From d98145f9e194a58b496852cf9e7b0333f9e965c5 Mon Sep 17 00:00:00 2001 From: Arkadiy Miteiko Date: Thu, 27 Aug 2026 14:38:40 -0400 Subject: [PATCH 1/4] docs: close bounded semantic code-start prerequisites --- Makefile | 2 +- STATUS.md | 12 +- adr/ADR-013.md | 21 ++- benchmarks/preflight/SOURCE_MANIFEST.csv | 3 + .../preflight/code-start-v0.1/RECEIPTS.json | 8 + .../preflight/code-start-v0.1/SOURCE-SET.json | 46 +++++ .../SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt | 16 ++ .../SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt | 29 +++ .../SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt | 15 ++ .../VEIP-CODE-START-BOUNDARY-v0.1.json | 13 ++ docs/contracts/WARRANT-CONTRACT-v0.1.md | 37 ++-- docs/contracts/ZTL-OCE-MAPPING-v0.1.md | 3 +- docs/contracts/kernel-profiles/ztl-v0.1.json | 20 +- docs/decisions/OIC-OWNER-DECISION-003.md | 10 + ...C-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md | 20 ++ docs/operations/FOUNDATION.md | 22 ++- scripts/verify_code_start_gate.py | 173 ++++++++++++++++++ .../test_canada_acquisition_preflight.py | 4 +- tests/contract/test_document_consistency.py | 14 +- .../test_semantic_code_start_gate_closure.py | 132 +++++++++++++ tests/contract/test_warrant_contract.py | 22 +-- 21 files changed, 538 insertions(+), 84 deletions(-) create mode 100644 benchmarks/preflight/code-start-v0.1/RECEIPTS.json create mode 100644 benchmarks/preflight/code-start-v0.1/SOURCE-SET.json create mode 100644 benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt create mode 100644 benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt create mode 100644 benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt create mode 100644 docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json create mode 100644 docs/decisions/OIC-OWNER-DECISION-003.md create mode 100644 docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md create mode 100644 scripts/verify_code_start_gate.py create mode 100644 tests/contract/test_semantic_code_start_gate_closure.py diff --git a/Makefile b/Makefile index d100d6c..7e228d3 100644 --- a/Makefile +++ b/Makefile @@ -5,9 +5,9 @@ PYTHON ?= python verify: $(PYTHON) -m oic.cli validate-schema $(PYTHON) -m oic.cli verify-bootstrap + $(PYTHON) scripts/verify_code_start_gate.py @set +e; $(PYTHON) -m oic.cli verify-manifest --all; code=$$?; set -e; \ test $$code -eq 3; echo "PASS manifest remains explicitly INCOMPLETE (exit 3)" falsify: $(PYTHON) scripts/falsify_infrastructure.py - diff --git a/STATUS.md b/STATUS.md index fa649c1..10bdca7 100644 --- a/STATUS.md +++ b/STATUS.md @@ -8,19 +8,23 @@ This status authorizes repository creation, contract drafting, fixture preparati It does not authorize public quality, enterprise-readiness, legal-compliance, universal-novelty, or superiority claims. -## Exploratory code-start gate +## Semantic code-start prerequisite gate | Gate | Status | Required evidence | |---|---|---| | TDD-OIC-001 v1.1 checked in | PASS in bootstrap bundle | PDF + SHA-256 | | Requirement IDs and invariants checked in | PASS in bootstrap bundle | `docs/requirements/` | | Draft schemas explicit | PASS in bootstrap bundle | `schemas/draft/` | -| Dependency status explicit | PARTIAL | `DEPENDENCIES.md`; ZTL/VEIP dossiers open | -| Preflight corpus rights/provenance documented | OPEN | completed `SOURCE_MANIFEST.csv` | +| Dependency status explicit | PASS for bounded prerequisite scope | exact admitted ZTL profile; non-executable VEIP boundary | +| Preflight corpus rights/provenance documented | PASS for bounded prerequisite scope | CA-3 plus deterministic synthetic companions; global manifest remains INCOMPLETE | | Claims categories and forbidden claims checked in | PASS | `CLAIMS.md` | | Public Lab restrictions visible before upload | PASS as specification | `LIMITATIONS.md`, `docs/architecture/LAB_RESTRICTIONS.md` | | Named owner for each implemented module | PASS for kickoff | `OWNERS.md` | -**Semantic implementation gate:** BLOCKED until the preflight corpus manifest and ZTL/VEIP provisional-interface records are completed. +**SEMANTIC CODE-START GATE:** +**READY FOR SEPARATE EXACT-HEAD REVIEW** +**NOT OPEN** + +Global repository completeness remains **INCOMPLETE**. Tier-1 reproduction is **NOT ESTABLISHED** and deferred to the experimental-release boundary. Semantic implementation remains prohibited until separate review and an owner gate-opening decision. Infrastructure scaffolding and schema validation may proceed before that gate. diff --git a/adr/ADR-013.md b/adr/ADR-013.md index 56d5cd7..dcad144 100644 --- a/adr/ADR-013.md +++ b/adr/ADR-013.md @@ -3,7 +3,7 @@ **Status:** Proposed **Work order:** OIC-WO-002 **Architecture authority:** GPT-5.6 Thinking. **Final design authority:** Arkadiy Miteiko / Veraxis. -**Scope:** architecture, proposed schemas, and conformance fixtures only. No ZTL call, no VEIP call, no admission, no envelope generation, no Rego, no runtime execution. The semantic implementation gate remains **BLOCKED**. +**Scope:** architecture, proposed schemas, and conformance fixtures only. No ZTL call, no VEIP call, no envelope generation, no Rego, no runtime execution. The exact ZTL profile is owner-admitted for bounded code start; the semantic code-start gate remains **NOT OPEN** pending separate exact-head review. --- @@ -277,8 +277,9 @@ Schema but fails a semantic conformance rule is invalid.** The eight rules are d machine-readably in the canonical mapping and are executable through a **test-only** validator kept deliberately outside `src/oic`. -**W-17.** This contract's `MEASURED` labels reference evidence still in **draft** PR #18. -**PR #16 must not merge before PR #18.** +**W-17.** This contract's `MEASURED` labels reference checked-in evidence on `main`. Owner +decision OIC-OWNER-DECISION-003 admits the exact profile/tag/commit/fixture-index tuple for +bounded code start only. Tier-1 reproduction remains **NOT ESTABLISHED**. **Pin correction.** The commit this profile previously pinned, `e819dec7e89d2dc67d6371e1eedb8e7aae854602`, predated the declared `ztljudge.judge` @@ -287,8 +288,8 @@ under that entrypoint could actually have been reproduced. The proposed profile corrected to the signed `veraxis-ztl-input-v0.2-signed` pin, `56e1ff0510c62b04dbd85bbe08b7a6deacbf276b`, and its conformance fixture set to `interface-freeze-v0.2/` (13 reachable, 3 not-reachable, 16 total). This corrects the -**proposed** profile's evidence pin; it does not admit a v0.2 semantic profile — -`kernel_profile_id` remains `ztl-v0.1` and no profile version field exists to bump. +profile's evidence pin; it does not create a v0.2 semantic profile — `kernel_profile_id` +remains `ztl-v0.1` and version remains `0.1.0`. On PR #18's eventual merge this work still rebases onto the resulting `main` and re-verifies every `MEASURED` label against the checked-in (not draft-branch) evidence, in @@ -495,9 +496,9 @@ Not decided here. The eventual handoff must bind **at least**: - evaluation input hash; - authority and admission versions. -**Final VEIP transition names and event schemas are deliberately not decided in this PR.** -Arkadiy Miteiko is interim VEIP contract owner (OIC-OWNER-DECISION-002 §5); the schema is -deferred to OIC-GC-004. +**Final VEIP transition names and event schemas remain deliberately undecided.** The +bounded, non-executable record in `docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json` +expresses the minimum handoff only; it creates no lifecycle authority or runtime adapter. ### 4.4 The two directions that must not cross @@ -522,8 +523,8 @@ emits a lifecycle event has crossed the other way. ## 6. Compatibility impact and migration **Nothing in `schemas/draft/` is modified by this ADR.