Skip to content

Commit 3283a5c

Browse files
committed
T1.13 docs: as built, the design row's pointer and the tracker row
as-built.md gains T1.13's section, each claim with its mechanism; the design's T1.13 row points to it and names what it activates (the reference's identity and coverage, tests/test_contract_reference.py); the tracker row records the E49 probes. Signed-off-by: Adi Wadaskar <awadaskar@nvidia.com>
1 parent 544e287 commit 3283a5c

3 files changed

Lines changed: 14 additions & 2 deletions

File tree

‎docs/design/rust-core/phase-1/as-built.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,18 @@ S0 case corpus (design, the T1.12 row).
7474

7575
As built at T1.12, each claim with its mechanism: 22 cases in `contract/cases/s0/` beside T1.10's two (three added in fix round 1), all on the shop base, which `case.schema.json` validates through both loaders (`tests/test_contract_cases.py`, `sdm-testkit`'s `tests/s0_cases.rs`). Accepted: binary and multiclass classification (regression is `s0.accept.sum-window`). Refused, each at `materialize` with `INVALID_REQUEST`, one per validator family (parse, target, task, time, type, join, model, value; schema is `s0.refuse.unknown-column`) and a date that does not exist (D9); the PQL code each reaches was checked on the reference's `predictive_query.validate` and the core's `validate_query` alike when the case was written, and is named in its `why`, since an observation records the public code only. Boundaries: integer literals of 4,300 digits (accepted) and 4,301 (refused), all but one leading zeros; escapes read (`\u00e9`, `\t`, `\'`, `\\` and `\/`) and a truncated `\u` refused; an escaped surrogate pair and a lone one, diagnostic under register PQL-1 (proposed), which the reference's old materializer refuses and the core accepts, joining the pair and reading a lone one as U+FFFD; D8's packed date and DT-9's long field, diagnostic, naming register DT-9, the core answering `UNSUPPORTED_REQUEST` until T1.6b; 400 nested parentheses; 999, diagnostic under register PQL-2 (proposed); a query of 72,082 bytes; `test_the_s0_boundary_cases_sit_on_their_boundaries` holds each to that shape, the DT-9 cases to diagnostic and every other diagnostic case to a proposed entry, and `sdm-testkit`'s `tests/s0_cases.rs` holds each diagnostic case to the core answer its entry records (`UNSUPPORTED_REQUEST` for DT-9, acceptance for PQL-1 and PQL-2). Every runner's outcome is its case's expectation and the reference's, and python-core's and rust-host's answers agree (`compare.py` in CI's `rust-test` and `engine` jobs); the five diagnostic cases differ only as diagnostic notes. Their `python-ref` observations are committed in `contract/reference/b413e9a….jsonl`, because `compare.py` fails an acceptance case without one, recorded under T1.13's rules, the four earlier lines kept byte for byte. Not covered, since the public call cannot reach them as one validation: profiles other than RELATIONAL and the capability refusals (an in-place schema is always relational, `query.py`'s `materialize`; the other profiles are refused before validation; L1's corpus and `pql_adapter.rs` cover them); an accepted ranking (on the shop base none validates: `LIST_DISTINCT` of `orders.order_id` is refused as a primary key and of `orders.user_id` as a loop back to the entity table; over a further table the public call then asks for `candidates=`, which the case format does not carry) and an accepted forecast (it validates once per timeframe as well as whole, four `validate_query` starts against the case's one). The deepest valid query is 400, not the core's 999: the reference has no limit of its own and raises `RecursionError` past about 461 levels in the runner (on Python 3.12, as T1.12's last review measured it; "about 455" until T1.12b), where the core answers to 999 and refuses 1,000 (register PQL-2, proposed, recommending the core's bounded behavior)
7676

77+
## T1.13
78+
79+
S0 reference observations (design, the T1.13 row).
80+
81+
As built at T1.13, each claim with its mechanism:
82+
83+
- `contract/reference-env.txt` records the environment the reference observations were taken in: the reference commit (`b413e9a`, which names the observation file), the platform, the Python version (3.12.13) and the 114 distributions the reference interpreter's `importlib.metadata` finds, as `name==version`, lower-cased and sorted, with their SHA-256. That digest is the one `run_python.py` records as each observation's `identity.reference.environment`, so the file and the observations are bound to each other; the editable packages appear by name and version only, with no path.
84+
- `tests/test_contract_reference.py`, in CI's `test` job on every interpreter, holds `contract/reference/` to exactly one file, named for that commit, and every line of it to: JSON the reader reads (nesting past the parser's depth refused by name), valid against `observation.schema.json`, and the recording's full identity: runner `python-ref`, cell `ref-pandas3`, the platform and Python version of `reference-env.txt`, pandas, pyarrow, NumPy and DuckDB at the versions it lists, a clean checkout, the reference commit clean and its own, the environment digest its own, the guard passed before the first case and after the last, the old route (no `_native`, not loaded, no core operation, no contract version), and the SHA-256 of the case file and `bases.yaml` as they are now, so a case changed without its observation re-recorded fails. Every case in `contract/cases`, acceptance or diagnostic, has exactly one line, and no line names a case that does not exist. The digest is recomputed from the listed distributions. Each rule fails on missing, empty or retyped evidence, seeded in the same file (30 line faults, 13 file faults, a line nested 100,000 levels deep, and a fault on the last line only).
85+
- Already in place before T1.13 and kept: `tests/test_contract_cases.py` validates each line against the schema and runs `compare.py` with the file as the reference, which fails a case with no reference observation; CI's `rust-test` compares `rust-host` with it, and the `engine` job's `contract/tests` compare `python-core` and `python-old` with it.
86+
- Recorded the T1.13 way and compared, not overwritten: from a clean tree at `cce303b`, the reference checkout at `b413e9a` and its guard passing before and after, `run_python.py` in `python-ref` mode recorded all 26 cases. Every line equals the committed one once the fields the comparator does not gate are masked: the checkout recorded from (`identity.commit.sha`), the relations DuckDB binds and the SQL text naming them (`sql.bindings` and `sql.text`, diagnostic), the raw result and payload digests (integrity only), the in-order digest of a statement without a total `ORDER BY` (compared as a multiset) and the request id (E35); `compare.py`, given the new recording as a `python-ref` runner against the committed file, finds no difference.
87+
- Reference immutability (a line added, never changed or removed, without an approved entry) is T1.14's check (design, the T1.14 row and "Protected paths"), not built here.
88+
7789
## T1.21
7890

7991
DT-3 and ORD-1 findings (design, the T1.21 row).

‎docs/design/rust-core/phase-1/design.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -455,7 +455,7 @@ Each readiness item (sections 1.1 to 1.14 of the planning input `A-readiness-aud
455455
| T1.10e | 1a | Owner decisions of 2026-10-10: E50, the new order and the bridge freeze; E49 approved, E52 and E53 | E50, E49's approval, E52 (state lifetime) and E53 (cuts) in [decisions.md](decisions.md); T1.21c and T1.21d in this table and the tracker, T1.22 gated on T1.21d, T1.23 narrowed, T1.26 unblocked by E52, and T1.18, T1.19, T1.30 and T1.32a to T1.32e amended by E53; the refusal map's `time_name` moved to T1.21d and its owners widened to T1.21c and T1.21d; the bridge freeze, `scripts/rust_core/bridge_freeze.py` and its baseline `bridge_freeze.json`, run by `l0_deps.py`, with its self-tests in `selftest.py` ("Host-held semantics"); the process rule for a package that moves a ledger row | The freeze passes on the tree, its baseline matching the code; in `selftest.py` it fails on each seeded fault (a raise, a warning or a branch added, a new function in a `_rust/` bridge, the baseline raised without an allowance, a stale baseline left too high) and on missing, empty and retyped evidence, and its controls pass; it runs in `prepush.sh`'s cheap tier and CI's `rust-lint` through `l0_deps.py`; no product semantics move and the contract is unchanged | The bridge freeze |
456456
| T1.12 | 1a | S0 case corpus | Accept cases per task kind and profile, a refusal per validator family, date-literal and capability refusals, and boundary cases: the 4,300-digit limit on both sides, escapes, a D8 packed date and DT-9's query (both diagnostic until T1.6b), the deepest valid query and a start past 64 KB. As built: [as-built.md](as-built.md#t112). | Every case file validates in CI | Case validation |
457457
| T1.12b | 1a | Checkpoint 4 corrections | The corrections of the checkpoint 4 review of 2e47233..a20021f (both reviewers: COURSE CORRECTION NEEDED, on execution and process, not architecture): the guards frozen with a threat model, and the freeze's base branch a setting (E56); the entities' cast to T1.32a; T1.28 split into T1.28a and T1.28b; T1.26's named checks; classification evidence early (T1.21e, the Process rules, T1.29); the pin's disposition and the Journey check-in recorded; the size review; design.md's as-built text moved to [as-built.md](as-built.md) and the tracker's rows capped; cuts proposed to the owner, not enacted. No product semantics move and the contract is unchanged | E56 is recorded; `selftest.py` seeds the base setting (the environment read, `--base` over it, a blank one refused); the moved text changes no meaning; the hygiene check, `contract_lock.py` and the L0 guards pass | |
458-
| T1.13 | 1a | S0 reference observations | `contract/reference/<commit>.jsonl` and `contract/reference-env.txt`, recorded after the guard update through `run_python.py` in `python-ref` mode directly until T1.14 lands `gate.sh` | The file carries the guard result and full identity, the observation schema validates it, and the comparator reads it | |
458+
| T1.13 | 1a | S0 reference observations | `contract/reference/<commit>.jsonl` and `contract/reference-env.txt`, recorded after the guard update through `run_python.py` in `python-ref` mode directly until T1.14 lands `gate.sh`. As built: [as-built.md](as-built.md#t113). | The file carries the guard result and full identity, the observation schema validates it, and the comparator reads it | Reference identity and coverage (`tests/test_contract_reference.py`) |
459459
| T1.14 | 1a | Ratchet, register v2, gate and first baselines | `ratchet.py`, `register.schema.json` for `sdm-register/2` with today's entries migrated, `register.py validate`, `compare-policy.yaml`, `availability.yaml`, `protected-paths.txt`, a minimal `gate.sh` running the checkpoint's harness from its own worktree; the first baselines | First, on the candidate, a corrupted expectation, a missing case, a skipped call and a missing native library each fail; then seeded checks: a changed answer passes with a reviewer-approved exact entry and fails without one; a new refusal fails without the owner; a removed case and a demotion to diagnostic fail; a relaxed rule, an availability downgrade or a field added as unavailable fails without an owner-approved row; a protected-path change not named in the `Reviewed-by:` trailer fails; a new case meeting its effective expectation passes without a baseline; a tightened rule passes; a branch-side baseline edit has no effect; an identity-only change passes; an ID added to `KNOWN_DIFFERING` fails; advancing the phase ref cannot erase a deliberately changed outcome or an unauthorized protected-path edit, and self-comparison is rejected; a package rebased over another landing is judged against the new tip, and a push that lands two packages fails; T1.14's output names the landing from which the checkpoint harness judges | Ratchet; register validation; protected paths; reference immutability |
460460
| T1.15 | 1a | Coverage generator for S0 | `coverage.py` with rules 1 to 5 and 8, `--check`, `--gate S0` | `--check` and `--gate S0` pass; an unresolved ID and a dropped path each fail | Coverage `--check`, `--gate S0` |
461461
| T1.17 | 1a | Clean-container wheel smoke | `wheel-smoke` job | Passes on 3.10 with pyarrow 14.0.1, pandas 2.2.0 and NumPy 1.26.4, and on 3.14 with the newest pandas 3, NumPy 2 and pyarrow, each with the resolved environment recorded; canonical inputs cross sharing their buffers and are released exactly; admitted types match the expected canonical schema with values and null masks kept; outputs stay valid after input collection, error and run destruction, over the capsule path; busy and cancel behave through the binding | `wheel-smoke` |

‎docs/design/rust-core/phase-1/tracker.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ A task's checks are active from the moment it lands, as listed in the design's t
3333
| T1.10e Owner decisions of 2026-10-10: E50, the new order and the bridge freeze; E49 approved, E52 and E53 | 1a | done | Landed at a20021f; candidate run 38088983548 green at 3f3a6f3; landing runs 38090293420 (lane) and 38090293243 (phase) green; `BASE_SHA` and `CHECKPOINT_SHA` 80f759c; both approve at 3f3a6f3 (4 fix rounds; 1 same-way failure) | E50, E52, E53 and E49's approval recorded, T1.21c and T1.21d added, the bridge freeze built (as built in [as-built.md](as-built.md#the-bridge-freeze)); notes in [Fix-round histories](#fix-round-histories) |
3434
| T1.12 S0 case corpus | 1a | done | Landed at bd11d5a; candidate run 38096404905 green at 2f85b6f; landing runs 38098262381 (lane) and 38098262455 (phase) green; `BASE_SHA` and `CHECKPOINT_SHA` a20021f; both approve at 2f85b6f (1 fix round) | 22 S0 cases, five of them diagnostic; register PQL-1 and PQL-2 proposed for the owner; three fail-open fixes in the freeze; as built in [as-built.md](as-built.md#t112), notes in [Fix-round histories](#fix-round-histories) |
3535
| T1.12b Checkpoint 4 corrections | 1a | done | Landed at cce303b; candidate run 38107634133 green at 0fd213a; landing runs 38108110460 (lane) and 38108110222 (phase) green; `BASE_SHA` and `CHECKPOINT_SHA` 2e4bb21; both approve at 0fd213a (2 fix rounds) | The checkpoint 4 review of 2e47233..a20021f (see Owner check-ins): docs and one tooling bug fix (the freeze's base branch, E56(c)); no product semantics moved and the contract is unchanged; design.md 188,950 bytes at the landing |
36-
| T1.13 S0 reference observations | 1a | in progress | Started at cce303b; `BASE_SHA` and `CHECKPOINT_SHA` cce303b, on lane `rust-core-phase-1-lane-1a`, in parallel with lane 1b's T1.21e; lands by its landing commit, whose SHA and CI run the next package records (E25) | Records through `run_python.py` in `python-ref` mode until T1.14 lands `gate.sh`; commits `contract/reference-env.txt`; immutability activates in T1.14 |
36+
| T1.13 S0 reference observations | 1a | in progress | Started at cce303b; `BASE_SHA` and `CHECKPOINT_SHA` cce303b, on lane `rust-core-phase-1-lane-1a`, in parallel with lane 1b's T1.21e; lands by its landing commit, whose SHA and CI run the next package records (E25) | `contract/reference-env.txt` committed, bound to the observations by the environment digest; `tests/test_contract_reference.py` holds every line's schema, guard result and full identity, and one line per case; re-recorded from a clean tree, every outcome the committed one; immutability activates in T1.14 (as built in [as-built.md](as-built.md#t113)). E49 probes: no route changed; the one new reader of outside JSON refuses 100,000 levels by name and a 100,000-key object by the schema; every rule seeded fail-closed |
3737
| T1.14 Ratchet, register v2, gate and first baselines | 1a | not started | | The checkpoint (merge base with the phase branch) harness in its own worktree, protected paths named in the `Reviewed-by:` trailer, availability (H2); the four fail-first controls before it lands; the checkpoint harness judges from its landing; `BASE_SHA` and `CHECKPOINT_SHA` recorded per package, self-comparison rejected. Constraint from checkpoint 3 (Codex P2, recorded at T1.11f): consume the comparator (`compare.py`), `contract/compare-policy.yaml`, the shared vectors and the recorded observations that exist, building no parallel mechanism |
3838
| T1.15 Coverage generator for S0 | 1a | not started | | Cut proposed to the owner at checkpoint 4, not enacted: `--check` only, unless a locked check needs `--gate S0` (locked check 1 does; see Owner check-ins) |
3939
| T1.16 L0 guard self-tests | 1a | merged into T1.10c | | Re-review round 2 |

0 commit comments

Comments
 (0)