0.0 +Created: 2026-08-27T00:00:00Z +Effective state: SYNTHETIC_CURRENT +Confidentiality: PUBLIC_SYNTHETIC + +This amendment supersedes SYNTHETIC-NORTHSTAR-PROCEDURE-v1 in full. + +Current procedure: TEST_PURCHASE_HIGH requires both Approver-A and Approver-B, +consistent with the Governance Charter. A stale procedure must be refused as +current evidence. + +This document is fictional. It creates no legal, governmental, institutional, +Canadian, or other real-world authority. It is limited to deterministic tests +and benchmarks. diff --git a/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt new file mode 100644 index 0000000..dee9069 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt @@ -0,0 +1,29 @@ +SYNTHETIC — FICTIONAL TEST/BENCHMARK AUTHORITY ONLY +Document: Northstar Test Institution Governance Charter +Version: 1.0.0 +Created: 2026-08-27T00:00:00Z +Effective state: SYNTHETIC_CURRENT +Confidentiality: PUBLIC_SYNTHETIC + +Definitions: Requester means a fictional test actor. Approver means a fictional +test actor listed in the matrix. Evidence means a deterministic record bound to +the proposed action. + +Approval and delegation matrix: +- TEST_PURCHASE_LOW requires Approver-A. +- TEST_PURCHASE_HIGH requires Approver-A and Approver-B. +- Approver-A may delegate TEST_PURCHASE_LOW to Delegate-A. No other delegation + is recognized. + +Evidence requirement: every proposal carries its source identifier, amount, +requester identifier, and approval records. + +Exception: TEST_EMERGENCY may omit Approver-B only when an emergency record and +Approver-A approval are present. + +Discretionary clause: Approver-A may refer any proposal for human review. +Referral establishes no approval. + +This document is fictional. It creates no legal, governmental, institutional, +Canadian, or other real-world authority. It is limited to deterministic tests +and benchmarks. diff --git a/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt new file mode 100644 index 0000000..3e24e76 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt @@ -0,0 +1,15 @@ +SYNTHETIC — FICTIONAL STALE TEST/BENCHMARK SOURCE +Document: Northstar Test Institution Operating Procedure +Version: 1.0.0 +Created: 2026-08-27T00:00:00Z +Effective state: SYNTHETIC_SUPERSEDED +Confidentiality: PUBLIC_SYNTHETIC + +Procedure: TEST_PURCHASE_HIGH requires only Approver-A. + +This deliberately conflicting procedure is superseded in full by +SYNTHETIC-NORTHSTAR-AMENDMENT-v2. It must never be treated as current. + +This document is fictional. It creates no legal, governmental, institutional, +Canadian, or other real-world authority. It is limited to deterministic tests +and benchmarks. diff --git a/docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json b/docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json new file mode 100644 index 0000000..9b0abd8 --- /dev/null +++ b/docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json @@ -0,0 +1,13 @@ +{ + "status": "NON_EXECUTABLE_BOUNDARY_RECORD", + "version": "0.1.0", + "sequence": ["ActionProposal", "OIC exact proposal", "RuntimeDecision", "evidence handed downstream toward VEIP"], + "executable_runtime_integration": false, + "oic_has_veip_lifecycle_authority": false, + "veip_reinterprets_ztl": false, + "oic_self_authorizes_runtime_execution": false, + "missing_lifecycle_integration": "FAIL_CLOSED", + "runtime_adapter_authorized": false, + "lifecycle_execution_authorized": false, + "runtime_import_authorized": false +} diff --git a/docs/contracts/WARRANT-CONTRACT-v0.1.md b/docs/contracts/WARRANT-CONTRACT-v0.1.md index b9ae57b..1134f2d 100644 --- a/docs/contracts/WARRANT-CONTRACT-v0.1.md +++ b/docs/contracts/WARRANT-CONTRACT-v0.1.md @@ -550,15 +550,15 @@ the first VEIP artifact. ZTL must not create a VEIP lifecycle record. VEIP must not reinterpret the ZTL formula. -## 13a. Evidence dependency on PR #18 +## 13a. Admitted bounded ZTL evidence -**PR #16 must not merge before PR #18.** - -Every `MEASURED` label in the canonical mapping, and every field in -[`kernel-profiles/ztl-v0.1.json`](kernel-profiles/ztl-v0.1.json), references evidence that -is still in **draft** PR #18 and is not yet on `main`. Merging this first would leave the -contract citing a branch that could still change or be abandoned — the mapping would claim -measurement it could not point at. +The evidence formerly carried through PR #18 is checked in on `main`. Owner decision +OIC-OWNER-DECISION-003 admits the exact `ztl-v0.1` profile version `0.1.0`, signed tag +`veraxis-ztl-input-v0.2-signed`, commit +`56e1ff0510c62b04dbd85bbe08b7a6deacbf276b`, and fixture-index SHA-256 +`ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145` for bounded +semantic code start only. Tier-1 reproduction remains **NOT ESTABLISHED** and is deferred +to the experimental-release boundary. No ZTL runtime import or execution is admitted. ### Pin correction @@ -577,29 +577,20 @@ dependency pin. `interface-freeze-v0.1` is **not edited**. It remains immutable historical evidence with a documented lineage hole — the commit it cited predated `ztljudge.judge`, so no fixture claiming reproduction against it under that entrypoint was actually recomputable at that -pin. This correction updates the **proposed** `ztl-v0.1` profile's evidence pin only. -`kernel_profile_id` remains `ztl-v0.1`; no admitted v0.2 semantic profile is created. +pin. This correction updated the `ztl-v0.1` profile's evidence pin only. +`kernel_profile_id` remains `ztl-v0.1`; no v0.2 semantic profile is created. The new commit's fixture set additionally reproduces `EARNED` + non-empty `unverified` as a **pinned, reachable** fixture (`earned-hereditary-nonempty-unverified.json`), rather than leaving it as census-only corroboration. That question from the prior revision is therefore resolved by the pin correction itself, not left open. -### Remaining merge-order steps - -Because the current evidence is PR #18's **draft** head rather than its merged state, this -PR still must, once PR #18 merges: - -1. rebase onto the merged `main`; -2. re-verify **every** `MEASURED` authority label against the checked-in evidence, in case - anything moved between the current evidence head and the merge; -3. re-point the census and fixture references at their merged paths if either changed. - ## 14. Standing -Proposed under OIC-WO-002. Not admitted. No ZTL or VEIP code exists, is imported, or is +The contract remains proposed and unimplemented; only the exact ZTL input profile is +owner-admitted for bounded code start. No ZTL or VEIP code exists, is imported, or is called. No policy document is parsed, no Institutional IR is constructed, no Open Control Envelope is generated, no Rego is emitted, and OPA is not invoked. -`STATUS.md` is unchanged. `schemas/draft/` is unchanged. **No semantic implementation was -introduced. The semantic implementation gate remains BLOCKED.** +`schemas/draft/` is unchanged. **No semantic implementation was introduced. The semantic +code-start gate is READY FOR SEPARATE EXACT-HEAD REVIEW and NOT OPEN.** diff --git a/docs/contracts/ZTL-OCE-MAPPING-v0.1.md b/docs/contracts/ZTL-OCE-MAPPING-v0.1.md index eb8704e..f119ee7 100644 --- a/docs/contracts/ZTL-OCE-MAPPING-v0.1.md +++ b/docs/contracts/ZTL-OCE-MAPPING-v0.1.md @@ -213,4 +213,5 @@ Proposed by the OIC side under OIC-WO-002. Requires: - **Arkadiy Miteiko / Veraxis** — final design authority. No ZTL call was made to produce this document; the measured rows cite fixtures published -by the ZTL side. No adapter exists. The semantic implementation gate remains **BLOCKED**. +by the ZTL side. No adapter exists. The semantic code-start gate remains **NOT OPEN** +pending separate exact-head review. diff --git a/docs/contracts/kernel-profiles/ztl-v0.1.json b/docs/contracts/kernel-profiles/ztl-v0.1.json index 2f8520b..5c5b93a 100644 --- a/docs/contracts/kernel-profiles/ztl-v0.1.json +++ b/docs/contracts/kernel-profiles/ztl-v0.1.json @@ -1,5 +1,5 @@ { - "$comment": "PROPOSED, NOT ADMITTED. A frozen description of one logic kernel's interface and vocabulary. Dispositions, grades, and digests are NOT portable between kernels, so every WarrantArtifact declares the kernel_profile_id it was produced under and OIC never compares artifacts across profiles. Nothing in this file imports, executes, or calls ZTL.", + "$comment": "OWNER-ADMITTED FOR BOUNDED SEMANTIC CODE START ONLY. A frozen description of one logic kernel's interface and vocabulary. Dispositions, grades, and digests are NOT portable between kernels, so every WarrantArtifact