[seonghobae]

Issue #2 — relational evidence to governed semantic-model proposals

Head: 85d91e264b68a7d226757d3542de9bb4eb4c7301
Stacked base branch: codex/pr6-v3-index-evidence (PR #46); its current remote tip 077324286cbc5c1a7a037cb808dad6a6c88cdcfa is an ancestor of this head. Draft; acceptance remains incomplete.

Scope to review

• Source Observation: exact source/policy capability binding, bounded read-only PostgreSQL 18 capture, qualified coordinates/types, immutable receipts, explicit material-evidence successor identities and historical framing reproduction. Unknown/distinct/not-distinct uniqueness semantics remain separate. Incomplete or unsupported captures fail closed.

• Adapter: one read-only repeatable-read catalog transaction and shared operation budget, cancellation/resource bounds, verifying TLS, least-privilege credential resolution, native catalog comparisons and anonymized GRC-shaped conformance. Credentials stay behind the adapter boundary; no cross-service application SQL.

• Semantic vertical: deterministic receipt-bound proposals, explicit alignment and validation, steward review, immutable publication records, signed manifests and client admission against trusted release metadata. Observed facts, proposed claims and published truth remain separate.

• Production repairs: one access-method/schema/operator-class identity cannot claim multiple operator families in one capture; expected relation-Var columns use the already verified exact coordinate set. Valid historical digest/receipt framing stays unchanged. Public negative tests retain duplicate/completeness/type/column/provenance rejection.

• Failure proof: malformed/stale/mixed evidence, source and policy isolation, exact expression/predicate membership, receipt denial for absent coordinates, invalid publication headers, staging/write/read failures and governed signing/admission boundaries. Input permutations preserve identities. No protection or coverage threshold was reduced.

• Composed expression-schema proofs bind to the complete capture tuple, including source, policy, extractor revision and observation time. The reproduced jointly stale-proof admission was repaired using existing full equality; independently varied public capture fixtures retain each exact refusal and fully current controls.

• Core computation remains Rust 1.98.0, with provider/network/database concerns behind versioned ports and ACLs. Model output remains proposal evidence; publication requires validation and steward review. Correction uses supersession, preserving historical releases and receipt framing.

Current-head verification and remaining gates

85d91e26 adds native PostgreSQL 18 proof for two authorized schemas with no tables. It checks each captured schema owner OID and role name against pg_namespace/pg_roles, both owner receipts against the one exact snapshot digest, and digest stability when request schema order reverses. The isolated database was removed. No production behavior or historical receipt framing changed.

Exact-head Rust 1.98 pipeline exited 0: 7,394 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,392 reported passes across 220 suites plus PostgreSQL 18 TLS conformance, then failed the unchanged owned 100% gate: functions 4,422/4,422 (100%), regions 45,174/46,793 (96.540081%), branch arms 3,792/4,662 (81.338481%). Remaining gaps: 1,619 regions and 870 branch arms. Both exact-head verification databases were removed.

Exact-head CI/coverage contracts and cargo-deny passed. Dependency manifests and Cargo.lock are unchanged from predecessor b7a451f7; nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed on that manifest-equivalent predecessor. Hosted Product/security/dependency checks and independent approval remain absent. Product workflow 347237753 is disabled_manually. This Draft PR has not met protected merge criteria. Producer PR #35 remains Draft with Changes Requested and failing older CodeQL/Strix jobs; those runs cannot validate this head.

Predecessor b7a451f7 adds the public domain contract for complete schema-owner inventory, independent rejection of missing/duplicate/unauthorized rows, order-stable digest, material owner OID and invalid identifiers. Its exact-head Rust 1.98 pipeline passed, and integrated coverage failed the unchanged gate at the same current counts.

Predecessor evidence

35ef0407 pinned missing type-owner predecessor and duplicate schema-owner attachment rejection. Exact-head full Rust passed; coverage failed at 100% functions, 96.536852% regions, and 81.317031% branch arms. Local dependency and Product contracts passed; hosted gates did not.

dd95dd32 rejected PostgreSQL 18 identity sequences with equal minimum and maximum values. Exact-head full Rust passed; coverage failed at 100% functions, 96.534717% regions, and 81.274131% branch arms. Local dependency and Product contracts passed; hosted gates did not.

7624168e admitted matching identity-sequence and Sequence relation observations at one PostgreSQL coordinate. Exact-head full Rust passed; coverage failed at 100% functions, 96.534717% regions, and 81.252681% branch arms. Local dependency and Product contracts passed; hosted gates did not.

de5fe6a8 closed the table/index namespace collision gap for identity sequences. Exact-head full Rust passed; coverage failed at 100% functions, 96.534495% regions, and 81.252681% branch arms. Local dependency and Product contracts passed; hosted gates did not. The current head refines that guard for matching Sequence relation observations.

d67c073a repaired the Unix-only adapter transport boundary: pinned tokio-postgres prefers hostaddr over a Unix host. A local TCP-listener RED proved the old NoTls path attempted TCP; the pre-I/O guard now rejects hostaddr. Exact-head full Rust passed; coverage failed at 100% functions, 96.532274% regions, and 81.244635% branch arms. Local dependency and Product contracts passed; hosted gates did not.

0bf4a59e added a native PostgreSQL 18 differential for schema-local relation/index name uniqueness, distinct receipts across two schemas, request-order-stable digests, and a renamed-index digest change. Its exact-head full Rust pipeline passed; coverage failed the unchanged gate at 100% functions, 96.532199% regions, and 81.236582% branch arms. Local dependency and Product contracts passed; hosted gates did not.

10041da5 proved that permuting both provenance and concept IDs preserves canonical governed release comparison. Its exact-head full Rust pipeline passed; coverage failed the unchanged gate at 100% functions, 96.532199% regions, and 81.043366% branch arms. Hosted gates did not.

Predecessor 6081f77e:

6081f77e repairs governed release comparison: two authoritative releases with the same ID and trusted manifest digest could be falsely rejected as conflicting when concept IDs arrived in a different order. A public RED reproduced ConflictingReleaseIdentity despite identical canonical manifest digests; the client now compares exact manifest digests for same-ID conflict and the same test passes. A changed-content same-ID release still fails trusted-manifest admission. This preserves order-independent immutable release identity without weakening client trust.

Exact-head Rust 1.98 workspace pipeline exited 0: 7,385 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,383 reported passes across 220 suites plus owned PG18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,423/4,423 (100%), regions 45,179/46,802 (96.532199%), branch arms 3,775/4,658 (81.043366%). 1,623 regions and 883 branch arms remain uncovered. Both isolated PG databases were removed. Exact-head cargo-deny, CI/coverage contracts, locked metadata, pinned Product JSON-schema/fixture checks, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed locally. SBOM hashes: /tmp/cw-6081f77e-sboms-manifest.json (local artifact only). Hosted Product/security/dependency checks and independent approval remain absent; Product workflow 347237753 is disabled_manually.

Predecessor 0f398c10:

0f398c10 extends the actual PostgreSQL 18 identity-sequence fixture. Renaming an internally owned sequence to the quoted whitespace-only name " " preserves its exact observed coordinate, changes the snapshot digest, and leaves the column receipt bound to that new digest. The native test passed against an isolated PostgreSQL 18 database; no production or historical framing code changed.

Exact-head Rust 1.98 workspace pipeline exited 0: 7,384 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,382 reported passes across 220 suites plus owned PG18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,423/4,423 (100%), regions 45,178/46,801 (96.532125%), branch arms 3,775/4,658 (81.043366%). 1,623 regions and 883 branch arms remain uncovered. Both isolated verification DBs and the focused native-test DB were removed. Exact-head cargo-deny, CI/coverage contracts, locked metadata, pinned Product JSON-schema/fixture checks, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed locally. SBOM hashes: /tmp/cw-0f398c10-sboms-manifest.json (local artifact only). Hosted Product/security/dependency checks and independent approval remain absent; Product workflow 347237753 is disabled_manually.

Predecessor 66a7ba0e:

66a7ba0e proves a governed supersession may reference an already Superseded predecessor only when its manifest is trusted and both predecessor and successor references bind to exact release IDs and artifact digests. The five-test client suite passed; no production or evidence-framing code changed.

Exact-head Rust 1.98 workspace pipeline exited 0: 7,384 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,382 reported passes across 220 suites plus owned PG18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,423/4,423 (100%), regions 45,178/46,801 (96.532125%), branch arms 3,775/4,658 (81.043366%). 1,623 regions and 883 branch arms remain uncovered. Both isolated PG databases were removed. Exact-head cargo-deny, CI/coverage contracts, locked metadata, pinned Product JSON-schema/fixture checks, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed locally. SBOM hashes: /tmp/cw-66a7ba0e-sboms-manifest.json (local artifact only). Hosted Product/security/dependency checks and independent approval remain absent; Product workflow 347237753 is disabled_manually.

Predecessor 9859361d:

9859361d adds a regular-suite TLS ACL test: an authorized but unconfigured source key and an invalid adapter-local trust anchor both return SourceUnavailable before network I/O. The focused unit test, strict package Clippy and fmt passed. No production code or historical evidence framing changed. The test executes one previously uncovered owned production region.

Exact-head Rust 1.98 workspace pipeline exited 0: 7,384 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,382 reported passes across 220 suites plus owned PG18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,423/4,423 (100%), regions 45,176/46,801 (96.527852%), branch arms 3,773/4,658 (81.000429%). 1,625 regions and 885 branch arms remain uncovered. Both isolated PG databases were removed. Exact-head cargo-deny, CI/coverage contracts, locked dependency metadata, pinned Product JSON-schema/fixture checks, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed locally. SBOM hashes are retained at /tmp/cw-9859361d-sboms-manifest.json. These local artifacts do not establish hosted Product upload, hosted security/dependency acceptance or independent review.

Predecessor dcf2ae6f extends the real PostgreSQL 18 quoted-coordinate fixture with empty and whitespace-only enum labels. Renaming the one-space label to two spaces changes the exact observed labels, snapshot digest and receipt-bound proposal ID; the new enum receipt binds to the changed snapshot digest. The focused native-I/O test passed in an isolated database. This is a test-only contract proof; production code and historical framing are unchanged. PostgreSQL documents that whitespace in enum labels is significant (PostgreSQL 18 enumerated types).

Predecessor dcf2ae6f Rust 1.98 workspace pipeline exited 0: 7,383 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,381 reported passes across 220 suites plus owned PG18 TLS conformance, then exited 1 at the unchanged 100% gate: functions 4,423/4,423 (100%), regions 45,175/46,801 (96.525715%), branch arms 3,773/4,658 (81.000429%). The native acceptance case does not increase instrumented coverage. Both isolated PG databases were removed. Exact-head cargo-deny, CI/coverage contracts, locked dependency metadata, pinned Product JSON-schema/fixture checks and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed locally. SBOM hashes are retained at /tmp/cw-dcf2ae6f-sboms-manifest.json. These are local artifacts, not hosted Product upload evidence. Hosted Product/security/dependency acceptance and independent approval remain absent.

Predecessor fe24f15d exercises PostgreSQL 18 source-fidelity with a quoted whitespace-only schema name in the existing schema-owner native-I/O test. In an isolated PG18 database, the exact schema-owner observation, role-owner change, role rename, source-digest changes, schema-scoped receipt, and fail-closed unmodeled comment/grant controls all passed. This is a two-line test change; production code and historical digest framing are unchanged.

Predecessor fe24f15d Rust 1.98 workspace pipeline exited 0: 7,383 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,381 reported passes across 220 suites plus owned PG18 TLS conformance, then exited 1 at the unchanged 100% gate: functions 4,423/4,423 (100%), regions 45,175/46,801 (96.525715%), branch arms 3,773/4,658 (81.000429%). The new native case adds source-shape acceptance but does not increase instrumented coverage. Both isolated PG databases were removed. Exact-head cargo-deny, CI/coverage-contract, locked dependency metadata and pinned Product JSON-schema/fixture checks passed locally. Nine CycloneDX 1.5 SBOMs cover all 136 locked packages; hashes are retained in /tmp/cw-fe24f15d-sboms-manifest.json. These are local artifacts, not hosted Product upload evidence. Hosted Product/security/dependency acceptance and independent approval remain absent.

e63e5c8b extends the existing PostgreSQL 18 referenced-procedure native-I/O fixture to insert a whitespace-only security-label provider into isolated catalog rows and assert the adapter retains the exact provider text. The selected test covered five referenced procedure shapes; native-row equality, digest change, receipt provenance and restoration after label removal all passed. The first RED was a stale fixture cleanup predicate, corrected before GREEN; no production code changed in this commit. Separately, a transient provider based on PostgreSQL's test-module pattern was loaded into an isolated PostgreSQL 18.4 database: SECURITY LABEL FOR " " ON FUNCTION succeeded and pg_seclabel.provider encoded to UTF-8 hex 20. That native source-validity probe and all fixture databases/modules were removed. The adapter fixture uses isolated catalog rows rather than loading the transient provider into every adapter session.

Predecessor 12631659 contains the relation-partition production repair: public RED showed it rejected a whitespace provider as blank; the constructor now reuses existing empty/NUL validation without trimming. Its 273-test contract binary and strict package Clippy passed. PostgreSQL 18 stores pg_seclabel.provider as text and upstream registration copies its name without trimming (catalog, registration source).

Predecessor e63e5c8b Rust 1.98 workspace pipeline exited 0: 7,383 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage ran 7,381 reported passes across 220 suites and owned PostgreSQL 18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,423/4,423 (100%), regions 45,175/46,801 (96.525715%), branch arms 3,773/4,658 (81.000429%). 1,626 regions and 885 branch arms remain uncovered. Both integrated-test DBs were removed. Exact-head cargo-deny, CI/coverage-contract, locked dependency-metadata and pinned Product public JSON-schema/fixture commands passed locally. The lockfile is unchanged. Pinned cargo-cyclonedx 0.5.9 generated nine exact-head CycloneDX 1.5 SBOMs in an isolated HEAD archive; the repository verifier confirmed coverage of all 136 locked packages. Artifact SHA-256 hashes are retained locally in /tmp/cw-e63e5c8b-sboms-manifest.json with the nine JSON files under /tmp/cw-e63e5c8b-sboms/. These are local artifacts, not hosted Product upload evidence.

Hosted Product/security/dependency acceptance and independent approval remain absent. Local passes and CodeRabbit status do not establish protected acceptance.

Producer PR #35 remains Draft with CodeQL dispatch verdicts pending and Strix failed. Its exact-head Strix log completed the scan with zero reported vulnerabilities, then failed because the evidence binder was absent from its trusted workspace at protected ConceptWeave main@f4f440dd. The current organization .github/main contains the binder, while ConceptWeave main does not; the central Strix workflow still checks out the target repository base as trusted-workspace. This is an upstream trust-source integration gate, not adapter execution evidence.

Latest committed public failure proof

9c8cb01d proves that a Unix adapter configuration with no explicit host is refused as SourceUnavailable before source I/O. Existing public tests already cover TCP hosts, unknown bindings, stale policy bindings and cancellation. The new refusal closes the implicit/default-host transport proof without production or dependency changes. Selected Rust 1.98 test, strict adapter-package Clippy, fmt and diff checks passed.

6f639b8d proves the shared cumulative metadata byte ceiling at the adapter trust boundary: an admitted 8,192-byte chunk succeeds and the next one-byte chunk is refused as ByteLimitExceeded { max_bytes: 8_192 }. Existing PostgreSQL 18 cases already cover oversized individual source fields; this check executes the previously untested aggregate-meter refusal. No production code, historical framing or dependency changed. Selected Rust 1.98 unit test, strict adapter-package Clippy, fmt and diff checks passed.

38c4747f extends the owned PostgreSQL 18 foreign-key conformance case: a real COMMENT ON CONSTRAINT makes the bounded adapter refuse the unmodeled source fact as InvalidCapturedMetadata; removing the comment restores the exact prior source digest. This executes the actual catalog-query rejection path without changing production logic or historical framing. Selected native-I/O test, strict adapter-package Clippy, fmt and diff checks passed.

45281a74 adds one focused identity regression: reordering any of the three two-column foreign-key comparison-operator arrays changes the owner digest. This preserves material source order without changing production code, historical receipt framing, or the PostgreSQL adapter scope. Rust 1.98 selected test, strict observation-package all-target/all-feature Clippy, fmt and diff checks passed. Exact-head full results follow.

fff6bb1c tried to reject impossible constraint-owner relation kinds in the relation builder, but the aggregate already enforces that PostgreSQL rule with relation_constraint_kind. The redundant early guard broke the existing public contract; exact-head workspace tests failed at relation_constraint_kind_contract. Commit 6eb3dbbe reverted the attempt without force-push; its source tree is byte-identical to prior f3e7fb75. Exact-head Rust 1.98 workspace tests passed 7,378 reported tests across 229 suites; strict workspace Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage passed 7,376 reported tests across 220 suites and owned PostgreSQL 18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,424/4,424 (100%), regions 45,178/46,808 (96.517689%), branch arms 3,769/4,660 (80.879828%). Both owned databases were removed. Current-head cargo-deny, CI/coverage contracts, local Product JSON-schema/fixture checks and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes and coverage report are retained locally. Hosted Product/security/dependency acceptance and independent approval remain absent.

f3e7fb75 repairs the public foreign-key catalog contract for a bounded partitioned-table parent. PostgreSQL 18 creates this valid FK and binds its two comparison-operator entries to the partitioned parent index; the previous public attachment returned foreign_key_reference_scope. The shared catalog validator now admits that exact relation kind while retaining referenced-index uniqueness, column, predicate, lifecycle and arity checks. The ordinary-table control still passes. The concrete PostgreSQL adapter intentionally rejects partitioned relations before snapshot construction because partition topology is not yet captured; an attempted end-to-end fixture returned InvalidCapturedMetadata, so this commit does not claim partitioned-source adapter support. Exact-head Rust 1.98 workspace tests passed 7,378 reported tests across 229 suites; strict workspace Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage passed 7,376 reported tests across 220 suites and owned PostgreSQL 18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,424/4,424 (100%), regions 45,178/46,808 (96.517689%), branch arms 3,769/4,660 (80.879828%). Both owned databases were removed. Current-head cargo-deny, CI/coverage contracts, local Product JSON-schema/fixture checks and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes and coverage report are retained locally. Hosted Product/security/dependency acceptance and independent approval remain absent.

b7c9b23b reproduces a public Source Observation panic: a bounded child foreign key named a missing column on its also-bounded parent; attaching column-collation evidence panicked at column_collation.rs:276. The base V3 snapshot now refuses that malformed relationship as foreign_key_referenced_column before digest or receipt construction. A referenced relation outside the bounded observation remains valid external evidence. Historical v1/v2 framing and published truth were untouched. Exact-head Rust 1.98 workspace tests passed 7,378 reported tests across 229 suites; strict workspace Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage passed 7,376 reported tests across 220 suites and owned PostgreSQL 18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,424/4,424 (100%), regions 45,178/46,807 (96.519751%), branch arms 3,769/4,660 (80.879828%). Both owned databases were removed. Current-head cargo-deny, CI/coverage contracts, local Product JSON-schema/fixture checks and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes and coverage report are retained locally. Hosted Product/security/dependency acceptance and independent approval remain absent.

9b039752 adds an actual PostgreSQL 18 TLS regression: an otherwise valid certificate/configuration with a stale policy binding is refused as SourceUnavailable before cancellation or connection. The existing TLS certificate, plaintext and host-name refusals continue to pass. No production code or historical evidence framing changed. Selected TLS runtime conformance, Rust 1.98 selected-target strict Clippy, fmt and diff passed. Exact-head full Rust exited 0 with 7,377 reported passes across 229 suites, strict workspace Clippy, fmt, warnings-denied rustdoc and release build. Integrated coverage ran 7,375 reported passes across 220 suites and owned PostgreSQL 18 TLS runtime conformance, then exited 1 at the unchanged 100% gate: functions 4,421/4,421 (100%), regions 45,152/46,783 (96.513691%), branch arms 3,761/4,652 (80.846948%). The TLS stale-binding branch executed once in the retained report. Both owned databases were removed. Current-head cargo-deny, CI/coverage contracts, local Product JSON-schema/fixture checks and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes and coverage report are retained locally. Hosted Product/security/dependency acceptance and independent review remain absent.

ff8c7b7a proves governed candidate evidence encoding is independent of receipt order while a changed source location changes the bytes. The production encoder uses the existing sort and framing; no public API or historical artifact bytes changed. Rust 1.98 selected governance tests, strict Clippy, fmt and diff checks passed. Exact-head full Rust exited 0 with 7,377 reported passes across 229 suites, strict workspace Clippy, fmt, warnings-denied rustdoc and release build. Integrated coverage ran 7,375 reported passes across 220 suites and actual owned PostgreSQL 18 TLS conformance, then exited 1 at the unchanged 100% gate: functions 4,421/4,421 (100%), regions 45,151/46,783 (96.511553%), branch arms 3,760/4,652 (80.825451%). Both owned databases were removed. Current-head cargo-deny, CI/coverage contracts, local Product JSON-schema/fixture checks and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes and the coverage report are retained locally. Hosted Product/security/dependency acceptance and independent review are still absent.

49fbd5ad bounds the one-based expression collation and relation-Var occurrence conversions before usize addition. The two owners retain their exact typed field errors for out-of-range positions and preserve all representable positions. Direct unit checks cover first, maximum representable and overflow offsets; the existing catalog-collation and relation-Var integration suites passed 8/8 each. Strict relation-partition all-target/all-feature Clippy, fmt and diff checks passed. No historical predecessor framing changed. Exact-head full Rust exited 0; owned coverage exited 1 at the unchanged 100% gate. Both used separate PostgreSQL databases and build targets; both owned databases were removed. Current-head cargo-deny, CI/coverage contracts, local Product JSON-schema/fixture checks and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes are retained in the local manifest.

f8f9e39f adds one public matrix for six post-generation Source Observation families. Each family refuses repeat attachment; every earlier family refuses all publicly constructible later families with its exact error. The matrix covers 21 reverse-order pairs and six replays without private-state injection or production changes. Rust 1.98 selected test passed 1/1, strict selected-target Clippy, fmt and diff checks passed. Exact-head full Rust exited 0; owned coverage exited 1 at the unchanged 100% gate. Both used separate PostgreSQL databases and build targets; both owned databases were removed. Predecessor-head cargo-deny, CI/coverage contracts and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes are retained in the local manifest.

8f9fad8b adds public order proofs for column generation and expression evidence. Each refuses five separately constructible later observation families, and each refuses a repeated attachment with its exact error. The expression case first supplies the required generation family. No production code or historical identity framing changed. Rust 1.98 selected suites passed 8/8 and 10/10, strict Clippy for both selected targets, fmt and diff checks passed. Exact-head full Rust exited 0; fresh owned coverage exited 1 at the unchanged 100% gate. Both used separate PostgreSQL databases and build targets; both owned databases were removed. Predecessor-head cargo-deny, CI/coverage contracts and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; artifact hashes are retained in the local manifest.

b90afa1f adds one public column-collation ordering test. It proves that seven separately constructible later observation families refuse a late collation family with the exact order error; no production code or historical identity framing changed. Rust 1.98 selected tests passed 11/11, strict observation-package all-target/all-feature Clippy, fmt and diff checks passed. Exact-head full Rust exited 0; fresh owned coverage exited 1 at the unchanged 100% gate. Both used separate PostgreSQL databases and build targets; both owned databases were removed. Predecessor-head cargo-deny, CI/coverage contracts and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; the SBOM hashes are retained in the local manifest.

f2793be5 replaces 43 literal-only, side-effect-free error closures in 38 existing relation-partition source files with direct construction of the same InvalidObservationField values. The exact 43 reviewed substitutions and formatting were verified against committed source; Option refusal guards and allocating unknown-location/overflow paths remain. The all-feature Rust 1.98 relation-partition package reported 6,796 passes across 103 suites, strict all-target/all-feature package Clippy and fmt passed. This simplification is not execution proof of missing-state paths or whole-head coverage. Exact-head full Rust exited 0; fresh owned coverage exited 1 at the unchanged 100% gate. Both used separate PostgreSQL databases and build targets; both owned databases were removed. Predecessor-head cargo-deny, CI contract and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; artifact hashes are retained in the local manifest.

07c79a69 tests rejection of late type-kind evidence after each of nine publicly constructible later observation families. It also removes eight redundant expression-family checks: the expression family can only exist after the generation family, and all constructors and the only setter preserve that implication. This retains the real guards and historical identity framing. Rust 1.98 all-feature observation-package tests passed 408 across 84 suites; strict all-target/all-feature package Clippy, fmt and diff checks passed. The first full Rust and owned-coverage run on this head is excluded: the isolated verification checkout was modified during execution. A clean checkout rerun is required before any whole-head result is claimed. Predecessor-head cargo-deny, CI contract, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed.

9b67e3b5 adds a public refusal test for attempting to attach the same observed PostgreSQL type-kind family twice to one immutable source snapshot. Its all-feature Rust 1.98 test target passed 8 tests, with strict package all-target/all-feature Clippy, fmt and diff checks passed. Exact-head full Rust and owned coverage results are reported below. Predecessor-head cargo-deny, CI contract and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed.

46b584ac adds a public converter-owner receipt contract: both observed converter directions issue exact receipts; zero and extra key positions, same type name in another schema, and another type name are refused. Its all-feature Rust 1.98 test target passed 134 tests, and strict package all-target/all-feature Clippy, fmt and diff checks passed. Full exact-head verification is reported below.

fb9820a4 simplifies 45 literal-only enum-error closures in 17 existing source files using the established direct-error pattern. Every Option refusal guard and exact error field remains; allocating location errors and overflow guards are unchanged. Package-wide Rust 1.98 and nightly runs each reported 6,771 passes (103/102 suites respectively), with strict all-target/all-feature package Clippy, fmt and diff checks passed. Diff verification permits only the reviewed substitutions and Rust formatting. This is simplification, not execution proof of downstream missing-state paths, whole current-head acceptance or 100% coverage.

29374d2b changes five existing test files, without production or receipt-framing changes:

• Parentage, enforcement and period receipts reject independently mismatched schema, relation, valid relation kind and constraint name, returning the exact unknown location. Each formerly unexecuted error closure ran four times.
• Converter ACL receipts admit both observed directions and reject zero/extra key positions, same-name types in a different schema, and different type names. The formerly unexecuted error closure ran eight times.
• Repeating otherwise-admissible converter evidence is rejected with the exact coordinate error. Previously unexecuted sort and tie-break functions each ran once.

Rust 1.98 and nightly selected runs passed: 11 tests across three receipt suites, 124 tests in the converter suite, and 140 tests in its ACL suite. These suites include shared fixtures; counts are not additive unique cases. Strict all-target/all-feature package Clippy, fmt and diff checks passed. Initial test assumptions about unsupported relation kinds and direction-token spelling were corrected to the existing contracts before the passing runs. No private-state injection, production changes or native I/O claims are made from these deterministic fixtures.

Exact full verification

Exact current head 9c8cb01d complete Rust 1.98 pipeline exited 0: 7,380 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage exited 1 at the unchanged 100% gate after 7,378 reported passes across 220 suites and owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,424/4,424 (100%), regions 45,180/46,808 (96.521962%), branch arms 3,772/4,660 (80.944206%). The no-host test executed one previously uncovered transport branch; 1,628 regions and 888 arms remain. Exact report and normalized inventories are retained under /tmp/cw-9c8cb01d-*; both isolated PG databases were removed. Current-head cargo-deny, CI/coverage contract, and pinned Product JSON-schema/fixture checks passed locally. Hosted Product/security/dependency checks and independent approval remain absent.

Exact predecessor 6f639b8d complete Rust 1.98 pipeline exited 0: 7,380 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage exited 1 at the unchanged 100% gate after 7,378 reported passes across 220 suites and owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,424/4,424 (100%), regions 45,180/46,808 (96.521962%), branch arms 3,771/4,660 (80.922747%). The cumulative byte test executed one previously uncovered owned region and branch arm; 1,628 regions and 889 arms remain. Exact report and normalized inventories are retained under /tmp/cw-6f639b8d-*; both isolated PG databases were removed. Current-head cargo-deny, CI/coverage contract, and pinned Product JSON-schema/fixture checks passed locally. Hosted Product/security/dependency checks and independent approval remain absent.

Exact predecessor 38c4747f complete Rust 1.98 pipeline exited 0: 7,379 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Integrated coverage exited 1 at the unchanged 100% gate after 7,377 reported passes across 220 suites and owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,424/4,424 (100%), regions 45,179/46,808 (96.519826%), branch arms 3,770/4,660 (80.901288%). The FK comment test executed one previously uncovered owned region and branch arm; 1,629 regions and 890 arms remain. Exact report and normalized inventories are retained under /tmp/cw-38c4747f-*; both isolated PG databases were removed. Current-head cargo-deny, CI/coverage contract, and pinned Product JSON-schema/fixture checks passed locally. Hosted Product/security/dependency checks and independent approval remain absent.

Exact predecessor 45281a74 complete Rust 1.98 pipeline exited 0: 7,379 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its isolated PostgreSQL database was removed. Integrated coverage exited 1 at the unchanged 100% owned-production gate after 7,377 reported passes across 220 suites and owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,424/4,424 (100%), regions 45,178/46,808 (96.517689%), branch arms 3,769/4,660 (80.879828%); missing 1,630 regions and 891 branch arms. The exact JSON report and normalized inventories are retained under /tmp/cw-45281a74-*; its isolated database was removed. Current-head cargo-deny and CI/coverage-contract checks passed locally. Hosted Product/security/dependency checks and independent approval are still absent.

Exact predecessor 49fbd5ad complete Rust pipeline terminated with exit 0: 7,376 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate after 7,374 reported passes across 220 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,419/4,420 (99.977376%), regions 45,140/46,778 (96.498354%), branch arms 3,760/4,652 (80.825451%). Remaining gaps: 1 function, 1,638 regions, 892 arms. The exact report and normalized inventories are retained; its owned coverage database is absent. Current-head cargo-deny, CI/coverage contracts, fifteen pinned Product JSON-schema/fixture commands, semantic supersession fixture validation, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed locally; SBOM artifact hashes are retained in the local manifest.

Exact predecessor f8f9e39f complete Rust pipeline terminated with exit 0: 7,374 reported passes across 229 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. The owned PostgreSQL 18 capture suite reported 59 passes with an explicit isolated DB; these include deterministic/public-error cases and are not 59 separate native-I/O proofs. Its owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate after 7,372 reported passes across 220 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,415/4,420 (99.886878%), regions 45,111/46,754 (96.485862%), branch arms 3,760/4,652 (80.825451%). Remaining gaps: 5 functions, 1,643 regions, 892 arms. The exact report and normalized inventories are retained; its owned coverage database is absent. Predecessor-head cargo-deny, CI/coverage contracts, fifteen pinned Product JSON-schema/fixture commands, semantic supersession fixture validation, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed locally; SBOM artifact hashes are retained in the local manifest.

Exact predecessor 8f9fad8b complete Rust pipeline terminated with exit 0: 7,373 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate after 7,371 reported passes across 219 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,415/4,420 (99.886878%), regions 45,106/46,754 (96.475168%), branch arms 3,742/4,652 (80.438521%). Remaining gaps: 5 functions, 1,648 regions, 910 arms. The exact report and normalized inventories are retained; its owned coverage database is absent. Predecessor-head cargo-deny, CI/coverage contracts, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed, with artifact hashes in the local manifest.

Exact predecessor b90afa1f complete Rust pipeline terminated with exit 0: 7,371 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate after 7,369 reported passes across 219 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,415/4,420 (99.886878%), regions 45,104/46,754 (96.470890%), branch arms 3,730/4,652 (80.180567%). Remaining gaps: 5 functions, 1,650 regions, 922 arms. The exact report and normalized inventories are retained; its owned coverage database is absent. Predecessor-head cargo-deny, CI/coverage contracts, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed, with artifact hashes in the local manifest.

Exact predecessor f2793be5 complete Rust pipeline terminated with exit 0: 7,370 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate after 7,368 reported passes across 219 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,415/4,420 (99.886878%), regions 45,103/46,754 (96.468751%), branch arms 3,723/4,652 (80.030095%). Remaining gaps: 5 functions, 1,651 regions, 929 arms. The exact report and normalized function inventory are retained; its owned coverage database is absent. Predecessor-head cargo-deny, CI contract and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed, with artifact hashes in the local manifest.

Exact frozen predecessor 9b67e3b5 complete Rust pipeline terminated with exit 0: 7,369 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate after 7,367 reported passes across 219 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,415/4,463 (98.924490%), regions 45,068/46,848 (96.200478%), branch arms 3,724/4,668 (79.777207%). Remaining gaps: 48 functions, 1,780 regions, 944 arms. The exact report and normalized function inventory are retained; the owned coverage database is absent. Predecessor-head cargo-deny, CI contract, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed, with artifact hashes in the local manifest.

Exact frozen predecessor 46b584ac complete Rust pipeline terminated with exit 0: 7,368 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate, after 7,366 reported passes across 219 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,415/4,463 (98.924490%), regions 45,067/46,848 (96.198344%), branch arms 3,723/4,668 (79.755784%). Remaining gaps: 48 functions, 1,781 regions, 945 arms. The exact report and normalized function inventory are retained; its owned coverage database is absent. Predecessor-head cargo-deny, CI contract, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; hashes are retained in the local manifest.

Exact frozen predecessor fb9820a4 full Rust pipeline terminated with exit 0: 7,343 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. The owned workspace database is absent. Fresh integrated coverage terminated with exit 1 at the unchanged 100% gate, after 7,341 reported passes across 219 suites and actual owned PostgreSQL 18 TLS runtime conformance passed. Owned functions 4,415/4,463 (98.924490%), regions 45,067/46,848 (96.198344%), branch arms 3,722/4,668 (79.734362%). Remaining gaps: 48 functions, 1,781 regions, 946 arms. The exact report and normalized function inventory are retained; the owned coverage database is absent. Separate predecessor-head TLS conformance, cargo-deny, CI contract, and nine CycloneDX 1.5 SBOMs covering all 136 locked packages passed; artifact hashes are retained in the local manifest. Earlier readers were terminal before reusing the checkout; predecessor source and reports are archived.

Exact frozen predecessor 29374d2b complete Rust pipeline terminated with exit 0: 7,343 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Its owned workspace database is absent. Predecessor-head PostgreSQL 18 TLS runtime conformance, cargo-deny, CI contract and nine CycloneDX 1.5 SBOMs covering 136 locked packages also passed. Integrated coverage terminated with exit 1 at the unchanged 100% gate, after 7,341 reported passes across 219 suites and actual TLS conformance passed. Owned functions 4,418/4,508 (98.003549%), regions 45,025/46,848 (96.108692%), branch arms 3,722/4,668 (79.734362%). Remaining gaps: 90 functions, 1,823 regions, 946 arms. The exact report and normalized inventory are retained; its owned database is absent. All six selected successor functions are now included in integrated proof. Older readers were terminal before the verification checkout was updated; predecessor source and reports were archived.

Frozen predecessor 4128c7339364bf89b6657f0ec3266a59f1740cd1:

• Complete Rust pipeline exited 0: 7,343 reported passes across 228 suites, strict workspace/all-target/all-feature Clippy, fmt, warnings-denied rustdoc and release build passed. Owned workspace database is absent.
• Integrated coverage exited 1 at the unchanged 100% gate after 7,341 reported passes across 219 suites and actual owned PostgreSQL 18 TLS conformance passed. Owned functions 4,412/4,508 (97.870453%), regions 44,995/46,848 (96.044655%), branch arms 3,719/4,668 (79.670094%). Gaps: 96 functions, 1,853 regions, 949 arms. Report and normalized inventory are retained; owned coverage database is absent.
• PostgreSQL capture suite reported 59 passes with the explicit owned-database DSN. This includes deterministic/public-error tests and is not 59 independent native I/O proofs.
• Separate TLS runtime conformance, cargo-deny, CI contract, and nine CycloneDX 1.5 SBOMs covering 136 locked packages passed at that exact predecessor.

Predecessor 9c8cb01d local verification was complete. Its integrated coverage did not satisfy the unchanged 100% owned production coverage gate, and protected hosted acceptance remains absent. The full original Issue #2 scope remains required.

Protected acceptance and remaining work

Predecessor 9c8cb01d GraphQL audit: Draft, unchanged stacked base branch, only CodeRabbit SUCCESS, no independent approval, zero unresolved review threads, and no additional review/thread pages. CodeRabbit status is not Product/security/dependency acceptance.

Owner .github main is 3295c259bcb688673170a1902f46d1d6c775bad4; master-context and product-goal directive blobs are unchanged from the fully read versions. Owner PR #2350 remains open and unmerged at 1e8da05d5b0851da212b3e340e7085fb1de550ce; producer ConceptWeave PR #35 remains open, Draft and unmerged at d7b7e30b278ec2f27096b4d313c7d5eaf5387ddc, with CHANGES_REQUESTED and a failing status rollup. A fresh workflow API audit confirms Product (.github/workflows/product.yml, id 347237753) is disabled_manually; the current head has no hosted Product check.

Remaining: close the unchanged 100% owned coverage gaps with valid proof, complete hosted current-head Product/security/dependency checks, and obtain independent approval through the ordinary protected owner/producer/Foundation propagation order. The uncovered base-snapshot index-relation-kind guard is unreachable through the public relation builder because that builder already refuses the invalid state; the redundant trust-boundary guard remains intact rather than being deleted to improve a percentage. No manual child-workflow wake, readiness promotion, protection change, self-approval, merge or release is authorized by partial local results.

Historical predecessor dependency evidence: nine CycloneDX 1.5 SBOMs were regenerated from an isolated git archive of exact 9c8cb01db208e2a76a17d4e8045e7789bb3be402; scripts/check_sbom.py passed and found all 136 locked packages. Their SHA-256 manifest is /tmp/cw-9c8cb01d-sboms-manifest.json (local artifact only). Dependency manifests are byte-identical to 6eb3dbbe. Exact-head cargo deny check passed separately. This is local evidence, not a hosted security/dependency check.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head finding: Source Observation now correctly treats PostgreSQL identifiers as empty/NUL-invalid but otherwise exact, including quoted whitespace. pg_language.lanname and pg_extension.extname are name identifiers, yet the relation-partition transform extension-membership constructor still routes both through trim().is_empty(), so a legal quoted whitespace language/extension is rejected downstream. I added only the focused retained RED candidate in index_exclusion_constraint_operator_procedure_transform_extension_membership_identifier_contract.rs; production is intentionally unchanged until this exact head obtains attributable execution evidence. No PR-triggered hosted workflow run is currently attached to 789597e16a4b46b6fcd0a0895d0c2f1e6ad4f89f, so this is not yet promoted to reality RED/GREEN.