demo: implement bounded OIC-ZTL-OAM end-to-end lane - #31
Merged
veraxis-protocol merged 4 commits intoAug 18, 2026
Conversation
Implements the demonstration lane only. Nothing here is a measured result: every automated run is DEVELOPMENT_TEST_ONLY, and `oic demo run` refuses with RESULT_BEARING_EXECUTION_NOT_AUTHORIZED unless a separate owner-issued artifact opens it. There is no flag that opens it. The compiler front end reads a small synthetic notation invented for one scenario and walks it through the existing object model: SourceDocument -> SourceNode -> SourceAnchor -> CandidateNormativeUnit -> owner-authored AdmissionRecord -> InstitutionalIR -> AuthorityRecord -> OpenControlEnvelope -> RuntimeBinding. The governing draft schemas are used unchanged. The load-bearing rule is that extraction confers nothing: the scenario carries a GUIDANCE line that parses cleanly, extracts as an advisory candidate, is never admitted, and never reaches the envelope. That difference is asserted rather than described. ZTL is reached through exactly one file. adapters/ztl/demo_bridge.py verifies the external checkout is at 56e1ff05 before importing anything, calls ztljudge.judge and nothing else, and returns the kernel result without institutional reading. raw_verdict crosses the boundary operationally inert: T is not ALLOW. zverify.grade is never called, and the contract test parses the bridge rather than grepping it, so the prohibition cannot be satisfied by a comment. The OAM record keeps four questions in four fields: what the kernel concluded, whether the institution authorizes the act, what the runtime does, and why. _compose() is not even handed the epistemic status, so an authority or currentness refusal has no route by which it could rewrite it -- the separation is structural rather than a rule someone has to remember. All five semantic cases run live against the pinned kernel. Case 1 permits and issues reliance through a separate consumer process that re-resolves currentness and re-evaluates authority for itself. Case 2 blocks on SUPERSEDED while the logic stays ESTABLISHED. Case 3 blocks on A10 with the proposition still established. Case 4 is A6: UNRESOLVED and escalated, never a finding that the claim is false. Case 5 re-runs the kernel under v2, is REFUTED on the merits, and leaves the case-1 reliance bytes untouched. The four adjudicated L0 runtime modules are byte-identical to the L1 baseline; L1 integrated against their existing interfaces and changed none of them. The L0 source-delta proposition is preserved and strengthened: it now compares two frozen commits instead of the working tree, so it stays true permanently, and L1 asserts its own exact delta against its own baseline with a negative interlock. Local only. No push, no PR, no result-bearing run, no RUN-004, no STATUS.md change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Six defects, each of which let something look established that was not.
**Two Canada guards had drifted forward.** They asserted that STATUS.md, the
draft schemas, docs/contracts and adapters/ztl were untouched between a fixed
starting commit and HEAD. HEAD moves, so a completed historical proposition
quietly became a standing prohibition on every later lane: any future work
touching one of those paths failed a test that was only ever meant to record what
that work order did not do. Both now compare against the frozen pre-L1 state.
The forbidden path set is unchanged, nothing is exempted by name, and both ends
of the interval must resolve or the guard fails.
Also correcting my own report: the earlier "1438 passed, 0 failed" local numbers
were measured before the L1 commit existed, while demo_bridge.py was still
untracked and therefore invisible to guards that diff committed state. The
collision existed at commit time and I reported it as clean.
**Evidence was inferred rather than observed.** `evidence_ok` was the truth of
`bool(envelope["evidence_requirements"])` — the presence of a requirement stood in
for its satisfaction, which is exactly the collapse this lane exists to prevent.
There is now a synthetic evidence observation with its own bytes; the runtime
opens it, verifies identity and digest, reads a state, and only then decides
satisfaction. Requirement and satisfaction are separate fields in the record.
**A missing observation could become false.** `evidence_signed: bool` mapped
absence onto `False` onto `F`, so never having looked was indistinguishable from
having looked and found nothing. EvidenceState carries SIGNED / UNSIGNED /
INVALID / UNKNOWN / NOT_OBSERVED; the last two supply no mark at all, the atom
stays Z, and the formula comes back OPEN. Never REFUTED.
**Warrants were trusted because we built them.** The runtime now re-derives
every binding a warrant claims — profile, formula hash, kernel commit, anchors,
admissions, version bindings, envelope identity, validity, ground set, output
projection, and whether the disposition/grade pair is even reachable. Nine
mutations are tested; each fails closed and no other satisfied component repairs
it. The validator lives in the source lane: a runtime whose contract lives in the
test tree has no contract wherever the tests are not installed.
**Authority was evaluated after currentness had already refused.** Case 2 carried
an A1 for an operation the gate had stopped, and an A1 that meant nothing looks
exactly like one that did. Authority is no longer reached unless the gate returns
G1/PROCEED; the record says NOT_EVALUATED and why, structurally distinguishable
from any authority reason code. Cases 3 and 4 still reach it.
**Evidence references were unfalsifiable.** `bool(ref.get("evidence_id"))`
resolved a substituted, corrupted or absent artifact exactly as well as the real
one. Refs now carry a locator and a digest; the consumer opens the bytes and
recomputes. Wrong digest, missing file and substituted bytes each refuse.
The result-bearing gate is now a contract rather than three fields. An
authorization binds the implementation commit, the scenario bundle digest, the
kernel commit, the output directory and the ceiling, and each is compared against
recomputed state over a clean tree. The execution context enum authorizes
nothing: the interlock requires the object only the validator returns, and
refuses before the kernel is called or a byte is written. Single use is exclusive
creation, and consuming an authorization never mutates it.
The positive `oic demo run` path is implemented end to end so the frozen baseline
has no stub. It is not invoked here: no authorization exists, and nothing in this
work order creates one.
No result-bearing execution. No frozen claim package. No measured claim. The four
adjudicated L0 modules remain byte-identical to a59b885; schemas/draft,
schemas/proposed, STATUS.md, the Canada artifacts and the workflows are untouched.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The other seven jobs prove the repository is internally consistent. None of them
proves the OIC->ZTL->OAM lane ever reaches the kernel: standard CI has no ZTL
checkout, so every live test skips, and a green run establishes nothing about the
one thing this lane is for.
live-ztl-demo fetches the external kernel at its immutable commit into
${RUNNER_TEMP}, outside the OIC worktree, and then proves it did not contaminate
the tree it is validating. It compares the fetched HEAD against the pinned commit
rather than trusting a branch or tag, verifies the frozen fixture INDEX by digest,
and runs the checked-in conformance verifier.
Exit code 0 is not accepted on its own. The verifier's own counts are asserted
line by line — 13 reproduced, 3 not-reachable, 0 mismatches, 0 hash problems — so
a future version that reported success while reproducing nothing would fail here.
The three not-reachable combinations stay not-reachable and are never relabelled.
The live suite then runs with zero tolerance for skips. A skip in this job means
the kernel was not reached, which is the single condition the job exists to rule
out, so the JUnit result is parsed and any skip fails. If the external checkout
cannot be obtained the job fails rather than degrading into a green run.
The CI contract now governs the job it added: the new assertions read the frozen
kernel profile for the repository, commit, fixture location, index digest and the
13/3 counts rather than restating them, so the workflow and the profile cannot
drift apart while both look correct in isolation.
One deviation from the authorized three-path list, disclosed rather than hidden.
test_demo_slice_contract.py::test_no_workflow_file_changed — written by me in the
previous successor — asserted that .github/ was untouched full stop. True of that
work order, false as a permanent rule, and exactly the drift the two Canada guards
had. It is now scoped to what is authorized: the delta must be precisely
.github/workflows/ci.yml and nothing else, the authorization artifact must name
that path and authorize CI validation only, and a second workflow file still
fails. The PR path count is unchanged at 28 because that file was already in the
diff.
DEVELOPMENT_TEST_ONLY. No `oic demo run`, no result-bearing execution, no
execution authorization artifact, no RUN-004, no STATUS.md change. A green result
here is remote execution of this project's own test contract on someone else's
hardware; it is not independent assurance and must not be described as such.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The live-ZTL gate required changing the one existing CI workflow, and a guard I had written in the previous successor asserted that .github/ stays untouched forever. That assertion was true of the work order that produced it and false as a standing rule — the same drift the two Canada guards had, where a proposition about one interval quietly becomes a prohibition on later authorized work. I scoped it rather than exempting anything: the delta must equal exactly .github/workflows/ci.yml, the live-gate authorization must name that path and authorize CI validation only, and a second workflow file still fails. That was a path the gate authorization had not anticipated, so it was disclosed rather than absorbed, and this artifact records the owner's ratification of it. Recorded classification: HISTORICAL_SCOPE_CORRECTION true; workflow allowlist carve-out false; test semantic weakening false; result-bearing gate change false; runtime change false. Evidence only. One file, no runtime, test, workflow, schema or scenario delta from 07a61c9, and no additional implementation change is authorized by it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
veraxis-protocol
marked this pull request as ready for review
August 18, 2026 00:53
veraxis-protocol
merged commit Aug 18, 2026
a2ece68
into
ztl/currentness-slice-001-frozen-design
8 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Demo lane only. Bounded synthetic demonstration lane. The global semantic implementation gate remains CLOSED. DRAFT — do not merge.
Four commits:
3e3436605900f2eb07a61c9f43a77635Final validated head:
43a7763565d24f0115927eed15a65a775dc2f258— validation run 32081449314, 8/8 green, live ZTL56e1ff0510c62b04dbd85bbe08b7a6deacbf276b, conformance 13 / 3 / 0 / 0, live suite 52 passed / 0 skipped / 0 failed / 0 errors.Correction to the earlier numbers in this PR
The first version of this description reported a full local suite of 1438 passed / 0 failed. That was wrong. Those runs were executed before the implementation commit existed, while
adapters/ztl/demo_bridge.pywas still untracked — and the guards that later failed diff committed state, so an untracked file was invisible to them. Measured at3e343660the real numbers were 2 failed, 1436 passed. The collision existed at commit time and was reported as clean.What the two Canada guards were, and what changed
test_canada_acquisition_freeze.pyandtest_canada_rights_resolution_dossier.pyasserted thatSTATUS.md,schemas/draft/,docs/contracts/andadapters/ztl/were untouched between a fixed starting commit and HEAD. HEAD moves. A completed historical proposition therefore drifted forward into a standing prohibition on every later lane.Both now compare against the frozen pre-L1 state
a59b8854. This is historical scoping, not an exemption:demo_bridge.pyis not named, allowlisted or carved outEvidence and authorization defects closed
bool(envelope["evidence_requirements"])— a requirement standing in for its satisfactionFalse→F: never looked was indistinguishable from looked and found nothingEvidenceState(SIGNED/UNSIGNED/INVALID/UNKNOWN/NOT_OBSERVED); unknown supplies no mark, atom staysZ, formula returns OPEN, never REFUTEDA1NOT_EVALUATEDand whybool(ref.get("evidence_id"))— unfalsifiableThe execution-context enum authorizes nothing on its own: the interlock requires the object only the validator returns, and refuses before the kernel is called or any byte is written. Single use is exclusive creation; consuming an authorization never mutates it.
The positive
oic demo runpath is implemented end to end so the frozen baseline carries no stub. It is not invoked here — no authorization artifact exists, and this work order creates none.Case results (live pinned kernel, DEVELOPMENT_TEST_ONLY)
Local validation at
07a61c9fRemote live-ZTL gate — final validation run 32081449314, 8/8 green
Run 32081449314 on head
43a77635is the final validation of the merge head. Run32079337848on07a61c9fis retained as predecessor evidence only; both produced identical live-gate observations.live-ztl-demofetches the external kernel at its immutable commit into${RUNNER_TEMP}, outside the OIC worktree, then proves it did not contaminate the tree it is validating.56e1ff0510c62b04dbd85bbe08b7a6deacbf276bINDEX.jsonsha256ffadd65352d69ffcf55787c6dc26339e51eaed76b4c2ae789f7c813625247145Exit code 0 is not accepted on its own — the verifier's own counts are asserted line by line, and the JUnit result is parsed so that any skip fails the job. A skip here would mean the kernel was never reached, which is the one condition this job exists to rule out. If the external checkout cannot be obtained the job fails rather than degrading into a green run.
REMOTE_LIVE_ZTL_VALIDATION= ESTABLISHED_FOR_PINNED_PR_CIThis is not independent assurance. The GitHub runner executes this project's own test contract on someone else's hardware.
INDEPENDENT_TIER1_REPRODUCTIONremains NOT ESTABLISHED.The standard
testjob still skips the live suite by design (34 skips, no ZTL checkout provisioned there); those skips are not counted as passes anywhere.Ratified scope correction
Adding the authorized
live-ztl-demojob required changing the one existing CI workflow — and a guard written in the previous successor asserted that.github/stays untouched forever. True of the work order that produced it; false as a standing rule.tests/contract/test_demo_slice_contract.pywas therefore modified, a path the gate authorization had not anticipated. It was disclosed rather than absorbed, and is now explicitly owner-ratified indocs/operations/OIC-ZTL-OAM-DEMO-SLICE-001-L1-REMOTE-LIVE-ZTL-DEVIATION-RATIFICATION-001.jsonas HISTORICAL_SCOPE_CORRECTION.It is not a filename exemption and not a weakening of the workflow boundary. The guard now requires the
.github/delta to equal exactly.github/workflows/ci.yml, requires the live-gate authorization to name that path and authorizeCI_VALIDATION_ONLY, and still fails if a second workflow file appears.Claim state
a59b8854;schemas/draft,schemas/proposed,STATUS.mdand the Canada artifacts unchanged.github/workflows/ci.ymlchanged only by the addition of the owner-authorizedlive-ztl-demojob, and no second workflow file was added56e1ff0510c62b04dbd85bbe08b7a6deacbf276b🤖 Generated with Claude Code