declares the kernel_profile_id it was produced under and OIC never compares artifacts across profiles. Nothing in this file imports, executes, or calls ZTL.", "canonicalization_profile_id": "ztl-jcs-float-free-sha384-v0.1", "commit": "56e1ff0510c62b04dbd85bbe08b7a6deacbf276b", "conformance_fixture_set": { @@ -13,7 +13,7 @@ "index_sha256": "ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145", "location": "adapters/ztl/fixtures/interface-freeze-v0.2/", "not_reachable": 3, - "provenance": "Published by the ZTL side under ZTL-OIC-WO-002/OIC-WO-003, reproduced against the pinned v0.2 commit by its author (Tier 3). Independent Tier-1 reproduction remains OPEN.", + "provenance": "Published by the ZTL side under ZTL-OIC-WO-002/OIC-WO-003, reproduced against the pinned v0.2 commit by its author (Tier 3). Independent Tier-1 reproduction is NOT ESTABLISHED and is deferred to the experimental-release boundary.", "reachable": 13, "total": 16 }, @@ -81,16 +81,9 @@ ], "entrypoint": "ztljudge.judge", "evidence_dependency_notice": { - "current_pin": "interface-freeze-v0.2, index_sha256 ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145 (13 reachable, 3 not-reachable, 16 total), reproduced against the signed commit 56e1ff0510c62b04dbd85bbe08b7a6deacbf276b (veraxis-ztl-input-v0.2-signed). This is PR #18's current DRAFT evidence head, not its merged state.", - "merge_order": "PR #16 must not merge before PR #18.", - "on_pr18_merge": [ - "PR #16 rebases onto the merged main.", - "Every MEASURED authority label in the canonical mapping is re-verified against the checked-in evidence, in case anything moved between the current evidence head and the merge.", - "conformance_fixture_set.location, counts and index_sha256 are re-pointed at the merged path if the evidence changed further before merge.", - "The census reference is re-pointed at its merged path." - ], - "statement": "Every field in this profile references evidence that is still in DRAFT pull request #18 and is NOT yet on main.", - "status": "BLOCKING for merge order" + "current_pin": "interface-freeze-v0.2, index_sha256 ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145 (13 reachable, 3 not-reachable, 16 total), reproduced against signed commit 56e1ff0510c62b04dbd85bbe08b7a6deacbf276b (veraxis-ztl-input-v0.2-signed). Evidence is checked in on main and owner-admitted for bounded code start.", + "statement": "The exact profile, tag, commit, and fixture index are admitted only for bounded semantic code start. No runtime import or execution is admitted.", + "status": "ADMITTED_BOUNDED_CODE_START" }, "formula_digest_algorithm": "sha384", "formula_hash_projection": { @@ -218,7 +211,8 @@ "name": "veraxis-ztl-input-v0.2-signed", "signs_commit": "56e1ff0510c62b04dbd85bbe08b7a6deacbf276b" }, - "status": "PROPOSED - frozen interface description, not admitted", + "status": "ADMITTED FOR BOUNDED SEMANTIC CODE START ONLY", + "tier_1_reproduction": "NOT ESTABLISHED — DEFERRED TO EXPERIMENTAL RELEASE", "unsigned_tag": "veraxis-ztl-input-v0.1", "unverified_ground_semantics": { "EARNED": "informational - irrelevant to this conclusion because the result is hereditary", diff --git a/docs/decisions/OIC-OWNER-DECISION-003.md b/docs/decisions/OIC-OWNER-DECISION-003.md new file mode 100644 index 0000000..4c3cb01 --- /dev/null +++ b/docs/decisions/OIC-OWNER-DECISION-003.md @@ -0,0 +1,10 @@ +# OIC Owner Decision 003 — semantic code-start prerequisites + +Status: **RECORDED FOR SEPARATE EXACT-HEAD REVIEW — GATE NOT OPEN** + +- **OD-001:** bounded source set is CA-3 plus deterministic, explicitly synthetic fictional companions. Synthetic material has benchmark authority only. CA-3 remains an unofficial copy with its existing source-specific rights limitations; broader Canada clearance is unchanged. +- **OD-002:** admit only profile `ztl-v0.1` version `0.1.0`, tag `veraxis-ztl-input-v0.2-signed`, commit `56e1ff0510c62b04dbd85bbe08b7a6deacbf276b`, fixture-index SHA-256 `ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145` for bounded semantic code start. No ZTL runtime is imported or executed. +- **OD-003:** Tier-1 independent reproduction is **NOT ESTABLISHED** and deferred to the experimental-release boundary. It is not a code-start blocker and is not represented as