EPOCH-2: terminal-outcome progress semantics + epoch lineage (ruling executed) - #18
Merged
Merged
Conversation
…te advance on event-specific VALIDATED terminals The epoch-1 deadlock (EPOCH-1-CLOSURE.md finding F1/F2): completed_cells accepted only COMPLETE, so a lawful validated NOT-PROMOTED terminal — and the CAPABILITY_LOCK event of a failed universe, which had no terminal writer — never advanced the frozen prefix walk. - order.progress_valid(): the ruling's algebra — model cells COMPLETE only; PROMOTION COMPLETE|NOT-PROMOTED; CAPABILITY_LOCK COMPLETE| NOT-LOCKED; downstream cells of a validly failed capability universe NOT-EVALUABLE; INCOMPLETE/INADMISSIBLE never progress. The prefix walk consumes it (strict prefix, stops at the first non-progress-valid cell); cell_state is order-admissible against the same algebra. - NOT-EVALUABLE now rides _local_state (the exact validated state cell_state already produced) so the walk/order guard see it. - CAPABILITY_LOCK dispatches outcome-first to the new _not_locked_state validator: outcome fields exact, bound to the RECORDED promotion outcome sha + the real T0/T1 chain tips, PROMOTION re-validated NOT-PROMOTED, no real lock, no fabricated manifest, no conflicting governance artifact — any defect is INADMISSIBLE and blocks the walk. - emit_capability_lock_outcome(): the terminal NOT-LOCKED writer (once, in the derived lock-run dir; fail closed on a real lock, a receipt, a non-terminal promotion, stray artifacts, out-of-order prefix, re-invocation). - promotion.advance(): one call drives a failed universe to BOTH terminals (NOT-PROMOTED recorded, then the lock event completes NOT-LOCKED), refusing with PROMOTION-DENY | LOCK-DENY; re-invocation is an idempotent write-once refusal. next_event keeps deriving PROMOTION while the terminal record is owed (the derived terminal is progress-valid). Non-COMPLETE terminals are never converted to COMPLETE and authorize no promotion, lock, capability consumption or retry.
…-lock acceptance in preflight/runner/mint; live probe epoch-awareness EPOCH-1-CLOSURE.md orders an explicit epoch boundary. Epoch 1 stays immutable (state/**, FINAL lock bytes, closure record untouched); epoch 2 is a fresh lineage: - harness/epoch.py: EPOCH_ID="epoch2"; a structural transition record (EPOCH-2-TRANSITION.json) activates epoch 2 — it must cite the closure record's actual bytes and the closure-recorded epoch-1 FINAL lock hashes (f6616ea2 / 96eac57b). state_root() prefixes all derived namespaces under state/epoch2/ (order.state_dir/verify_namespace_ancestry/ ensure_namespace; specificity's stray walk), so epoch-1 evidence is never scanned or written. validate_record / validate_epoch1_historical_lock / validate_epoch2_lock_binding / validate_transition audit the boundary. - harness/epoch_transition.py: the operator command. --check reports the active epoch; --transition verifies the epoch-1 closure facts on disk (refusing a drifted epoch), writes the record, mints the fresh OPEN epoch-2 locks (epoch: 2 + transition citation + their OWN empty amendment lineage + frozen constants + full harness coverage + ORDER- EXPANSION pin), and never finalizes (owner act). - preflight: V2/V3 dispatch to validate_protocol_epoch2 / validate_execution_epoch2 when the record exists — the epoch-2 locks are the live authority (same structural rules: linear append-only chains from the recorded epoch-2 genesis, disk == unique tip, harness bytes/closure, ORDER-EXPANSION pin, status vocabulary), while the epoch-1 FINAL locks are checked as historical records (closure-cited bytes + status) and their tips are no longer enforced against the epoch-2 bytes. active_protocol_tips() is the dispatcher the live-lineage probes use. META gains the closure record + the three epoch-2 files, and the instance-freeze walk no longer judges runtime state/ (a live-tree fix: the closure record had left preflight at 1/0/0). - runner: final_lock_gate and the seal-time identity bundle read the ACTIVE epoch's locks; under epoch 2 the OPEN fresh locks refuse the wired estimand surface (LOCK-NOT-FINAL) until the owner finalizes — the epoch-1 FINAL locks authorize nothing. - mint_execution_lock.py: epoch-aware (re-mint/finalize the active epoch's lock; the closed epoch-1 lock is never touched). - H28/H29/H30 live-lineage probes judge the ACTIVE authority (active_protocol_tips); H30's certified preflight.py lineage constant re-certified 26 -> 27 for this commit. H36's live gate proof is epoch-aware (open active locks => named LOCK-NOT-FINAL refusal).
smoke_h37_epoch2_semantics.py proves the ruling end-to-end through the
real controllers/validators (hermetic fixtures + one disposable git
worktree; no network, no docker):
A. terminal algebra: T0/T1 COMPLETE with a failed candidate validation;
PROMOTION derives NOT-PROMOTED before any record; ONE advance()
records PROMOTION-OUTCOME.json and completes the CAPABILITY_LOCK
event as CAPABILITY-LOCK-OUTCOME.json (NOT-LOCKED, bound to the
promotion outcome sha + real chain tips), refusing with the combined
terminal message; the full prefix walks past the failed universe
(downstream NOT-EVALUABLE); the deadlock is gone (the next universe's
T0 authorizes) while nothing is authorized (no lock/receipt, no
consumption, ACQUISITION-FAILED-DENY, no retry) and re-invocation is
an idempotent write-once refusal.
B. malformed/forged terminals fail closed (INADMISSIBLE + walk blocks):
tampered outcome field, forged tips, fabricated run manifest,
tampered promotion-outcome bytes, a real lock beside NOT-LOCKED.
C. epoch-2 lineage: activation/state prefixing/epoch-1 evidence never
scanned (completed_cells empty, cell INCOMPLETE, stray walk scoped),
a forged closure citation de-activates; the real transition on a git
worktree (drifted epoch-1 lock refuses; fresh locks carry epoch: 2 +
the transition citation + their own empty lineage; preflight green in
epoch 2 incl. committed lock byte authority; the runner gate names
the OPEN epoch-2 locks; the standard mint --finalize lifecycle
continues on the new lineage; a fixture finalization turns the gate
green; drifted epoch-2 harness bytes still fail closed).
D. algebra table + no-conversion guard (NOT-PROMOTED can never be
consumed as COMPLETE).
H12 gains the same algebra table plus the strict-prefix ledger proof (an
INADMISSIBLE cell drops itself and every later completion), without
weakening any existing assertion.
…validators; lock_universe refuses an already-terminal universe in LOCK-DENY vocabulary; suite fixture carries the full governed set
… epoch-1 untouched harness/epoch_transition.py --transition verified the epoch-1 closure facts on disk (closure record sha256 917f379429a9; FINAL EXECUTION-LOCK.json f6616ea2...; FINAL PROTOCOL-LOCK.json 96eac57b...) and wrote: - benchmarks/fam-c/EPOCH-2-TRANSITION.json: the epoch boundary record. It cites the closure record bytes and the two closure-recorded lock hashes, the epoch-2 state prefix state/epoch2/, and the genesis base map (the transition-time governed bytes) both epoch-2 locks must anchor on. - benchmarks/fam-c/EXECUTION-LOCK-EPOCH2.json: fresh execution authority, epoch 2, status open-round2, its OWN append-only amendment lineage (amendments: []), 27 harness files byte-minted from this commit. - benchmarks/fam-c/PROTOCOL-LOCK-EPOCH2.json: fresh protocol authority, epoch 2, status living-lock, governed = the transition-time governed bytes, amendments: [], ORDER-EXPANSION.json pin re-verified. NOT finalized: both epoch-2 locks stay OPEN (the owner finalizes later per the ruling). The runner's FINAL gate therefore refuses wired estimand cells naming the epoch-2 locks; epoch-2 cells execute from the beginning under this lineage once finalized. The epoch-1 locks remain FINAL at their closure-recorded bytes and the archived state/PQ/** evidence is untouched and never scanned by epoch-2 machinery. Verification at this commit: harness/epoch_transition.py --check green; python3 benchmarks/fam-c/preflight.py 0/0/0 (epoch-2 locks are the live authority; epoch-1 locks checked as historical records).
…h2; H7/H31 probes judge the active epoch Post-transition verification surfaced two real gaps and one probe assumption: - order.ensure_namespace(): under epoch 2 the state root (state/epoch2) sits one level below the historical state/ dir, so creating it with a bare mkdir failed when state/ did not exist yet (a fresh worktree). Every missing component is now created explicitly at 0755, no-follow, and verify_namespace_ancestry() walks state/ BEFORE state/epoch2/... so a symlinked state/ is refused in both epochs. - H31's forged-lock probes now forge the ACTIVE epoch's protocol lock (the fresh lineage starts with amendments: [], so the forged single edge is built directly from the recorded genesis base) and assert the active lock's named authority finding; its live byte-equality probe and the certified preflight.py lineage constant (26 -> 27) follow the active lineage. - H7's derived-namespace probe asserts the per-universe derivation under the ACTIVE state root (the epoch prefix is plumbing, the rule is the same). The epoch-2 EXECUTION-LOCK-EPOCH2.json was re-minted through the standard flow (harness/mint_execution_lock.py --slice epoch2-slice --reason ...): its first, own-lineage amendment records the order.py fix. Epoch-1 locks untouched. Verification: python3 benchmarks/fam-c/preflight.py 0/0/0; H7 71/71, H12 51/51, H14 25/25, H23 15/15, H31 33/33.
The prefix walk's new NOT-EVALUABLE dispatch made h25 (minutes-scale by design) run against the 300s suite cap. Two semantics-preserving fixes: - order._acquisition_failed_inner(): the predicate is a conjunction, so the cheap committed-artifact reads (T1 chain's single failed candidate-validation event, T0 arrival candidate sha) run FIRST and the full T0/T1 COMPLETE validations (chain re-verification + admissibility classification) LAST. A healthy universe now short-circuits on its T1 chain; a genuinely failed one still demands both acquisitions validated COMPLETE before the predicate can hold (same answer, bounded cost). - The already-loaded ORDER-EXPANSION is threaded through cell_state -> _local_state -> _model_run_state / acquisition_failed / completed_cells, so one parse serves a whole validation walk instead of thousands (the guard validates every earlier cell per cell). h25 runtime: 258s -> 162s (baseline before this slice: 191s). Probe fixes prompted by running the suites in the epoch-2 world: - H35's seal/receipt execution-identity control reads the ACTIVE epoch's execution lock (the one the runner sealed with). - H37's rehearsal worktree anchors at the commit that ADDED the transition record (the last untransitioned state), so the transition is exercised for real even when the live HEAD is already epoch 2. - H37's own `_EPOCH`/probe list now compares the OPEN epoch-2 locks. EXECUTION-LOCK-EPOCH2.json re-minted through the standard flow (its own lineage amendment records the order.py changes). Epoch-1 locks untouched.
…nifest Records the implemented epoch-2 slice in FAMC-EXECUTION-STATUS.md: the terminal-outcome algebra + NOT-LOCKED writer/validator, the explicit epoch-2 lineage (transition record + fresh OPEN locks with their own amendment lineage + state/epoch2/ prefixing), the preflight/runner epoch-2 acceptance, the operator commands, the deferred owner act (epoch-2 finalization + cells from the beginning), and the verification numbers: code ref c62c54f battery 39/39 PASS (direct exit codes, 300s cap) preflight 0/0/0 synthetic attack 5/5 at the same ref For contrast the pre-slice baseline (a012d60) is recorded: 32/38 with all six failures caused by EPOCH-1-CLOSURE.md missing from preflight's meta set. MANIFEST.json is the attack driver's refreshed record at this ref.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per the EPOCH-1 closure ruling (EPOCH-2 PROTOCOL): event-specific progress-valid terminal algebra (COMPLETE | NOT-PROMOTED | NOT-LOCKED | NOT-EVALUABLE; INCOMPLETE/INADMISSIBLE never), a validated NOT-LOCKED terminal writer for lock cells of failed universes, validator symmetry mirroring the denial rigor, smoke_h37 (26/26) proving the full failed-universe prefix walks without authorizing anything and malformed terminal records still block, plus the epoch-2 lineage mechanism (fresh OPEN locks on their own append-only lineage citing the closure hashes; state under state/epoch2/; epoch-1 artifacts untouched — hashes re-verified). Battery 39/39 at 53e72ef; preflight 0/0/0; attack 5/5. Also repairs the closure-file META gap that left preflight red after PR #17.