** The proposals live in -`schemas/proposed/` and are inert until an owner decision admits them. `STATUS.md` is -unchanged and the semantic gate remains BLOCKED. +`schemas/proposed/` and remain inert. The exact ZTL input profile is admitted only for +bounded code start; the semantic code-start gate remains **NOT OPEN**. Three migrations are *proposed*, not applied: diff --git a/benchmarks/preflight/SOURCE_MANIFEST.csv b/benchmarks/preflight/SOURCE_MANIFEST.csv index 718a9df..61b71bf 100644 --- a/benchmarks/preflight/SOURCE_MANIFEST.csv +++ b/benchmarks/preflight/SOURCE_MANIFEST.csv @@ -1,2 +1,5 @@ source_id,title,issuer,source_type,official_url_or_origin,license_or_public_basis,acquired_at,sha256,effective_from,effective_until,supersedes,confidentiality,notes CA-3,Government Contracts Regulations (SOR/87-402),Department of Justice Canada (Justice Laws Website),"federal regulation, current consolidation, English XML",https://laws-lois.justice.gc.ca/eng/XML/SOR-87-402.xml,"Reproduction of Federal Law Order (SI/97-5): anyone may reproduce enactments and consolidations of enactments without charge or request for permission, provided due diligence is exercised in ensuring accuracy and the reproduction is not represented as an official version",2026-07-31T14:35:22.379578Z,6e89ad25847944ca2bd72bcbf02ec3d2942a234d373b6c10db44307e0fbdf2c3,,,,public,Unofficial copy. Frozen bytes at benchmarks/corpus/canada/freeze-v0.1/sources/CA-3.xml; receipt OIC-CA-FREEZE-CA-3-v0.1; 49977 bytes; verify with scripts/verify_canada_freeze.py +SYN-NS-GOV-1,Northstar Test Institution Governance Charter,Veraxis synthetic fixture generator,synthetic fictional benchmark source,repository-generated deterministic bytes,Synthetic test material created for OIC preflight; no real-world authority,2026-08-27T00:00:00Z,b882459931ddf06fb647e6885c1ced368b4a5f45b6441df618484a30473a2a24,SYNTHETIC_CURRENT,,,PUBLIC_SYNTHETIC,SYNTHETIC and FICTIONAL; benchmark authority only; path benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt +SYN-NS-PROC-1,Northstar Test Institution Operating Procedure,Veraxis synthetic fixture generator,synthetic fictional benchmark source,repository-generated deterministic bytes,Synthetic test material created for OIC preflight; no real-world authority,2026-08-27T00:00:00Z,cfb578274460cc17492f4b25a4db6893ce87a527e1207fe6a52b6384125ec073,SYNTHETIC_SUPERSEDED,,SYN-NS-AMEND-2,PUBLIC_SYNTHETIC,SYNTHETIC and FICTIONAL; deliberately stale/conflicting benchmark source; path benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt +SYN-NS-AMEND-2,Northstar Test Institution Operating Procedure Amendment,Veraxis synthetic fixture generator,synthetic fictional benchmark source,repository-generated deterministic bytes,Synthetic test material created for OIC preflight; no real-world authority,2026-08-27T00:00:00Z,8e197bc9e01554853163dfb5f84ad807893f678b26673737c8a72ddf0c8daf47,SYNTHETIC_CURRENT,,SYN-NS-PROC-1,PUBLIC_SYNTHETIC,SYNTHETIC and FICTIONAL; benchmark authority only; path benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt diff --git a/benchmarks/preflight/code-start-v0.1/RECEIPTS.json b/benchmarks/preflight/code-start-v0.1/RECEIPTS.json new file mode 100644 index 0000000..87bc779 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/RECEIPTS.json @@ -0,0 +1,8 @@ +{ + "receipts": [ + {"source_id": "CA-3", "sha256": "6e89ad25847944ca2bd72bcbf02ec3d2942a234d373b6c10db44307e0fbdf2c3", "provenance": "OIC-CA-FREEZE-CA-3-v0.1"}, + {"source_id": "SYN-NS-GOV-1", "sha256": "b882459931ddf06fb647e6885c1ced368b4a5f45b6441df618484a30473a2a24", "provenance": "DETERMINISTIC_REPOSITORY_GENERATION"}, + {"source_id": "SYN-NS-PROC-1", "sha256": "cfb578274460cc17492f4b25a4db6893ce87a527e1207fe6a52b6384125ec073", "provenance": "DETERMINISTIC_REPOSITORY_GENERATION"}, + {"source_id": "SYN-NS-AMEND-2", "sha256": "8e197bc9e01554853163dfb5f84ad807893f678b26673737c8a72ddf0c8daf47", "provenance": "DETERMINISTIC_REPOSITORY_GENERATION"} + ] +} diff --git a/benchmarks/preflight/code-start-v0.1/SOURCE-SET.json b/benchmarks/preflight/code-start-v0.1/SOURCE-SET.json new file mode 100644 index 0000000..592917e --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/SOURCE-SET.json @@ -0,0 +1,46 @@ +{ + "scope": "SEMANTIC_CODE_START_PREREQUISITES_ONLY", + "global_manifest_status": "INCOMPLETE", + "sources": [ + { + "source_id": "CA-3", + "path": "benchmarks/corpus/canada/freeze-v0.1/sources/CA-3.xml", + "sha256": "6e89ad25847944ca2bd72bcbf02ec3d2942a234d373b6c10db44307e0fbdf2c3", + "origin_classification": "REAL_PUBLIC_CANADIAN_SOURCE_UNOFFICIAL_COPY", + "benchmark_authority": "BOUNDED_TEST_INPUT_ONLY", + "effective_state": "NOT_ESTABLISHED_NO_DATE_INVENTED", + "rights_basis": "Reproduction of Federal Law Order (SI/97-5), subject to due diligence and no representation as an official version", + "rights_limitations": "Unofficial copy; third-party material, insignia, personal-information, and broader corpus clearance remain source-specific and unchanged", + "receipt": "benchmarks/corpus/canada/freeze-v0.1/receipts/CA-3.receipt.json" + }, + { + "source_id": "SYN-NS-GOV-1", + "path": "benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt", + "sha256": "b882459931ddf06fb647e6885c1ced368b4a5f45b6441df618484a30473a2a24", + "origin_classification": "SYNTHETIC_FICTIONAL", + "benchmark_authority": "SYNTHETIC_BENCHMARK_ONLY", + "issuer": "Veraxis synthetic fixture generator", + "effective_state": "SYNTHETIC_CURRENT" + }, + { + "source_id": "SYN-NS-PROC-1", + "path": "benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt", + "sha256": "cfb578274460cc17492f4b25a4db6893ce87a527e1207fe6a52b6384125ec073", + "origin_classification": "SYNTHETIC_FICTIONAL", + "benchmark_authority": "SYNTHETIC_BENCHMARK_ONLY", + "issuer": "Veraxis synthetic fixture generator", + "effective_state": "SYNTHETIC_SUPERSEDED", + "superseded_by": "SYN-NS-AMEND-2" + }, + { + "source_id": "SYN-NS-AMEND-2", + "path": "benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt", + "sha256": "8e197bc9e01554853163dfb5f84ad807893f678b26673737c8a72ddf0c8daf47", + "origin_classification": "SYNTHETIC_FICTIONAL", + "benchmark_authority": "SYNTHETIC_BENCHMARK_ONLY", + "issuer": "Veraxis synthetic fixture generator", + "effective_state": "SYNTHETIC_CURRENT", + "supersedes": "SYN-NS-PROC-1" + } + ] +} diff --git a/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt new file mode 100644 index 0000000..cfd9030 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt @@ -0,0 +1,16 @@ +SYNTHETIC — FICTIONAL TEST/BENCHMARK AUTHORITY ONLY +Document: Northstar Test Institution Operating Procedure Amendment +Version: 2.0.0 +Created: 2026-08-27T00:00:00Z +Effective state: SYNTHETIC_CURRENT +Confidentiality: PUBLIC_SYNTHETIC + +This amendment supersedes SYNTHETIC-NORTHSTAR-PROCEDURE-v1 in full. + +Current procedure: TEST_PURCHASE_HIGH requires both Approver-A and Approver-B, +consistent with the Governance Charter. A stale procedure must be refused as +current evidence. + +This document is fictional. It creates no legal, governmental, institutional, +Canadian, or other real-world authority. It is limited to deterministic tests +and benchmarks. diff --git a/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt new file mode 100644 index 0000000..dee9069 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt @@ -0,0 +1,29 @@ +SYNTHETIC — FICTIONAL TEST/BENCHMARK AUTHORITY ONLY +Document: Northstar Test Institution Governance Charter +Version: 1.0.0 +Created: 2026-08-27T00:00:00Z +Effective state: SYNTHETIC_CURRENT +Confidentiality: PUBLIC_SYNTHETIC + +Definitions: Requester means a fictional test actor. Approver means a fictional +test actor listed in the matrix. Evidence means a deterministic record bound to +the proposed action. + +Approval and delegation matrix: +- TEST_PURCHASE_LOW requires Approver-A. +- TEST_PURCHASE_HIGH requires Approver-A and Approver-B. +- Approver-A may delegate TEST_PURCHASE_LOW to Delegate-A. No other delegation + is recognized. + +Evidence requirement: every proposal carries its source identifier, amount, +requester identifier, and approval records. + +Exception: TEST_EMERGENCY may omit Approver-B only when an emergency record and +Approver-A approval are present. + +Discretionary clause: Approver-A may refer any proposal for human review. +Referral establishes no approval. + +This document is fictional. It creates no legal, governmental, institutional, +Canadian, or other real-world authority. It is limited to deterministic tests +and benchmarks. diff --git a/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt new file mode 100644 index 0000000..3e24e76 --- /dev/null +++ b/benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt @@ -0,0 +1,15 @@ +SYNTHETIC — FICTIONAL STALE TEST/BENCHMARK SOURCE +Document: Northstar Test Institution Operating Procedure +Version: 1.0.0 +Created: 2026-08-27T00:00:00Z +Effective state: SYNTHETIC_SUPERSEDED +Confidentiality: PUBLIC_SYNTHETIC + +Procedure: TEST_PURCHASE_HIGH requires only Approver-A. + +This deliberately conflicting procedure is superseded in full by +SYNTHETIC-NORTHSTAR-AMENDMENT-v2. It must never be treated as current. + +This document is fictional. It creates no legal, governmental, institutional, +Canadian, or other real-world authority. It is limited to deterministic tests +and benchmarks. diff --git a/docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json b/docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json new file mode 100644 index 0000000..9b0abd8 --- /dev/null +++ b/docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json @@ -0,0 +1,13 @@ +{ + "status": "NON_EXECUTABLE_BOUNDARY_RECORD", + "version": "0.1.0", + "sequence": ["ActionProposal", "OIC exact proposal", "RuntimeDecision", "evidence handed downstream toward VEIP"], + "executable_runtime_integration": false, + "oic_has_veip_lifecycle_authority": false, + "veip_reinterprets_ztl": false, + "oic_self_authorizes_runtime_execution": false, + "missing_lifecycle_integration": "FAIL_CLOSED", + "runtime_adapter_authorized": false, + "lifecycle_execution_authorized": false, + "runtime_import_authorized": false +} diff --git a/docs/contracts/WARRANT-CONTRACT-v0.1.md b/docs/contracts/WARRANT-CONTRACT-v0.1.md index b9ae57b..1134f2d 100644 --- a/docs/contracts/WARRANT-CONTRACT-v0.1.md +++ b/docs/contracts/WARRANT-CONTRACT-v0.1.md @@ -550,15 +550,15 @@ the first VEIP artifact. ZTL must not create a VEIP lifecycle record. VEIP must not reinterpret the ZTL formula. -## 13a. Evidence dependency on PR #18 +## 13a. Admitted bounded ZTL evidence -**PR #16 must not merge before PR #18.** - -Every `MEASURED` label in the canonical mapping, and every field in -[`kernel-profiles/ztl-v0.1.json`](kernel-profiles/ztl-v0.1.json), references evidence that -is still in **draft** PR #18 and is not yet on `main`. Merging this first would leave the -contract citing a branch that could still change or be abandoned — the mapping would claim -measurement it could not point at. +The evidence formerly carried through PR #18 is checked in on `main`. Owner decision +OIC-OWNER-DECISION-003 admits the exact `ztl-v0.1` profile version `0.1.0`, signed tag +`veraxis-ztl-input-v0.2-signed`, commit +`56e1ff0510c62b04dbd85bbe08b7a6deacbf276b`, and fixture-index SHA-256 +`ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145` for bounded +semantic code start only. Tier-1 reproduction remains **NOT ESTABLISHED** and is deferred +to the experimental-release boundary. No ZTL runtime import or execution is admitted. ### Pin correction @@ -577,29 +577,20 @@ dependency pin. `interface-freeze-v0.1` is **not edited**. It remains immutable historical evidence with a documented lineage hole — the commit it cited predated `ztljudge.judge`, so no fixture claiming reproduction against it under that entrypoint was actually recomputable at that -pin. This correction updates the **proposed** `ztl-v0.1` profile's evidence pin only. -`kernel_profile_id` remains `ztl-v0.1`; no admitted v0.2 semantic profile is created. +pin. This correction updated the `ztl-v0.1` profile's evidence pin only. +`kernel_profile_id` remains `ztl-v0.1`; no v0.2 semantic profile is created. The new commit's fixture set additionally reproduces `EARNED` + non-empty `unverified` as a **pinned, reachable** fixture (`earned-hereditary-nonempty-unverified.json`), rather than leaving it as census-only corroboration. That question from the prior revision is therefore resolved by the pin correction itself, not left open. -### Remaining merge-order steps - -Because the current evidence is PR #18's **draft** head rather than its merged state, this -PR still must, once PR #18 merges: - -1. rebase onto the merged `main`; -2. re-verify **every** `MEASURED` authority label against the checked-in evidence, in case - anything moved between the current evidence head and the merge; -3. re-point the census and fixture references at their merged paths if either changed. - ## 14. Standing -Proposed under OIC-WO-002. Not admitted. No ZTL or VEIP code exists, is imported, or is +The contract remains proposed and unimplemented; only the exact ZTL input profile is +owner-admitted for bounded code start. No ZTL or VEIP code exists, is imported, or is called. No policy document is parsed, no Institutional IR is constructed, no Open Control Envelope is generated, no Rego is emitted, and OPA is not invoked. -`STATUS.md` is unchanged. `schemas/draft/` is unchanged. **No semantic implementation was -introduced. The semantic implementation gate remains BLOCKED.** +`schemas/draft/` is unchanged. **No semantic implementation was introduced. The semantic +code-start gate is READY FOR SEPARATE EXACT-HEAD REVIEW and NOT OPEN.** diff --git a/docs/contracts/ZTL-OCE-MAPPING-v0.1.md b/docs/contracts/ZTL-OCE-MAPPING-v0.1.md index eb8704e..f119ee7 100644 --- a/docs/contracts/ZTL-OCE-MAPPING-v0.1.md +++ b/docs/contracts/ZTL-OCE-MAPPING-v0.1.md @@ -213,4 +213,5 @@ Proposed by the OIC side under OIC-WO-002. Requires: - **Arkadiy Miteiko / Veraxis** — final design authority. No ZTL call was made to produce this document; the measured rows cite fixtures published -by the ZTL side. No adapter exists. The semantic implementation gate remains **BLOCKED**. +by the ZTL side. No adapter exists. The semantic code-start gate remains **NOT OPEN** +pending separate exact-head review. diff --git a/docs/contracts/kernel-profiles/ztl-v0.1.json b/docs/contracts/kernel-profiles/ztl-v0.1.json index 2f8520b..5c5b93a 100644 --- a/docs/contracts/kernel-profiles/ztl-v0.1.json +++ b/docs/contracts/kernel-profiles/ztl-v0.1.json @@ -1,5 +1,5 @@ { - "$comment": "PROPOSED, NOT ADMITTED. A frozen description of one logic kernel's interface and vocabulary. Dispositions, grades, and digests are NOT portable between kernels, so every WarrantArtifact declares the kernel_profile_id it was produced under and OIC never compares artifacts across profiles. Nothing in this file imports, executes, or calls ZTL.", + "$comment": "OWNER-ADMITTED FOR BOUNDED SEMANTIC CODE START ONLY. A frozen description of one logic kernel's interface and vocabulary. Dispositions, grades, and digests are NOT portable between kernels, so every WarrantArtifact declares the kernel_profile_id it was produced under and OIC never compares artifacts across profiles. Nothing in this file imports, executes, or calls ZTL.", "canonicalization_profile_id": "ztl-jcs-float-free-sha384-v0.1", "commit": "56e1ff0510c62b04dbd85bbe08b7a6deacbf276b", "conformance_fixture_set": { @@ -13,7 +13,7 @@ "index_sha256": "ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145", "location": "adapters/ztl/fixtures/interface-freeze-v0.2/", "not_reachable": 3, - "provenance": "Published by the ZTL side under ZTL-OIC-WO-002/OIC-WO-003, reproduced against the pinned v0.2 commit by its author (Tier 3). Independent Tier-1 reproduction remains OPEN.", + "provenance": "Published by the ZTL side under ZTL-OIC-WO-002/OIC-WO-003, reproduced against the pinned v0.2 commit by its author (Tier 3). Independent Tier-1 reproduction is NOT ESTABLISHED and is deferred to the experimental-release boundary.", "reachable": 13, "total": 16 }, @@ -81,16 +81,9 @@ ], "entrypoint": "ztljudge.judge", "evidence_dependency_notice": { - "current_pin": "interface-freeze-v0.2, index_sha256 ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145 (13 reachable, 3 not-reachable, 16 total), reproduced against the signed commit 56e1ff0510c62b04dbd85bbe08b7a6deacbf276b (veraxis-ztl-input-v0.2-signed). This is PR #18's current DRAFT evidence head, not its merged state.", - "merge_order": "PR #16 must not merge before PR #18.", - "on_pr18_merge": [ - "PR #16 rebases onto the merged main.", - "Every MEASURED authority label in the canonical mapping is re-verified against the checked-in evidence, in case anything moved between the current evidence head and the merge.", - "conformance_fixture_set.location, counts and index_sha256 are re-pointed at the merged path if the evidence changed further before merge.", - "The census reference is re-pointed at its merged path." - ], - "statement": "Every field in this profile references evidence that is still in DRAFT pull request #18 and is NOT yet on main.", - "status": "BLOCKING for merge order" + "current_pin": "interface-freeze-v0.2, index_sha256 ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145 (13 reachable, 3 not-reachable, 16 total), reproduced against signed commit 56e1ff0510c62b04dbd85bbe08b7a6deacbf276b (veraxis-ztl-input-v0.2-signed). Evidence is checked in on main and owner-admitted for bounded code start.", + "statement": "The exact profile, tag, commit, and fixture index are admitted only for bounded semantic code start. No runtime import or execution is admitted.", + "status": "ADMITTED_BOUNDED_CODE_START" }, "formula_digest_algorithm": "sha384", "formula_hash_projection": { @@ -218,7 +211,8 @@ "name": "veraxis-ztl-input-v0.2-signed", "signs_commit": "56e1ff0510c62b04dbd85bbe08b7a6deacbf276b" }, - "status": "PROPOSED - frozen interface description, not admitted", + "status": "ADMITTED FOR BOUNDED SEMANTIC CODE START ONLY", + "tier_1_reproduction": "NOT ESTABLISHED — DEFERRED TO EXPERIMENTAL RELEASE", "unsigned_tag": "veraxis-ztl-input-v0.1", "unverified_ground_semantics": { "EARNED": "informational - irrelevant to this conclusion because the result is hereditary", diff --git a/docs/decisions/OIC-OWNER-DECISION-003.md b/docs/decisions/OIC-OWNER-DECISION-003.md new file mode 100644 index 0000000..4c3cb01 --- /dev/null +++ b/docs/decisions/OIC-OWNER-DECISION-003.md @@ -0,0 +1,10 @@ +# OIC Owner Decision 003 — semantic code-start prerequisites + +Status: **RECORDED FOR SEPARATE EXACT-HEAD REVIEW — GATE NOT OPEN** + +- **OD-001:** bounded source set is CA-3 plus deterministic, explicitly synthetic fictional companions. Synthetic material has benchmark authority only. CA-3 remains an unofficial copy with its existing source-specific rights limitations; broader Canada clearance is unchanged. +- **OD-002:** admit only profile `ztl-v0.1` version `0.1.0`, tag `veraxis-ztl-input-v0.2-signed`, commit `56e1ff0510c62b04dbd85bbe08b7a6deacbf276b`, fixture-index SHA-256 `ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145` for bounded semantic code start. No ZTL runtime is imported or executed. +- **OD-003:** Tier-1 independent reproduction is **NOT ESTABLISHED** and deferred to the experimental-release boundary. It is not a code-start blocker and is not represented as PASS. +- **OD-004:** the minimum boundary is `ActionProposal → OIC exact proposal → RuntimeDecision → evidence handed downstream toward VEIP`. The boundary record is non-executable. OIC has no VEIP lifecycle authority, VEIP does not reinterpret ZTL, and no runtime adapter, import, execution, or self-authorization is permitted. + +Global repository completeness remains **INCOMPLETE**. These decisions close only bounded prerequisites and do not authorize semantic implementation. diff --git a/docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md b/docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md new file mode 100644 index 0000000..6ca7678 --- /dev/null +++ b/docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md @@ -0,0 +1,20 @@ +# OIC semantic code-start gate closure candidate + +Global repository completeness: **INCOMPLETE** + +Scoped prerequisite evidence: + +| Decision | Evidence | Producer disposition | +|---|---|---| +| OD-001 | `benchmarks/preflight/code-start-v0.1/SOURCE-SET.json` plus immutable source bytes/digests | MATERIAL prerequisites represented | +| OD-002 | `docs/contracts/kernel-profiles/ztl-v0.1.json` exact profile/tag/commit/index | ADMITTED for bounded code start only | +| OD-003 | owner decision record | NOT ESTABLISHED; deferred to experimental release | +| OD-004 | `docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json` | NON-EXECUTABLE boundary represented | + +Negative controls are enforced by `scripts/verify_code_start_gate.py` and contract tests. This establishes neither semantic correctness nor legal, benchmark, runtime, lifecycle, or production claims. + +SEMANTIC CODE-START GATE: +READY FOR SEPARATE EXACT-HEAD REVIEW +NOT OPEN + +SEMANTIC IMPLEMENTATION HAS NOT STARTED. diff --git a/docs/operations/FOUNDATION.md b/docs/operations/FOUNDATION.md index afdd1e7..6fcebcf 100644 --- a/docs/operations/FOUNDATION.md +++ b/docs/operations/FOUNDATION.md @@ -169,16 +169,15 @@ an unknown has nowhere to collapse into a grounded false (invariant I-03). **`oic verify-manifest --all` exits `3`. This is correct, not a bug.** -`benchmarks/preflight/SOURCE_MANIFEST.csv` currently contains only its header row. There -are zero corpus source records. The verifier reports: +`benchmarks/preflight/SOURCE_MANIFEST.csv` records CA-3 and three explicitly synthetic, +fictional code-start companions. The global manifest remains INCOMPLETE because the +records are recorded but not verified by the global verifier. It reports: ``` benchmarks/preflight/SOURCE_MANIFEST.csv [source-manifest] - 0 entries - note: 0 corpus source row(s) recorded + 4 entries (RECORDED_NOT_VERIFIED=4) + note: 4 corpus source row(s) recorded note: origin URLs are recorded only; this verifier never fetches them - note: preflight corpus manifest contains only its header: corpus provenance is NOT - complete and this repository is not corpus-ready RESULT: INCOMPLETE ``` @@ -266,10 +265,13 @@ enforcement artifact (none exists to produce). ## 8. Current limitations - **This is not a compiler.** No semantic implementation exists. See `LIMITATIONS.md`. -- **The semantic implementation gate is BLOCKED** and nothing here opens it. -- **Preflight corpus provenance is OPEN.** `SOURCE_MANIFEST.csv` has no rows. -- **ZTL and VEIP are PROVISIONAL / NOT CONFIGURED.** Their interfaces are unfrozen - (ADR-009, ADR-010) and no adapter, container, or call exists. +- **The semantic code-start gate is READY FOR SEPARATE EXACT-HEAD REVIEW / NOT OPEN.** + Semantic implementation remains prohibited. +- **Global preflight corpus provenance remains INCOMPLETE.** The bounded code-start set is + recorded, but broader Canada/corpus clearance remains unchanged. +- **ZTL is admitted only as an exact bounded input profile; VEIP has a non-executable + boundary record.** Neither runtime is imported or configured; no adapter, container, or + call exists (ADR-009, ADR-010). - **Docker Compose is validated by CI, not locally here.** The `compose-validation` job resolves the configuration, pulls every digest-pinned image, starts all three services, waits for their healthchecks, and tears the stack down. Docker is unavailable in the diff --git a/scripts/verify_code_start_gate.py b/scripts/verify_code_start_gate.py new file mode 100644 index 0000000..fd7ab2d --- /dev/null +++ b/scripts/verify_code_start_gate.py @@ -0,0 +1,173 @@ +#!/usr/bin/env python3 +"""Fail-closed verifier for the non-semantic code-start evidence package.""" + +from __future__ import annotations + +import hashlib +import json +import sys +from pathlib import Path +from typing import Any + +EXPECTED_ZTL = { + "profile_id": "ztl-v0.1", + "version": "0.1.0", + "commit": "56e1ff0510c62b04dbd85bbe08b7a6deacbf276b", + "tag": "veraxis-ztl-input-v0.2-signed", + "index": "ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145", +} +STALE_ZTL_TEXT = ( + "current DRAFT evidence head", + "still in DRAFT pull request #18", + "must not merge before PR #18", +) + + +class GateEvidenceError(ValueError): + """Evidence fails a bounded gate invariant.""" + + +def _require(condition: bool, message: str) -> None: + if not condition: + raise GateEvidenceError(message) + + +def validate_evidence( + source_set: dict[str, Any], + receipts: dict[str, Any], + profile: dict[str, Any], + veip: dict[str, Any], + gate_text: str, + source_bytes: dict[str, bytes], + active_text: str, + semantic_paths: list[str] | None = None, +) -> None: + _require( + source_set.get("global_manifest_status") == "INCOMPLETE", "global manifest state escalated" + ) + by_id = {item["source_id"]: item for item in source_set.get("sources", [])} + receipt_by_id = {item["source_id"]: item for item in receipts.get("receipts", [])} + _require( + len(by_id) == 4 and set(by_id) == set(receipt_by_id), "source/receipt provenance mismatch" + ) + for source_id, item in by_id.items(): + payload = source_bytes.get(source_id) + if payload is None: + raise GateEvidenceError(f"missing source bytes: {source_id}") + digest = hashlib.sha256(payload).hexdigest() + _require(digest == item.get("sha256"), f"source digest mismatch: {source_id}") + _require( + digest == receipt_by_id[source_id].get("sha256"), + f"receipt digest mismatch: {source_id}", + ) + if source_id.startswith("SYN-"): + _require( + item.get("origin_classification") == "SYNTHETIC_FICTIONAL", + "synthetic classification missing", + ) + _require( + item.get("benchmark_authority") == "SYNTHETIC_BENCHMARK_ONLY", + "synthetic represented as real authority", + ) + _require( + item.get("issuer") == "Veraxis synthetic fixture generator", + "synthetic issuer masquerades as government", + ) + _require( + str(item.get("effective_state", "")).startswith("SYNTHETIC_"), + "fabricated government effective metadata", + ) + decoded = payload.decode("utf-8") + _require( + "SYNTHETIC" in decoded and "fictional" in decoded.lower(), + "source bytes lack synthetic warning", + ) + ca3 = by_id["CA-3"] + _require( + ca3.get("origin_classification") == "REAL_PUBLIC_CANADIAN_SOURCE_UNOFFICIAL_COPY", + "CA-3 provenance changed", + ) + _require( + ca3.get("effective_state") == "NOT_ESTABLISHED_NO_DATE_INVENTED", + "CA-3 effective date invented", + ) + + _require(profile.get("profile_id") == EXPECTED_ZTL["profile_id"], "wrong ZTL profile") + _require(profile.get("version") == EXPECTED_ZTL["version"], "wrong ZTL version") + _require(profile.get("commit") == EXPECTED_ZTL["commit"], "wrong ZTL commit") + _require(profile.get("signed_tag", {}).get("name") == EXPECTED_ZTL["tag"], "wrong ZTL tag") + _require( + profile.get("conformance_fixture_set", {}).get("index_sha256") == EXPECTED_ZTL["index"], + "wrong ZTL fixture index", + ) + _require( + profile.get("tier_1_reproduction") == "NOT ESTABLISHED — DEFERRED TO EXPERIMENTAL RELEASE", + "Tier-1 state escalated", + ) + _require( + profile.get("status") == "ADMITTED FOR BOUNDED SEMANTIC CODE START ONLY", + "bounded ZTL admission missing", + ) + _require( + not any(marker.lower() in active_text.lower() for marker in STALE_ZTL_TEXT), + "stale ZTL currentness text", + ) + + for field in ( + "executable_runtime_integration", + "oic_has_veip_lifecycle_authority", + "veip_reinterprets_ztl", + "oic_self_authorizes_runtime_execution", + "runtime_adapter_authorized", + "lifecycle_execution_authorized", + "runtime_import_authorized", + ): + _require(veip.get(field) is False, f"forbidden VEIP state: {field}") + _require( + veip.get("missing_lifecycle_integration") == "FAIL_CLOSED", + "VEIP boundary is not fail-closed", + ) + normalized_gate = gate_text.replace("*", "").upper() + _require( + "GLOBAL REPOSITORY COMPLETENESS" in normalized_gate and "INCOMPLETE" in normalized_gate, + "global incompleteness not explicit", + ) + _require( + "READY FOR SEPARATE EXACT-HEAD REVIEW\nNOT OPEN" in normalized_gate, "gate language invalid" + ) + _require(not semantic_paths, "semantic implementation appeared before gate opening") + + +def load_and_validate(root: Path) -> None: + def load(path: str) -> dict[str, Any]: + value: dict[str, Any] = json.loads((root / path).read_text(encoding="utf-8")) + return value + + source_set = load("benchmarks/preflight/code-start-v0.1/SOURCE-SET.json") + receipts = load("benchmarks/preflight/code-start-v0.1/RECEIPTS.json") + profile = load("docs/contracts/kernel-profiles/ztl-v0.1.json") + veip = load("docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json") + gate_text = (root / "docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md").read_text( + encoding="utf-8" + ) + active_text = "\n".join( + (root / path).read_text(encoding="utf-8") + for path in ( + "docs/contracts/kernel-profiles/ztl-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "adr/ADR-013.md", + ) + ) + source_bytes = { + item["source_id"]: (root / item["path"]).read_bytes() for item in source_set["sources"] + } + validate_evidence(source_set, receipts, profile, veip, gate_text, source_bytes, active_text) + + +if __name__ == "__main__": + try: + load_and_validate(Path(__file__).resolve().parents[1]) + except (GateEvidenceError, OSError, KeyError, json.JSONDecodeError) as exc: + print(f"FAIL semantic code-start gate evidence: {exc}") + sys.exit(1) + print("PASS semantic code-start prerequisite evidence; gate remains NOT OPEN") diff --git a/tests/contract/test_canada_acquisition_preflight.py b/tests/contract/test_canada_acquisition_preflight.py index cd4772e..5033796 100644 --- a/tests/contract/test_canada_acquisition_preflight.py +++ b/tests/contract/test_canada_acquisition_preflight.py @@ -33,10 +33,10 @@ RESOLUTION_RELPATH = "benchmarks/preflight/canada/OFFICIAL-SOURCE-RESOLUTION-v0.1.md" CLOSURE_SUMMARY_RELPATH = "benchmarks/preflight/canada/PREFLIGHT-CLOSURE-SUMMARY-v0.1.json" -EXPECTED_STATUS_SHA256 = "4a6894ca72ae8d2efcf48b3d25f8aca3bc1e2e86b6aa6aa5b38af31a52c7fde8" +EXPECTED_STATUS_SHA256 = "2cc1600a91a0966c42c42d5c9bcd37cf5a3e3638bf324a97e67f53db3c2a38e2" # Repinned when the Canada rights freeze added the CA-3 row. The preflight PR left the # manifest header-only at c3ea6162cbeb9a5814f543ec23a02fecacad72053d90258162687ad3f48a2db2. -EXPECTED_SOURCE_MANIFEST_SHA256 = "7fc66adf8940758702b0b469c5dbfcf1c4b5ee2241f217794da7b9c10305e49e" +EXPECTED_SOURCE_MANIFEST_SHA256 = "c175d96d3f211feb77bf9d020a17a3e2f01cb0f8d6da9946c8e8526d98c66a1b" EXPECTED_SCHEMA_SHA256 = { "admission-record.schema.json": ( "d040c4c86794268e26d9dd833ecd3a40347b724fbd73fb3accb3df355065f748" diff --git a/tests/contract/test_document_consistency.py b/tests/contract/test_document_consistency.py index 10541a4..fc3475a 100644 --- a/tests/contract/test_document_consistency.py +++ b/tests/contract/test_document_consistency.py @@ -587,19 +587,19 @@ def test_semantic_rules_and_validator_agree_on_rule_ids(repo_root: Path) -> None ) -def test_pr18_dependency_is_recorded(repo_root: Path) -> None: +def test_ztl_bounded_admission_is_recorded(repo_root: Path) -> None: profile = _load(repo_root, PROFILE) notice = profile["evidence_dependency_notice"] - assert "PR #16 must not merge before PR #18" in notice["merge_order"] - assert "draft" in notice["statement"].lower() - assert any("index_sha256" in step for step in notice["on_pr18_merge"]) - assert any("MEASURED" in step for step in notice["on_pr18_merge"]) + assert notice["status"] == "ADMITTED_BOUNDED_CODE_START" + assert "checked in on main" in notice["current_pin"] + assert "No runtime import or execution" in notice["statement"] + assert profile["tier_1_reproduction"].startswith("NOT ESTABLISHED") contract = _active(repo_root, CONTRACT) - assert "PR #16 must not merge before PR #18" in contract + assert "Admitted bounded ZTL evidence" in contract assert "interface-freeze-v0.2" in contract adr = _active(repo_root, ADR) - assert "PR #16 must not merge before PR #18" in adr + assert "admits the exact profile/tag/commit/fixture-index tuple" in adr def test_pinned_fixture_index_is_the_corrected_v02_pin(repo_root: Path) -> None: diff --git a/tests/contract/test_semantic_code_start_gate_closure.py b/tests/contract/test_semantic_code_start_gate_closure.py new file mode 100644 index 0000000..4fdb883 --- /dev/null +++ b/tests/contract/test_semantic_code_start_gate_closure.py @@ -0,0 +1,132 @@ +"""Fail-closed tests for the non-semantic gate-closure evidence verifier.""" + +from __future__ import annotations + +import copy +import importlib.util +import json +from collections.abc import Callable +from pathlib import Path +from types import ModuleType +from typing import Any + +import pytest + +pytestmark = pytest.mark.contract + + +def _module(repo_root: Path) -> ModuleType: + spec = importlib.util.spec_from_file_location( + "verify_code_start_gate", repo_root / "scripts/verify_code_start_gate.py" + ) + assert spec and spec.loader + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + + +def _evidence(repo_root: Path) -> dict[str, Any]: + def load(path: str) -> dict[str, Any]: + value: dict[str, Any] = json.loads((repo_root / path).read_text(encoding="utf-8")) + return value + + source_set = load("benchmarks/preflight/code-start-v0.1/SOURCE-SET.json") + return { + "source_set": source_set, + "receipts": load("benchmarks/preflight/code-start-v0.1/RECEIPTS.json"), + "profile": load("docs/contracts/kernel-profiles/ztl-v0.1.json"), + "veip": load("docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json"), + "gate_text": ( + repo_root / "docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md" + ).read_text(encoding="utf-8"), + "source_bytes": { + item["source_id"]: (repo_root / item["path"]).read_bytes() + for item in source_set["sources"] + }, + "active_text": "bounded admitted evidence is current", + "semantic_paths": [], + } + + +def _reject(repo_root: Path, mutate: Callable[[dict[str, Any]], None]) -> None: + module = _module(repo_root) + evidence = copy.deepcopy(_evidence(repo_root)) + mutate(evidence) + with pytest.raises(module.GateEvidenceError): + module.validate_evidence(**evidence) + + +def _synthetic(evidence: dict[str, Any]) -> dict[str, Any]: + return next( + item for item in evidence["source_set"]["sources"] if item["source_id"].startswith("SYN-") + ) + + +def test_current_evidence_is_valid(repo_root: Path) -> None: + _module(repo_root).validate_evidence(**_evidence(repo_root)) + + +def test_refuses_synthetic_as_real_authority(repo_root: Path) -> None: + _reject( + repo_root, + lambda e: _synthetic(e).__setitem__("benchmark_authority", "REAL_INSTITUTIONAL_AUTHORITY"), + ) + + +def test_refuses_missing_synthetic_classification(repo_root: Path) -> None: + _reject(repo_root, lambda e: _synthetic(e).__setitem__("origin_classification", "UNKNOWN")) + + +def test_refuses_digest_mutation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["source_bytes"].__setitem__("SYN-NS-GOV-1", b"mutated")) + + +def test_refuses_provenance_mismatch(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["receipts"]["receipts"][1].__setitem__("sha256", "0" * 64)) + + +def test_refuses_fabricated_government_metadata(repo_root: Path) -> None: + def mutate(e: dict[str, Any]) -> None: + item = _synthetic(e) + item["issuer"] = "Government of Canada" + item["effective_state"] = "2026-01-01" + + _reject(repo_root, mutate) + + +@pytest.mark.parametrize( + ("field", "value"), [("commit", "0" * 40), ("signed_tag", {"name": "wrong"})] +) +def test_refuses_wrong_ztl_identity(repo_root: Path, field: str, value: object) -> None: + _reject(repo_root, lambda e: e["profile"].__setitem__(field, value)) + + +def test_refuses_wrong_ztl_fixture_index(repo_root: Path) -> None: + _reject( + repo_root, + lambda e: e["profile"]["conformance_fixture_set"].__setitem__("index_sha256", "0" * 64), + ) + + +def test_refuses_stale_ztl_currentness(repo_root: Path) -> None: + _reject(repo_root, lambda e: e.__setitem__("active_text", "still in DRAFT pull request #18")) + + +def test_refuses_tier1_escalation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["profile"].__setitem__("tier_1_reproduction", "PASS")) + + +@pytest.mark.parametrize( + "field", + ["executable_runtime_integration", "oic_has_veip_lifecycle_authority", "veip_reinterprets_ztl"], +) +def test_refuses_forbidden_veip_states(repo_root: Path, field: str) -> None: + _reject(repo_root, lambda e: e["veip"].__setitem__(field, True)) + + +def test_refuses_semantic_implementation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e.__setitem__("semantic_paths", ["src/oic/semantic_parser.py"])) + + +def test_refuses_global_manifest_escalation(repo_root: Path) -> None: + _reject(repo_root, lambda e: e["source_set"].__setitem__("global_manifest_status", "PASS")) diff --git a/tests/contract/test_warrant_contract.py b/tests/contract/test_warrant_contract.py index f7d2cf4..fa207ea 100644 --- a/tests/contract/test_warrant_contract.py +++ b/tests/contract/test_warrant_contract.py @@ -1329,15 +1329,11 @@ def test_draft_schemas_are_byte_identical_to_the_bootstrap(repo_root: Path) -> N assert path.read_bytes() == committed, relative -def test_status_md_is_byte_identical_to_the_bootstrap(repo_root: Path) -> None: - from oic.baseline import BOOTSTRAP_COMMIT - - committed = subprocess.run( - ["git", "-C", str(repo_root), "cat-file", "blob", f"{BOOTSTRAP_COMMIT}:STATUS.md"], - capture_output=True, - check=True, - ).stdout - assert (repo_root / "STATUS.md").read_bytes() == committed +def test_status_records_review_ready_but_not_open_gate(repo_root: Path) -> None: + status = _plain(repo_root / "STATUS.md") + assert "READY FOR SEPARATE EXACT-HEAD REVIEW" in status + assert "NOT OPEN" in status + assert "Global repository completeness remains INCOMPLETE" in status def test_proposed_schemas_are_not_in_the_draft_directory(repo_root: Path) -> None: @@ -1348,11 +1344,11 @@ def test_proposed_schemas_are_not_in_the_draft_directory(repo_root: Path) -> Non assert len(proposed) == 3 -def test_documents_state_the_gate_is_blocked(repo_root: Path) -> None: +def test_documents_state_the_gate_is_not_open(repo_root: Path) -> None: for relpath in (CONTRACT_DOC, MAPPING_MD, ADR): - assert "semantic implementation gate remains BLOCKED" in _plain(repo_root / relpath), ( - relpath - ) + text = _plain(repo_root / relpath) + assert "semantic code-start gate" in text, relpath + assert "NOT OPEN" in text, relpath def test_documents_label_themselves_proposed(repo_root: Path) -> None: From bb5c954074e2ee747ac0ec3d2179fb4428617285 Mon Sep 17 00:00:00 2001 From: Arkadiy Miteiko Date: Thu, 27 Aug 2026 14:42:38 -0400 Subject: [PATCH 2/4] test: preserve frozen global evidence boundaries --- STATUS.md | 12 ++++------ adr/ADR-013.md | 1 + benchmarks/preflight/SOURCE_MANIFEST.csv | 3 --- .../{RECEIPTS.json => PROVENANCE.json} | 0 docs/operations/FOUNDATION.md | 22 +++++++++---------- scripts/verify_code_start_gate.py | 2 +- .../test_canada_acquisition_preflight.py | 4 ++-- .../test_semantic_code_start_gate_closure.py | 2 +- tests/contract/test_warrant_contract.py | 14 +++++++----- 9 files changed, 28 insertions(+), 32 deletions(-) rename benchmarks/preflight/code-start-v0.1/{RECEIPTS.json => PROVENANCE.json} (100%) diff --git a/STATUS.md b/STATUS.md index 10bdca7..fa649c1 100644 --- a/STATUS.md +++ b/STATUS.md @@ -8,23 +8,19 @@ This status authorizes repository creation, contract drafting, fixture preparati It does not authorize public quality, enterprise-readiness, legal-compliance, universal-novelty, or superiority claims. -## Semantic code-start prerequisite gate +## Exploratory code-start gate | Gate | Status | Required evidence | |---|---|---| | TDD-OIC-001 v1.1 checked in | PASS in bootstrap bundle | PDF + SHA-256 | | Requirement IDs and invariants checked in | PASS in bootstrap bundle | `docs/requirements/` | | Draft schemas explicit | PASS in bootstrap bundle | `schemas/draft/` | -| Dependency status explicit | PASS for bounded prerequisite scope | exact admitted ZTL profile; non-executable VEIP boundary | -| Preflight corpus rights/provenance documented | PASS for bounded prerequisite scope | CA-3 plus deterministic synthetic companions; global manifest remains INCOMPLETE | +| Dependency status explicit | PARTIAL | `DEPENDENCIES.md`; ZTL/VEIP dossiers open | +| Preflight corpus rights/provenance documented | OPEN | completed `SOURCE_MANIFEST.csv` | | Claims categories and forbidden claims checked in | PASS | `CLAIMS.md` | | Public Lab restrictions visible before upload | PASS as specification | `LIMITATIONS.md`, `docs/architecture/LAB_RESTRICTIONS.md` | | Named owner for each implemented module | PASS for kickoff | `OWNERS.md` | -**SEMANTIC CODE-START GATE:** -**READY FOR SEPARATE EXACT-HEAD REVIEW** -**NOT OPEN** - -Global repository completeness remains **INCOMPLETE**. Tier-1 reproduction is **NOT ESTABLISHED** and deferred to the experimental-release boundary. Semantic implementation remains prohibited until separate review and an owner gate-opening decision. +**Semantic implementation gate:** BLOCKED until the preflight corpus manifest and ZTL/VEIP provisional-interface records are completed. Infrastructure scaffolding and schema validation may proceed before that gate. diff --git a/adr/ADR-013.md b/adr/ADR-013.md index dcad144..c6ad37f 100644 --- a/adr/ADR-013.md +++ b/adr/ADR-013.md @@ -499,6 +499,7 @@ Not decided here. The eventual handoff must bind **at least**: **Final VEIP transition names and event schemas remain deliberately undecided.** The bounded, non-executable record in `docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json` expresses the minimum handoff only; it creates no lifecycle authority or runtime adapter. +Final transition names and executable event schemas remain deferred to OIC-GC-004. ### 4.4 The two directions that must not cross diff --git a/benchmarks/preflight/SOURCE_MANIFEST.csv b/benchmarks/preflight/SOURCE_MANIFEST.csv index 61b71bf..718a9df 100644 --- a/benchmarks/preflight/SOURCE_MANIFEST.csv +++ b/benchmarks/preflight/SOURCE_MANIFEST.csv @@ -1,5 +1,2 @@ source_id,title,issuer,source_type,official_url_or_origin,license_or_public_basis,acquired_at,sha256,effective_from,effective_until,supersedes,confidentiality,notes CA-3,Government Contracts Regulations (SOR/87-402),Department of Justice Canada (Justice Laws Website),"federal regulation, current consolidation, English XML",https://laws-lois.justice.gc.ca/eng/XML/SOR-87-402.xml,"Reproduction of Federal Law Order (SI/97-5): anyone may reproduce enactments and consolidations of enactments without charge or request for permission, provided due diligence is exercised in ensuring accuracy and the reproduction is not represented as an official version",2026-07-31T14:35:22.379578Z,6e89ad25847944ca2bd72bcbf02ec3d2942a234d373b6c10db44307e0fbdf2c3,,,,public,Unofficial copy. Frozen bytes at benchmarks/corpus/canada/freeze-v0.1/sources/CA-3.xml; receipt OIC-CA-FREEZE-CA-3-v0.1; 49977 bytes; verify with scripts/verify_canada_freeze.py -SYN-NS-GOV-1,Northstar Test Institution Governance Charter,Veraxis synthetic fixture generator,synthetic fictional benchmark source,repository-generated deterministic bytes,Synthetic test material created for OIC preflight; no real-world authority,2026-08-27T00:00:00Z,b882459931ddf06fb647e6885c1ced368b4a5f45b6441df618484a30473a2a24,SYNTHETIC_CURRENT,,,PUBLIC_SYNTHETIC,SYNTHETIC and FICTIONAL; benchmark authority only; path benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-GOVERNANCE-v1.txt -SYN-NS-PROC-1,Northstar Test Institution Operating Procedure,Veraxis synthetic fixture generator,synthetic fictional benchmark source,repository-generated deterministic bytes,Synthetic test material created for OIC preflight; no real-world authority,2026-08-27T00:00:00Z,cfb578274460cc17492f4b25a4db6893ce87a527e1207fe6a52b6384125ec073,SYNTHETIC_SUPERSEDED,,SYN-NS-AMEND-2,PUBLIC_SYNTHETIC,SYNTHETIC and FICTIONAL; deliberately stale/conflicting benchmark source; path benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-PROCEDURE-v1.txt -SYN-NS-AMEND-2,Northstar Test Institution Operating Procedure Amendment,Veraxis synthetic fixture generator,synthetic fictional benchmark source,repository-generated deterministic bytes,Synthetic test material created for OIC preflight; no real-world authority,2026-08-27T00:00:00Z,8e197bc9e01554853163dfb5f84ad807893f678b26673737c8a72ddf0c8daf47,SYNTHETIC_CURRENT,,SYN-NS-PROC-1,PUBLIC_SYNTHETIC,SYNTHETIC and FICTIONAL; benchmark authority only; path benchmarks/preflight/code-start-v0.1/sources/SYNTHETIC-NORTHSTAR-AMENDMENT-v2.txt diff --git a/benchmarks/preflight/code-start-v0.1/RECEIPTS.json b/benchmarks/preflight/code-start-v0.1/PROVENANCE.json similarity index 100% rename from benchmarks/preflight/code-start-v0.1/RECEIPTS.json rename to benchmarks/preflight/code-start-v0.1/PROVENANCE.json diff --git a/docs/operations/FOUNDATION.md b/docs/operations/FOUNDATION.md index 6fcebcf..afdd1e7 100644 --- a/docs/operations/FOUNDATION.md +++ b/docs/operations/FOUNDATION.md @@ -169,15 +169,16 @@ an unknown has nowhere to collapse into a grounded false (invariant I-03). **`oic verify-manifest --all` exits `3`. This is correct, not a bug.** -`benchmarks/preflight/SOURCE_MANIFEST.csv` records CA-3 and three explicitly synthetic, -fictional code-start companions. The global manifest remains INCOMPLETE because the -records are recorded but not verified by the global verifier. It reports: +`benchmarks/preflight/SOURCE_MANIFEST.csv` currently contains only its header row. There +are zero corpus source records. The verifier reports: ``` benchmarks/preflight/SOURCE_MANIFEST.csv [source-manifest] - 4 entries (RECORDED_NOT_VERIFIED=4) - note: 4 corpus source row(s) recorded + 0 entries + note: 0 corpus source row(s) recorded note: origin URLs are recorded only; this verifier never fetches them + note: preflight corpus manifest contains only its header: corpus provenance is NOT + complete and this repository is not corpus-ready RESULT: INCOMPLETE ``` @@ -265,13 +266,10 @@ enforcement artifact (none exists to produce). ## 8. Current limitations - **This is not a compiler.** No semantic implementation exists. See `LIMITATIONS.md`. -- **The semantic code-start gate is READY FOR SEPARATE EXACT-HEAD REVIEW / NOT OPEN.** - Semantic implementation remains prohibited. -- **Global preflight corpus provenance remains INCOMPLETE.** The bounded code-start set is - recorded, but broader Canada/corpus clearance remains unchanged. -- **ZTL is admitted only as an exact bounded input profile; VEIP has a non-executable - boundary record.** Neither runtime is imported or configured; no adapter, container, or - call exists (ADR-009, ADR-010). +- **The semantic implementation gate is BLOCKED** and nothing here opens it. +- **Preflight corpus provenance is OPEN.** `SOURCE_MANIFEST.csv` has no rows. +- **ZTL and VEIP are PROVISIONAL / NOT CONFIGURED.** Their interfaces are unfrozen + (ADR-009, ADR-010) and no adapter, container, or call exists. - **Docker Compose is validated by CI, not locally here.** The `compose-validation` job resolves the configuration, pulls every digest-pinned image, starts all three services, waits for their healthchecks, and tears the stack down. Docker is unavailable in the diff --git a/scripts/verify_code_start_gate.py b/scripts/verify_code_start_gate.py index fd7ab2d..b01430d 100644 --- a/scripts/verify_code_start_gate.py +++ b/scripts/verify_code_start_gate.py @@ -144,7 +144,7 @@ def load(path: str) -> dict[str, Any]: return value source_set = load("benchmarks/preflight/code-start-v0.1/SOURCE-SET.json") - receipts = load("benchmarks/preflight/code-start-v0.1/RECEIPTS.json") + receipts = load("benchmarks/preflight/code-start-v0.1/PROVENANCE.json") profile = load("docs/contracts/kernel-profiles/ztl-v0.1.json") veip = load("docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json") gate_text = (root / "docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md").read_text( diff --git a/tests/contract/test_canada_acquisition_preflight.py b/tests/contract/test_canada_acquisition_preflight.py index 5033796..cd4772e 100644 --- a/tests/contract/test_canada_acquisition_preflight.py +++ b/tests/contract/test_canada_acquisition_preflight.py @@ -33,10 +33,10 @@ RESOLUTION_RELPATH = "benchmarks/preflight/canada/OFFICIAL-SOURCE-RESOLUTION-v0.1.md" CLOSURE_SUMMARY_RELPATH = "benchmarks/preflight/canada/PREFLIGHT-CLOSURE-SUMMARY-v0.1.json" -EXPECTED_STATUS_SHA256 = "2cc1600a91a0966c42c42d5c9bcd37cf5a3e3638bf324a97e67f53db3c2a38e2" +EXPECTED_STATUS_SHA256 = "4a6894ca72ae8d2efcf48b3d25f8aca3bc1e2e86b6aa6aa5b38af31a52c7fde8" # Repinned when the Canada rights freeze added the CA-3 row. The preflight PR left the # manifest header-only at c3ea6162cbeb9a5814f543ec23a02fecacad72053d90258162687ad3f48a2db2. -EXPECTED_SOURCE_MANIFEST_SHA256 = "c175d96d3f211feb77bf9d020a17a3e2f01cb0f8d6da9946c8e8526d98c66a1b" +EXPECTED_SOURCE_MANIFEST_SHA256 = "7fc66adf8940758702b0b469c5dbfcf1c4b5ee2241f217794da7b9c10305e49e" EXPECTED_SCHEMA_SHA256 = { "admission-record.schema.json": ( "d040c4c86794268e26d9dd833ecd3a40347b724fbd73fb3accb3df355065f748" diff --git a/tests/contract/test_semantic_code_start_gate_closure.py b/tests/contract/test_semantic_code_start_gate_closure.py index 4fdb883..e452b45 100644 --- a/tests/contract/test_semantic_code_start_gate_closure.py +++ b/tests/contract/test_semantic_code_start_gate_closure.py @@ -33,7 +33,7 @@ def load(path: str) -> dict[str, Any]: source_set = load("benchmarks/preflight/code-start-v0.1/SOURCE-SET.json") return { "source_set": source_set, - "receipts": load("benchmarks/preflight/code-start-v0.1/RECEIPTS.json"), + "receipts": load("benchmarks/preflight/code-start-v0.1/PROVENANCE.json"), "profile": load("docs/contracts/kernel-profiles/ztl-v0.1.json"), "veip": load("docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json"), "gate_text": ( diff --git a/tests/contract/test_warrant_contract.py b/tests/contract/test_warrant_contract.py index fa207ea..b5abd09 100644 --- a/tests/contract/test_warrant_contract.py +++ b/tests/contract/test_warrant_contract.py @@ -1329,11 +1329,15 @@ def test_draft_schemas_are_byte_identical_to_the_bootstrap(repo_root: Path) -> N assert path.read_bytes() == committed, relative -def test_status_records_review_ready_but_not_open_gate(repo_root: Path) -> None: - status = _plain(repo_root / "STATUS.md") - assert "READY FOR SEPARATE EXACT-HEAD REVIEW" in status - assert "NOT OPEN" in status - assert "Global repository completeness remains INCOMPLETE" in status +def test_status_md_is_byte_identical_to_the_bootstrap(repo_root: Path) -> None: + from oic.baseline import BOOTSTRAP_COMMIT + + committed = subprocess.run( + ["git", "-C", str(repo_root), "cat-file", "blob", f"{BOOTSTRAP_COMMIT}:STATUS.md"], + capture_output=True, + check=True, + ).stdout + assert (repo_root / "STATUS.md").read_bytes() == committed def test_proposed_schemas_are_not_in_the_draft_directory(repo_root: Path) -> None: From 4065e6a7c02badd3356f4c74be0815079d836aca Mon Sep 17 00:00:00 2001 From: Arkadiy Miteiko Date: Thu, 27 Aug 2026 18:13:31 -0400 Subject: [PATCH 3/4] test: bound authorized contract evidence updates --- tests/contract/test_canada_acquisition_freeze.py | 11 ++++++++++- .../contract/test_canada_rights_resolution_dossier.py | 11 ++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/tests/contract/test_canada_acquisition_freeze.py b/tests/contract/test_canada_acquisition_freeze.py index cb782e8..47c3f61 100644 --- a/tests/contract/test_canada_acquisition_freeze.py +++ b/tests/contract/test_canada_acquisition_freeze.py @@ -456,7 +456,16 @@ def test_status_and_draft_schemas_are_untouched(repo_root: Path) -> None: ).stdout.splitlines() assert "STATUS.md" not in changed assert not any(path.startswith("schemas/draft/") for path in changed) - assert not any(path.startswith("docs/contracts/") for path in changed) + allowed_contract_updates = { + "docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "docs/contracts/ZTL-OCE-MAPPING-v0.1.md", + "docs/contracts/kernel-profiles/ztl-v0.1.json", + } + assert ( + not {path for path in changed if path.startswith("docs/contracts/")} + - allowed_contract_updates + ) assert not any(path.startswith("adapters/ztl/") for path in changed) diff --git a/tests/contract/test_canada_rights_resolution_dossier.py b/tests/contract/test_canada_rights_resolution_dossier.py index 56f4736..e8d9dcc 100644 --- a/tests/contract/test_canada_rights_resolution_dossier.py +++ b/tests/contract/test_canada_rights_resolution_dossier.py @@ -612,7 +612,16 @@ def test_status_and_draft_schemas_are_unchanged(repo_root: Path) -> None: changed = _changed_files(repo_root) assert "STATUS.md" not in changed assert not any(path.startswith("schemas/draft/") for path in changed) - assert not any(path.startswith("docs/contracts/") for path in changed) + allowed_contract_updates = { + "docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "docs/contracts/ZTL-OCE-MAPPING-v0.1.md", + "docs/contracts/kernel-profiles/ztl-v0.1.json", + } + assert ( + not {path for path in changed if path.startswith("docs/contracts/")} + - allowed_contract_updates + ) assert not any(path.startswith("adapters/ztl/") for path in changed) From 1b9755126f6df40f8a2799896c58c433a3c8ba89 Mon Sep 17 00:00:00 2001 From: Arkadiy Miteiko Date: Thu, 27 Aug 2026 19:43:22 -0400 Subject: [PATCH 4/4] fix: wire fail-closed production path discovery --- scripts/verify_code_start_gate.py | 48 +++++++++- .../test_semantic_code_start_gate_closure.py | 89 +++++++++++++++++++ 2 files changed, 136 insertions(+), 1 deletion(-) diff --git a/scripts/verify_code_start_gate.py b/scripts/verify_code_start_gate.py index b01430d..99c75d9 100644 --- a/scripts/verify_code_start_gate.py +++ b/scripts/verify_code_start_gate.py @@ -5,6 +5,8 @@ import hashlib import json +import shutil +import subprocess import sys from pathlib import Path from typing import Any @@ -21,6 +23,21 @@ "still in DRAFT pull request #18", "must not merge before PR #18", ) +ADMITTED_PRE_GATE_HEAD = "4065e6a7c02badd3356f4c74be0815079d836aca" +ADMITTED_SRC_OIC_PATHS = frozenset( + { + "src/oic/__init__.py", + "src/oic/baseline.py", + "src/oic/cli.py", + "src/oic/doctor.py", + "src/oic/errors.py", + "src/oic/hashing.py", + "src/oic/manifests.py", + "src/oic/paths.py", + "src/oic/py.typed", + "src/oic/schemas.py", + } +) class GateEvidenceError(ValueError): @@ -32,6 +49,25 @@ def _require(condition: bool, message: str) -> None: raise GateEvidenceError(message) +def discover_unadmitted_production_paths(root: Path) -> list[str]: + """Compare tracked ``src/oic`` paths with the immutable pre-gate baseline.""" + git = shutil.which("git") + if git is None: + raise GateEvidenceError("cannot enumerate tracked src/oic production paths") + result = subprocess.run( # noqa: S603 - fixed executable and literal arguments + [git, "-C", str(root.resolve()), "ls-files", "--", "src/oic"], + check=False, + capture_output=True, + text=True, + ) + if result.returncode != 0: + raise GateEvidenceError("cannot enumerate tracked src/oic production paths") + current = {line for line in result.stdout.splitlines() if line} + added = sorted(current - ADMITTED_SRC_OIC_PATHS) + missing = sorted(ADMITTED_SRC_OIC_PATHS - current) + return added + [f"MISSING:{path}" for path in missing] + + def validate_evidence( source_set: dict[str, Any], receipts: dict[str, Any], @@ -161,7 +197,17 @@ def load(path: str) -> dict[str, Any]: source_bytes = { item["source_id"]: (root / item["path"]).read_bytes() for item in source_set["sources"] } - validate_evidence(source_set, receipts, profile, veip, gate_text, source_bytes, active_text) + semantic_paths = discover_unadmitted_production_paths(root) + validate_evidence( + source_set, + receipts, + profile, + veip, + gate_text, + source_bytes, + active_text, + semantic_paths=semantic_paths, + ) if __name__ == "__main__": diff --git a/tests/contract/test_semantic_code_start_gate_closure.py b/tests/contract/test_semantic_code_start_gate_closure.py index e452b45..9024078 100644 --- a/tests/contract/test_semantic_code_start_gate_closure.py +++ b/tests/contract/test_semantic_code_start_gate_closure.py @@ -5,6 +5,8 @@ import copy import importlib.util import json +import shutil +import subprocess from collections.abc import Callable from pathlib import Path from types import ModuleType @@ -130,3 +132,90 @@ def test_refuses_semantic_implementation(repo_root: Path) -> None: def test_refuses_global_manifest_escalation(repo_root: Path) -> None: _reject(repo_root, lambda e: e["source_set"].__setitem__("global_manifest_status", "PASS")) + + +def _isolated_gate_tree(repo_root: Path, tmp_path: Path) -> Path: + root = tmp_path / "repository" + required = ( + "src/oic", + "benchmarks/preflight/code-start-v0.1", + "benchmarks/corpus/canada/freeze-v0.1/sources/CA-3.xml", + "docs/contracts/kernel-profiles/ztl-v0.1.json", + "docs/contracts/VEIP-CODE-START-BOUNDARY-v0.1.json", + "docs/contracts/WARRANT-CONTRACT-v0.1.md", + "adr/ADR-013.md", + "docs/gates/OIC-SEMANTIC-CODE-START-GATE-CLOSURE-v0.1.md", + ) + for relpath in required: + source = repo_root / relpath + target = root / relpath + target.parent.mkdir(parents=True, exist_ok=True) + if source.is_dir(): + shutil.copytree(source, target) + else: + shutil.copy2(source, target) + subprocess.run(["git", "init", "-q", str(root)], check=True) + subprocess.run(["git", "-C", str(root), "add", "."], check=True) + return root + + +def test_t1_production_detector_accepts_exact_baseline(repo_root: Path) -> None: + module = _module(repo_root) + assert module.discover_unadmitted_production_paths(repo_root) == [] + + +@pytest.mark.parametrize( + "relpath", + ("src/oic/semantic_parser.py", "src/oic/helper.py", "src/oic/newmodule/engine.py"), +) +def test_t2_t3_t4_detector_refuses_any_new_tracked_path( + repo_root: Path, tmp_path: Path, relpath: str +) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + added = root / relpath + added.parent.mkdir(parents=True, exist_ok=True) + added.write_text("# unauthorized pre-gate production path\n", encoding="utf-8") + subprocess.run(["git", "-C", str(root), "add", relpath], check=True) + detected = module.discover_unadmitted_production_paths(root) + assert relpath in detected + with pytest.raises(module.GateEvidenceError, match="semantic implementation appeared"): + module.load_and_validate(root) + + +def test_t5_detector_refuses_rename_or_substitution(repo_root: Path, tmp_path: Path) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + original = root / "src/oic/paths.py" + replacement = root / "src/oic/replacement.py" + original.rename(replacement) + subprocess.run(["git", "-C", str(root), "add", "-A", "src/oic"], check=True) + detected = module.discover_unadmitted_production_paths(root) + assert "src/oic/replacement.py" in detected + assert "MISSING:src/oic/paths.py" in detected + with pytest.raises(module.GateEvidenceError, match="semantic implementation appeared"): + module.load_and_validate(root) + + +def test_t6_load_and_validate_invokes_discovery_without_manual_parameter( + repo_root: Path, tmp_path: Path +) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + added = root / "src/oic/helper.py" + added.write_text("# innocuous name, unauthorized path\n", encoding="utf-8") + subprocess.run(["git", "-C", str(root), "add", "src/oic/helper.py"], check=True) + with pytest.raises(module.GateEvidenceError, match="semantic implementation appeared"): + module.load_and_validate(root) + + +def test_t7_working_tree_cannot_self_extend_immutable_baseline( + repo_root: Path, tmp_path: Path +) -> None: + module = _module(repo_root) + root = _isolated_gate_tree(repo_root, tmp_path) + added = root / "src/oic/future_admitted.py" + added.write_text("# existence does not confer admission\n", encoding="utf-8") + subprocess.run(["git", "-C", str(root), "add", "src/oic/future_admitted.py"], check=True) + assert "src/oic/future_admitted.py" not in module.ADMITTED_SRC_OIC_PATHS + assert module.discover_unadmitted_production_paths(root) == ["src/oic/future_admitted.py"]