PASS. +- **OD-004:** the minimum boundary is `ActionProposal → OIC exact proposal → RuntimeDecision → evidence handed downstream toward VEIP`. The boundary record is non-executable. OIC has no VEIP lifecycle authority, VEIP does not reinterpret ZTL, and no runtime adapter, import, execution, or self-authorization is permitted. + +Global repository completeness remains **INCOMPLETE**. These decisions close only bounded prerequisites and do not authorize semantic implementation. diff --git a/docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md b/docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md new file mode 100644 index 0000000..6ca7678 --- /dev/null +++ b/docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md @@ -0,0 +1,20 @@ +# OIC semantic code-start gate closure candidate + +Global repository completeness: **INCOMPLETE** + +Scoped prerequisite evidence: + +| Decision | Evidence | Producer disposition | +|---|---|---| +| OD-001 | `benchmarks/preflight/code-start-v0.1/SOURCE-SET.json` plus immutable source bytes/digests | MATERIAL prerequisites represented | +| OD-002 | `docs/contracts/kernel-profiles/ztl-v0.1.json` exact profile/tag/commit/index | ADMITTED for bounded code start only | +| OD-003 | owner decision record | NOT ESTABLISHED; deferred to experimental release | +| OD-004 | `docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json` | NON-EXECUTABLE boundary represented | + +Negative controls are enforced by `scripts/verify_code_start_gate.py` and contract tests. This establishes neither semantic correctness nor legal, benchmark, runtime, lifecycle, or production claims. + +SEMANTIC CODE-START GATE: +READY FOR SEPARATE EXACT-HEAD REVIEW +NOT OPEN + +SEMANTIC IMPLEMENTATION HAS NOT STARTED. diff --git a/scripts/verify_code_start_gate.py b/scripts/verify_code_start_gate.py new file mode 100644 index 0000000..99c75d9 --- /dev/null +++ b/scripts/verify_code_start_gate.py @@ -0,0 +1,219 @@ +#!/usr/bin/env python3 +"""Fail-closed verifier for the non-semantic code-start evidence package.""" + +from __future__ import annotations + +import hashlib +import json +import shutil +import subprocess +import sys +from pathlib import Path +from typing import Any + +EXPECTED_ZTL = { + "profile_id": "ztl-v0.1", + "version": "0.1.0", + "commit": "56e1ff0510c62b04dbd85bbe08b7a6deacbf276b", + "tag": "veraxis-ztl-input-v0.2-signed", + "index": "ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145", +} +STALE_ZTL_TEXT = ( + "current DRAFT evidence head", + "still in DRAFT pull request #18", + "must not merge before PR #18", +) +ADMITTED_PRE_GATE_HEAD = "4065e6a7c02badd3356f4c74be0815079d836aca" +ADMITTED_SRC_OIC_PATHS = frozenset( + { + "src/oic/__init__.py", + "src/oic/baseline.py", + "src/oic/cli.py", + "src/oic/doctor.py", + "src/oic/errors.py", + "src/oic/hashing.py", + "src/oic/manifests.py", + "src/oic/paths.py", + "src/oic/py.typed", + "src/oic/schemas.py", + } +) + + +class GateEvidenceError(ValueError): + """Evidence fails a bounded gate invariant.""" + + +def _require(condition: bool, message: str) -> None: + if not condition: + raise GateEvidenceError(message) + + +def discover_unadmitted_production_paths(root: Path) -> list[str]: + """Compare tracked ``src/oic`` paths with the immutable pre-gate baseline.""" + git = shutil.which("git") + if git is None: + raise GateEvidenceError("cannot enumerate tracked src/oic production paths") + result = subprocess.run( # noqa: S603 - fixed executable and literal arguments + [git, "-C", str(root.resolve()), "ls-files", "--", "src/oic"], + check=False, + capture_output=True, + text=True, + ) + if result.returncode != 0: + raise GateEvidenceError("cannot enumerate tracked src/oic production paths") + current = {line for line in result.stdout.splitlines() if line} + added = sorted(current - ADMITTED_SRC_OIC_PATHS) + missing = sorted(ADMITTED_SRC_OIC_PATHS - current) + return added + [f"MISSING:{path}" for path in missing] + + +def validate_evidence( + source_set: dict[str, Any], + receipts: dict[str, Any], + profile: dict[str, Any], + veip: dict[str, Any], + gate_text: str, + source_bytes: dict[str, bytes], + active_text: str, + semantic_paths: list[str] | None = None, +) -> None: + _require( + source_set.get("global_manifest_status") == "INCOMPLETE", "global manifest state escalated" + ) + by_id = {item["source_id"]: item for item in source_set.get("sources", [])} + receipt_by_id = {item["source_id"]: item for item in receipts.get("receipts", [])} + _require( + len(by_id) == 4 and set(by_id) == set(receipt_by_id), "source/receipt provenance mismatch" + ) + for source_id, item in by_id.items(): + payload = source_bytes.get(source_id) + if payload is None: + raise GateEvidenceError(f"missing source bytes: {source_id}") + digest = hashlib.sha256(payload).hexdigest() + _require(digest == item.get("sha256"), f"source digest mismatch: {source_id}") + _require( + digest == receipt_by_id[source_id].get("sha256"), + f"receipt digest mismatch: {source_id}", + ) + if source_id.startswith("SYN-"): + _require( + item.get("origin_classification") == "SYNTHETIC_FICTIONAL", + "synthetic classification missing", + ) + _require( + item.get("benchmark_authority") == "SYNTHETIC_BENCHMARK_ONLY", + "synthetic represented as real authority", + ) + _require( + item.get("issuer") == "Veraxis synthetic fixture generator", + "synthetic issuer masquerades as government", + ) + _require( + str(item.get("effective_state", "")).startswith("SYNTHETIC_"), + "fabricated government effective metadata", + ) + decoded = payload.decode("utf-8") + _require( + "SYNTHETIC" in decoded and "fictional" in decoded.lower(), + "source bytes lack synthetic warning", + ) + ca3 = by_id["CA-3"] + _require( + ca3.get("origin_classification") == "REAL_PUBLIC_CANADIAN_SOURCE_UNOFFICIAL_COPY", + "CA-3 provenance changed", + ) + _require( + ca3.get("effective_state") == "NOT_ESTABLISHED_NO_DATE_INVENTED", + "CA-3 effective date invented", + ) + + _require(profile.get("profile_id") == EXPECTED_ZTL["profile_id"], "wrong ZTL profile") + _require(profile.get("version") == EXPECTED_ZTL["version"], "wrong ZTL version") + _require(profile.get("commit") == EXPECTED_ZTL["commit"], "wrong ZTL commit") + _require(profile.get("signed_tag", {}).get("name") == EXPECTED_ZTL["tag"], "wrong ZTL tag") + _require( + profile.get("conformance_fixture_set", {}).get("index_sha256") == EXPECTED_ZTL["index"], + "wrong ZTL fixture index", + ) + _require( + profile.get("tier_1_reproduction") == "NOT ESTABLISHED — DEFERRED TO EXPERIMENTAL RELEASE", + "Tier-1 state escalated", + ) + _require( + profile.get("status") == "ADMITTED FOR BOUNDED SEMANTIC CODE START ONLY", + "bounded ZTL admission missing", + ) + _require( + not any(marker.lower() in active_text.lower() for marker in STALE_ZTL_TEXT), + "stale ZTL currentness text", + ) + + for field in ( + "executable_runtime_integration", + "oic_has_veip_lifecycle_authority", + "veip_reinterprets_ztl", + "oic_self_authorizes_runtime_execution", + "runtime_adapter_authorized", + "lifecycle_execution_authorized", + "runtime_import_authorized", + ): + _require(veip.get(field) is False, f"forbidden VEIP state: {field}") + _require( + veip.get("missing_lifecycle_integration") == "FAIL_CLOSED", + "VEIP boundary is not fail-closed", + ) + normalized_gate = gate_text.replace("*", "").upper() + _require( + "GLOBAL REPOSITORY COMPLETENESS" in normalized_gate and "INCOMPLETE" in normalized_gate, + "global incompleteness not explicit", + ) + _require( + "READY FOR SEPARATE EXACT-HEAD REVIEW\nNOT OPEN" in normalized_gate, "gate language invalid" + ) + _require(not semantic_paths, "semantic implementation appeared before gate opening") + + +def load_and_validate(root: Path) -> None: + def load(path: str) -> dict[str, Any]: + value: dict[str, Any] = json.loads((root / path).read_text(encoding="utf-8")) + return value + + source_set = load("benchmarks/preflight/code-start-v0.1/SOURCE-SET.json") + receipts = load("benchmarks/preflight/code-start-v0.1/PROVENANCE.json") + profile = load("docs/contracts/kernel-profiles/ztl-v0.1.json") + veip = load("docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json") + gate_text = (root / "docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md").read_text( + encoding="utf-8" + ) + active_text = "\n".join( + (root / path).read_text(encoding="utf-8") + for path in ( + "docs/contracts/kernel-profiles/ztl-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "adr/ADR-013.md", + ) + ) + source_bytes = { + item["source_id"]: (root / item["path"]).read_bytes() for item in source_set["sources"] + } + semantic_paths = discover_unadmitted_production_paths(root) + validate_evidence( + source_set, + receipts, + profile, + veip, + gate_text, + source_bytes, + active_text, + semantic_paths=semantic_paths, + ) + + +if __name__ == "__main__": + try: + load_and_validate(Path(__file__).resolve().parents[1]) + except (GateEvidenceError, OSError, KeyError, json.JSONDecodeError) as exc: + print(f"FAIL semantic code-start gate evidence: {exc}") + sys.exit(1) + print("PASS semantic code-start prerequisite evidence; gate remains NOT OPEN") diff --git a/tests/contract/test_canada_acquisition_freeze.py b/tests/contract/test_canada_acquisition_freeze.py index cb782e8..47c3f61 100644 --- a/tests/contract/test_canada_acquisition_freeze.py +++ b/tests/contract/test_canada_acquisition_freeze.py @@ -456,7 +456,16 @@ def test_status_and_draft_schemas_are_untouched(repo_root: Path) -> None: ).stdout.splitlines() assert "STATUS.md" not in changed assert not any(path.startswith("schemas/draft/") for path in changed) - assert not any(path.startswith("docs/contracts/") for path in changed) + allowed_contract_updates = { + "docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "docs/contracts/ZTL-OCE-MAPPING-v0.1.md", + "docs/contracts/kernel-profiles/ztl-v0.1.json", + } + assert ( + not {path for path in changed if path.startswith("docs/contracts/")} + - allowed_contract_updates + ) assert not any(path.startswith("adapters/ztl/") for path in changed) diff --git a/tests/contract/test_canada_rights_resolution_dossier.py b/tests/contract/test_canada_rights_resolution_dossier.py index 56f4736..e8d9dcc 100644 --- a/tests/contract/test_canada_rights_resolution_dossier.py +++ b/tests/contract/test_canada_rights_resolution_dossier.py @@ -612,7 +612,16 @@ def test_status_and_draft_schemas_are_unchanged(repo_root: Path) -> None: changed = _changed_files(repo_root) assert "STATUS.md" not in changed assert not any(path.startswith("schemas/draft/") for path in changed) - assert not any(path.startswith("docs/contracts/") for path in changed) + allowed_contract_updates = { + "docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "docs/contracts/ZTL-OCE-MAPPING-v0.1.md", + "docs/contracts/kernel-profiles/ztl-v0.1.json", + } + assert ( + not {path for path in changed if path.startswith("docs/contracts/")} + - allowed_contract_updates + ) assert not any(path.startswith("adapters/ztl/") for path in changed) diff --git a/tests/contract/test_document_consistency.py b/tests/contract/test_document_consistency.py index 10541a4..fc3475a 100644 --- a/tests/contract/test_document_consistency.py +++ b/tests/contract/test_document_consistency.py @@ -587,19 +587,19 @@ def test_semantic_rules_and_validator_agree_on_rule_ids(repo_root: Path) -> None ) -def test_pr18_dependency_is_recorded(repo_root: Path) -> None: +def test_ztl_bounded_admission_is_recorded(repo_root: Path) -> None: profile = _load(repo_root, PROFILE) notice = profile["evidence_dependency_notice"] - assert "PR #16 must not merge before PR #18" in notice["merge_order"] - assert "draft" in notice["statement"].lower() - assert any("index_sha256" in step for step in notice["on_pr18_merge"]) - assert any("MEASURED" in step for step in notice["on_pr18_merge"]) + assert notice["status"] == "ADMITTED_BOUNDED_CODE_START" + assert "checked in on main" in notice["current_pin"] + assert "No runtime import or execution" in notice["statement"] + assert profile["tier_1_reproduction"].startswith("NOT ESTABLISHED") contract = _active(repo_root, CONTRACT) - assert "PR #16 must not merge before PR #18" in contract + assert "Admitted bounded ZTL evidence" in contract assert "interface-freeze-v0.2" in contract adr = _active(repo_root, ADR) - assert "PR #16 must not merge before PR #18" in adr + assert "admits the exact profile/tag/commit/fixture-index tuple" in adr def test_pinned_fixture_index_is_the_corrected_v02_pin(repo_root: Path) -> None: diff --git a/tests/contract/test_semantic_code_start_gate_closure.py b/tests/contract/test_semantic_code_start_gate_closure.py new file mode 100644 index 0000000..9024078 --- /dev/null +++ b/tests/contract/test_semantic_code_start_gate_closure.py @@ -0,0 +1,221 @@ +"""Fail-closed tests for the non-semantic gate-closure evidence verifier.""" + +from __future__ import annotations + +import copy +import importlib.util +import json +import shutil +import subprocess +from collections.abc import Callable +from pathlib import Path +from types import ModuleType +from typing import Any + +import pytest + +pytestmark = pytest.mark.contract + + +def _module(repo_root: Path) -> ModuleType: + spec = importlib.util.spec_from_file_location( + "verify_code_start_gate", repo_root / "scripts/verify_code_start_gate.py" + ) + assert spec and spec.loader + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + + +def _evidence(repo_root: Path) -> dict[str, Any]: + def load(path: str) -> dict[str, Any]: + value: dict[str, Any] = json.loads((repo_root / path).read_text(encoding="utf-8")) + return value + + source_set = load("benchmarks/preflight/code-start-v0.1/SOURCE-SET.json") + return { + "source_set": source_set, + "receipts": load("benchmarks/preflight/code-start-v0.1/PROVENANCE.json"), + "profile": load("docs/contracts/kernel-profiles/ztl-v0.1.json"), + "veip": load("docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json"), + "gate_text": ( + repo_root / "docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md" + ).read_text(encoding="utf-8"), + "source_bytes": { + item["source_id"]: (repo_root / item["path"]).read_bytes() + for item in source_set["sources"] + }, + "active_text": "bounded admitted evidence is current", + "semantic_paths": [], + } + + +def _reject(repo_root: Path, mutate: Callable[[dict[str, Any]], None]) -> None: + module = _module(repo_root) + evidence = copy.deepcopy(_evidence(repo_root)) + mutate(evidence) + with pytest.raises(module.GateEvidenceError): + module.validate_evidence(**evidence) + + +def _synthetic(evidence: dict[str, Any]) -> dict[str, Any]: + return next( + item for item in evidence["source_set"]["sources"] if item["source_id"].startswith("SYN-") + ) + + +def test_current_evidence_is_valid(repo_root: Path) -> None: + _module(repo_root).validate_evidence(**_evidence(repo_root)) + + +def test_refuses_synthetic_as_real_authority(repo_root: Path) -> None: + _reject( + repo_root, + lambda e: _synthetic(e).__setitem__("benchmark_authority", "REAL_INSTITUTIONAL_AUTHORITY"), + ) + + +def test_refuses_missing_synthetic_classification(repo_root: Path) -> None: + _reject(repo_root, lambda e: _synthetic(e).__setitem__("origin_classification", "UNKNOWN")) + + +def test_refuses_digest_mutation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["source_bytes"].__setitem__("SYN-NS-GOV-1", b"mutated")) + + +def test_refuses_provenance_mismatch(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["receipts"]["receipts"][1].__setitem__("sha256", "0" * 64)) + + +def test_refuses_fabricated_government_metadata(repo_root: Path) -> None: + def mutate(e: dict[str, Any]) -> None: + item = _synthetic(e) + item["issuer"] = "Government of Canada" + item["effective_state"] = "2026-01-01" + + _reject(repo_root, mutate) + + +@pytest.mark.parametrize( + ("field", "value"), [("commit", "0" * 40), ("signed_tag", {"name": "wrong"})] +) +def test_refuses_wrong_ztl_identity(repo_root: Path, field: str, value: object) -> None: + _reject(repo_root, lambda e: e["profile"].__setitem__(field, value)) + + +def test_refuses_wrong_ztl_fixture_index(repo_root: Path) -> None: + _reject( + repo_root, + lambda e: e["profile"]["conformance_fixture_set"].__setitem__("index_sha256", "0" * 64), + ) + + +def test_refuses_stale_ztl_currentness(repo_root: Path) -> None: + _reject(repo_root, lambda e: e.__setitem__("active_text", "still in DRAFT pull request #18")) + + +def test_refuses_tier1_escalation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["profile"].__setitem__("tier_1_reproduction", "PASS")) + + +@pytest.mark.parametrize( + "field", + ["executable_runtime_integration", "oic_has_veip_lifecycle_authority", "veip_reinterprets_ztl"], +) +def test_refuses_forbidden_veip_states(repo_root: Path, field: str) -> None: + _reject(repo_root, lambda e: e["veip"].__setitem__(field, True)) + + +def test_refuses_semantic_implementation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e.__setitem__("semantic_paths", ["src/oic/semantic_parser.py"])) + + +def test_refuses_global_manifest_escalation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["source_set"].__setitem__("global_manifest_status", "PASS")) + + +def _isolated_gate_tree(repo_root: Path, tmp_path: Path) -> Path: + root = tmp_path / "repository" + required = ( + "src/oic", + "benchmarks/preflight/code-start-v0.1", + "benchmarks/corpus/canada/freeze-v0.1/sources/CA-3.xml", + "docs/contracts/kernel-profiles/ztl-v0.1.json", + "docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "adr/ADR-013.md", + "docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md", + ) + for relpath in required: + source = repo_root / relpath + target = root / relpath + target.parent.mkdir(parents=True, exist_ok=True) + if source.is_dir(): + shutil.copytree(source, target) + else: + shutil.copy2(source, target) + subprocess.run(["git", "init", "-q", str(root)], check=True) + subprocess.run(["git", "-C", str(root), "add", "."], check=True) + return root + + +def test_t1_production_detector_accepts_exact_baseline(repo_root: Path) -> None: + module = _module(repo_root) + assert module.discover_unadmitted_production_paths(repo_root) == [] + + +@pytest.mark.parametrize( + "relpath", + ("src/oic/semantic_parser.py", "src/oic/helper.py", "src/oic/newmodule/engine.py"), +) +def test_t2_t3_t4_detector_refuses_any_new_tracked_path( + repo_root: Path, tmp_path: Path, relpath: str +) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + added = root / relpath + added.parent.mkdir(parents=True, exist_ok=True) + added.write_text("# unauthorized pre-gate production path\n", encoding="utf-8") + subprocess.run(["git", "-C", str(root), "add", relpath], check=True) + detected = module.discover_unadmitted_production_paths(root) + assert relpath in detected + with pytest.raises(module.GateEvidenceError, match="semantic implementation appeared"): + module.load_and_validate(root) + + +def test_t5_detector_refuses_rename_or_substitution(repo_root: Path, tmp_path: Path) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + original = root / "src/oic/paths.py" + replacement = root / "src/oic/replacement.py" + original.rename(replacement) + subprocess.run(["git", "-C", str(root), "add", "-A", "src/oic"], check=True) + detected = module.discover_unadmitted_production_paths(root) + assert "src/oic/replacement.py" in detected + assert "MISSING:src/oic/paths.py" in detected + with pytest.raises(module.GateEvidenceError, match="semantic implementation appeared"): + module.load_and_validate(root) + + +def test_t6_load_and_validate_invokes_discovery_without_manual_parameter( + repo_root: Path, tmp_path: Path +) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + added = root / "src/oic/helper.py" + added.write_text("# innocuous name, unauthorized path\n", encoding="utf-8") + subprocess.run(["git", "-C", str(root), "add", "src/oic/helper.py"], check=True) + with pytest.raises(module.GateEvidenceError, match="semantic implementation appeared"): + module.load_and_validate(root) + + +def test_t7_working_tree_cannot_self_extend_immutable_baseline( + repo_root: Path, tmp_path: Path +) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + added = root / "src/oic/future_admitted.py" + added.write_text("# existence does not confer admission\n", encoding="utf-8") + subprocess.run(["git", "-C", str(root), "add", "src/oic/future_admitted.py"], check=True) + assert "src/oic/future_admitted.py" not in module.ADMITTED_SRC_OIC_PATHS + assert module.discover_unadmitted_production_paths(root) == ["src/oic/future_admitted.py"] diff --git a/tests/contract/test_warrant_contract.py b/tests/contract/test_warrant_contract.py index f7d2cf4..b5abd09 100644 --- a/tests/contract/test_warrant_contract.py +++ b/tests/contract/test_warrant_contract.py @@ -1348,11 +1348,11 @@ def test_proposed_schemas_are_not_in_the_draft_directory(repo_root: Path) -> Non assert len(proposed) == 3 -def test_documents_state_the_gate_is_blocked(repo_root: Path) -> None: +def test_documents_state_the_gate_is_not_open(repo_root: Path) -> None: for relpath in (CONTRACT_DOC, MAPPING_MD, ADR): - assert "semantic implementation gate remains BLOCKED" in _plain(repo_root / relpath), ( - relpath - ) + text = _plain(repo_root / relpath) + assert "semantic code-start gate" in text, relpath + assert "NOT OPEN" in text, relpath def test_documents_label_themselves_proposed(repo_root: Path) -> None: