Skip to content

Qualify FINAL evidence while keeping admission disabled - #1167

Open
seathatflowsinourveins wants to merge 3 commits into
mainfrom
codex/ns2604-final-admission-redesign-20261015
Open

Qualify FINAL evidence while keeping admission disabled#1167
seathatflowsinourveins wants to merge 3 commits into
mainfrom
codex/ns2604-final-admission-redesign-20261015

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Scope

Qualify retained FINAL evidence against current repository inputs while
production admission continues to refuse every FINAL claim. Current angle
evidence, complete run pins, canonical winners, registered waves, native
receipts and retained ledger history must agree on each qualification call.

  • Base commit: 9d5bc9f9e076e033a24fcef2a26d41986506c647.
  • Current head: 4d6f31a4be9fed388db540f22a55f5d77f70d714.
  • Lane: lane:foundation.
  • Owned paths: final-stack qualification, recorder and wave consumers,
    local-pages manifest, seven test modules, angle contract/output, CI schema
    input/lock and OSV targets, two decisions, retained check/source records and
    their evidence registrations; 23 paths in total.

Native integrity precedes qualification. Canonical catalogs must identify one
current row, its verdict metadata must match, and its registered retained wave
must bind the layer and winner. Native symbolic reopening namespaces remain
metadata; other references retain confined files. A later complete covering
sweep must repair incomplete discovery, and the native repository/ID join
revalidates the selected run. Retained FINAL snapshots and legacy aliases
establish no current admission result.

This landing rebase replays the three qualification commits ending at
0807bda199129e9960ede70655836947f322a989 onto the exact base above. Its two
integration paths are manifests/evidence.json and scripts/final_stack.py.
The registry starts from exact main and its 22 branch-owned rows are registered
through scripts.host_receipts.register_file; unrelated rows and non-file
metadata remain intact.

The FINAL integration keeps main's shared candidate, receipt and condition
helpers. Qualification calls those helpers and attaches the layer context to
their errors. Deferred angle-validator imports preserve generation-only
imports. Condition 3 retains the original explicit URI validation for every
source URL and repository, including additional citations. Condition 4 keeps
the unchanged native UTC-Z parser and strict window ordering. All other
original final-stack definitions and module-level nodes are unchanged.

The previously published 0807bda1 revision was the result of the earlier
registry/generated-output rebase onto 1b633d861518fa0d299279b1cfaec11d0fb47f82.
Earlier qualification revisions and their execution receipts remain historical
evidence; the current rebase checks are reported below.

SOTA sources

Evidence-class table

Claim Evidence class Command / receipt
Current ledger, catalog, wave, winner and receipt binding synthetic Native V1/V2 fixture builders and public qualification methods in the regression command below.
Naive helper selection would lose URI refusal synthetic Before correction, the existing malformed additional-citation test failed with FinalStackError not raised; the UTC-Z/window control passed. Two tests, one assertion failure, zero setup errors.
Preserved helper integration and disabled admission synthetic / local_integration The 12-module integrated command below passed 358 tests with no skips, including both URI and UTC-Z/window regressions.
Registry preservation and generated output local_integration Exact-main registry restored and 22 rows registered natively; zero unrelated row changes; native validate and final-stack check.
Production FINAL admission source_review Remains disabled. A separate opening PR and a current-main second-party native qualification receipt are still required.

Local commands run

All long checks run detached at idle CPU weight, with a durable PID record and
an exit file. The command exit and completed receipt determine each result.

Before correcting the URI merge regression:

python3 -m unittest tests.test_final_admission_checks.NativeHistoryQualificationTests.test_malformed_uri_in_an_additional_e2e_citation_is_refused tests.test_final_admission_checks.NativeHistoryQualificationTests.test_invocation_window_uses_explicit_utc_z_policy_and_order

Two tests; one assertion failure, zero errors, rc 1. The failure was the missing
URI refusal; the strict UTC-Z/window control already passed.

Required integrated checks:

python3 -m unittest -v tests.test_final_stack tests.test_final_admission_checks tests.test_final_admission tests.test_final_history_ordering tests.test_final_stack_dependencies tests.test_angle_records_fix3 tests.test_local_pages_architecture_manifest tests.test_final_ordering tests.test_final_disabled tests.test_final_registration_refusal tests.test_record_verdicts tests.test_layer_verdicts
python3 scripts/validate.py
python3 scripts/final_stack.py --check

The integrated suite passed 358 tests, no skips, rc 0, in 302.425 seconds.
Stage-one and committed-head generated-output checks passed. All three
pre-commit validations passed; validation reports 12,268 hashes, 71 components,
four profiles and 240 receipts.

The resulting chain is 9d5bc9f9 -> 3d9061fba -> 553aa871b -> 4d6f31a4b.
All three commit pairs preserve their exact changed lines outside the two
integration paths (21, six and three files respectively). The total path set
remains 23. The isolated FINAL helper resolution is described above; it is
included explicitly in the resolution read. Final merge-tree against the
exact base returns 0, and the rebased worktree is clean.

The exact final-stack resolution and full three-pair range-diff are retained
by name in angle-records.landing2-20261016.final-stack-resolution.patch and
angle-records.landing2-20261016.range-diff.txt. These are rebase integration
records, not new qualification or admission receipts.

Decision record

docs/decisions/2026-10-15-final-evidence-qualification.md. The scope qualifies
evidence while keeping admission disabled. The opening scope, including the
page activation item, remains separate.

Host evidence

No host receipt is added or changed.

Checklist

  • PR describes the current exact base and separates historical receipts.
  • Corrections retain pinned sources and fail-first public regressions.
  • Evidence registrations use the native helper and preserve main metadata.
  • No new workflow, dependency version, secret, paid service or account action.
  • Other lanes' files and worktrees are preserved.

@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 15, 2026
This was referenced Oct 16, 2026
Merged
Open
Open
@seathatflowsinourveins
seathatflowsinourveins force-pushed the codex/ns2604-final-admission-redesign-20261015 branch from bd0474d to 0807bda Compare October 16, 2026 08:10
seathatflowsinourveins added a commit that referenced this pull request Oct 16, 2026
@seathatflowsinourveins @claude
tools(landing): stop nas's CI wait at once on DIRTY (the CC's follow-up)
e321571 
The command center's follow-up of 2026-10-16: #1167 and #1180 each held the nas landing lock
for about 45-50 minutes, waiting for checks a DIRTY pull request never completes, and #1180's
lander stopped with 6, a CI timeout. In the CI-wait loop, after the head-follow step, a
mergeStateStatus of DIRTY ("The merge commit cannot be cleanly created.", github/docs@be38ec5d
src/graphql/data/fpt/schema.docs.graphql:26528-26530) now stops at once with 10, the exit
merge_validate gives a merge that does not apply cleanly, nothing merged; the lock ends with the
script. The header's exit codes and the README's exit list name it.

Fail-first: the new test (a DIRTY pull request with a check still running) exited 6 after the
25 polls against this pull request's previous nas_land.sh, whose CI wait is main's; now 10 before
any sleep 120, with the lock free after it. Its control (CLEAN, a check running) still waits and
times out with 6. tests.test_landing_scripts: 215 tests OK (1 skipped); validate.py and
evidence_manifest.py --check pass; README digest rows and evidence rows refreshed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 16, 2026
Draft
5 tasks done
@seathatflowsinourveins
Qualify FINAL evidence while keeping admission disabled
3d9061f 
Validate native retained history before replay and require current inputs.
Keep the common refusal, protect retained consumers and qualify recovery.
@seathatflowsinourveins
Recheck current FINAL evidence without enabling admission
553aa87 
Use a fresh native source reader for each qualification call so a caller's
cached JSON cannot hide changed inputs. Retain symbolic reopening IDs as
metadata, require discovery failures to be repaired, and recompute the
native repository/ID winner-to-run join.

Keep legacy alias display states unreported, restore explicit desk checks,
cover list.sort in the no-date oracle, and exercise settlement/refutation
through the native qualification seam. Production FINAL still refuses.

Sources at 425c436:
final_stack.py:1087-1092 (fresh reader), :564-594 (native run join),
saturation_ledger.py:1091-1094 and :1463-1468 (reopening identifiers),
:1171-1178 (retained failures), and the pinned references in the decision.

Fail-first: nine methods at the frozen head yield 11 assertion failures
and two errors from native-valid symbolic references treated as files.
Successful qualification still reports admission_enabled false.
All 900 tests in the 21 affected modules pass; focused native controls
pass 37 tests. No model call or candidate capability qualification.
Native regeneration and post-generation validate.py return rc 0;
12,137 hashes, 71 components, four profiles and 240 receipts checked.
@seathatflowsinourveins
Bind FINAL qualification to current catalogs and native frozen waves
4d6f31a 
Enumerate canonical current rows before following a packet source pointer,
derive winner/verdict metadata from that row, and reconcile the registered
wave through the native checker after validating its retained bytes.

Native sources at f33b1cb:
- scripts/final_stack.py:249-269 (current-row uniqueness), :545-561 (verdict)
- tools/sota-convergence/build_verdicts.py:476-495 (frozen-wave reconciliation)
- scripts/saturation_ledger.py:1091-1094 (nonempty marker references),
  :1463-1493 (the two native symbolic namespaces)

Require explicit baseline reopening metadata and retain all file-shaped
references. Native-valid null and whitespace metadata fail with domain
errors; symbolic post-anchor events still refuse through history policy.
Regression methods fail against the exact prior source before these fixes.
The decision and check record retain the commands, counts and limits.
Production admission remains disabled.
@seathatflowsinourveins
seathatflowsinourveins force-pushed the codex/ns2604-final-admission-redesign-20261015 branch from 0807bda to 4d6f31a Compare October 16, 2026 11:32

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins