0.7.24: scale block-paced Actors and close Asset Conversion trust boundaries

.agents/skills/README.md

@@ -5,7 +5,7 @@ Project skills form a small Domain DAG for agent-facing workflow ownership. They
 | Skill | Owns | Explicitly excludes | Public route |
 | --- | --- | --- | --- |
 | `alignment` | Changed-scope DEOS audits, completion judgement, and durable failure memory | Project CI/release validation; subsystem implementation policy | `alignment/SKILL.md`; `alignment/scripts/completion-gate.sh` |
-| `benchmarking` | Benchmark design, evidence classification, interpretation, and integration | Runtime semantics; shared command execution; release publication | `benchmarking/SKILL.md`; project-owned benchmark/build scripts |
+| `architecture-experiments` | Physical architecture hypotheses, controlled benchmark design, production-Weight evidence, durable rejected alternatives, artifact-bound lineage, invalidation, and optimization gradients | Protocol semantics; benchmark command execution; open-work and architecture truth | `architecture-experiments/SKILL.md` |
 | `domain-dag` | Independent generic ownership/DAG review and validator | DEOS subsystem policy; project acceptance | `domain-dag/SKILL.md`; `domain-dag/scripts/validate-domain-dag.sh` |
 | `release-assurance` | Agent-led dependency provenance, Weight delta, threat-boundary, artifact-identity, and attestation review | Project validation, CI, runtime semantics, publication, signing, and history mutation | `release-assurance/SKILL.md` and its private evidence scripts |
 | `wiki-sync` | Independent generated Wiki projection, provenance, trust, localization, and consolidation | Source specification ownership; browser implementation; project acceptance | `wiki-sync/SKILL.md` and its private scripts |

.agents/skills/alignment/ledgers/ambiguities.jsonl

@@ -4,3 +4,9 @@
 {"timestamp":"2026-08-10T16:09:48Z","title":"Prelaunch contraction delta conflict","summary":"The original exact-zero count notation conflicted with the mandatory removal of pre-genesis compatibility shadows.","scope":"release/staking-compatibility","status":"resolved","files":"BACKLOG.md,template/pallets/staking/src/lib.rs","tags":"release-scope,compatibility,storage,dispatch","remedy":"Interpret closure counts as no-growth constraints and require count deltas at or below zero; removal of unsupported dispatch, storage, and runtime API surfaces remains admissible.","related":"BACKLOG.md Scope Constraints and CLEAN-3"}
 {"timestamp":"2026-08-11T00:12:27Z","title":"Reference upgrade authorization had no executable proposal ingress","summary":"The urgent runtime-upgrade path could authorize an existing L1RootAction proposal through unanimous VETO Pass, but proposal creation remained AdminOnly under EnsureRoot with no declared live Root ingress.","scope":"release/runtime-upgrade","status":"resolved","files":"BACKLOG.md,template/pallets/governance/src/lib.rs,template/runtime/src/configs/governance_config.rs","tags":"upgrade,governance,authority,live-evidence","remedy":"Use PrimaryEligibleSigned on the existing proposal call for protocol L1RootAction only; derive eligibility from nonzero primary-track staking power, retain fee/cap/rollback semantics, and leave Root-equivalent execution inside the bounded payload executor. VETO remains protection-only.","related":"BACKLOG.md AUTH-1 and NET-5"}
 {"timestamp":"2026-08-11T01:13:48Z","title":"Exact baseline cannot use candidate governance ingress","summary":"The apparent causality blocker came from treating pre-1.0 source tags as deployed runtime lineage, although no downstream product network may launch before DEOS 1.0.","scope":"release/runtime-upgrade","status":"resolved","files":"AGENTS.md,BACKLOG.md,template/runtime/src/lib.rs","tags":"upgrade,governance,authority,baseline,causality,pre-genesis","remedy":"Treat every 0.x line as fresh-genesis source with breaking changes and no migrations; keep runtime version 1 and require live upgrade evidence only after a downstream production genesis at 1.0 or later.","related":"AGENTS.md Pre-1.0 Launch Boundary"}
+{"timestamp":"2026-08-29T06:07:27Z","title":"Parachain validation fixed-overhead owner","summary":"Upstream cumulus set_validation_data declares zero dispatch Weight and explicitly leaves its non-message overhead unbenchmarked, while only selected hook/message work is registered dynamically; additionally, the SDK DMP reserve is not directly consumed by the reference runtime's EnqueueWithOrigin adapter, so DEOS replaced its fictitious 25% value with the measured finite owner and derived a 512-message cap from the relay 32 MiB allocation and sanitized 64 KiB minimum but must still enforce it in Prepass check_inherents, so DEOS cannot yet claim a conservative FixedBlockWeight from FRAME counters or nominal reserve constants alone.","scope":"actors/resource-integration","status":"open","files":"docs/actors-resource-policy.specification.en.md,template/runtime/src/configs/mod.rs","tags":"resource-accounting,parachain-inherent,upstream-gap","remedy":"Introduce measured bounded DEOS ownership for validation-context overhead, classify each active DMP/XCMP path, enforce the declared 512-message DMP cap plus finite XCMP full/hashed bounds pre-execution through the Prepass check_inherents owner, remove or replace unbound legacy reserves, then combine the resulting maxima component-wise with Timestamp and all other fixed hooks before activating the resource budget.","related":"cumulus-pallet-parachain-system-0.29.0/src/lib.rs:set_validation_data"}
+{"timestamp":"2026-08-29T06:29:37Z","title":"Message Queue hook phase misclassification","summary":"Pallet order initially suggested Message Queue consumed its 35% service envelope during on_idle before Actors, but runtime configuration binds that envelope to ServiceWeight while IdleMaxServiceWeight is disabled; Message Queue therefore runs in on_initialize, and XCMP Queue on_idle owns only bounded lazy migration.","scope":"actors/resource-policy","status":"resolved","files":"docs/actors-resource-policy.specification.en.md,template/runtime/src/lib.rs,template/runtime/src/configs/mod.rs","tags":"economic-zipper,on-idle,xcm,message-queue","remedy":"Classify Message Queue on_initialize and the bounded XCMP lazy-migration reserve under FixedBlockWeight; retain the simple ExternalPhase to FreshDrain transition and do not invent an ExternalIdleService resource domain.","related":"docs/actors-resource-policy.specification.en.md Sections 1, 2, and 6"}
+{"timestamp":"2026-08-29T08:05:47Z","title":"Session rotation consumes the full block Weight","summary":"Upstream pallet_session::on_initialize returns RuntimeBlockWeights::max_block whenever the six-hour PeriodicSessions boundary rotates, so a static FixedBlockWeight that honestly covers every block leaves zero schedulable Actor/User capacity.","scope":"actors/resource-policy","status":"open","files":"docs/actors-resource-policy.specification.en.md,template/runtime/src/configs/mod.rs,template/runtime/src/tests/actors_integration_tests.rs","tags":"session,weight,fixed-envelope,economic-zipper","remedy":"Move periodic rotation into a small benchmarked DEOS pallet that calls public pallet_session::rotate_session, bind upstream ShouldEndSession to a never-ending adapter while retaining periodic NextSessionRotation, and use the generated bounded hook owner; retaining the full charge is rejected because it leaves zero Actor Control for the required Prepass.","related":"pallet-session-49.0.0/src/lib.rs:on_initialize"}
+{"timestamp":"2026-08-29T08:51:50Z","title":"Session rotation consumes the full block Weight","summary":"Resolved by moving periodic rotation to pallet-deos-session-rotation, disabling upstream ShouldEndSession rotation, retaining PeriodicSessions prediction, and binding a 120-identity runtime benchmark owner.","scope":"actors/resource-policy","status":"resolved","files":"template/pallets/session-rotation,template/runtime/src/configs/mod.rs,template/runtime/src/weights/pallet_session_rotation.rs,docs/actors-resource-policy.specification.en.md","tags":"session,weight,fixed-envelope,economic-zipper","remedy":"Retain generated session rotation Weight in FixedBlockWeight and regenerate whenever session geometry or manager composition changes.","related":"BACKLOG.md Implementation / Session Rotation Weight"}
+{"timestamp":"2026-08-29T09:28:23Z","title":"Maximum context benchmark needs a no-std relay-proof fixture","summary":"Benchmarking the complete set_validation_data path cannot call its private enqueue leaves or construct BasicParachainInherentData from defaults; the measured callback must retain a valid relay proof and maximum abridged message data prepared outside the measured block.","scope":"actors/resource-policy","status":"open","files":"template/pallets/actors/src/benchmarking.rs,template/runtime/src/configs/actor_config.rs,template/runtime/src/apis.rs","tags":"benchmark,context-inherent,xcmp,weight","remedy":"Use an associated benchmark fixture type on the Actors BenchmarkHelper and gate no-std cumulus-test-relay-sproof-builder under runtime-benchmarks; prepare the valid BasicParachainInherentData plus InboundMessagesData outside #[block], dispatch set_validation_data inside it, and verify registered-versus-unregistered component ownership before binding Weight.","related":"BACKLOG.md Evidence / Context Inherent Geometry"}
+{"timestamp":"2026-08-29T10:12:46Z","title":"Maximum context benchmark needs a no-std relay-proof fixture","summary":"Resolved with a validated static SCALE BasicParachainInherentData proof keyed to benchmark ParaId 100, exact included_para_head, and maximum DMP/HRMP MQC heads; setup reconstructs abridged messages outside measurement and the Wasm benchmark executes set_validation_data successfully.","scope":"actors/resource-policy","status":"resolved","files":"template/runtime/fixtures/maximum-context-basic.scale,template/runtime/src/configs/actor_config.rs,template/pallets/actors/src/benchmarking.rs","tags":"benchmark,context-inherent,xcmp,weight","remedy":"Retain fixture hash 720062c34020ad38b5c56e7772befd24a38775a7b3dff547c4b5b28dac97ae17 and regenerate whenever context bounds, ParaId benchmark genesis, MQC construction, proof topology, or message allocation changes.","related":"BACKLOG.md Evidence / Context Inherent Geometry"}

.agents/skills/alignment/ledgers/dead_ends.jsonl

@@ -8,3 +8,12 @@
 {"timestamp":"2026-08-21T07:48:46Z","title":"Truncating sub-account derivation for generic custody","summary":"Replacing hashed-seed AccountId decoding with PalletId::into_sub_account_truncating can collapse distinct tagged or owner-specific custody identities for narrow generic AccountId types.","scope":"template/pallets/actors,template/pallets/staking","status":"resolved","files":"template/pallets/actors/src/lib.rs,template/pallets/staking/src/pool.rs","tags":"account-identity,generic-runtime,panic-hardening","remedy":"Preserve canonical identities and remove decoding panics through explicit host-supplied custody accounts or a fallible API; validate narrow-AccountId mocks and concrete runtime addresses before retaining a derivation change.","related":""}
 {"timestamp":"2026-08-22T03:10:33Z","title":"Recursive PAPI generation during npm install","summary":"Running papi generate from postinstall is self-recursive because descriptor generation invokes npm install; a clean CI host can retain incomplete descriptor types even when a warm local worktree passes.","scope":"web-client/generated-descriptors","status":"resolved","files":"web-client/package.json,web-client/README.md","tags":"papi,postinstall,clean-ci,generated-types","remedy":"Keep dependency installation free of descriptor generation; make clean validation prepare Svelte state, then generate descriptors exactly once before type checking.","related":"GitHub Actions run 32547604017"}
 {"timestamp":"2026-08-22T04:09:55Z","title":"Post-merge-only heavy validation","summary":"A pull-request gate that runs only the fast profile can approve changes to client or heavy validation that first fail after merge on main, turning main into the discovery environment.","scope":"github-actions/release-validation","status":"resolved","files":".github/workflows/ci.yml,scripts/validate-local.sh","tags":"ci-topology,pr-gate,main-failure,release","remedy":"Run the heavy profile under the required pull-request validation-gate; retain main heavy and tag full as repeated evidence rather than first coverage.","related":"GitHub Actions runs 32547507574,32550146969"}
+{"timestamp":"2026-08-28T13:25:34Z","title":"Global request_activation deferral cannot implement NextBlock provenance","summary":"Forcing every Idle request_activation under NextBlock to a block-N+1 wakeup produced 242 package test failures and changed temporal, direct-control, observation, queue-capacity, scheduler-meter, and continuation fixtures. request_activation is a shared placement owner, not a certified cause boundary; it cannot distinguish external causes from previously caused temporal or continuation service.","scope":"actors-fresh-step-zero","status":"rejected","files":"template/pallets/actors/src/scheduler.rs,template/pallets/actors/src/tests,template/runtime/src/tests/actors_integration_tests.rs","tags":"causality,provenance,activation","remedy":"Carry typed cause provenance at occurrence materialization and preserve a separate prepass cutoff; do not infer cause timing from the generic activation owner or actor state.","related":"actors/EXP-0018"}
+{"timestamp":"2026-08-28T16:23:52Z","title":"Phase-only deferred-cause floor","summary":"Applying N+1 from worker time whenever provenance is Deferred repeatedly postpones Observation fanout first processed after its source block and cannot distinguish already-aged work.","scope":"template/pallets/actors causal timing","status":"rejected","files":"template/pallets/actors/src/reactions.rs,template/pallets/actors/src/scheduler.rs","tags":"actors,causality,provenance","remedy":"Persist the exact cause block with each latest/active dirty revision and Crossing transition; apply the floor only while service occurs in that source block.","related":""}
+{"timestamp":"2026-08-28T18:33:57Z","title":"W2 over-capacity sustained-Fresh geometry","summary":"An EXP-0018 profile with 10,000 continuously Running Actors plus additional Fresh Actors exceeds the production MaxActiveActors=10,000 boundary and cannot represent an admitted workload.","scope":"actors-fresh-step-zero","status":"rejected","files":".agents/skills/architecture-experiments/tracks/actors/EXP-0018.md,template/runtime/src/configs/actor_config.rs","tags":"actors,experiment,capacity,liveness","remedy":"Define 1,000/10,000 as total active populations partitioned between Running Actors and a bounded reusable Fresh-ingress pool; never exceed the configured active cap.","related":"actors/EXP-0018"}
+{"timestamp":"2026-08-28T21:40:03Z","title":"Maximum W2 setup through measured runtime blocks","summary":"Constructing 6,656 Running and 3,329 Fresh Actors, then opening the Running set through ordinary runtime blocks, failed to finish by block 7,000 after 2,479 seconds with effectful Steps; replacing effects with skipped Steps still timed out after 3,600 seconds. This mixes population setup with the liveness interval and is not a bounded comparative harness.","scope":"actors-fresh-step-zero","status":"rejected","files":"template/runtime/src/tests/actors_integration_tests.rs,.agents/skills/architecture-experiments/tracks/actors/EXP-0018.md","tags":"actors,experiment,liveness,harness","remedy":"Materialize a validated prebuilt Running/Fresh state artifact outside measured blocks, attest its storage/config identity, and measure only bounded post-snapshot ingress/service windows. Do not retain an hour-scale ignored unit test.","related":"actors/EXP-0018"}
+{"timestamp":"2026-08-29T06:05:38Z","title":"Average initialization ratio as fixed resource envelope","summary":"FRAME's 10% average-initialization hint is not a conservative FixedBlockWeight bound; parachain validation registers dynamic inbound DMP/XCMP work and the runtime configures independent 25% reserves for each message class.","scope":"actors/resource-integration","status":"rejected","files":"template/runtime/src/lib.rs,template/runtime/src/configs/mod.rs,docs/actors-resource-policy.specification.en.md","tags":"resource-accounting,parachain-inherent,weight","remedy":"Derive and enforce a component-wise worst-case fixed/context envelope covering base/finalization, Timestamp, validation overhead, and both inbound-message reserves before configuring the schedulable budget.","related":""}
+{"timestamp":"2026-08-29T09:48:12Z","title":"No-std relay proof builder and incomplete static proof fixture","summary":"cumulus-test-relay-sproof-builder advertises default-features=false but fails wasm32v1-none compilation because its source lacks no-std prelude/alloc imports. A generated static BasicParachainInherentData proof compiled, but benchmark dispatch trapped because the proof omitted the included parachain head required by set_validation_data.","scope":"actors/resource-policy","status":"open","files":"template/runtime/src/configs/actor_config.rs,template/pallets/actors/src/benchmarking.rs","tags":"benchmark,context-inherent,wasm,relay-proof","remedy":"Generate a complete static proof fixture containing included_para_head plus the exact DMP/HRMP MQC heads, validate it by dispatching set_validation_data in a std fixture test before embedding, then retry the Wasm benchmark; do not bind or retain a benchmark whose fixture has not passed the actual dispatch.","related":"BACKLOG.md Evidence / Context Inherent Geometry"}
+{"timestamp":"2026-08-29T10:12:46Z","title":"No-std relay proof builder and incomplete static proof fixture","summary":"Resolved by generating the proof under std, validating the actual maximum set_validation_data dispatch, embedding only the 13,669-byte SCALE Basic fixture, and reconstructing message data in Wasm benchmark setup; benchmark completed at 50 steps and 20 repeats.","scope":"actors/resource-policy","status":"resolved","files":"template/runtime/fixtures/maximum-context-basic.scale,template/runtime/src/tests/actors_integration_tests.rs","tags":"benchmark,context-inherent,wasm,relay-proof","remedy":"Do not depend on the broken no-std proof-builder path; keep the static fixture dispatch test as the falsification owner.","related":"maximum_context_inherent benchmark"}
+{"timestamp":"2026-08-29T15:18:00Z","title":"Prepass stale cleanup cannot reuse the current single-meter base pass","summary":"Resolved by adding an independent scan-control meter bounded by the reserved Actor Control maximum; saturated prepass cleanup can now leave a stale suffix without letting subsequent FIFO scans consume ActorBase effect capacity or retain reservation authority.","scope":"actors/mandatory-prepass","status":"resolved","files":"template/pallets/actors/src/lib.rs,template/pallets/actors/src/scheduler.rs","tags":"resource-algebra,prepass,stale-cleanup,domain-meter","remedy":"Keep FIFO scan consumption dual-metered against both total pass capacity and Actor Control; do not substitute total-minus-effect reconciliation as the admission guard.","related":"BACKLOG.md I5"}
+{"timestamp":"2026-08-30T08:18:00Z","title":"100-Steps-per-block planning witness is incompatible with generated production Weight","summary":"Complete branch-exact Actor control and effect Weight disproves the historical target of 10,000 one-Step cycles in 100 blocks; the accepted 10,000-Active-Actor scheduler requires a measured 1,300-block first-traversal horizon.","scope":"actors/production-throughput","status":"resolved","files":"BACKLOG.md,template/runtime/src/tests/actors_integration_tests.rs","tags":"actors,throughput,weight,completion-honesty","remedy":"Use starvation-free first traversal under generated two-dimensional Weight as release evidence, report committed Steps and distinct Actors separately, and never present the 1,300-block evidence horizon as an SLA.","related":"stress_10k_actors_queue_scheduler"}