[MaxGhenis]

Milestone M0 of the ARCH-1 end state Max ruled on 2026-10-15 (cos d1160). It puts the release contract on paper, freezes C1 and C5 as golden fixtures, and clears the 10-09 systems report's retire-now items that are still open. It turns no refusal on. Enforcement starts 2026-11-06 per the ruling; nothing here changes what publishes or any published number.

What changes

• docs/release-contract.md (new). It covers:

  • the end state and what is served today;
  • contracts C1–C5, each as the code enforces it now (cited to the function that does it) and as it will from 11-06;
  • how C1 keys by declared country instead of id strings (required_release_files, _expected_model_package, line_for_release_id);
  • Build K epic: transactional country executor via strangler extraction from the US release monolith #378's parity rule and the enforcement timeline;
  • the golden fixtures and the retire list's state.

  It replaces the branch-only us-uk-release-path.md. The emitter section follows what merged in Delegate local telemetry and graph publication to microcosm-emitter (deferred) #1153 (external microcosm-emitter), as d1162's note records.

• tools/assemble_uk_release_dir.py. The two manifest dicts move into uk_national_release_manifests, a pure function. Output is byte-for-byte unchanged: I ran the old and new assembler on the green fixture with a fixed clock, and the manifests were identical in key order and the evidence files identical in bytes, apart from the NPZ digest, which changes on every run because zip entries carry timestamps.

• tools/generate_release_contract_fixtures.py writes the golden fixtures under packages/microcosm-data/tests/fixtures/release_contract/v1/, following the staging-fixture pattern:

  • C1: the UK national build_manifest.json and release_manifest.json, written by the assembler's own function, plus inventory.json, read from the contract's constants (required files, the files shipped, the certification's kind, schema, fields, parts and signing-key variable).
  • C5: latest.json and latest-national.json, serialized exactly as publish_release uploads them, and registry.json.
  • SHA256SUMS and a --check mode.

  The fixtures carry no gate report or signed certification, on purpose: those embed the live UK gate-spec digests. uk/gates.json changed 94 times since 2026-09-01, so byte-frozen copies would churn almost daily.

• Retired: format_uk_release_id, UKReleaseIdentity and apply_uk_release_identity. None had a caller outside its own tests and the re-export, in this repository or in policyengine.py, microcosm-dynamics or the benchmark, runs or emitter repositories. The line ids and tier vocabulary stay, and the contract still validates existing exact-k ids.

• Changelog fragments, and pointers from README.md and docs/agent-guide.md.

Invariants the tests hold

• Freeze: generate_release_contract_fixtures.py --check reproduces every committed byte. A change to the assembler's manifests, the contract's required files or certification fields, the pointer payloads or the registry fails it until the fixtures are regenerated. Mutation checks: rewording the manifest description failed --check, and renaming a registry file failed the C5 test.
• C1 validity, for every input: a Hypothesis property (60 examples) holds that for any valid inputs, uk_national_release_manifests output:
  • passes _check_build_manifest, _check_release_manifest and the cross-manifest check;
  • pins every artifact to the one cut tag;
  • ships exactly the signed evidence files;
  • resolves through the registry's national spec in the loader;
  • is deterministic.
• Golden validity: validate_release_dir on the golden UK directory raises exactly two failures, the two files the fixture omits (calibration_diagnostics.json, release_certification.json).
• Differential, producer against consumer: the C5 pointers equal latest_pointer_payload / line_pointer_payload byte for byte and read back through latest_release / latest_line_release. The line pointer names the C1 release at its cut tag. registry.json equals REGISTRY.
• Executable gap pins (test_release_contract_keying.py): today's id-string keying, which M3 flips deliberately. One test shows the same release bytes validate under microcosm-nz-2025-national and fail under a populace-us- id.

Retire list (checked 2026-10-15)

• Already done: the graph-native drafts (10-09 and, under d1161, 10-15) and Publish UK execution graphs through a general build emitter service #1148 (Add country-neutral Orrery execution evidence and UK contracts #1144 and Publish UK Orrery graphs with the existing local build service #1151 merged).
• Closed now, branches kept: Add Axiom input concept-coverage diagnostics #822, Add Belgium target and population-input boundary #824, Authenticate Axiom relation materialization #826 and SLD per-district local layer: 2024-vintage membership, doctrine solve, validated sidecar (#625) #642.
• Noted for Pavel: evidence on Record process telemetry for US release builds #1083 (mostly superseded by Add always-on build telemetry delivery #1099/Delegate local telemetry and graph publication to microcosm-emitter (deferred) #1153 and run_outcome) and Keep US staging telemetry on for every build #1082 (belongs in Emit staging telemetry for US exact-K builds #933).
• Add reusable typed model artifacts and transfer graphs #873: left open. microcosm-dynamics still pins its off-main head 3ff92b0; I've asked the dynamics session to repin.
• tools/build_uk_rowwise_dataset.py: kept. The report's premise fails, because the graph driver takes --candidate-clone-counts only with --dry-run, and UK-3 is undecided.
• Stale text, microcosm.institute and the evidence tier: left to task_d2b70813.
• Build K epic: transactional country executor via strangler extraction from the US release monolith #378: closes on merge.

Review

• Independent GPT-6.1 Sol review: queued (Subfleet job 20261015-061558-m0-1285-review). The Codex lanes reopen at about 14:53Z.
• An Opus review is running in parallel.
• Verdicts will be posted here.

🤖 Generated with Claude Code

[MaxGhenis]

Opus 5.5 review of c2d50d8: REQUEST_CHANGES (0 blockers, 3 majors, 16 minors and nits). All 19 are addressed at 47389ec.

Majors:

1. US Logbook writers. The doc wrongly listed tools/us_bundle_generation/core.py as a writer; it only reads and verifies logbook/us.jsonl. Corrected.
2. Required lists. The "whatever the id" list overstated the compatible_model_packages requirement for ids the contract does not recognise. Now qualified.
3. gates shape. The C1 golden carried a gates shape the national line never ships: a map from gate id to status, where the certifier writes a status census, {"passed": N}. Fixed in the generator and the property strategy. A new assembler test, test_assembled_release_has_the_release_contract_golden_shape, now holds a real assembly to the golden key for key and type for type, and holds its directory to the inventory's file list.

Design points, now settled in the doc:

• C2 v1 generalizes the source-enrichment rule. Core stays exactly pinned, claims are bounded, admission uses PEP 440 equality, and the basis is attributed to the first matching claim.
• Grandfathering is by published (release id, revision), not by id alone, because the UK lines keep constant ids across cuts.
• Every id-keyed check (about 35 sites) and the pointer readers move to the declared country.
• Remote staging delivery stays required as the pre-publication review, with a re-delivery path so an outage doesn't force a rebuild. The delivery gate moves into prepare_release.
• The staging terminal document and the Logbook row ship inside the release directory, because the publisher can't see the build host.

Also: runtime is now copied rather than aliased, and the determinism property compares serialized bytes.

Local runs: 67 tests pass across the touched files, and generate_release_contract_fixtures.py --check passes. The review is at _reviews/microcosm-1285/opus-review-c2d50d8.md.

The independent GPT-6.1 Sol review is re-queued on 47389ec (Subfleet job 20261015-063645-m0-1285-review-b) and starts when the Codex lanes reopen, about 14:53Z. It will check each of these fixes and then review independently.