campaign: checkpoint research ABI reconstruction
This commit is contained in:
alex
parent
3bfde5a70d
commit
8f3106ae10
733 changed files with 1724995 additions and 892 deletions
54
AGENTS.md
Normal file
54
AGENTS.md
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# SOTS campaign instructions
|
||||
|
||||
This repository is the state authority for the SOTS reconstruction and its Windows lab.
|
||||
Start with `campaign/README.md`, your contract, its latest checkpoint, and open surprises.
|
||||
Current policy: `guides/multi-agent-workflow.md`. Engine architecture: `sots-engine/docs/architecture.md`.
|
||||
Historical findings are evidence, not current execution instructions or accepted status.
|
||||
|
||||
## Authority and models
|
||||
|
||||
- The normal lead/RE/implementation/verification/lab loop runs on **GPT-5.6 Sol
|
||||
(`openai/gpt-5.6-sol`)**. Reserve **GPT-6 Astra (`openai/gpt-6-astra`)** for resolving
|
||||
falsified assumptions, conflicting evidence, unexpected instrument effects, or changed scope.
|
||||
- `campaign/models.json` is the role/model registry. Launch with `tools/run_agent.py` and an
|
||||
explicit role, contract, state root, and paired worktrees. Never silently downgrade or fall back.
|
||||
- Ordinary implementation/test failures inside the contract may be fixed by its worker.
|
||||
Falsified assumptions, conflicting evidence, unexpected instrument effects, or changed scope
|
||||
require a recorded surprise and an Astra resolution before affected work continues.
|
||||
- No worker subdelegation. The lead assigns parallelism; max two implementation slices after
|
||||
the pilot. Independent workload preparation is scheduled against explicit resource leases.
|
||||
|
||||
## Durable state and context
|
||||
|
||||
Checkpoint in the canonical RE state root every **20 tool calls or 15 minutes**, whichever is
|
||||
earlier, and before an experiment, compaction, handoff, or stop. Include model/session, exact
|
||||
source identities, evidence paths, decisions versus observations, tests, blockers, and ONE exact
|
||||
next action. Do not store state only in a chat summary or `/tmp`.
|
||||
The runner uses bounded 40-step quanta. After checkpointing, stop and restart from the repository;
|
||||
automatic compaction is a backstop, not proof that a checkpoint was written. On recovery read the
|
||||
contract/checkpoint, verify worktree and resource identities, then continue. Missing state means
|
||||
blocked, not permission to reconstruct progress from memory.
|
||||
|
||||
## Ownership
|
||||
|
||||
Use distinct engine and RE worktrees per lane, baseline-pinned. Canonical runtime state is shared
|
||||
only through the campaign tools. One integrator writes current evidence pointers and projections.
|
||||
Never stage someone else's changes. No automatic commit, push, pull, or reset. Commands requiring
|
||||
these actions need explicit user authorization. Source edits use apply_patch.
|
||||
VM, shared build-host, and Ghidra mutation require leases. A stale lease is not automatically free.
|
||||
Record preconditions, side effects, cleanup and access verification for any lab operation.
|
||||
Rollout bootstrap file-ownership exception: `campaign/rollout/architecture-decision.md` only.
|
||||
|
||||
## Evidence
|
||||
|
||||
No generic `verified` promotion. Separate understanding, implementation, original dependencies,
|
||||
and validation scope. A count is insufficient without distinct states, branch exposures, and
|
||||
positive execution evidence. Include all writes, container elements, allocations, IDs, events,
|
||||
RNG draws, and runtime-only inputs. Original-assisted execution is not independent replacement.
|
||||
Synthetic boundary tests and original-game differential tests are complementary. Missing required
|
||||
inputs, zero execution, incomplete coverage, unexpected skips, stale binaries or unbound source
|
||||
identity fail acceptance. One independent verifier must reproduce the package; integrated-tree
|
||||
evidence is required for acceptance. Reports are measurements until those gates pass.
|
||||
|
||||
Never commit owner-supplied binaries/assets or secrets. Engine facts cross only documented
|
||||
generated channels. Never paste disassembly/decompiler output into the engine repository.
|
||||
8
CLAUDE.md
Normal file
8
CLAUDE.md
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
# SOTS entry point
|
||||
|
||||
Read `AGENTS.md`. The normal campaign loop uses `openai/gpt-5.6-sol`; problem resolution uses
|
||||
`openai/gpt-6-astra`.
|
||||
The supported execution harness is OpenCode through `tools/run_agent.py`; role definitions and
|
||||
models are versioned in this repository. Do not revive the removed global `re-*` Claude agents
|
||||
or use a Claude model alias as a substitute for the required model. Read-only research may be
|
||||
assigned explicitly, with its checkpoint and evidence stored in the canonical RE state root.
|
||||
|
|
@ -1,143 +1,46 @@
|
|||
# SotS RE campaign — coverage dashboard
|
||||
# Campaign status
|
||||
|
||||
Generated 2026-09-09 14:24 UTC · `sots-re` @ d9b06ca,2026-09-09 · `sots-engine` @ 7741d42,2026-09-09 (252 commits) · regenerate with `tools/dashboard.py`
|
||||
Generated by `python3 tools/dashboard.py`; edit contracts and `campaign/current.json`.
|
||||
|
||||
> **North star:** A functional reimplementation of the engine — behavior-equivalent, NOT byte-for-byte
|
||||
Plan: [backlog.md](backlog.md). Policy: [method rules](../guides/method-rules.md).
|
||||
|
||||
## 1. Map coverage (campaign/board.md)
|
||||
## Current evidence
|
||||
|
||||
454 targets · mapped-or-better **405/454** `[█████████░] 89%` · verified **362/454** `[████████░░] 80%`
|
||||
Gate: **passed (host)**; this is scoped gate evidence, not whole-engine acceptance.
|
||||
Manifest: `campaign/evidence/8e14e00ee3ce7478ddfdef8de12183451e858c52d78dc28cffbdee47f5d087d8-gate.json` · SHA-256 `8e14e00ee3ce7478ddfdef8de12183451e858c52d78dc28cffbdee47f5d087d8`.
|
||||
- engine: dirty snapshot; manifest identity `c9c90acbd182b872841e1c073e367a4747d6742f095e0c9ed737d608cdff78c6`; recorded revision `7741d42fc5e4e761e6449bdaf0e4a61d00036a23`.
|
||||
- re: dirty snapshot; manifest identity `47b741d67acc48baefec6b4a673bf3525abc415165e59d4d3512dd0cc350c89a`; recorded revision `3bfde5a70d874a723e797a695bbd847fd82c0aa7`.
|
||||
- Binary SHA-256: `78b2562ea2c56351f9f6f0f24d271afcced741eadbc148047780e6dfd101940b`.
|
||||
- Input SOTS_SAVES_DIR: 43 hashed files at `/home/alex/sots-re/verify/results/saves`.
|
||||
- Tests passed: ["addr_smoke", "mars_parse_unit", "game_config_unit", "game_config_manifest", "game_data_unit", "game_design_unit", "game_sim_economy", "game_sim_research", "game_sim_colony", "game_sim_movement", "game_sim_techgraph", "game_sim_visibility", "game_sim_construction", "game_sim_player_turn", "mars_rng_unit", "mars_stream_unit", "mars_stream_save", "mars_stream_domains", "mars_stream_wire_schema", "mars_text_unit", "mars_vfs_unit", "shim_trace_sha256", "shim_trace_emitter", "shim_trace_diff", "shim_trace_coverage", "shim_trace_hook", "game_effects", "game_events", "game_combat_retreat", "game_nav_pathplan", "game_ai_tasks", "game_ai_turn_order", "game_ai_orders", "game_ai_agent", "game_ai_live_blocks", "game_ai_apply_order", "game_ai_command_capture", "shim_budget_unit", "shim_techfx_unit", "shim_colony_unit", "shim_movement_unit", "shim_events_unit", "shim_player_turn_unit", "shim_rng_ledger_unit", "app_catalog", "app_turn", "app_trade_raid", "app_alliance", "app_treaty", "app_event_phase", "app_turn_record", "app_command_replay"]
|
||||
- Tests skipped: ["game_config_replay", "game_data_realdata", "game_design_realdata", "game_design_census", "game_sim_smoke_real_save", "mars_text_realdata", "mars_vfs_realdata"]
|
||||
- Tests failed: []
|
||||
- Limitations: ["host profile allowed skips: game_config_replay, game_data_realdata, game_design_census, game_design_realdata, game_sim_smoke_real_save, mars_text_realdata, mars_vfs_realdata"]
|
||||
|
||||
| Status | Count | % |
|
||||
|---|---:|---:|
|
||||
| verified | 362 | 80% |
|
||||
| mapped | 43 | 9% |
|
||||
| in-progress | 5 | 1% |
|
||||
| backlog | 41 | 9% |
|
||||
| blocked | 2 | 0% |
|
||||
Replay: **measured** (separate file-byte, inflated-byte and state equality).
|
||||
- /home/alex/sots-re/verify/results/saves/turn2-state.sav → /home/alex/sots-re/verify/results/saves/turn3-state.sav: file=False, inflated=False, state=False.
|
||||
|
||||
| Type | verified | mapped | in-progress | backlog | blocked | total |
|
||||
|---|---:|---:|---:|---:|---:|---:|
|
||||
| objects | 46 | 6 | 0 | 3 | 1 | 56 |
|
||||
| control-flow | 41 | 2 | 1 | 0 | 0 | 44 |
|
||||
| subsystems | 4 | 8 | 0 | 2 | 1 | 15 |
|
||||
| engine | 34 | 1 | 0 | 0 | 0 | 35 |
|
||||
| verify | 106 | 15 | 3 | 35 | 0 | 159 |
|
||||
| phase2 | 15 | 3 | 1 | 0 | 0 | 20 |
|
||||
| meta | 95 | 6 | 0 | 1 | 0 | 102 |
|
||||
| other | 21 | 2 | 0 | 0 | 0 | 23 |
|
||||
Unselected findings and artifacts are historical evidence, not current acceptance.
|
||||
|
||||
## 2. Binary understanding
|
||||
## Capabilities / workloads
|
||||
|
||||
- RTTI type descriptors: **1,924** (`Game::` 1,404, `Mars::` 194; serializable types 179)
|
||||
- Classes with recovered member layouts: **384** / 1,598 named classes `[██░░░░░░░░] 24%` — `objects/layouts.json` (serializer recovery) plus classes recovered by hand in `struct-recovery.md` + `schema-gaps-resolved.md`. Note 179 types are *serializable*; the recovery also reaches non-serializable ones, so this is not a subset of that
|
||||
- Functions: **41,411** (parsed from `01-fingerprint.md`); named/annotated in the **address contract** (`ghidra/addresses.json`, not Ghidra's full rename count): **1320**, verified **1187** `[█████████░] 90%`
|
||||
Contract lifecycle is reported independently of the evidence axes above.
|
||||
|
||||
## 3. Data layer
|
||||
| Contract | Lifecycle | Scope / workload | Original dependencies |
|
||||
|---|---|---|---|
|
||||
| [Bootstrap canonical contract controls and bounded worker launcher](contracts/controls-bootstrap.json) | accepted | ["tools/campaign.py", "tools/run_agent.py", "campaign/", "verify/campaign/"] | ["No original game executable required for control tests"] |
|
||||
| [Normal Astra launcher, explicit routing and durable checkpoint smoke](contracts/launcher-smoke.json) | proposed | ["SMOKE ONLY: Read this contract and campaign/README.md from the canonical RE state root. Do not implement any other contract, edit source, delegate, or access the lab.", "Use the canonical campaign CLI to write a checkpoint for launcher-smoke with the run-supplied session ID, actor launcher-smoke, role architecture-review and model openai/gpt-6-astra. Summary: explicit Astra launcher reached canonical RE state from paired worktrees; no source mutation. Artifact: campaign/agents/lead.md. Next action: lead inspects this run's actual event/session/checkpoint binding.", "After writing that checkpoint, immediately return a short completion. Do not plan extra work."] | [] |
|
||||
| [RE: research completion record construction and allocator ABI](contracts/research-completion-abi.json) | proposed | ["Reverse engineering only. Own canonical campaign/research/research-completion-abi.md and verify/results/research-completion-abi/ captures. Use assigned source-identical paired worktrees for source inspection; canonical RE for unique evidence/checkpoint outputs.", "Recover actual constructors/copy/destructors/vector-growth/allocation/free conventions used by RecordObservedTech and EventStorage/TurnEvents/PlayerEvent. Resolve implementable ABI operations, not another general framework.", "Use existing ReVa read-only tools through canonical tools/reva_call.py or the owner-supplied local binary. No Ghidra renames/type writes, VM mutation, new engine code, framework code, agents or delegation. Do not commit/stage/push.", "Start with findings/subsystems/{events,observedtech-append,research-replace}.md and campaign/pilots/research-replacement.md; cross-check binary bytes/decompilation rather than merely repeat notes. Anchors: RecordObservedTech 0x007ba1a0, EventStorage::PostEvent 0x008862b0, PlayerEvent constructor 0x0084ee30. Addresses are hypotheses to validate against fingerprint and actual tools.", "Produce recovered signatures, ownership/lifetime rules, short/long string and empty/full-capacity container paths, and exact unresolved dependencies with minimum next probe. Store raw tool outputs and a hash/provenance index in your owned RE results directory. Keep code-derived material out of engine repo."] | ["Original binary is the object of analysis, not a replacement dependency decision"] |
|
||||
| [Completion-bearing research replacement pilot (proposed; acceptance runner and dependencies pending)](contracts/research-replacement.json) | proposed | ["Planning only until ready: campaign/pilots/research-replacement.md is the detailed input, write-boundary and acceptance specification. No replacement code or lab operations authorized by this proposed contract.", "Target ProcessResearch plus SetResearched and required OnTechResearched effects for the W1 turn3 LOAD-to-turn4 completion; broad research correctness is not implied.", "Before implementation assign paired baseline-pinned worktrees, exact owned source paths, supported-input preflight and executable acceptance. Uncommitted bootstrap changes are not bound by these HEAD IDs."] | ["Existing research adapter calls original TechTree::Cost for effective and cascade costs; independent effective-cost replacement is not established.", "Separate B2 hook uses original has-researched lookup and node-bore updater. The updater allocates/frees state and is not read-only. Its integration/retention needs an explicit lead decision.", "Runtime EventText lookup and caller-supplied asset tables already exist. Whether live text/allocator/event adapters use original helpers is unresolved; no PostEvent policy or address is assumed.", "Shim workload retains original turn driver, budget allocation, remaining simulation, data loading and save serialization. Successful scoped shim replacement would not establish independent standalone turn parity."] |
|
||||
|
||||
- Catalogs: **1,595/1,595** files parsed (91 block kinds in `schema_stats.json`), dangling cross-refs **0** (`crosslink.json`)
|
||||
- Oracle `mars-parse`: **1,531/1,531** files agree `[██████████] 100%`
|
||||
- Oracle `mars-text`: **64/64** files agree `[██████████] 100%`
|
||||
- Saves: **43/43** real saves strict-clean — strict exit 0, 0 errors, 0 warnings
|
||||
- Design rules: **127/127** stock designs pass `[██████████] 100%`
|
||||
- Value domains: **490/724** typed fields have been seen to vary `[███████░░░] 68%` — the other **234** have only ever held one value across the corpus, so their typing is untested (`value-domain-census.md`)
|
||||
## Blockers / surprises
|
||||
|
||||
## 4. Engine accrual (sots-engine)
|
||||
- No open surprise records found (not proof of acceptance).
|
||||
- **controls-bootstrap** (accepted): dependencies []; stop conditions ["Cross-cutting architecture changes require Astra resolution"]; checkpoint campaign/runtime/checkpoints/controls-bootstrap-5643d7cec1edd289b0465d5f.json.
|
||||
- **launcher-smoke** (proposed): dependencies []; stop conditions ["Any model, permission, contract, checkpoint or source mismatch: record incomplete; no fallback."]; checkpoint campaign/runtime/checkpoints/launcher-smoke-9e8a62fea4de50abd96f27d6.json.
|
||||
- **research-completion-abi** (proposed): dependencies ["controls-bootstrap"]; stop conditions ["Stop affected interpretation on binary fingerprint mismatch, contradictory ownership/ABI evidence, unavailable original data, or any scope-changing surprise; record and escalate to Astra", "Checkpoint every 20 calls/15 minutes and before compaction/stopping; return exact next RE action within 40 steps", "Do not expand into framework development or mark pilot replacement ready/accepted"]; checkpoint campaign/runtime/checkpoints/research-completion-abi-5e30f7db1f3804d05c217369.json.
|
||||
- **research-replacement** (proposed): dependencies []; stop conditions ["Remain proposed while readiness criterion, dependency decisions, input manifests and executable acceptance are missing; do not interpret narrative strings as execution proof.", "Stop on control disagreement, instrumentation mismatch, source/input drift, missing artifacts/assets, unknown RNG, unmodelled fired branch, unexpected writes, zero required execution or forbidden original fallback.", "Record any falsified assumption or changed scope as a surprise and obtain Astra resolution before affected work continues; checkpoint at 20 calls/15 minutes and before experiments, handoff or stop.", "No lab or shared-host mutation without explicit assignment and lease; no commits, staging, push or delegated work under the current pilot-design assignment."]; checkpoint null.
|
||||
|
||||
| Module | LOC | Test files | Checks | Wired | Doc |
|
||||
|---|---:|---:|---:|---|---|
|
||||
| `app` | 5,092 | 9 | 207 | yes | N-output-term.md |
|
||||
| `game/ai` | 2,138 | 8 | 322 | yes | L4-ai-orders.md |
|
||||
| `game/combat` | 582 | 2 | 34 | yes | L2-predictions.md |
|
||||
| `game/config` | 558 | 4 | 131 | yes | M1.md |
|
||||
| `game/data` | 2,077 | 12 | 462 | yes | game-data.md |
|
||||
| `game/design` | 1,200 | 19 | 303 | yes | game-design.md |
|
||||
| `game/effects` | 973 | 3 | 231 | yes | game-effects.md |
|
||||
| `game/events` | 558 | 3 | 152 | yes | E-events.md |
|
||||
| `game/nav` | 581 | 2 | 113 | yes | — |
|
||||
| `game/sim` | 4,918 | 15 | 1086 | yes | game-sim.md |
|
||||
| `mars/parse` | 875 | 12 | 277 | yes | mars-parse.md |
|
||||
| `mars/rng` | 273 | 0 | 0 | yes | mars-rng.md |
|
||||
| `mars/stream` | 6,021 | 8 | 331 | yes | mars-stream.md |
|
||||
| `mars/text` | 899 | 8 | 245 | yes | mars-text.md |
|
||||
| `mars/vfs` | 788 | 9 | 140 | yes | mars-vfs.md |
|
||||
| `shim` | 16,777 | 0 | 0 | direct (WIN32) | H-probes.md |
|
||||
| `shim/hooks` | 13,658 | 0 | 0 | direct (WIN32) | L1-predictions.md |
|
||||
| `shim/trace` | 2,258 | 9 | 273 | direct (WIN32) | shim-trace.md |
|
||||
| **total** | **60,226** | **123** | **4307** | | |
|
||||
## Next action
|
||||
|
||||
Board `engine:` rows: verified **34**, mapped 1, in flight 0 (of 35) — verified & merged `[██████████] 97%`
|
||||
|
||||
## 5. Phase 2 milestones
|
||||
|
||||
| Milestone | Status | Coverage | Notes |
|
||||
|---|---|---:|---|
|
||||
| P2-M0 shim bootstrap | ✅ verified | 100% | sots-engine 5f5bc41: proxy binkw32.dll (66 exports identical), MinHook, asm-stub trace hoo |
|
||||
| P2-M1 flat-KV config loader | ✅ verified | 100% | LIVE: GlobalConsts::LoadFile hooked; trace 19 calls/1088 regions (tracecmp 0); compare 19/ |
|
||||
| P2-M2 manifest/id registry | ✅ verified | 80% | LIVE: trace 22 calls (tracecmp 0); weapons compare 1/1 0 divergences; REPLACE+oracle byte- |
|
||||
| P2-M3 Mars brace-block parser | ✅ verified | 0% | SUPERSEDED (engine mars/parse, oracle 1531/1531). Mars::Script pull tokenizer (Open 0x008c |
|
||||
| P2-M4 gobio VFS read | ✅ verified | 0% | SUPERSEDED (engine mars/vfs, 10268 files CRC-clean). choke point: bool __cdecl gobio::Read |
|
||||
|
||||
## 6. Standalone (`src/app`) — distance to the byte-match
|
||||
|
||||
Turn-driver phases: **16/44** modelled (12 committed) `[████░░░░░░] 36%`
|
||||
|
||||
| | verified | implemented | partial | blocked | stub |
|
||||
|---|---:|---:|---:|---:|---:|
|
||||
| turn drivers (44) | 0 | 4 | 8 | 4 | 28 |
|
||||
| post-combat tail (37) | 0 | 1 | 4 | 1 | 31 |
|
||||
|
||||
Reference pair `turn2-state.sav` → `turn3-state.sav`, leaves localised by `state_checksum.py` (coverage proved by re-serialisation):
|
||||
|
||||
- baseline (a standalone that does nothing): **108** leaves diverge
|
||||
- after one standalone turn: **63** leaves diverge — closed 45, regressed 0
|
||||
- byte match: ❌ not yet `[████░░░░░░] 42%`
|
||||
|
||||
Where the remaining divergence lives:
|
||||
|
||||
| Subsystem | Leaves |
|
||||
|---|---:|
|
||||
| `/Sim/systems` | 24 |
|
||||
| `/Sim/players` | 20 |
|
||||
| `/Sim/turnstats` | 8 |
|
||||
| `/Sim/fleets` | 3 |
|
||||
| `/Sim/FleetIDs[]` | 1 |
|
||||
| `/Sim/ModCount` | 1 |
|
||||
| `/Sim/NMnx` | 1 |
|
||||
| `/Sim/NumFlts` | 1 |
|
||||
|
||||
Generator: 16 word(s) modelled per turn; unattributed per turn: 18-20 (lane Z, in flight). A byte-match is impossible until that closes — the generator state is saved state.
|
||||
|
||||
Detail: `verify/results/standalone/report.txt`.
|
||||
|
||||
## 7. Verification ledger
|
||||
|
||||
- ✅ Saves strict: 43/43 (strict exit 0, 0 errors, 0 warnings)
|
||||
- ✅ Design rules: 127/127
|
||||
- ✅ oracle mars-parse 1531/1531 · ✅ oracle mars-text 64/64
|
||||
- ✅ Compare harness present (`verify/harness/compare/`)
|
||||
- ✅ M0 evidence present (`verify/results/shim/m0.log`)
|
||||
- ✅ Determinism oracle: verified
|
||||
|
||||
## 8. Open questions
|
||||
|
||||
Open **26** · resolved/parked 11 · backlog items: 1. The engine today 0, 2. The milestone, restated — 2026-09-09 7, 2-old. The milestone as restated 2026-09-08 5, 3. The plan — three tracks, in priority order 0, 4. Future engine modules 5, 5. Workloads to manufacture 7, 6. Multiplayer revival 4, 7. Method and infrastructure 5, Parked 2
|
||||
|
||||
Most recent open:
|
||||
|
||||
- Some truths are unreachable by compare — B3's draw-divisor bug differed on 0.78% of draws yet flip…
|
||||
- x87 precision-control mode at runtime — 53-bit MSVC default vs 24-bit if D3D9 grabbed the FPU; mov…
|
||||
- Struct-modelling hazard (found by M2) — an MSVC-2010 `std::vector` member is three words, so a…
|
||||
- SAVE_FORMAT tag corrections (fix Python reader + spec) — real on-disk tags: `otnF` (not `ontF`) in…
|
||||
- Not traced end-to-end — `Species/_NPC/weapons/*.weapon` loading and the `.effect` dictionary entry…
|
||||
|
||||
## 9. Delta since previous dashboard
|
||||
|
||||
- verified targets: 361 → 362 (+1) · mapped-or-better: 404 → 405 (+1)
|
||||
- engine LOC: 59,834 → 60,226 (+392) · test files: 122 → 123 (+1) · checks: 4,259 → 4,307 (+48)
|
||||
- addresses verified: 1,179 → 1,187 (+8) · recovered layouts: 384 → 384 (+0) · open questions: 26 → 26 (+0)
|
||||
- standalone leaves closed: 45 → 45 (+0) · leaves still diverging: 63 → 63 (+0)
|
||||
|
||||
---
|
||||
warnings: board.md line 459: unknown status 'open' for '**A replace of `ProcessResearch` is gated on `ServerPlayer::OnTechResearched`, and partly on a policy question**'; board.md: unknown types engine + gate, subsystems, tooling; mars-rng.md: no oracle total row parsed; mars-stream.md: no oracle total row parsed; mars-vfs.md: no oracle total row parsed
|
||||
<!-- dashboard-metrics {"verified": 362, "mapped_plus": 405, "targets": 454, "loc": 60226, "tests": 123, "checks": 4307, "addr_verified": 1187, "addr_total": 1320, "layouts": 384, "open_q": 26, "sa_closed": 45, "sa_left": 63} -->
|
||||
Framework complete; reverse engineering active. First research-completion ABI pass recovered constructors/copy/ownership and callback ordering. Continue with nested event buckets, duplicate/prune and exceptional cleanup, then a scoped live-record adapter experiment. See campaign/research/NEXT.md.
|
||||
|
|
|
|||
223
campaign/README.md
Normal file
223
campaign/README.md
Normal file
|
|
@ -0,0 +1,223 @@
|
|||
# Canonical campaign controls
|
||||
|
||||
`sots-re/campaign/` is the state authority. Start with your contract, its checkpoint, open
|
||||
surprises, and [current policy](../guides/multi-agent-workflow.md). Board/dashboard are generated
|
||||
projections. Historical evidence is not current acceptance. No automatic commits or lab operations.
|
||||
|
||||
Framework development is complete. The `controls-bootstrap` contract reached scoped acceptance;
|
||||
see [rollout result](rollout/RESULT.md) and its current contract/verdict for source-bound evidence.
|
||||
Active work is reverse engineering. Change tooling only to unblock a named RE experiment.
|
||||
|
||||
## Contract format
|
||||
|
||||
`contract.schema.json` is strict JSON Schema (unknown fields and duplicate JSON keys fail).
|
||||
The standard-library validator implements the schema's used subset. A populated example is
|
||||
[contracts/controls-bootstrap.json](contracts/controls-bootstrap.json); its lifecycle is in the record.
|
||||
|
||||
Required fields:
|
||||
|
||||
| Field | Structure |
|
||||
|---|---|
|
||||
| `id`, `title`, `status` | Slug, short title, lifecycle state |
|
||||
| `owner` | `{ "name": "worker-identity", "role": "implementer" }` |
|
||||
| `baseline` | `{ "engine": {"path":"/absolute/canonical/engine","commit":"full-commit-id"}, "re": {"path":"/absolute/canonical/re","commit":"full-commit-id"} }` |
|
||||
| `scope`, `inputs`, `effects` | Arrays of explicit nonempty strings; include full write set and runtime inputs |
|
||||
| `original_dependencies` | String array, including original-assisted portions and unavailable inputs |
|
||||
| `dependencies` | Array of other contract IDs; all must be accepted before ready/implementing |
|
||||
| `acceptance` | Array of `{ "id": "unique-criterion", "axis": "validation-scope", "criterion": "executable requirement" }` |
|
||||
| `predictions`, `stop_conditions` | String arrays of predictions and conditions that halt work |
|
||||
| `checkpoint` | `null` or `campaign/runtime/checkpoints/<id>.json` |
|
||||
|
||||
Optional `evidence` is an array of
|
||||
`{id,axis,path,sha256,source,integrated,source_binding,binaries,inputs,outcomes}`.
|
||||
`path` is an existing canonical RE-relative artifact; `sha256` hashes its actual bytes; `source`
|
||||
equals the contract's complete baseline object. Store understanding,
|
||||
implementation, original dependencies, and validation scope as separate acceptance/evidence axes.
|
||||
There is no generic `verified` scalar. Baseline commit IDs describe starting repositories;
|
||||
dirty source identity is machine-bound by `source_binding`, never inferred from those commits.
|
||||
Criteria need distinct states, branch exposure, positive execution, complete writes/elements,
|
||||
allocations/IDs/events/RNG/runtime inputs, synthetic and original-game differentials as applicable.
|
||||
The CLI checks package identity and declared axes; the independent reviewer evaluates the actual
|
||||
criteria, gate outcomes, full manifests and integrated reproduction. A passing measurement alone
|
||||
does not establish acceptance.
|
||||
|
||||
### Source-bound evidence interface (R4)
|
||||
|
||||
`source_binding` is `{engine:{path,commit,sha256},re:{path,commit,sha256}}`. Generate it with:
|
||||
|
||||
```sh
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re source-binding research-replacement --engine-worktree /absolute/candidate-engine --re-worktree /absolute/candidate-re
|
||||
```
|
||||
|
||||
Omit both worktree arguments to bind the canonical integrated trees. Paths must be Git worktree
|
||||
roots in the respective baseline repositories. `commit` is the actual current HEAD; `sha256`
|
||||
is the deterministic digest of the actual file manifest, including dirty/untracked nonignored
|
||||
files, deleted tracked paths (`null`), file bytes and Unix modes. Symlinks/submodules fail closed.
|
||||
The fixed manifest policy uses `git ls-files --cached --others --exclude-standard`; ignored
|
||||
untracked build/output files are not source. Python cache directories are excluded. In RE only,
|
||||
`verify/results/` and `campaign/` are excluded **except** `campaign/models.json`,
|
||||
`campaign/contract.schema.json`, and `campaign/agents/**`. These exclusions prevent mutable
|
||||
contracts/checkpoints/evidence/projections from hashing themselves. Relevant RE tools, tests,
|
||||
generated facts and guides remain bound. Any consumed item outside that source inventory must
|
||||
appear among immutable input/binary artifacts. The independent reviewer checks inventory adequacy.
|
||||
|
||||
`binaries` and `inputs` are nonempty arrays of `{path,sha256}` artifact references; for tooling
|
||||
contracts, bind the executable scripts/interpreter identity package and fixture input package.
|
||||
`outcomes` exactly covers the acceptance criterion IDs for that evidence axis, with entries
|
||||
`{criterion,status,artifact:{path,sha256}}`; promotion requires `status: "pass"`. Outcome artifacts
|
||||
contain positive execution, branch/state exposures, reproduction recipe and required effect/input
|
||||
accounting. The CLI checks identities, hashes and declared outcomes, **not arbitrary criterion
|
||||
semantics**. The independent verifier must reproduce and challenge those claims.
|
||||
|
||||
For example, an outcome for the bootstrap contract is:
|
||||
|
||||
```json
|
||||
{"criterion":"controls-negative-paths","status":"pass","artifact":{"path":"verify/results/controls/result.json","sha256":"<actual 64-hex artifact hash>"}}
|
||||
```
|
||||
|
||||
Capture bindings when producing evidence; do not attach a fresh source hash to old measurements.
|
||||
Every evidence/verdict/promotion check rehashes referenced sources and artifacts. Same-HEAD byte
|
||||
changes reject old evidence and verdicts. Integrated records require canonical paths, lead in
|
||||
integration state, and one identical binding across **all** final integrated evidence. A lead's
|
||||
`integrated` boolean cannot substitute for this check. Verdicts bind the full evidence array and
|
||||
the source-binding array; old verdicts lacking these identities must be reproduced.
|
||||
|
||||
This contract wrapper is separate from gate measurement schema **`sots-gate/1`**, whose `source`
|
||||
still has `engine`/`re`. Reference its immutable manifest/binary/input package; do not rename its
|
||||
fields to match contract `source`. Reporter output is measured evidence, with `--require-match`
|
||||
for required equality, and gains acceptance only through independent contract/integration gates.
|
||||
|
||||
## State and transactions
|
||||
|
||||
Every command requires `--state-root /absolute/canonical/sots-re` (the repository, not `campaign/`).
|
||||
No sibling inference. Control records stay below canonical `campaign/runtime/`; contracts remain
|
||||
in `campaign/contracts/`. Immutable hashed artifacts may be referenced anywhere inside canonical
|
||||
RE, including existing `verify/` corpora, without copying them. Absolute/traversing artifact paths,
|
||||
outside symlinks, Git internals and named secret/private-key locations are rejected; aliases are
|
||||
checked after resolution too. Never reference secrets or commit owner-supplied binaries/assets.
|
||||
JSON writes are atomic and fsynced; a canonical `flock` serializes
|
||||
CLI mutations, WIP decisions, and resource acquisition. Do not hand-edit active state concurrently
|
||||
with commands. Interrupted multi-file operations retain blocking records and require inspection.
|
||||
|
||||
Runtime APIs (JSON files; no server):
|
||||
|
||||
- `runtime/checkpoints/*.json`: `sots-checkpoint/1`, contract, actor/role/model/session, timestamp,
|
||||
contract `basis` digest, bounded summary (6000 characters), up to 32 `{path,sha256}` artifacts,
|
||||
and one `next_action` (2000 characters). Include observations versus decisions, source identities,
|
||||
tests, blockers, resources/access/cleanup, exact next action in the summary/artifacts.
|
||||
Do not attach the checkpoint's own contract as an artifact: saving the pointer changes that
|
||||
file. Its task metadata is already covered by `basis`; the CLI rejects this self-reference.
|
||||
- `runtime/surprises/*.json`: `sots-surprise/1`, id, contract, `status: open|resolved`, summary,
|
||||
discriminating probe, actor/model/session provenance where applicable, optional decision ID.
|
||||
- `runtime/decisions/*.json`: `sots-decision/1`, Astra resolution, explanation/probe, invalidated
|
||||
evidence and checkpoint; prior verdict is marked invalidated. Resolution returns needs-revision
|
||||
only when all surprises are closed. Re-probe and rebuild evidence; resolution is not acceptance.
|
||||
- `runtime/verdicts/<contract>.json`: independent verifier actor/session/model, pass/fail,
|
||||
explanation, contract basis, complete evidence digest and source-bindings digest.
|
||||
- `runtime/transitions/*.json`: actor/model, previous/next lifecycle state, timestamp.
|
||||
- `runtime/leases/<resource>.json`: owner, random token, held/released, acquisition/release provenance.
|
||||
- `runtime/runs/run-*.json`, `.jsonl`, `.stderr.log`: requested model/config, command, worktree
|
||||
manifests before/after, expanded prompt hash, effective configuration hashes, canonical config
|
||||
file hashes, actual events/session/model when emitted, completion/checkpoint status. Effective
|
||||
provider config is hashed rather than persisted because it can contain credentials.
|
||||
`active-<contract>.json` reserves the contract. Interrupted running reservations never auto-expire.
|
||||
|
||||
Lifecycle: `proposed -> ready -> implementing -> verification -> integration -> accepted`.
|
||||
Blocked and needs-revision edges support repairs; no skipping stages. Ready requires scope,
|
||||
inputs, acceptance, stop conditions, valid pinned baseline and accepted dependencies. Implementing
|
||||
is atomically capped at two concurrent contracts; lead schedules only one pilot before enabling
|
||||
two independent slices. Verification requires fresh checkpoint/artifacts after implementation start.
|
||||
Integration requires lead plus independent passing verifier bound to current source/evidence.
|
||||
Accepted requires every declared axis in integrated evidence, passing independent verdict over
|
||||
that final package, and no open surprises. Adding integrated evidence changes the evidence digest:
|
||||
the verifier must attest the integrated package again. Handoff/promotion/end checkpoints must be
|
||||
within 15 minutes; recovery start has no age limit.
|
||||
|
||||
Role/model registry: lead/architecture-review/analyst/implementer/verifier/lab =
|
||||
`openai/gpt-5.6-sol`; resolver = `openai/gpt-6-astra`.
|
||||
CLI identity fields are **claims, not authenticated model authority**. The runner requests the
|
||||
registry model explicitly and records emitted provenance. Editable JSON, agent permissions and
|
||||
shell-accessible tooling are not a security boundary. No silent routing fallback.
|
||||
|
||||
## Commands
|
||||
|
||||
Run from either repository using the canonical tool path when necessary. Examples:
|
||||
|
||||
```sh
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re validate
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re list
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re status research-replacement
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re checkpoint controls-bootstrap --actor controls-architect --role architecture-review --model openai/gpt-6-astra --session rollout-controls --summary 'Source identities, observations, decisions, tests and blockers are in the attached checkpoint.' --artifact campaign/rollout/controls-worker-state.md --next-action 'Run the independent controls review.'
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re transition controls-bootstrap ready --actor controls-architect --role architecture-review --model openai/gpt-6-astra
|
||||
```
|
||||
|
||||
`surprise CONTRACT --summary TEXT --probe TEXT` blocks immediately. `resolve SURPRISE_ID
|
||||
--explanation TEXT --probe TEXT` requires claimed Astra lead/resolver. Both also require
|
||||
`--actor NAME --role ROLE --model MODEL`. `evidence CONTRACT --record campaign/path.json`
|
||||
uses the same identity flags; record format is the evidence object above. Integrated records
|
||||
require lead and integration state. `verdict CONTRACT --session SESSION --verdict pass|fail
|
||||
--explanation TEXT` requires verifier identity flags and independent actor/session.
|
||||
|
||||
```sh
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re lease acquire windows-vm --actor lab-one --role lab --model openai/gpt-5.5
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re lease show windows-vm
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re lease release windows-vm --actor lab-one --role lab --model openai/gpt-5.5 --token TOKEN_FROM_ACQUIRE
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re lease release windows-vm --actor lead --role lead --model openai/gpt-6-astra --lead-release --reason 'Confirmed prior operator stopped; access and cleanup checked.'
|
||||
```
|
||||
|
||||
No stale lease stealing. Explicit lead release requires an explanation and lab preconditions,
|
||||
side effects, cleanup, and access verification in the operator checkpoint. Treat lease tokens
|
||||
as local owner capabilities, not secrets to put in a board/dashboard.
|
||||
|
||||
## Fresh bounded launches
|
||||
|
||||
Prepare **two actual linked worktrees**, each distinct from its canonical source repository,
|
||||
at the contract's full baseline commit. No auto commits/worktree creation. Launch uses explicit
|
||||
canonical `OPENCODE_CONFIG`, checks matching repo-local agent/model/40 steps, and sets the final
|
||||
environment overlay to bind requested role/model/steps. Other inherited config overrides are
|
||||
cleared. `opencode models` must list the exact requested model even for dry runs.
|
||||
|
||||
```sh
|
||||
python3 tools/run_agent.py --state-root /home/alex/sots-re --role implementer --actor worker-one --contract slice-one --engine-worktree /home/alex/worktrees/slice-one-engine --re-worktree /home/alex/worktrees/slice-one-re --cwd engine --dry-run
|
||||
```
|
||||
|
||||
Remove `--dry-run` to execute. Normal worker launch requires a valid durable checkpoint, matching
|
||||
owner/role/status, no open surprises, baseline HEADs and canonical Git common-directory identity.
|
||||
Recovery checks checkpoint identity/basis and artifact hashes regardless of age, rechecks any
|
||||
source-bound evidence, and validates paired Git worktree/baseline identity. Missing ordinary-worker
|
||||
state still blocks. Bootstrap lead/architecture-review can start without a checkpoint; they still
|
||||
need paired worktrees. Astra lead/resolver may launch a blocked contract with open surprises and
|
||||
without a worker checkpoint in **resolution-only** scope: read evidence and write decisions/state,
|
||||
no implementation. Its prompt and permission overlay carry that limit, and worktree source changes
|
||||
fail completion. Ordinary affected workers stay blocked. Other Astra architecture actors receive
|
||||
explicit architecture authority within their owned scope. Each run is a fresh
|
||||
`opencode run --format json --model ... --agent ...`; no resume/continue option is used. The prompt
|
||||
supplies the run ID to use as checkpoint `--session`; actual OpenCode session IDs are captured
|
||||
separately when emitted. On exit, a checkpoint after start matching actor/role/model/run ID is
|
||||
mandatory or the run is marked incomplete. Completion additionally requires a zero exit, no
|
||||
`type:error`, a successful `step_finish` with `part.reason: "stop"`, one nonempty actual session ID,
|
||||
and consistent explicitly emitted model IDs. Text/tool-call/length events alone cannot complete a
|
||||
run. Missing model emission is recorded `observed_model_status: "unavailable"`, never invented.
|
||||
|
||||
The runner checks the exact Git baseline again under reservation lock, rejects intervening contract
|
||||
changes, and checks canonical model/prompt/config files and effective configuration for drift at
|
||||
completion. Expanded role prompt/model/steps are frozen in the last-layer environment overlay.
|
||||
`opencode debug config` runs in the actual launch cwd with the actual environment before execution
|
||||
and again at completion. Permissions explicitly allow read/search, ordinary worker shell commands,
|
||||
and external-directory access to the assigned paired trees plus canonical RE; role-specific edit
|
||||
denies survive. Task delegation and interactive questions are denied. No `--auto` is required.
|
||||
Noninteractive command/environment tests and a live loader check cover this overlay; an actual
|
||||
normal worker launch smoke is a separate lead integration check. Permissions and before/after
|
||||
checks are operational guards, not a sandbox or continuous filesystem audit.
|
||||
Compaction is a backstop; no token threshold or machine-enforced 20-tool-call claim.
|
||||
|
||||
## Local verification
|
||||
|
||||
```sh
|
||||
python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v
|
||||
python3 tools/campaign.py --state-root /home/alex/sots-re validate
|
||||
```
|
||||
|
||||
Tests create commits only in disposable fixture repositories, linked worktrees and fake OpenCode processes; they do
|
||||
not launch agents or touch the lab. Historical rollout artifacts retain the scope and source identity
|
||||
of their runs; consult the accepted contract and current evidence, not an old handoff's status prose.
|
||||
15
campaign/agents/analyst.md
Normal file
15
campaign/agents/analyst.md
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
You are the SOTS RE analyst. Read canonical RE AGENTS.md, campaign/README.md, your contract,
|
||||
checkpoint and open surprises. Follow the launcher-selected model; never choose a fallback.
|
||||
Recover one bounded behavior: complete inputs, predicates, ordering, precision, allocations,
|
||||
transitive writes, container elements, event records and RNG. Distinguish static facts, measured
|
||||
observations and hypotheses. Use domain findings as evidence, not unquestioned specifications.
|
||||
|
||||
Specify original-helper dependencies and missing runtime inputs. Work with the independent
|
||||
verifier on falsifiers and distinct-state/branch coverage. Synthetic boundary fixtures are useful;
|
||||
coherent parsing alone cannot prove field semantics. Do not promote your own claim.
|
||||
|
||||
Own only assigned files/worktrees. No architecture/planning changes, delegates, dashboard writes
|
||||
or unleased Ghidra/VM mutations. A surprise that changes scope or standing claims blocks the
|
||||
affected work and goes to Astra with concrete evidence and a proposed discriminating check.
|
||||
Checkpoint every 20 calls/15min and before compaction, experiment, handoff or stop. A bounded
|
||||
40-step session ends with a repository checkpoint, exact next action and held-resource inventory.
|
||||
14
campaign/agents/implementer.md
Normal file
14
campaign/agents/implementer.md
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
You are the SOTS implementation engineer. Read canonical RE AGENTS.md, campaign/README.md,
|
||||
your ready contract/checkpoint, and engine CONTRIBUTING.md/docs/architecture.md. Implement only
|
||||
the approved input/effect domain. Keep reusable rules outside live-process adapters. Do not
|
||||
replace unknown inputs with zero, hide original-helper execution or update counts without records.
|
||||
|
||||
Preserve RNG values/save layout and declared numeric precision. Write meaningful negative and
|
||||
boundary tests, then execute the required checks. Never certify your own fidelity. Provide the
|
||||
independent verifier source identity, full commands, input/artifact hashes and residuals.
|
||||
|
||||
No architecture changes, scope expansion, nested delegates, shared status writes, automatic
|
||||
commits/pushes or unleased remote operations. Unexpected evidence changing the plan goes to Astra
|
||||
via a surprise record; fix ordinary in-contract implementation bugs yourself.
|
||||
Checkpoint every 20 calls/15min and before compaction, experiment, handoff or stop. End a 40-step
|
||||
quantum with exact changed files/tests/next action persisted to canonical RE, not only chat.
|
||||
15
campaign/agents/lab.md
Normal file
15
campaign/agents/lab.md
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
You are the SOTS lab/workload operator. Read canonical RE AGENTS.md, campaign/README.md, the
|
||||
contract/checkpoint, relevant infrastructure instructions and current leases. Confirm actual guest
|
||||
identity and live activity; old FREE text is not ownership. Acquire a lease before mutation.
|
||||
|
||||
Capture controls before instrumented runs. Record procedure including load-versus-continuation,
|
||||
source/binary/config/input hashes, branches that fired, distinct states and output artifacts.
|
||||
Preserve raw output and positive execution evidence. Never infer a run succeeded from quiet logs.
|
||||
Run only the assigned workload. Do not change FPU/game/config settings outside the experiment.
|
||||
|
||||
For authorized housekeeping preserve game/assets/saves, guest agent, networking, runtimes,
|
||||
graphics and lab tools. Verify unattended console login plus authenticated administration; no
|
||||
blank passwords or secrets in logs/repositories. Reboot only free guests with recorded recovery.
|
||||
Unexpected interference or access changes go to Astra before broadening work. No delegates.
|
||||
Checkpoint every 20 calls/15min and before compaction, experiments, reboots, handoff or stopping.
|
||||
At a 40-step boundary persist per-VM status, held leases, artifacts and exact next action.
|
||||
22
campaign/agents/lead.md
Normal file
22
campaign/agents/lead.md
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
You are the SOTS lead/integrator, running GPT-5.6 Sol. Read AGENTS.md, campaign/README.md,
|
||||
guides/multi-agent-workflow.md, selected contracts, latest checkpoints and open surprises.
|
||||
State lives in the explicitly selected canonical RE repository. Do not reconstruct it from chat.
|
||||
|
||||
Own architecture, task boundaries, model allocation, independent acceptance and integration.
|
||||
Select work by dependencies unlocked and complete write sets, not row/leaf counts. At most two
|
||||
implementation slices after the pilot. Delegate through tools/run_agent.py with explicit role,
|
||||
contract, state root and paired worktrees. No nested worker delegation or implicit model fallback.
|
||||
Validate model availability before assigning work. Astra problem-resolution sessions are
|
||||
allowed when explicitly allocated. Keep exclusive file and resource ownership clear.
|
||||
|
||||
Write acceptance before implementation. Require independent verification and integrated source-
|
||||
bound evidence. Only you publish current pointers/projections. Never promote a historical claim
|
||||
without the stated workload, identity, coverage and reproduction. Host passed != full acceptance.
|
||||
|
||||
Handle surprises as experiments: record evidence, block affected work, examine instrument/source
|
||||
identity, list surviving/qualified/overturned claims, choose one discriminating check, update
|
||||
contracts and invalidate affected results. Do not hide contradictions in appended caveats.
|
||||
|
||||
Checkpoint every 20 tool calls/15min and before compaction, experiments, handoff or stop. At a
|
||||
40-step quantum boundary persist exact next action and finish; next session resumes from RE state.
|
||||
Follow explicit user authorization for commits/pushes; this rollout authorizes neither.
|
||||
14
campaign/agents/resolver.md
Normal file
14
campaign/agents/resolver.md
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
You are the SOTS resolver, running GPT-6 Astra. Read canonical RE AGENTS.md, campaign/README.md,
|
||||
the surprise, affected contracts, checkpoints and raw evidence. First state the observation and
|
||||
its provenance. Check source/binary/input identity, positive execution and instrument neutrality
|
||||
before interpreting game behavior. Do not diagnose a stale build as a game mechanism.
|
||||
|
||||
For every affected claim record survives / qualified / overturned and exact domain. Name the
|
||||
cheapest discriminating experiment, revised scope/dependencies and affected evidence that must
|
||||
be invalidated. Resolve through campaign controls with a durable Astra decision. Never silently
|
||||
waive acceptance or treat untested inference as measurement. Leave blocked work blocked until
|
||||
the decision supplies a valid next action. No autonomous lab mutation or nested delegation.
|
||||
|
||||
Checkpoint every 20 calls/15min and before compaction, handoff or stop. Use short bounded sessions;
|
||||
the repository carries decisions, not chat memory. Do not create another explanatory history in
|
||||
the live board: link the actual decision and regenerate projections after integration.
|
||||
16
campaign/agents/verifier.md
Normal file
16
campaign/agents/verifier.md
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
You are the independent SOTS verifier, a separate execution from the implementation author.
|
||||
Read canonical RE AGENTS.md, campaign/README.md, the contract, raw evidence and checkpoint.
|
||||
Challenge the interpretation, boundary and instrument, not just the implementation syntax.
|
||||
Before coding starts define falsifiers, required branch exposures and distinct states. Afterward
|
||||
reproduce from the handoff alone and challenge at least one assumption with a held-out workload,
|
||||
boundary, negative control or ablation. Check actual state/RNG independently of reported counters.
|
||||
|
||||
Reject missing/invalid inputs, zero execution, unexpected skips, truncated coverage, stale binary
|
||||
identity and self-certified evidence. Separate original-assisted, partial compare, full compare,
|
||||
independent replacement and integrated replay. Whole-state equality on one workload has that
|
||||
workload's scope. Record failed predictions and residuals without converting them into success.
|
||||
|
||||
Own verification artifacts only; no edits to implementation to make tests pass, architecture
|
||||
changes, delegates, shared status or unleased lab actions. Plan-changing surprises require Astra.
|
||||
Checkpoint every 20 calls/15min and before compaction, experiments, handoff/stop. Finish each
|
||||
40-step quantum with reproduction commands/results and exact next action in canonical RE.
|
||||
|
|
@ -1,265 +1,32 @@
|
|||
# Roadmap
|
||||
# Campaign plan
|
||||
|
||||
Groomed 2026-09-08. Replaces the phase-0/phase-2 backlog, all of which shipped. The board
|
||||
(`board.md`) is the ledger of findings; this is the plan. **The product is `sots-engine` — our
|
||||
code.** RE findings are inputs to it, and the measure of progress is how much of the game runs in
|
||||
our engine, verified against the original. Every number here is measured; the source is named.
|
||||
Goal: a behavior-equivalent engine reading owner-supplied original assets. The next end-to-end
|
||||
milestone is a strategic turn reproduced under an explicit load/continuation procedure and
|
||||
recorded command stream, with file-byte, inflated-byte and state equality reported separately.
|
||||
|
||||
## 1. The engine today (`sots-engine` main, ~33k LOC, ctest 46/46, 1,031 addresses, clean-room, MIT)
|
||||
## Priority order
|
||||
|
||||
| module | LOC | what it is | verification |
|
||||
|---|---:|---|---|
|
||||
| `mars/parse`, `mars/text` | 1,774 | brace-block + flat-KV + CSV readers (the `Mars::Script` pull tokenizer, first-wins keys) | oracle 1,531/1,531 + 64/64 |
|
||||
| `mars/vfs` | 788 | `.gob` ZIP + native-override VFS (the `./Mods` mechanism) | 10,268 files CRC-clean |
|
||||
| `mars/stream` | 5,407 | save reader/writer, 386-class wire schema, `SchemaProbe`, `CoverageArchive` | **100% named coverage, byte-identical round-trip, 11 saves** |
|
||||
| `mars/rng` | 244 | MT19937 + all seven entry points (`NextFloat/NextInt/Chance/NextUInt/FloatRange/IntRangeBell/GaussianRange`) | live: every draw of a turn attributed |
|
||||
| `game/data`, `game/design`, `game/config` | 3,835 | weapons/sections/tech/strings catalogs, design rules, hull class, tuning | 229,042 values 0 diffs; 127/127 designs |
|
||||
| `game/effects`, `game/events` | 1,531 | tech effects, `EventStorage` (turn-bucketed, dedup) | live: research slice 35 calls / 0 div |
|
||||
| `game/sim` | 3,382 | economy (`ComputeBudget`, output term), research + unlock cascade, colony, movement | live: budget 4,437 / output 24,357 / research 35 / movement 45 calls — all 0 div on declared regions |
|
||||
| `game/nav`, `game/combat` | 1,163 | route classifier + failure bits; retreat **planner** | offline vs 58 waypoints / 46 plans, 0 failures; retreat never instrumented |
|
||||
| `app` (`sots_turn`) | 1,754 | **the standalone**: load save → walk all three drivers' phase order → write save; divergence + completion metric | 11/11 saves run; ref pair **209 → 158** leaves, closed 51 / regressed 0 |
|
||||
| `shim` | 769 + hooks | proxy `binkw32.dll` + MinHook trace/compare/replace harness — **scaffolding, to be displaced** | it is the instrument, not the product |
|
||||
1. **Establish rollout baseline.** Finish campaign controls, source-bound gate and reporter,
|
||||
honest execution accounting, and generated publishing. Select reproducible evidence explicitly
|
||||
in `current.json`; missing baseline means not established. Independent reproduction and
|
||||
integrated-tree evidence precede acceptance.
|
||||
2. **Complete research write-set replacement pilot.** Proposed/blocked until its contract has
|
||||
executable acceptance criteria, complete inputs, workload/branch exposures, and lease/control
|
||||
evidence. Include tech-tree writes, player effects, container elements, allocations, IDs,
|
||||
events and RNG state. Existing compare runs and partial replacement attempts are historical
|
||||
evidence, not a completed pilot. Start with [research findings](../findings/subsystems/research-replace.md).
|
||||
3. **Command payload semantics and ship construction.** After the pilot, admit at most two
|
||||
independent slices with explicit dependencies and paired worktrees. Resolve runtime inputs,
|
||||
complete command payload effects, construction allocations/IDs and write boundaries before
|
||||
interpreting a replay result. See [construction findings](../findings/subsystems/ship-construction.md).
|
||||
4. **Recorded-command standalone replay.** Reproduce explicitly identified workload pairs with
|
||||
bound commands, assets, route, seeds and visit order. Report residuals and original dependencies;
|
||||
consuming a stream or parsing a save is not behavioral equivalence.
|
||||
|
||||
What the engine can do end to end today: read every shipped asset and every save byte-for-byte,
|
||||
run the economy/research/movement/output pieces to the original's numbers, and step a turn with
|
||||
**16 of 44** driver phases and **5 of 37** tail phases modelled (10 committed). It cannot yet
|
||||
reproduce a turn.
|
||||
## How work advances
|
||||
|
||||
## 2. The milestone, restated — 2026-09-09 (after the determinism arc)
|
||||
|
||||
> `sots_turn` loads a save, runs one strategic turn, and writes an autosave that byte-matches
|
||||
> the original's — **for a stated procedure and route**.
|
||||
|
||||
Two days of lanes went into determinism and the foundation is now laid. What is *measured*:
|
||||
|
||||
- **The sim is deterministic given the command stream.** Every draw of a turn attributed by
|
||||
return address; the strategic generator's residual is 0 on every measured turn.
|
||||
- **The AI is deterministic given (seeds, visit order).** Its per-process seed is one word per
|
||||
client, minted from the global generator — which does *nothing else* on an encounter-free turn.
|
||||
Pinning the seeds collapses a rich turn's divergence from 94 leaves to **one transposition**, and
|
||||
that transposition is the **order of two heap pointers**: the fleet-assignment pass walks a
|
||||
container keyed on `fleet->Location`. There is **no original order to match**; we choose one
|
||||
member of its outcome set and say so (`orders.h`). The visit order is *written into the block*
|
||||
(list 10), so a captured run carries its own.
|
||||
- **The route is part of the procedure.** The same turn reached by continuation and by load gives
|
||||
different, individually reproducible results, because a `Colonize` task alive in the AI agent by
|
||||
continuation is *absent* after a load. Certified pairs live in `verify/results/saves/certified-pairs.md`
|
||||
as `(save, procedure, route, hashes, processes, masks)`; a hash without its route is not a claim.
|
||||
- **Exposure is a screen, not a decision procedure** (rule 26(c)): it says a control is *likely* to
|
||||
vary; it cannot certify one will agree.
|
||||
|
||||
**So the rungs stand as written below, with one scope line each:**
|
||||
|
||||
- **Rung A** — byte-match modulo the command stream, **on a load→turn procedure**. Canonical pair
|
||||
`ref-turn2 → turn3`. 204 leaves open; the RE for them is done (§3-old items 1b/1c/7).
|
||||
- **Rung B** — byte-match given the recorded stream. **Climbed to outcome 3 on the first rich turn
|
||||
(lane CV):** the replay runs and consumes the whole stream; the result is a **ranked leaf list of
|
||||
thirteen named subsystems, zero ungrouped** — 1,092 leaves. Two blockers sit *upstream* of the
|
||||
turn (§3, track 0). The tail's sim draw fires on this workload (`tscr = 253`), so Rung B needs
|
||||
the same generator model as Rung A — that correction is load-bearing here.
|
||||
- **Rung C** — `game/ai` deterministic given (save, seeds, visit order). **C-exact survives
|
||||
literally** on that basis; the comparison side (`--relabel-new-ids`) ships with both acceptance
|
||||
halves. The engine side is not built: `game/ai` mints no fleet ids yet.
|
||||
|
||||
**What stops now.** Further RNG/determinism lanes, unless a rung is actually blocked by one. Board
|
||||
row count as a success signal — 89% of 444 rows measures campaign activity, not the product. The
|
||||
value-domain census as a work generator — it is a screen; use it when a lane needs a corpus count.
|
||||
|
||||
**What the headline is.** Displacement (`tools/displacement.py`): **3 replaced / 7 compared /
|
||||
7 modelled / 3 mapped**, unmoved for two days. And the phase catalogue: 14 of 44 driver phases,
|
||||
2 of 37 tail. Those two numbers are the product.
|
||||
|
||||
## 2-old. The milestone as restated 2026-09-08 (kept for the record)
|
||||
|
||||
> `sots_turn` loads a save, runs one strategic turn, and writes an autosave that byte-matches
|
||||
> the original's.
|
||||
|
||||
**Lane L5 showed the original cannot always do this itself.** Three runs of `turn1-state → turn2`
|
||||
gave three different autosaves, differing in exactly four leaves — one AI empire's research pick and
|
||||
the derived checksum — with the instrument exonerated (two runs had identical hooks and still
|
||||
differed; `hooks=off` was a third value). The oracle stands on `ref-turn2 → turn3`, where every AI
|
||||
already holds a target; it fails on the neighbour, where three AI players must *choose* one.
|
||||
|
||||
This is not a contradiction of the lockstep multiplayer design — it is the reason for it. The AI is a
|
||||
`StrategyClient`, not part of the sim: it decides **once**, on one machine, and its decisions travel
|
||||
as `TurnCommands` through the same host relay as a human's. Peers reproduce the sim's response to a
|
||||
command, never the decision. The sim is deterministic (lane Z's zero-residual ledger is the strategic
|
||||
generator, which the AI never touches); the decision layer is not, and does not need to be.
|
||||
|
||||
So the rungs are:
|
||||
|
||||
- **Rung A — byte-match modulo the command stream.** Every leaf except `ModCount`,
|
||||
`Summary.Checksum`, and what the AI's own orders touch. No AI needed. **Canonical reference pair
|
||||
is now `turn2-state → turn3-state`** — deterministic, oracle-hashed. `turn1-state → turn2` stays
|
||||
as a secondary pair with its four non-deterministic leaves masked.
|
||||
- **Rung B — byte-match given a recorded command stream.** `sots_turn --turn-commands <blocks>`
|
||||
replays the AI's (and human's) orders captured from a real turn, and the output must match that
|
||||
turn's autosave byte-for-byte. This is what "the engine is the game" means when the game's own
|
||||
decision layer is not reproducible from a save. Lane AI1's fallback becomes the primary path.
|
||||
|
||||
**Correction 2026-09-09.** I previously told lane RB that Rung B was insulated from the strategic
|
||||
generator "because replay runs no AI". That was wrong, and the resolver caught it. Replay **does**
|
||||
run the post-combat tail (`command_replay.h:83`), and lane AC has now measured a **sim** draw in
|
||||
that tail — on `S+0x16c`, gated on a predicate over save fields, nothing to do with the AI. So
|
||||
**Rung B needs the same generator model as Rung A**: the tail's draws are ours to reproduce in
|
||||
both. The canonical pair is untouched by the predicate (`tscr = 252`, no fleet at a trade sector),
|
||||
so nothing already measured is invalidated — but a replay of any raid turn would have diverged
|
||||
silently under the reasoning I gave.
|
||||
- **Rung C — `game/ai` as a deterministic function of (save, per-client seed).** The original's AI
|
||||
is not non-deterministic: it is MT19937 from **one 32-bit word per AI client**, drawn once at
|
||||
construction from a per-process global generator — and that generator is one we already own bit
|
||||
for bit. Two strengths:
|
||||
- **C-exact.** Given the seeds captured from an original run (`sots_turn --ai-seed <netid>=<hex>`),
|
||||
our AI's block equals that run's block element for element and the autosave byte-matches, on
|
||||
**every** captured run. This is the user's framing made literal: make the AI deterministic and
|
||||
the old approach still pays. **Precondition:** `game/ai` must consume the client stream in the
|
||||
original's order and count, *including draws whose result never reaches the save* — a per-client
|
||||
draw ledger is the prerequisite (the site table already shows ~8 words/turn on these boards).
|
||||
- **C-set.** Where seeds were never captured — the historical `turn2-state.sav`, which **no
|
||||
process including the original can reproduce** — our canonical pick must be a member of the
|
||||
outcome set of the one seed-sensitive decision. Lane L4 has the XNC arm (k = 6, four observed,
|
||||
all inside) and **one arm unaccounted for (`BIO_GnMod`, 2 of 6)**, so "we can name all k" is
|
||||
**to prove**, not proved. The set is the support of a random draw, not a set of equal-score
|
||||
candidates.
|
||||
|
||||
Mechanism, **measured** (lane L1, not inferred): the per-client generator at `StrategyClient+0x134`
|
||||
is seeded from `NextUInt` on the global generator at `0x00af6e58`, which is **live and per-process**;
|
||||
the seed is in no save. Only one of three empires *shows* the effect because only one reaches the
|
||||
candidate walk (lane L4) — the other two are stream-insensitive **by code path**. My earlier
|
||||
"pointer-ordered tie under ASLR" inference was wrong and is **withdrawn**.
|
||||
|
||||
Rung B is unaffected: `--turn-commands` replay stays the no-AI path, and the canonical pair stays
|
||||
`turn2-state → turn3-state` until the pin probe promotes the creation turn.
|
||||
|
||||
## 3. The plan — three tracks, in priority order
|
||||
|
||||
### Track 0 — make the gate honest, then clear the two upstream blockers
|
||||
|
||||
The gate reported 59/59 for a day while the corpus tests **skipped** (`SOTS_SAVES_DIR` unset on
|
||||
CT111). With the corpus it is **57/59**: the coverage ratchet broke when the corpus grew 22 → 43
|
||||
(rule 27, as designed), and a writer defect appeared. `tools/gate.sh --fresh` is now the gate and
|
||||
it fails if a corpus test skips.
|
||||
|
||||
| # | item | module | evidence | why first |
|
||||
|---|---|---|---|---|
|
||||
| 0a | **`ProjectName` reads `usnc` as one item; the wire is a `usp`/`usc` pair.** 12 of 43 saves round-trip 12 bytes short. | `mars/stream` | lane CV; `ad-turn27` has `usnc == 1` | no byte-match claim is possible on the `ad-*`/`ar-*` family until the writer is exact; re-prove byte-neutrality after |
|
||||
| 0b | **Re-type what the ratchet caught** — the spy saves (`ap-*`) and whatever else dropped `pct` below 99.99. | `mars/stream` | `tools/gate.sh` output | the ratchet did its job; honour it |
|
||||
| 0c | **List-5 applier cannot fire** because the memory capture cannot type 7 of 8 fields. One UI run (two sliders, two values) settles it. | shim capture | lane CV | the only list with an applier, at zero |
|
||||
|
||||
### Track 1 — displacement: `compared → replaced`, then `modelled → compared`
|
||||
|
||||
**Pick the replace unit by its WRITE SET, not by its name.** Lane CR's failure is the rule's
|
||||
source: our code replaced `ProcessResearch` and produced **all 13** tech-tree leaves the turn moves
|
||||
— the model was right — and the oracle still missed by 16, every one written by
|
||||
`OnTechResearched`, a neighbouring function. A replace boundary that splits a write set cannot
|
||||
pass an oracle no matter how correct the model is. So before attempting one, enumerate the leaves
|
||||
the turn moves in that area and ask which functions write them; if the answer is more than one,
|
||||
the unit is the union or the attempt is wasted. The compare mode's guard spans already name the
|
||||
write set — CR's five spans predicted exactly the five fields the oracle later billed.
|
||||
|
||||
Only `replaced` means the original's code did not run. The bar, written once: an un-instrumented
|
||||
oracle first (`certified-pairs.md` format), then the same procedure with the hook in `replace`
|
||||
mode and the **same hashes**, with a count from the hook proving the path executed (rule 1).
|
||||
|
||||
| # | module | today | evidence for the attempt | target |
|
||||
|---|---|---|---|---|
|
||||
| 1a | `TechTree::ProcessResearch` + unlock cascade | compared | 35 calls / 3 workloads / 0 div; advance prediction held on a changed workload | **stays `compared`** (lane CR, 2026-09-09): our code displaced all 13 tech-tree leaves live, oracle missed by **16**, every one written by `OnTechResearched` — a different function. Next: the write-back |
|
||||
| 1b | `ServerSystem::ComputeTotalOutput` + `GroupOutput` | compared | 24,357 calls, 0 undeclared writes — but **13 distinct states** (rule 23) | replaced, after widening the state set |
|
||||
| 1c | `ServerSystem::ProcessTurn` (colony) | compared | 36 calls 0 div; 3 owned systems, gates all zero | replaced, on a save with gate traffic |
|
||||
| 1d | `game/nav`, `game/design`, `game/combat` retreat, `mars/vfs` | modelled, **never hooked** | host-tested only | compared — one lane each |
|
||||
|
||||
**Ruling (2026-09-09, on lane CR's policy question).** Reaching `replaced` on research needs two
|
||||
event *records* whose text comes from the game's string table. That text is **game data**, not
|
||||
engine code: the engine already reads every catalogue, tech name and design from the user's own
|
||||
install through `$SOTS_DATA_DIR` / the VFS, and a string table is no different. So the answer is
|
||||
**not** "call the game's `PostEvent` and take a QUALIFIED caveat" — it is **load the string table
|
||||
through the same VFS path everything else uses** and construct the record clean. We ship no
|
||||
strings; the user's copy supplies them. That is the same clean-room posture as every other data
|
||||
dependency, and it turns the last research residual into ordinary engine work rather than a
|
||||
policy exception. Track 1a, next lane: `OnTechResearched` write-back (~90 tech-effect fields) +
|
||||
`ObservedTech` element + the two event records via the VFS string table.
|
||||
|
||||
### Track 2 — Rung B worklist, ranked against a real rich turn (lane CV, residual 0)
|
||||
|
||||
| leaves | subsystem | note |
|
||||
|---:|---|---|
|
||||
| 539 | morale event ring `cme2` | **not a module** — a fixed 11-slot ring shifted by 27 appended events of three kinds (colonisation, savings band, population). It is the reporting surface of the next three rows and closes when they do |
|
||||
| 154 | colony growth / repair / bonuses | §3-old 1b/1c — `Pv*` is **mixed**: `PvPop`/`PvInfra` hold the uncapped projection, `PvSuit`/`PvRes` the pre-turn current |
|
||||
| 150 | fleet objects | needs the gather/mint (Rung C engine side) |
|
||||
| **79** | **`T34 RecordObservedDesigns`** | **largest independently closable stub, no upstream dependency — do this one first** |
|
||||
| 30 | player money + counters | §3-old item 1 chain |
|
||||
| 23 | `TShn` | watchpoint specified (§3-old 4) |
|
||||
| 23 | system↔fleet membership | with fleet objects |
|
||||
| 20 / 20 / 15 / 13 / 10 / 8 / 6 | ShipRecs · build queues · other system · crep/CD · id lists+generator · turnstats · trade manager | |
|
||||
| 5 of 6 regressions | one `ntdev` predicate | cheapest fix in the list |
|
||||
|
||||
`ModCount` residual 2 is localised to lists 1/7/12; the only uniform reading is list 7 at 2 bumps —
|
||||
a prediction fitted to one observation, falsified by any capture with a colonize count ≠ 2.
|
||||
|
||||
### §3-old — Rung A leaf ranking (still valid for the items it names)
|
||||
|
||||
| # | engine deliverable | module | RE input (done unless noted) | closes |
|
||||
|---|---|---|---|---|
|
||||
| 1 | ~~income chain~~ / ~~`ComputeOutput` turn path~~ **BOTH DONE** (lanes E1, C3) — the oracle hit 25/25 and the turn path is modelled (+1 leaf, 0 regressed; unspent construction cascades **two hops** into money). **The blocker moved upstream: `S11` civilian growth.** One input — imperial carrying capacity — gates the human's `Sav`, `PvSav`, `BnkEl` and `BnkPr` on both pairs. | `game/sim` | lanes E1/C3 | the budget leaves + unblocks T36 |
|
||||
| 1b | **`S11` civilian growth** — the new item 1 | `game/sim` | needs imperial carrying capacity | the human budget cluster |
|
||||
| 1c | **`Ship::RepairCost` 0x00815180** — the ninth output input, unread; taken as 0, so a colony with a damaged fleet reads high | `game/sim` | unread | output accuracy |
|
||||
| 2 | ~~wire `ShipCensus` + alliance mask into `BuildTurnRecord`~~ **DONE** (lane E2). T36 still blocked on two named things: the budget (item 1) and **ship construction** — a new blocker found by E2's *falsified* prediction (one census leaf short by exactly one destroyer on both pairs; no phase we run builds a ship). | `app` | lanes D2/A2 | +24 turnstats leaves when item 1 lands |
|
||||
| 3 | **encounter-detection draws** in the generator model | `game/sim` + `app` | lane I bound; **lane H measuring now** | last 2 RNG words |
|
||||
| 4 | ~~`nve` visibility record~~ **DONE** (lane E3): **closed 51, regressed 0** on the reference pair; validated on three pairs it was never fitted to — 128 leaves across five pairs, 0 regressed. The gate is `AFlags`, not `VFlags`/`EFlags`, and all three agree on nearly every corpus system so the wrong one *looks right*. Remainder: `TShn` (10/pair, gate proven NOT `AFlags`, watchpoint specified), `rcex` (6/pair, unexplained). | `game/sim` | lane E3 | **51 leaves closed** |
|
||||
| 5 | **post events into the save's turn bucket** (P11 + tail event phases) | `app` + `game/events` | model exists; wiring only | events subtree |
|
||||
| 6 | ~~`Player.Status` restore~~ **PREMISE REFUTED** (lane T2): there is **no writer between tail 31 and the autosave**. A whole-image scan finds three stores to `+0x164` — `ProcessTurn`'s encounter loop writes 1, `ResumePlaying` writes 0 on load, and `MarkPlayerTurnEnded` writes 4 from the End-Turn **submission** paths, *before* the turn runs. It needs **one predicate**, not a watchpoint — and only two corpus saves carry a non-zero `Status`, so an entry probe should name the set (rule 20). | `app` | lane T2 | S31 regression |
|
||||
| 7 | **tail phases** — bankruptcy decision half, turn results outbox swap, per-player sync | `game/sim` + `app` | lane K map; 34/37 stubs | tail subtree |
|
||||
| 8 | Rung B: **`--turn-commands` replay** from a captured block (then Rung C: `game/ai` behavioural equivalence) | `app`, then `game/ai` | lanes AI1–AI4, L4 | `ModCount`, Checksum given the stream |
|
||||
|
||||
Rules that hold for every item: formula-held-inputs-missing is **evaluated and reported, not
|
||||
written**; `closed` and `regressed` reported separately, never netted; `verified` in the phase
|
||||
table means compared against the live game and the build fails if it drifts silently.
|
||||
|
||||
## 4. Future engine modules (breadth, ranked by what it unblocks)
|
||||
|
||||
1. **`game/ai`** — `AIPlayer`, fuzzy `IAIRule`, `StrategyAIAgent`. Essentially unread; **proven
|
||||
to gate Rung B**. Known: `AISystem::Write` emits nothing; the 3 `AIAgent` save blocks are cache
|
||||
state (typed, 10 element layouts unexercised).
|
||||
2. **`game/combat`** beyond the planner — resolver (7,641 B, orchestration only) and retreat are
|
||||
mapped; the six pipeline callees and the tanker fold are unread; **nothing here has run under
|
||||
an instrument**. Combat *simulation* (`GameCombatSim`) stays parked.
|
||||
3. **trade + spy managers** — all 11 virtual targets named; four can draw RNG and none has fired
|
||||
(no trade routes / spy program in the corpus).
|
||||
4. **`net/`** — the lockstep protocol. Direct IP works in the original without GameSpy; our engine
|
||||
inherits determinism to the word, so a lockstep peer is mostly serialization we already own.
|
||||
5. **UI** and **renderer** — not on any path; DXVK carries rendering for the original.
|
||||
|
||||
## 5. Workloads to manufacture (an unexercised path is a hypothesis)
|
||||
|
||||
- **orders save → End Turn → autosave** — the Rung-A reference (human commands in-file).
|
||||
- **trade routes + spy program** — the four tail draw sites; `spies2`/`SysMem`/`mts` elements.
|
||||
- **a cruiser** (2 census leaves), **a DN platform** (the third).
|
||||
- **a Liir fleet** — waypoint type 2 is the Liir drive, not a node line; **a Hiver game** — types 4/5.
|
||||
- **a battle with `res->+4` clear and a partial retreat** — resolver + retreat instrumented; tests
|
||||
the `NMnx` prediction and the predicted zero-ship-fleet bug in the original.
|
||||
- `ResErrRoll` true entering `ProcessResearch` — save exists; needs one turn funding > ½ a tech.
|
||||
- expense sliders / debtor / aid — likely dead in 1.8; debtor ≈ 35 turns. Low priority.
|
||||
|
||||
## 6. Multiplayer revival (lane G2)
|
||||
|
||||
- **Tier 0 (hours):** `/concurrent /join 127.0.0.1:3369` — two clients on one VM, no server.
|
||||
Predictions written; queued behind lane H for VM140.
|
||||
- **Tier 1:** availability responder, byte-specified; probably a no-op (fails open on DNS failure).
|
||||
- **Tier 3 (config, not code):** self-hosted OpenSpy/UniSpy with the `swordots`/`Z5gR9Z`/1381
|
||||
row; fix queryport 3369 (not 6500) and add the 16 custom QR2 keys (ids 50–65).
|
||||
- No CD-key code exists; 333networks ruled out (v0 only).
|
||||
|
||||
## 7. Method and infrastructure
|
||||
|
||||
- `guides/method-rules.md` (18 rules) is the contract for every lane brief. Rule 18 — *measure
|
||||
first, the lab exists* — is why the RNG ledger closed in one VM session after three static lanes.
|
||||
- Reachability claims older than lane V2 are **lower bounds**; re-check "no caller" findings with
|
||||
`tools/vtable_map.py`. Never trust Ghidra's function end (five lanes bitten).
|
||||
- Regenerate the determinism-oracle autosaves on VM140 (lane N overwrote them; lane H doing it).
|
||||
- Board rows superseded by later rows are marked `SUPERSEDED` at integration — keep doing it.
|
||||
- Displace the shim: each hook that reaches `replace` with 0 divergences is code the original no
|
||||
longer runs. Track that count; it is the honest "how much of the game is ours" number.
|
||||
|
||||
## Parked
|
||||
- Battle-load bug (thread contention) — resume only with a reason.
|
||||
- Renderer — after the sim byte-matches.
|
||||
`contracts/*.json` owns scope and lifecycle. `board.md` and `DASHBOARD.md` are generated views.
|
||||
The integrator alone selects current evidence. Historical domain findings remain in `findings/`;
|
||||
they do not schedule work or establish current status. New evidence that changes the plan requires
|
||||
a recorded surprise and Astra resolution. Operational policy: [campaign README](README.md),
|
||||
[workflow](../guides/multi-agent-workflow.md), [method rules](../guides/method-rules.md).
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
41
campaign/contract.schema.json
Normal file
41
campaign/contract.schema.json
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "sots-contract/1",
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["id", "title", "status", "owner", "baseline", "scope", "inputs", "effects", "original_dependencies", "dependencies", "acceptance", "predictions", "stop_conditions", "checkpoint"],
|
||||
"properties": {
|
||||
"id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,79}$"},
|
||||
"title": {"type": "string", "minLength": 1, "maxLength": 240},
|
||||
"status": {"enum": ["proposed", "ready", "implementing", "verification", "integration", "accepted", "blocked", "needs-revision"]},
|
||||
"owner": {"type": "object", "additionalProperties": false, "required": ["name", "role"], "properties": {"name": {"type": "string", "minLength": 1, "maxLength": 120}, "role": {"enum": ["lead", "resolver", "architecture-review", "analyst", "implementer", "verifier", "lab"]}}},
|
||||
"baseline": {"$ref": "#/$defs/baseline"},
|
||||
"scope": {"$ref": "#/$defs/strings"},
|
||||
"inputs": {"$ref": "#/$defs/strings"},
|
||||
"effects": {"$ref": "#/$defs/strings"},
|
||||
"original_dependencies": {"$ref": "#/$defs/strings"},
|
||||
"dependencies": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,79}$"}},
|
||||
"acceptance": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["id", "axis", "criterion"], "properties": {"id": {"type": "string", "minLength": 1}, "axis": {"type": "string", "minLength": 1}, "criterion": {"type": "string", "minLength": 1}}}},
|
||||
"predictions": {"$ref": "#/$defs/strings"},
|
||||
"stop_conditions": {"$ref": "#/$defs/strings"},
|
||||
"checkpoint": {"type": ["string", "null"], "pattern": "^campaign/runtime/checkpoints/[a-zA-Z0-9_.-]+\\.json$"},
|
||||
"evidence": {"type": "array", "items": {"$ref": "#/$defs/evidence"}}
|
||||
},
|
||||
"$defs": {
|
||||
"strings": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 2000}},
|
||||
"repository": {"type": "object", "additionalProperties": false, "required": ["path", "commit"], "properties": {"path": {"type": "string", "pattern": "^/"}, "commit": {"type": "string", "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$"}}},
|
||||
"baseline": {"type": "object", "additionalProperties": false, "required": ["engine", "re"], "properties": {"engine": {"$ref": "#/$defs/repository"}, "re": {"$ref": "#/$defs/repository"}}},
|
||||
"artifact": {"type": "object", "additionalProperties": false, "required": ["path", "sha256"], "properties": {"path": {"type": "string", "minLength": 1}, "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}},
|
||||
"sourceTree": {"type": "object", "additionalProperties": false, "required": ["path", "commit", "sha256"], "properties": {"path": {"type": "string", "pattern": "^/"}, "commit": {"type": "string", "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$"}, "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}},
|
||||
"sourceBinding": {"type": "object", "additionalProperties": false, "required": ["engine", "re"], "properties": {"engine": {"$ref": "#/$defs/sourceTree"}, "re": {"$ref": "#/$defs/sourceTree"}}},
|
||||
"evidence": {"type": "object", "additionalProperties": false, "required": ["id", "axis", "path", "sha256", "source", "integrated", "source_binding", "binaries", "inputs", "outcomes"], "properties": {
|
||||
"id": {"type": "string", "minLength": 1}, "axis": {"type": "string", "minLength": 1},
|
||||
"path": {"type": "string", "minLength": 1}, "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
|
||||
"source": {"$ref": "#/$defs/baseline"}, "integrated": {"type": "boolean"},
|
||||
"source_binding": {"$ref": "#/$defs/sourceBinding"},
|
||||
"binaries": {"type": "array", "uniqueItems": true, "items": {"$ref": "#/$defs/artifact"}},
|
||||
"inputs": {"type": "array", "uniqueItems": true, "items": {"$ref": "#/$defs/artifact"}},
|
||||
"outcomes": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["criterion", "status", "artifact"], "properties": {"criterion": {"type": "string", "minLength": 1}, "status": {"enum": ["pass", "fail", "blocked"]}, "artifact": {"$ref": "#/$defs/artifact"}}}}
|
||||
}}
|
||||
}
|
||||
}
|
||||
115
campaign/contracts/controls-bootstrap.json
Normal file
115
campaign/contracts/controls-bootstrap.json
Normal file
|
|
@ -0,0 +1,115 @@
|
|||
{
|
||||
"acceptance": [
|
||||
{
|
||||
"axis": "control-tests",
|
||||
"criterion": "Unit tests reject lifecycle bypass, stale handoff/end checkpoints, same-HEAD candidate/integrated source drift, missing immutable inputs and criterion outcomes, bad identity/model, worker entry with pending surprises, lease collision and WIP overflow; old intact recovery checkpoints and resolution-only Astra entry succeed; runner requires successful completion/session/checkpoint and rejects provider errors and config drift",
|
||||
"id": "controls-negative-paths"
|
||||
}
|
||||
],
|
||||
"baseline": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"checkpoint": "campaign/runtime/checkpoints/controls-bootstrap-5643d7cec1edd289b0465d5f.json",
|
||||
"dependencies": [],
|
||||
"effects": [
|
||||
"Durable local contract controls and explicit-model worker launch"
|
||||
],
|
||||
"evidence": [
|
||||
{
|
||||
"axis": "control-tests",
|
||||
"binaries": [
|
||||
{
|
||||
"path": "tools/campaign.py",
|
||||
"sha256": "c7b7c7a30d907bba8e59386dee8704d7f3f5e978fcf709b686e37996fa465c31"
|
||||
},
|
||||
{
|
||||
"path": "tools/run_agent.py",
|
||||
"sha256": "0f5ccb53dcde59b64fe999768737b6cbd2dabcc1272e5605c1f1ecd86e5d5d2b"
|
||||
}
|
||||
],
|
||||
"id": "controls-suite",
|
||||
"inputs": [
|
||||
{
|
||||
"path": "verify/campaign/test_controls.py",
|
||||
"sha256": "108460f4e90c4cb7036642e85de581e31fd70c478533c32364691260461814fc"
|
||||
},
|
||||
{
|
||||
"path": "campaign/contract.schema.json",
|
||||
"sha256": "a2c76ec042ca097a57c3c05c1e519e392d498d387a31808c7d0f70482d43c201"
|
||||
},
|
||||
{
|
||||
"path": "campaign/rollout/controls_evidence.py",
|
||||
"sha256": "bfaf4e523b2ca39c0ecdab94adf0b2b19a3da68aab8a0fcba69a613aed46588a"
|
||||
}
|
||||
],
|
||||
"integrated": true,
|
||||
"outcomes": [
|
||||
{
|
||||
"artifact": {
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
"criterion": "controls-negative-paths",
|
||||
"status": "pass"
|
||||
}
|
||||
],
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e",
|
||||
"source": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"source_binding": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine",
|
||||
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re",
|
||||
"sha256": "6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"id": "controls-bootstrap",
|
||||
"inputs": [
|
||||
"campaign/rollout/architecture-decision.md",
|
||||
"campaign/rollout/controls-worker.md"
|
||||
],
|
||||
"original_dependencies": [
|
||||
"No original game executable required for control tests"
|
||||
],
|
||||
"owner": {
|
||||
"name": "controls-architect",
|
||||
"role": "architecture-review"
|
||||
},
|
||||
"predictions": [
|
||||
"All controls can run with Python standard library and Git without an external server"
|
||||
],
|
||||
"scope": [
|
||||
"tools/campaign.py",
|
||||
"tools/run_agent.py",
|
||||
"campaign/",
|
||||
"verify/campaign/"
|
||||
],
|
||||
"status": "accepted",
|
||||
"stop_conditions": [
|
||||
"Cross-cutting architecture changes require Astra resolution"
|
||||
],
|
||||
"title": "Bootstrap canonical contract controls and bounded worker launcher"
|
||||
}
|
||||
47
campaign/contracts/launcher-smoke.json
Normal file
47
campaign/contracts/launcher-smoke.json
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"acceptance": [
|
||||
{
|
||||
"axis": "control-execution",
|
||||
"criterion": "Real OpenCode process requests GPT-6 Astra, finishes successfully, emits one actual session and a matching fresh checkpoint; worktree source identities remain unchanged.",
|
||||
"id": "live-launch"
|
||||
}
|
||||
],
|
||||
"baseline": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"checkpoint": "campaign/runtime/checkpoints/launcher-smoke-9e8a62fea4de50abd96f27d6.json",
|
||||
"dependencies": [],
|
||||
"effects": [
|
||||
"One durable canonical RE checkpoint and one runner event/provenance record; no engine or RE worktree source changes"
|
||||
],
|
||||
"id": "launcher-smoke",
|
||||
"inputs": [
|
||||
"Canonical OpenCode configuration and role prompt",
|
||||
"Two isolated baseline-linked worktrees"
|
||||
],
|
||||
"original_dependencies": [],
|
||||
"owner": {
|
||||
"name": "launcher-smoke",
|
||||
"role": "architecture-review"
|
||||
},
|
||||
"predictions": [
|
||||
"Runner completes with explicit requested Astra model and a canonical checkpoint; both source worktrees remain unchanged."
|
||||
],
|
||||
"scope": [
|
||||
"SMOKE ONLY: Read this contract and campaign/README.md from the canonical RE state root. Do not implement any other contract, edit source, delegate, or access the lab.",
|
||||
"Use the canonical campaign CLI to write a checkpoint for launcher-smoke with the run-supplied session ID, actor launcher-smoke, role architecture-review and model openai/gpt-6-astra. Summary: explicit Astra launcher reached canonical RE state from paired worktrees; no source mutation. Artifact: campaign/agents/lead.md. Next action: lead inspects this run's actual event/session/checkpoint binding.",
|
||||
"After writing that checkpoint, immediately return a short completion. Do not plan extra work."
|
||||
],
|
||||
"status": "proposed",
|
||||
"stop_conditions": [
|
||||
"Any model, permission, contract, checkpoint or source mismatch: record incomplete; no fallback."
|
||||
],
|
||||
"title": "Normal Astra launcher, explicit routing and durable checkpoint smoke"
|
||||
}
|
||||
171
campaign/contracts/research-completion-abi.json
Normal file
171
campaign/contracts/research-completion-abi.json
Normal file
|
|
@ -0,0 +1,171 @@
|
|||
{
|
||||
"acceptance": [
|
||||
{
|
||||
"axis": "static-recovery",
|
||||
"criterion": "Addresses/signatures and record/container/string lifetime rules backed by fresh binary/tool captures; distinguish recorded facts, inference and unexercised branches. Name exact callable allocation/copy/destruction operations or precise unresolved blockers.",
|
||||
"id": "ownership-recovered"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "Independent verifier checks key instruction/ABI claims and archived record values. No static-only claim of live allocator safety or replacement acceptance.",
|
||||
"id": "independent-cross-check"
|
||||
}
|
||||
],
|
||||
"baseline": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"checkpoint": "campaign/runtime/checkpoints/research-completion-abi-d2e4078886c66df34ee00b24.json",
|
||||
"dependencies": [
|
||||
"controls-bootstrap"
|
||||
],
|
||||
"effects": [
|
||||
"Evidence-backed RE handoff and raw static captures; no game or shared database state changes"
|
||||
],
|
||||
"evidence": [
|
||||
{
|
||||
"axis": "static-recovery",
|
||||
"binaries": [
|
||||
{
|
||||
"path": "dumps/sots.exe",
|
||||
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"
|
||||
}
|
||||
],
|
||||
"id": "research-completion-abi-static-run-79357a65226f61d6a86c042d",
|
||||
"inputs": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/run-79357a65226f61d6a86c042d/report.md",
|
||||
"sha256": "d5a28f01002f1711cf8575ffd817a8f0998b413c6280d656e6cdad5a90a04477"
|
||||
}
|
||||
],
|
||||
"integrated": true,
|
||||
"outcomes": [
|
||||
{
|
||||
"artifact": {
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json",
|
||||
"sha256": "4fdf2cbf02f0f3dd53c4ccfd1787a2fb8012d0de76dad63e97c2b5cfbdc6c46c"
|
||||
},
|
||||
"criterion": "ownership-recovered",
|
||||
"status": "pass"
|
||||
}
|
||||
],
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json",
|
||||
"sha256": "4fdf2cbf02f0f3dd53c4ccfd1787a2fb8012d0de76dad63e97c2b5cfbdc6c46c",
|
||||
"source": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"source_binding": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine",
|
||||
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re",
|
||||
"sha256": "e74ef6cff202ee35a6fdc38d63842b4826a074e34502dfc2981a33ffea912bd4"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"binaries": [
|
||||
{
|
||||
"path": "dumps/sots.exe",
|
||||
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"
|
||||
}
|
||||
],
|
||||
"id": "research-completion-abi-validation-run-735fcb8f4876c10285b03fad",
|
||||
"inputs": [
|
||||
{
|
||||
"path": "verify/results/saves/turn3-state.sav",
|
||||
"sha256": "978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json",
|
||||
"sha256": "4fdf2cbf02f0f3dd53c4ccfd1787a2fb8012d0de76dad63e97c2b5cfbdc6c46c"
|
||||
}
|
||||
],
|
||||
"integrated": true,
|
||||
"outcomes": [
|
||||
{
|
||||
"artifact": {
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/independent-state.json",
|
||||
"sha256": "6463816f322803b2b7b479e1fc116c4ffa33fb2772a3005d492422a00acea433"
|
||||
},
|
||||
"criterion": "independent-cross-check",
|
||||
"status": "pass"
|
||||
}
|
||||
],
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/independent-state.json",
|
||||
"sha256": "6463816f322803b2b7b479e1fc116c4ffa33fb2772a3005d492422a00acea433",
|
||||
"source": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"source_binding": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine",
|
||||
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re",
|
||||
"sha256": "e74ef6cff202ee35a6fdc38d63842b4826a074e34502dfc2981a33ffea912bd4"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"id": "research-completion-abi",
|
||||
"inputs": [
|
||||
"Existing binary fingerprint/address contract and private RE findings",
|
||||
"Owner-supplied binary or live read-only ReVa endpoint",
|
||||
"Archived CR traces/saves for observed behavior",
|
||||
"Source-identical current engine/RE worktree snapshots"
|
||||
],
|
||||
"original_dependencies": [
|
||||
"Original binary is the object of analysis, not a replacement dependency decision"
|
||||
],
|
||||
"owner": {
|
||||
"name": "research-abi-analyst",
|
||||
"role": "analyst"
|
||||
},
|
||||
"predictions": [
|
||||
"Count-only scratch updates conceal concrete element construction and original allocator ownership requirements",
|
||||
"The observed-tech and nested-event containers use different element strides and nontrivial string lifetimes; raw header copying is insufficient"
|
||||
],
|
||||
"scope": [
|
||||
"Reverse engineering only. Own canonical campaign/research/research-completion-abi.md and verify/results/research-completion-abi/ captures. Use assigned source-identical paired worktrees for source inspection; canonical RE for unique evidence/checkpoint outputs.",
|
||||
"Recover actual constructors/copy/destructors/vector-growth/allocation/free conventions used by RecordObservedTech and EventStorage/TurnEvents/PlayerEvent. Resolve implementable ABI operations, not another general framework.",
|
||||
"Use existing ReVa read-only tools through canonical tools/reva_call.py or the owner-supplied local binary. No Ghidra renames/type writes, VM mutation, new engine code, framework code, agents or delegation. Do not commit/stage/push.",
|
||||
"Start with findings/subsystems/{events,observedtech-append,research-replace}.md and campaign/pilots/research-replacement.md; cross-check binary bytes/decompilation rather than merely repeat notes. Anchors: RecordObservedTech 0x007ba1a0, EventStorage::PostEvent 0x008862b0, PlayerEvent constructor 0x0084ee30. Addresses are hypotheses to validate against fingerprint and actual tools.",
|
||||
"Produce recovered signatures, ownership/lifetime rules, short/long string and empty/full-capacity container paths, and exact unresolved dependencies with minimum next probe. Store raw tool outputs and a hash/provenance index in your owned RE results directory. Keep code-derived material out of engine repo."
|
||||
],
|
||||
"status": "accepted",
|
||||
"stop_conditions": [
|
||||
"Stop affected interpretation on binary fingerprint mismatch, contradictory ownership/ABI evidence, unavailable original data, or any scope-changing surprise; record and escalate to Astra",
|
||||
"Checkpoint every 20 calls/15 minutes and before compaction/stopping; return exact next RE action within 40 steps",
|
||||
"Do not expand into framework development or mark pilot replacement ready/accepted"
|
||||
],
|
||||
"title": "RE: research completion record construction and allocator ABI"
|
||||
}
|
||||
92
campaign/contracts/research-live-record-bridge.json
Normal file
92
campaign/contracts/research-live-record-bridge.json
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
{
|
||||
"acceptance": [
|
||||
{
|
||||
"axis": "planning",
|
||||
"criterion": "Before ready, publish exact bridge-only source/test ownership, callable entrypoints and calling conventions, generated-address provenance, a bridge-only invocation route, VM/build resources, executable acceptance commands and immutable source/binary/fixture manifests. The route must not call or wire research replacement.",
|
||||
"id": "readiness"
|
||||
},
|
||||
{
|
||||
"axis": "understanding",
|
||||
"criterion": "Reconcile accepted binary evidence with generated and pure-model facts, including whether EvDsc participates in duplicate equality and whether the callable ObservedTech copy operation begins at 0x0079a150 or an interior site. Every exposed constructor/copy/append/destructor/new/delete operation has an exact ABI and ownership contract.",
|
||||
"id": "abi-reconciliation"
|
||||
},
|
||||
{
|
||||
"axis": "implementation",
|
||||
"criterion": "An isolated bridge constructs, copies, appends, updates and destroys complete live-layout ObservedTech, TurnEvents and PlayerEvent values using compatible original-runtime allocation services. It never copies raw owning headers and never calls original RecordObservedTech, EventStorage::PostEvent or any research completion root.",
|
||||
"id": "bridge-operations"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "Host tests and a fresh leased disposable-VM run positively execute empty, spare and full capacity; short and long strings; repeated observed names; exact duplicate and description-only-different events; normal destruction; and one contained recorded failure path. Preserve per-case operation/allocation/destruction counts and complete resulting records.",
|
||||
"id": "runtime-matrix"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "Executable negative controls reject raw string/header transfer, wrong callable entry or convention, mismatched allocator family, missing cleanup, double free, incomplete record fields, forbidden original decision-root calls, zero execution, missing artifacts and source/binary/fixture drift.",
|
||||
"id": "negative-controls"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "A different verifier session reproduces the source/binary/fixture-bound package and at least one meaningful negative control on an integrated tree. Author-only or static-only evidence cannot accept live allocator safety.",
|
||||
"id": "independent-reproduction"
|
||||
}
|
||||
],
|
||||
"baseline": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"checkpoint": "campaign/runtime/checkpoints/research-live-record-bridge-e25bb2cbc914031f4572ad84.json",
|
||||
"dependencies": [
|
||||
"research-completion-abi"
|
||||
],
|
||||
"effects": [
|
||||
"Complete 0x2c ObservedTech object fields, owned name string, existing-name update semantics, vector first/last/end and element lifetime across no-growth and growth paths.",
|
||||
"Complete 0x74 PlayerEvent fields and three independently owned strings, plus complete 0x18 TurnEvents bucket and nested vector lifetime across no-growth and growth paths.",
|
||||
"Event ID/order, exact duplicate behavior, description-only-different behavior and stale-bucket pruning only as needed to exercise the bridge fixture; no research callback or player-state effects.",
|
||||
"Allocation, copy, destruction and failure-path counters sufficient to detect leaks, mismatched frees, partial construction and double destruction."
|
||||
],
|
||||
"evidence": [],
|
||||
"id": "research-live-record-bridge",
|
||||
"inputs": [
|
||||
"Accepted research-completion-abi evidence and handoff, including binary fingerprint and independently reproduced static ownership windows.",
|
||||
"Original binary /home/alex/sots-re/dumps/sots.exe sha256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841; owner-supplied and never committed.",
|
||||
"Source-identical paired worktrees /tmp/opencode/sots-final-research-engine and /tmp/opencode/sots-final-research-re at the contract baselines; exact dirty source-content manifests are required before implementation evidence.",
|
||||
"Disposable VM144 is the preferred runtime fixture guest; verify its current MAC/IP, session/process state and housekeeping immediately before use, then acquire campaign/runtime/leases/vm144.json. VM140 is excluded from this experiment.",
|
||||
"Required but missing before ready: bridge-only invocation fixture, generated callable-address package, 32-bit shim/toolchain manifest, failure-containment design, executable acceptance checker and per-case expected records."
|
||||
],
|
||||
"original_dependencies": [
|
||||
"Original MSVCR100 scalar new/delete and narrowly accepted constructor/copy/append/destructor operations are permitted only as declared, counted ABI services.",
|
||||
"Original RecordObservedTech, EventStorage::PostEvent, ProcessResearch, SetResearched, OnTechResearched and localized string lookup are forbidden in the bridge fixture.",
|
||||
"The original game process supplies the MSVCR100 runtime and object address space for live tests; this contract does not claim standalone allocator or game-decision replacement."
|
||||
],
|
||||
"owner": {
|
||||
"name": "live-record bridge architect",
|
||||
"role": "architecture-review"
|
||||
},
|
||||
"predictions": [
|
||||
"ObservedTech no-growth append deep-copies one name; growth relocates every existing 0x2c element and destroys the old range without cross-runtime frees.",
|
||||
"PlayerEvent append deep-copies EvDsc, EvMsg and EvImg independently; full-capacity growth preserves all scalar/default fields and destroys old strings exactly once.",
|
||||
"Repeated observed name updates the existing record without vector growth; exact duplicate event does not append; description-only-different event does append if the accepted EvDsc equality result is correct.",
|
||||
"A contained allocation-failure fixture reports failure without an accepted partial record, leaked owned string, mismatched free or exception crossing into an unsafe ABI boundary."
|
||||
],
|
||||
"scope": [
|
||||
"Recover and implement only the live ABI bridge for ObservedTech, TurnEvents and PlayerEvent construction/copy/append/update/destruction plus isolated fixtures and acceptance tooling.",
|
||||
"First quantum is RE and architecture: reconcile callable boundaries and duplicate semantics, specify failure containment and name exact owned files. No engine implementation or VM mutation until the contract is ready and the operator holds required leases.",
|
||||
"Runtime validation uses a bridge-only fixture on a disposable clone. It must not wire src/shim/hooks/research.cpp or src/shim/main.cpp and must not execute a research completion workload.",
|
||||
"Static ABI acceptance is a dependency, not evidence of live safety. Acceptance remains scoped to bridge operations and does not promote research-replacement."
|
||||
],
|
||||
"status": "needs-revision",
|
||||
"stop_conditions": [
|
||||
"Remain proposed while callable ABI, exact ownership, fixture route, manifests, failure containment or executable acceptance is unresolved.",
|
||||
"Stop affected work and record a surprise on contradictory fresh binary/runtime evidence, binary/source drift, allocator mismatch, exception crossing, unexpected game-decision-root execution, leak/double-free, guest interference or access change.",
|
||||
"No Ghidra mutation or VM/build-host mutation without explicit assignment and the corresponding canonical lease; never touch VM140 under this contract.",
|
||||
"No research replacement wiring, delegation, staging, commit, push or destructive canonical worktree operation. Checkpoint every 20 calls/15 minutes and before experiment, handoff or stop."
|
||||
],
|
||||
"title": "Live ObservedTech and event record ABI bridge"
|
||||
}
|
||||
109
campaign/contracts/research-replacement.json
Normal file
109
campaign/contracts/research-replacement.json
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
{
|
||||
"acceptance": [
|
||||
{
|
||||
"axis": "planning",
|
||||
"criterion": "BLOCKED: accepted static ABI dependency is named and original-helper policy is fixed, but readiness still requires an accepted live-record-bridge contract, implemented tools/research_replacement.py interfaces from the pilot plan, required asset paths/hashes, W0 recertification, exact coordinator-owned paths and immutable source/binary/input manifests.",
|
||||
"id": "readiness"
|
||||
},
|
||||
{
|
||||
"axis": "implementation",
|
||||
"criterion": "Fresh full-profile source-bound host/assets/shim build; expected test identities and explicit positive executed workloads; no required missing input, unexpected skip or stale binary.",
|
||||
"id": "full-gate"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "Two fresh C1/C2 hooks-off processes and candidate compare N on the exact W1 input/route produce identical pre/post save pairs; full installed-site manifests and per-call CW retained. Reject incomplete raw bundles or disagreement.",
|
||||
"id": "control-neutrality"
|
||||
},
|
||||
{
|
||||
"axis": "implementation",
|
||||
"criterion": "W1 replace executes exactly one tech-144 completion and three unlocks, two actual event records and one full observed-tech record, refund 1166 and primary player effects; original displaced roots bypassed, declared helpers counted; zero unsupported paths, unreadable inputs or failures.",
|
||||
"id": "positive-replace"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "Require post-turn file-byte, inflated-byte and exact-bit unmasked state equality plus complete reader coverage and nonserialized order/RNG checks. Pre-turn resave equality, count-only regions and zero-execution passes cannot satisfy this criterion.",
|
||||
"id": "oracle"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "Executable checker rejects archived R0's 27 and R1's 16 leaf differences, absent callback/event/ObservedTech writes, W0 as completion evidence, missing artifacts, wrong hashes, and unknown RNG reported as zero.",
|
||||
"id": "negative-controls"
|
||||
},
|
||||
{
|
||||
"axis": "validation",
|
||||
"criterion": "Different verifier execution reproduces source/binary/input-bound package and a meaningful negative control; integrated-tree evidence is required before accepted. No author-only verdict or reporter --accept flag grants campaign acceptance.",
|
||||
"id": "independent-reproduction"
|
||||
},
|
||||
{
|
||||
"axis": "original_dependencies",
|
||||
"criterion": "Publish retained original helpers and W1-only scope separately. Require certified W2 and branch-specific original experiments plus synthetic boundaries before claiming RNG-consuming, other-effect-family, recursive, dedup, decay, plague or rebellion coverage.",
|
||||
"id": "coverage-and-dependencies"
|
||||
}
|
||||
],
|
||||
"baseline": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re"
|
||||
}
|
||||
},
|
||||
"checkpoint": "campaign/runtime/checkpoints/research-replacement-fc19e142bf1db96b10d29391.json",
|
||||
"dependencies": [
|
||||
"research-completion-abi"
|
||||
],
|
||||
"effects": [
|
||||
"All node state/progress/flag/cost/availability/researched-turn/order words; tree order counter; capped spend and refund accumulator; idle-node decay; ordered cascade including conditional recursive zero-cost completions.",
|
||||
"RNG full state, left and next-index plus actual consumed words, including conditional completion rolls, Zuul second roll and research-event paths; W1 has zero words and proves no positive-draw branch.",
|
||||
"All applicable callback player floats, boolean/species/design-option masks, target and roll flags, node-bore storage and lifetimes. Existing WritePlayerState is not integration of the full research callback.",
|
||||
"ObservedTech full record name/first-last turn/detected/with fields, dedup/update, vector elements/header/capacity and compatible allocation/destruction. Scratch span growth is not an append implementation.",
|
||||
"Complete ordered event turn buckets, records, ids/nextId, text, image/action/location/position/chainId, dedup/pruning and allocation lifetimes; keyless count-only events cannot satisfy the save oracle.",
|
||||
"Conditional transitive system/ship AI/cap/addiction/plague changes, recursive Zuul grant, rebellion object allocation and cancellation must be implemented or rejected by approved preflight before mutation; TechApplyOutcome alone performs none of them.",
|
||||
"Observe downstream bankruptcy, repair and checksum consequences through full turn/save validation; never copy original post-state or patch expected derived leaves."
|
||||
],
|
||||
"id": "research-replacement",
|
||||
"inputs": [
|
||||
"W1 verify/results/saves/turn3-state.sav sha256 978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921; exact fresh-process LOAD route, one End Turn.",
|
||||
"Historical oracle verify/results/saves/cr/cr-oracle-endturn.sav sha256 e00eed0c03a31d27a81b7470a9dcc9ba08a2ac48c20baeee4f34749164743e3f and cr-oracle-autosave.sav sha256 79df50475a7b83afa927d992b9f030dcf45710f4bda0133b8b1fa4800a72e420; re-certify controls with current candidate inputs.",
|
||||
"Historical negative saves cr-replace0-autosave.sav sha256 6b51db992b158caa5424d71b2dccf72924af7198b4165bfcfc870e0d438fb6d5 and cr-replace1-autosave.sav sha256 8a4309ee4fe0b3177a2820600b5016c7c256d0f51b065df469ecd0b4f2342235 under verify/results/saves/cr/.",
|
||||
"Raw historical evidence: verify/traces/cr-{N,R0,R1}.jsonl.gz; verify/results/compare/cr-{compare,replace0,replace1}.json; verify/results/shim/cr/cr-{N,R0,R1}.log. Historical build cr-618ccb1-20260909T131556Z does not identify the current candidate.",
|
||||
"Required but missing: operator-owned executable/proxy and tech graph/tuning/localized string assets with explicit paths, SHA-256, locale and load order; generated-address provenance; compiler/toolchain; exact candidate source-content and binary manifests.",
|
||||
"Runtime-only inputs include tree order counter, allocation entries/order, current turn, target and pending-roll flags, preexisting observed-tech and event elements, RNG state/index/left, full FPU CW, installed interception sites and LOAD/continuation route.",
|
||||
"W0 turn2-state.sav one End Turn is a no-completion regression control; pin hash and re-certify. W2 different-tech positive-RNG/second-completion workload remains to be selected and certified before expanding scope.",
|
||||
"Accepted static dependency research-completion-abi establishes record/container/string ABI only; live allocator safety, runtime construction and replacement acceptance remain absent."
|
||||
],
|
||||
"original_dependencies": [
|
||||
"Retained and counted original TechTree::Cost supplies effective and cascade costs; independent effective-cost replacement is excluded.",
|
||||
"Retained and counted original TechTree::HasResearched supplies common-tail/design-mask lookup; replacement owns resulting writes.",
|
||||
"Retained and counted ServerPlayer::UpdateNodeBoreParams runs in common-tail order and may allocate/free state; independent node-bore maintenance is excluded.",
|
||||
"Original MSVCR100 scalar new/delete and accepted copy/container ABI may be used only as a counted live memory bridge. Original RecordObservedTech, EventStorage::PostEvent and string lookup are forbidden displaced roots; localized text must come from manifested runtime assets.",
|
||||
"Shim workload retains original turn driver, budget allocation, remaining simulation, data loading and save serialization. Successful scoped shim replacement would not establish independent standalone turn parity."
|
||||
],
|
||||
"owner": {
|
||||
"name": "Astra pilot architect",
|
||||
"role": "architecture-review"
|
||||
},
|
||||
"predictions": [
|
||||
"W1 owner order 32/496/512 with allocations 144:2898,90:0,9:0; exactly one completion and two null calls.",
|
||||
"Tech144 progress 5768->7500, state3->4, researched turn4/order22, counter22->23, unchanged flag; capped spend1732/refund1166; no RNG words.",
|
||||
"Tech132/136/142 become available turn4 at costs10000/16000/8000; observed-tech count10->11 with real element; event nextId5->7 with complete records.",
|
||||
"Existing R1 still fails by 16 leaves (independently reproduced); merely enabling cascade cannot close callback residuals. Runtime text assets may avoid original PostEvent but live adapter and policy are unresolved."
|
||||
],
|
||||
"scope": [
|
||||
"Planning only until ready: campaign/pilots/research-replacement.md is the detailed input, write-boundary and acceptance specification. No replacement code or lab operations authorized by this proposed contract.",
|
||||
"Target ProcessResearch plus SetResearched and required OnTechResearched effects for the W1 turn3 LOAD-to-turn4 completion; broad research correctness is not implied.",
|
||||
"The accepted static ABI dependency does not authorize live wiring. First accept a separately contracted live record bridge; then assign one complete W1 coordinator write set with baseline-pinned paired worktrees and exclusive source/build/VM ownership.",
|
||||
"Before implementation provide exact owned source paths, supported-input preflight, executable acceptance and immutable manifests. Uncommitted bootstrap changes are not bound by these HEAD IDs."
|
||||
],
|
||||
"status": "proposed",
|
||||
"stop_conditions": [
|
||||
"Remain proposed while readiness criterion, dependency decisions, input manifests and executable acceptance are missing; do not interpret narrative strings as execution proof.",
|
||||
"Stop on control disagreement, instrumentation mismatch, source/input drift, missing artifacts/assets, unknown RNG, unmodelled fired branch, unexpected writes, zero required execution or forbidden original fallback.",
|
||||
"Record any falsified assumption or changed scope as a surprise and obtain Astra resolution before affected work continues; checkpoint at 20 calls/15 minutes and before experiments, handoff or stop.",
|
||||
"No lab or shared-host mutation without explicit assignment and lease; no commits, staging, push or delegated work under the current pilot-design assignment."
|
||||
],
|
||||
"title": "Completion-bearing W1 research replacement pilot (proposed; live bridge, assets and runner pending)"
|
||||
}
|
||||
2699
campaign/current.json
Normal file
2699
campaign/current.json
Normal file
File diff suppressed because it is too large
Load diff
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
104
campaign/evidence/controls-suite-1788991553768711267.json
Normal file
104
campaign/evidence/controls-suite-1788991553768711267.json
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
{
|
||||
"command": [
|
||||
"/usr/bin/python3",
|
||||
"-m",
|
||||
"unittest",
|
||||
"discover",
|
||||
"-s",
|
||||
"verify/campaign",
|
||||
"-v"
|
||||
],
|
||||
"expected": [
|
||||
"test_acceptance_requires_independent_final_integrated_package",
|
||||
"test_actual_worktree_identity_and_baseline_without_source_commits",
|
||||
"test_baseline_rechecked_under_reservation",
|
||||
"test_candidate_worktree_binding_cannot_claim_integration",
|
||||
"test_checkpoint_basis_session_model_and_bounds",
|
||||
"test_config_mutation_during_zero_exit_success_fails",
|
||||
"test_dry_run_writes_no_run_and_no_fallback",
|
||||
"test_duplicate_json_keys_and_nonfinite_numbers",
|
||||
"test_error_followed_by_success_still_fails",
|
||||
"test_evidence_source_tampering_and_revision",
|
||||
"test_identity_and_dependency_fail_closed",
|
||||
"test_immutable_inputs_and_criterion_coverage",
|
||||
"test_integrated_re_source_mutation_rejects_acceptance",
|
||||
"test_lease_concurrent_acquisition_exactly_one_winner",
|
||||
"test_lease_token_owner_and_explicit_stale_release",
|
||||
"test_lifecycle_no_bypass_or_missing_inputs",
|
||||
"test_missing_and_stale_checkpoint_and_artifact",
|
||||
"test_model_mismatch_and_nonzero_exit_fail",
|
||||
"test_model_registry_no_fallback",
|
||||
"test_multiple_surprises_remain_blocked_until_all_resolved",
|
||||
"test_old_recovery_checks_integrity_but_not_age",
|
||||
"test_permissions_expanded_prompt_and_provenance",
|
||||
"test_resolution_permission_scope_and_architecture_authority",
|
||||
"test_run_missing_end_checkpoint_is_incomplete",
|
||||
"test_run_success_captures_actual_events_and_checkpoint",
|
||||
"test_runner_role_status_surprise_and_missing_checkpoint",
|
||||
"test_running_reservation_is_not_stolen",
|
||||
"test_same_head_source_mutation_rejects_verdict_and_promotion",
|
||||
"test_schema_rejects_unknown_missing_types_and_ids",
|
||||
"test_scientific_artifacts_and_secret_path_escapes",
|
||||
"test_source_binding_add_delete_mode_and_escape",
|
||||
"test_state_root_and_path_escape",
|
||||
"test_surprise_blocks_and_resolution_invalidates",
|
||||
"test_unavailable_model_and_config_bound",
|
||||
"test_wip_bound",
|
||||
"test_zero_exit_error_and_incomplete_events_fail"
|
||||
],
|
||||
"passed": [
|
||||
"test_acceptance_requires_independent_final_integrated_package",
|
||||
"test_actual_worktree_identity_and_baseline_without_source_commits",
|
||||
"test_baseline_rechecked_under_reservation",
|
||||
"test_candidate_worktree_binding_cannot_claim_integration",
|
||||
"test_checkpoint_basis_session_model_and_bounds",
|
||||
"test_config_mutation_during_zero_exit_success_fails",
|
||||
"test_dry_run_writes_no_run_and_no_fallback",
|
||||
"test_duplicate_json_keys_and_nonfinite_numbers",
|
||||
"test_error_followed_by_success_still_fails",
|
||||
"test_evidence_source_tampering_and_revision",
|
||||
"test_identity_and_dependency_fail_closed",
|
||||
"test_immutable_inputs_and_criterion_coverage",
|
||||
"test_integrated_re_source_mutation_rejects_acceptance",
|
||||
"test_lease_concurrent_acquisition_exactly_one_winner",
|
||||
"test_lease_token_owner_and_explicit_stale_release",
|
||||
"test_lifecycle_no_bypass_or_missing_inputs",
|
||||
"test_missing_and_stale_checkpoint_and_artifact",
|
||||
"test_model_mismatch_and_nonzero_exit_fail",
|
||||
"test_model_registry_no_fallback",
|
||||
"test_multiple_surprises_remain_blocked_until_all_resolved",
|
||||
"test_old_recovery_checks_integrity_but_not_age",
|
||||
"test_permissions_expanded_prompt_and_provenance",
|
||||
"test_resolution_permission_scope_and_architecture_authority",
|
||||
"test_run_missing_end_checkpoint_is_incomplete",
|
||||
"test_run_success_captures_actual_events_and_checkpoint",
|
||||
"test_runner_role_status_surprise_and_missing_checkpoint",
|
||||
"test_running_reservation_is_not_stolen",
|
||||
"test_same_head_source_mutation_rejects_verdict_and_promotion",
|
||||
"test_schema_rejects_unknown_missing_types_and_ids",
|
||||
"test_scientific_artifacts_and_secret_path_escapes",
|
||||
"test_source_binding_add_delete_mode_and_escape",
|
||||
"test_state_root_and_path_escape",
|
||||
"test_surprise_blocks_and_resolution_invalidates",
|
||||
"test_unavailable_model_and_config_bound",
|
||||
"test_wip_bound",
|
||||
"test_zero_exit_error_and_incomplete_events_fail"
|
||||
],
|
||||
"returncode": 0,
|
||||
"schema": "sots-controls-test/1",
|
||||
"source_binding": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine",
|
||||
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re",
|
||||
"sha256": "82fc34631b2baa2ee74557020f74d68cc4db3c031561210f9933a3f22d7ff7b6"
|
||||
}
|
||||
},
|
||||
"status": "passed",
|
||||
"stderr": "test_schema_rejects_unknown_missing_types_and_ids (test_controls.Controls) ... ok\ntest_duplicate_json_keys_and_nonfinite_numbers (test_controls.Controls) ... ok\ntest_state_root_and_path_escape (test_controls.Controls) ... ok\ntest_lifecycle_no_bypass_or_missing_inputs (test_controls.Controls) ... ok\ntest_identity_and_dependency_fail_closed (test_controls.Controls) ... ok\ntest_missing_and_stale_checkpoint_and_artifact (test_controls.Controls) ... ok\ntest_checkpoint_basis_session_model_and_bounds (test_controls.Controls) ... ok\ntest_wip_bound (test_controls.Controls) ... ok\ntest_surprise_blocks_and_resolution_invalidates (test_controls.Controls) ... ok\ntest_multiple_surprises_remain_blocked_until_all_resolved (test_controls.Controls) ... ok\ntest_acceptance_requires_independent_final_integrated_package (test_controls.Controls) ... ok\ntest_evidence_source_tampering_and_revision (test_controls.Controls) ... ok\ntest_lease_concurrent_acquisition_exactly_one_winner (test_controls.Controls) ... ok\ntest_lease_token_owner_and_explicit_stale_release (test_controls.Controls) ... ok\ntest_model_registry_no_fallback (test_controls.Controls) ... ok\ntest_runner_role_status_surprise_and_missing_checkpoint (test_controls.Controls) ... ok\ntest_old_recovery_checks_integrity_but_not_age (test_controls.Controls) ... ok\ntest_same_head_source_mutation_rejects_verdict_and_promotion (test_controls.Controls) ... ok\ntest_integrated_re_source_mutation_rejects_acceptance (test_controls.Controls) ... ok\ntest_immutable_inputs_and_criterion_coverage (test_controls.Controls) ... ok\ntest_candidate_worktree_binding_cannot_claim_integration (test_controls.Controls) ... ok\ntest_source_binding_add_delete_mode_and_escape (test_controls.Controls) ... ok\ntest_scientific_artifacts_and_secret_path_escapes (test_controls.Controls) ... ok\ntest_run_success_captures_actual_events_and_checkpoint (test_controls.Runner) ... ok\ntest_run_missing_end_checkpoint_is_incomplete (test_controls.Runner) ... ok\ntest_unavailable_model_and_config_bound (test_controls.Runner) ... ok\ntest_dry_run_writes_no_run_and_no_fallback (test_controls.Runner) ... ok\ntest_model_mismatch_and_nonzero_exit_fail (test_controls.Runner) ... ok\ntest_running_reservation_is_not_stolen (test_controls.Runner) ... ok\ntest_zero_exit_error_and_incomplete_events_fail (test_controls.Runner) ... ok\ntest_config_mutation_during_zero_exit_success_fails (test_controls.Runner) ... ok\ntest_error_followed_by_success_still_fails (test_controls.Runner) ... ok\ntest_resolution_permission_scope_and_architecture_authority (test_controls.Runner) ... ok\ntest_baseline_rechecked_under_reservation (test_controls.Runner) ... ok\ntest_permissions_expanded_prompt_and_provenance (test_controls.Runner) ... ok\ntest_actual_worktree_identity_and_baseline_without_source_commits (test_controls.Worktrees) ... ok\n\n----------------------------------------------------------------------\nRan 36 tests in 6.574s\n\nOK\n",
|
||||
"stdout": ""
|
||||
}
|
||||
106
campaign/evidence/controls-suite-1788991911311171323.json
Normal file
106
campaign/evidence/controls-suite-1788991911311171323.json
Normal file
|
|
@ -0,0 +1,106 @@
|
|||
{
|
||||
"command": [
|
||||
"/usr/bin/python3",
|
||||
"-m",
|
||||
"unittest",
|
||||
"discover",
|
||||
"-s",
|
||||
"verify/campaign",
|
||||
"-v"
|
||||
],
|
||||
"expected": [
|
||||
"test_acceptance_requires_independent_final_integrated_package",
|
||||
"test_actual_worktree_identity_and_baseline_without_source_commits",
|
||||
"test_baseline_rechecked_under_reservation",
|
||||
"test_candidate_worktree_binding_cannot_claim_integration",
|
||||
"test_checkpoint_basis_session_model_and_bounds",
|
||||
"test_config_mutation_during_zero_exit_success_fails",
|
||||
"test_dry_run_writes_no_run_and_no_fallback",
|
||||
"test_duplicate_json_keys_and_nonfinite_numbers",
|
||||
"test_error_followed_by_success_still_fails",
|
||||
"test_evidence_source_tampering_and_revision",
|
||||
"test_final_integrated_verifier_launch_preserves_guards",
|
||||
"test_identity_and_dependency_fail_closed",
|
||||
"test_immutable_inputs_and_criterion_coverage",
|
||||
"test_integrated_re_source_mutation_rejects_acceptance",
|
||||
"test_lease_concurrent_acquisition_exactly_one_winner",
|
||||
"test_lease_token_owner_and_explicit_stale_release",
|
||||
"test_lifecycle_no_bypass_or_missing_inputs",
|
||||
"test_missing_and_stale_checkpoint_and_artifact",
|
||||
"test_model_mismatch_and_nonzero_exit_fail",
|
||||
"test_model_registry_no_fallback",
|
||||
"test_multiple_surprises_remain_blocked_until_all_resolved",
|
||||
"test_old_recovery_checks_integrity_but_not_age",
|
||||
"test_permissions_expanded_prompt_and_provenance",
|
||||
"test_resolution_permission_scope_and_architecture_authority",
|
||||
"test_run_missing_end_checkpoint_is_incomplete",
|
||||
"test_run_success_captures_actual_events_and_checkpoint",
|
||||
"test_runner_role_status_surprise_and_missing_checkpoint",
|
||||
"test_running_reservation_is_not_stolen",
|
||||
"test_same_head_source_mutation_rejects_verdict_and_promotion",
|
||||
"test_schema_rejects_unknown_missing_types_and_ids",
|
||||
"test_scientific_artifacts_and_secret_path_escapes",
|
||||
"test_source_binding_add_delete_mode_and_escape",
|
||||
"test_state_root_and_path_escape",
|
||||
"test_surprise_blocks_and_resolution_invalidates",
|
||||
"test_unavailable_model_and_config_bound",
|
||||
"test_wip_bound",
|
||||
"test_zero_exit_error_and_incomplete_events_fail"
|
||||
],
|
||||
"passed": [
|
||||
"test_acceptance_requires_independent_final_integrated_package",
|
||||
"test_actual_worktree_identity_and_baseline_without_source_commits",
|
||||
"test_baseline_rechecked_under_reservation",
|
||||
"test_candidate_worktree_binding_cannot_claim_integration",
|
||||
"test_checkpoint_basis_session_model_and_bounds",
|
||||
"test_config_mutation_during_zero_exit_success_fails",
|
||||
"test_dry_run_writes_no_run_and_no_fallback",
|
||||
"test_duplicate_json_keys_and_nonfinite_numbers",
|
||||
"test_error_followed_by_success_still_fails",
|
||||
"test_evidence_source_tampering_and_revision",
|
||||
"test_final_integrated_verifier_launch_preserves_guards",
|
||||
"test_identity_and_dependency_fail_closed",
|
||||
"test_immutable_inputs_and_criterion_coverage",
|
||||
"test_integrated_re_source_mutation_rejects_acceptance",
|
||||
"test_lease_concurrent_acquisition_exactly_one_winner",
|
||||
"test_lease_token_owner_and_explicit_stale_release",
|
||||
"test_lifecycle_no_bypass_or_missing_inputs",
|
||||
"test_missing_and_stale_checkpoint_and_artifact",
|
||||
"test_model_mismatch_and_nonzero_exit_fail",
|
||||
"test_model_registry_no_fallback",
|
||||
"test_multiple_surprises_remain_blocked_until_all_resolved",
|
||||
"test_old_recovery_checks_integrity_but_not_age",
|
||||
"test_permissions_expanded_prompt_and_provenance",
|
||||
"test_resolution_permission_scope_and_architecture_authority",
|
||||
"test_run_missing_end_checkpoint_is_incomplete",
|
||||
"test_run_success_captures_actual_events_and_checkpoint",
|
||||
"test_runner_role_status_surprise_and_missing_checkpoint",
|
||||
"test_running_reservation_is_not_stolen",
|
||||
"test_same_head_source_mutation_rejects_verdict_and_promotion",
|
||||
"test_schema_rejects_unknown_missing_types_and_ids",
|
||||
"test_scientific_artifacts_and_secret_path_escapes",
|
||||
"test_source_binding_add_delete_mode_and_escape",
|
||||
"test_state_root_and_path_escape",
|
||||
"test_surprise_blocks_and_resolution_invalidates",
|
||||
"test_unavailable_model_and_config_bound",
|
||||
"test_wip_bound",
|
||||
"test_zero_exit_error_and_incomplete_events_fail"
|
||||
],
|
||||
"returncode": 0,
|
||||
"schema": "sots-controls-test/1",
|
||||
"source_binding": {
|
||||
"engine": {
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"path": "/home/alex/sots-engine",
|
||||
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||
},
|
||||
"re": {
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"path": "/home/alex/sots-re",
|
||||
"sha256": "6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8"
|
||||
}
|
||||
},
|
||||
"status": "passed",
|
||||
"stderr": "test_schema_rejects_unknown_missing_types_and_ids (test_controls.Controls) ... ok\ntest_duplicate_json_keys_and_nonfinite_numbers (test_controls.Controls) ... ok\ntest_state_root_and_path_escape (test_controls.Controls) ... ok\ntest_lifecycle_no_bypass_or_missing_inputs (test_controls.Controls) ... ok\ntest_identity_and_dependency_fail_closed (test_controls.Controls) ... ok\ntest_missing_and_stale_checkpoint_and_artifact (test_controls.Controls) ... ok\ntest_checkpoint_basis_session_model_and_bounds (test_controls.Controls) ... ok\ntest_wip_bound (test_controls.Controls) ... ok\ntest_surprise_blocks_and_resolution_invalidates (test_controls.Controls) ... ok\ntest_multiple_surprises_remain_blocked_until_all_resolved (test_controls.Controls) ... ok\ntest_acceptance_requires_independent_final_integrated_package (test_controls.Controls) ... ok\ntest_evidence_source_tampering_and_revision (test_controls.Controls) ... ok\ntest_lease_concurrent_acquisition_exactly_one_winner (test_controls.Controls) ... ok\ntest_lease_token_owner_and_explicit_stale_release (test_controls.Controls) ... ok\ntest_model_registry_no_fallback (test_controls.Controls) ... ok\ntest_runner_role_status_surprise_and_missing_checkpoint (test_controls.Controls) ... ok\ntest_final_integrated_verifier_launch_preserves_guards (test_controls.Controls) ... ok\ntest_old_recovery_checks_integrity_but_not_age (test_controls.Controls) ... ok\ntest_same_head_source_mutation_rejects_verdict_and_promotion (test_controls.Controls) ... ok\ntest_integrated_re_source_mutation_rejects_acceptance (test_controls.Controls) ... ok\ntest_immutable_inputs_and_criterion_coverage (test_controls.Controls) ... ok\ntest_candidate_worktree_binding_cannot_claim_integration (test_controls.Controls) ... ok\ntest_source_binding_add_delete_mode_and_escape (test_controls.Controls) ... ok\ntest_scientific_artifacts_and_secret_path_escapes (test_controls.Controls) ... ok\ntest_run_success_captures_actual_events_and_checkpoint (test_controls.Runner) ... ok\ntest_run_missing_end_checkpoint_is_incomplete (test_controls.Runner) ... ok\ntest_unavailable_model_and_config_bound (test_controls.Runner) ... ok\ntest_dry_run_writes_no_run_and_no_fallback (test_controls.Runner) ... ok\ntest_model_mismatch_and_nonzero_exit_fail (test_controls.Runner) ... ok\ntest_running_reservation_is_not_stolen (test_controls.Runner) ... ok\ntest_zero_exit_error_and_incomplete_events_fail (test_controls.Runner) ... ok\ntest_config_mutation_during_zero_exit_success_fails (test_controls.Runner) ... ok\ntest_error_followed_by_success_still_fails (test_controls.Runner) ... ok\ntest_resolution_permission_scope_and_architecture_authority (test_controls.Runner) ... ok\ntest_baseline_rechecked_under_reservation (test_controls.Runner) ... ok\ntest_permissions_expanded_prompt_and_provenance (test_controls.Runner) ... ok\ntest_actual_worktree_identity_and_baseline_without_source_commits (test_controls.Worktrees) ... ok\n\n----------------------------------------------------------------------\nRan 37 tests in 6.919s\n\nOK\n",
|
||||
"stdout": ""
|
||||
}
|
||||
51
campaign/evidence/research-completion-abi-static.json
Normal file
51
campaign/evidence/research-completion-abi-static.json
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"id": "research-completion-abi-static-run-79357a65226f61d6a86c042d",
|
||||
"axis": "static-recovery",
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json",
|
||||
"sha256": "4fdf2cbf02f0f3dd53c4ccfd1787a2fb8012d0de76dad63e97c2b5cfbdc6c46c",
|
||||
"source": {
|
||||
"engine": {
|
||||
"path": "/home/alex/sots-engine",
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23"
|
||||
},
|
||||
"re": {
|
||||
"path": "/home/alex/sots-re",
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7"
|
||||
}
|
||||
},
|
||||
"integrated": true,
|
||||
"source_binding": {
|
||||
"engine": {
|
||||
"path": "/home/alex/sots-engine",
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||
},
|
||||
"re": {
|
||||
"path": "/home/alex/sots-re",
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"sha256": "e74ef6cff202ee35a6fdc38d63842b4826a074e34502dfc2981a33ffea912bd4"
|
||||
}
|
||||
},
|
||||
"binaries": [
|
||||
{
|
||||
"path": "dumps/sots.exe",
|
||||
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"
|
||||
}
|
||||
],
|
||||
"inputs": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/run-79357a65226f61d6a86c042d/report.md",
|
||||
"sha256": "d5a28f01002f1711cf8575ffd817a8f0998b413c6280d656e6cdad5a90a04477"
|
||||
}
|
||||
],
|
||||
"outcomes": [
|
||||
{
|
||||
"criterion": "ownership-recovered",
|
||||
"status": "pass",
|
||||
"artifact": {
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json",
|
||||
"sha256": "4fdf2cbf02f0f3dd53c4ccfd1787a2fb8012d0de76dad63e97c2b5cfbdc6c46c"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
55
campaign/evidence/research-completion-abi-validation.json
Normal file
55
campaign/evidence/research-completion-abi-validation.json
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
{
|
||||
"id": "research-completion-abi-validation-run-735fcb8f4876c10285b03fad",
|
||||
"axis": "validation",
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/independent-state.json",
|
||||
"sha256": "6463816f322803b2b7b479e1fc116c4ffa33fb2772a3005d492422a00acea433",
|
||||
"source": {
|
||||
"engine": {
|
||||
"path": "/home/alex/sots-engine",
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23"
|
||||
},
|
||||
"re": {
|
||||
"path": "/home/alex/sots-re",
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7"
|
||||
}
|
||||
},
|
||||
"integrated": true,
|
||||
"source_binding": {
|
||||
"engine": {
|
||||
"path": "/home/alex/sots-engine",
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||
},
|
||||
"re": {
|
||||
"path": "/home/alex/sots-re",
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"sha256": "e74ef6cff202ee35a6fdc38d63842b4826a074e34502dfc2981a33ffea912bd4"
|
||||
}
|
||||
},
|
||||
"binaries": [
|
||||
{
|
||||
"path": "dumps/sots.exe",
|
||||
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"
|
||||
}
|
||||
],
|
||||
"inputs": [
|
||||
{
|
||||
"path": "verify/results/saves/turn3-state.sav",
|
||||
"sha256": "978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json",
|
||||
"sha256": "4fdf2cbf02f0f3dd53c4ccfd1787a2fb8012d0de76dad63e97c2b5cfbdc6c46c"
|
||||
}
|
||||
],
|
||||
"outcomes": [
|
||||
{
|
||||
"criterion": "independent-cross-check",
|
||||
"status": "pass",
|
||||
"artifact": {
|
||||
"path": "verify/results/research-completion-abi-independent/integration-lead-20260910/independent-state.json",
|
||||
"sha256": "6463816f322803b2b7b479e1fc116c4ffa33fb2772a3005d492422a00acea433"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
23
campaign/models.json
Normal file
23
campaign/models.json
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"schema": "sots-models/1",
|
||||
"roles": {
|
||||
"lead": "openai/gpt-5.6-sol",
|
||||
"resolver": "openai/gpt-6-astra",
|
||||
"architecture-review": "openai/gpt-5.6-sol",
|
||||
"analyst": "openai/gpt-5.6-sol",
|
||||
"implementer": "openai/gpt-5.6-sol",
|
||||
"verifier": "openai/gpt-5.6-sol",
|
||||
"lab": "openai/gpt-5.6-sol"
|
||||
},
|
||||
"agents": {
|
||||
"lead": "sots-lead",
|
||||
"resolver": "sots-resolver",
|
||||
"architecture-review": "sots-lead",
|
||||
"analyst": "sots-analyst",
|
||||
"implementer": "sots-implementer",
|
||||
"verifier": "sots-verifier",
|
||||
"lab": "sots-lab"
|
||||
},
|
||||
"max_steps": 40,
|
||||
"implementation_wip": 2
|
||||
}
|
||||
|
|
@ -1,46 +1,10 @@
|
|||
# Open questions
|
||||
# Questions and surprises
|
||||
|
||||
Each links to the finding that raised it. Promoted to backlog or closed by **re-quartermaster**.
|
||||
Active blockers belong to the affected `contracts/*.json` and its checkpoint. Falsified assumptions,
|
||||
conflicting evidence, instrument effects and changed scope belong in `runtime/surprises/`, with a
|
||||
discriminating probe and an Astra resolution in `runtime/decisions/` before affected work resumes.
|
||||
|
||||
- **Compiler archive mismatch** — imports say MSVCR100/MSVCP100 (VS2010), but Ghidra applied
|
||||
`windows_vs12_32` datatypes (closest available). Confirm the exact toolchain from the PE Rich
|
||||
header; decide which datatype archive best fits. (from [[01-fingerprint]])
|
||||
- **Battle-load root cause** — inferred as single-threaded engine + core-count-sensitive code;
|
||||
must be confirmed by a `ForceSingleCore=0` vs `=1` diff once the main loop is mapped.
|
||||
(from [[00-strategy]])
|
||||
- **Save-editor struct coverage** — community editors cover players/tech/systems; fleet/combat
|
||||
state coverage may be partial. Treat as strong hints, verify each field against real saves.
|
||||
- **Lockstep determinism** — `@SYNC ERROR DETECTED: Frame %d` indicates a deterministic lockstep sim. Big for reimplementation + old-vs-new differential (determinism makes equivalence checkable frame-by-frame). Confirm scope. (from [[strings-and-config]])
|
||||
- **Mods override mechanism** — `.gob` = `gobio::ZipFileSystem` with a `NativeFileSystem` loose-file override; this is how `./Mods` wins over archived files. Verify load order. (from [[strings-and-config]])
|
||||
- **Battle-load root cause** — the shipped fix is a blunt process-affinity pin (`FUN_0089ee70`) with NO CPU-topology detection, so there is no adaptive branch. The real cause is emergent multi-core contention: which thread(s)? Investigate the 3 `CreateThread` sites (`FUN_00902350`, `FUN_00736e30`, startup `FUN_008a0e50`), the streaming-sound thread, and lockstep sync waits. (from [[ghidra-recon]])
|
||||
- **Save-struct contradictions (R1 vs R2)** — field widths (`Abdn`/`Dstyd`/`ltis` Int16 vs Int32; `Bats2`), R2's `OID = PID*16` owner-handle claim, species id 4 (`_NPC` vs 'AI Rebellion'). Resolve against the binary's Streamable read code. (from [[save-editor-structs]])
|
||||
- **Unlabeled save blocks** — `CdPlayer` (unknown1..35), empty `SimSystemDetailSpy`, opaque ~2500 B RNG blob. Analyst targets once the Streamable readers are located. (from [[save-editor-structs]])
|
||||
- **Missing HUD scripts** — exe references `GUI/Combat/CombatHUD.script`, `SensorHUD.script`, `NoHUD.script` but none ship in the gobs or loose; likely dev-only overrides via the gobio native-FS fallback. Confirm via `CombatScreen` load path. Also: `.script` files are display configs, not widget layouts (corrects round-one note). (from [[ui-screen-map]])
|
||||
- **Tech `allows` default per-race %** — `tech_tree.json` edges only carry races written in the `allows` string; the default for an unlisted race (believed 100%) is engine code. Ghidra target in the tech loader. (from [[data-parsers]])
|
||||
- **Engine parser leniency** — 12 shipped shipsections are syntactically broken (unclosed `{`, extra `}`) yet load; keys and identifiers are case-insensitive. Reimplementation must match this leniency. `.effect` is its own `TXT`/`BEGIN-END` format, not brace-block (corrects round one). (from [[data-parsers]])
|
||||
- **Struct recovery leftovers** — `PlayerColorID` exact on-disk width (writer `FUN_008b9cb0` undecompiled); `ServerSystem+0x10` owner type; `TechTree` per-tech body; `CdPlayer` block. R2's `OID = PID*16` is an id-allocation pattern, not in this code. (from [[struct-recovery]])
|
||||
- **Resolved (R1/R2 contradictions)** — `Bats2`/`rcex` are int64 (R2 wrong); `Abdn`/`Dstyd` bools, `ltis` int; `TRM`/`CstR/E/T`/`shrm`/`RefCap`/`RepCap`/PlayerView `Infra` are floats; `pswd` string; `TShn`/`ETS`/diplomacy counters int16 in memory, int32 on disk; `Nexp` carries `xid/xmin/xmax/xper`; `FtOrig` is Vector3. (from [[struct-recovery]])
|
||||
- **Battle-load, narrowed** — sim/combat load run on the main thread; the only other threads are net watchdog, TIME_CRITICAL audio streaming (`g_musicCS`), and a star-map mesh builder. Hypothesis: audio-thread critical-section contention or D3D9 runtime/driver threads on many cores. Needs a dynamic profile (x32dbg / ETW) under the software-GPU stack. (from [[turn-spine]])
|
||||
- **Spine leftovers** — `StrategyServer` struct partial (41 fields); static-initialiser region 0x009be000–0x009c1400 undisassembled; `Mars::Stream` vftable not located; several small ProcessTurn phase fns unnamed. (from [[turn-spine]])
|
||||
- **Save framing ambiguities (settle on first real save)** — padding joint `[len][name][value][pad]` vs split; bool vs int for names with len%4==0 (no type byte); on-disk tags for Summary/CreateParameters and count/element tags inside framed arrays unknown (positional for now). A real 3-char bool tag (`NPC`,`Dep`,`hsp`) settles padding. (from [[SAVE_FORMAT]])
|
||||
- **Strict-parse gaps vs real save (verifier output, round 3)** — (1) `ServerSystem`: 7/28 systems carry `VFlags` where `Name`/`vnh` were expected — a conditional layout (uncolonized/special systems?); (2) `halt[].haltv` is a 31/35-byte struct, not a bool; (3) optional `indi` (IndependenceInfo?) precedes `NVE`/`PID` in some systems; (4) `PrisonerHold.prisoners[]` entries lack `PrNSp`; (5) `/createParams/key` is int; (6) `turnstats.hist.stats.tch` is int; (7) optional trailing `zdsi`/`zdst`. Padding = **joint** (settled). 7 resyncs / 2728 raw bytes ≈ RNG blob. (from [[turn2-strict-issues]])
|
||||
- **RESOLVED: strict-parse gaps** — 5/8 were reader bugs (ASCII plausibility test applied to string values; empty string == int 0), 3 real: `PrNSp` only when `PrMax>0`; `indi` unconditional in `NVO` nodes (system-level gated by `hindi`); `zdsi/zdst` pairs under `zdsc`. `Key` is an empty string; `tch` int. Summary/CreateParams tag lists confirmed. Reader patch in flight. (from [[schema-gaps-resolved]])
|
||||
- **RESOLVED: save framing** — padding is joint; `"."` = NULL tag (VectorHelper count+elements, Vector3 bodies); empty strings are 4 zero bytes; `CDT` is a tagged frame + opaque `CD` frames. All three real saves parse `--strict` clean. Note: `SvSctOb` IS present in all saves (patch doc §7 was wrong). (from [[SAVE_FORMAT]])
|
||||
- **(parked) Combat loader job API** — does tactical-battle loading go through the job helpers `0x8fc160`/`0x8fa5b0` with the `TryEnterCriticalSection→Sleep(1000)` completion poll (`0x0071ea60`)? If yes, that is a plausible many-core stall (lost try-lock = +1 s per poll). End Turn also has a deliberate `Sleep(computed)` ≈0.85 s at `0x00838da9`. (from [[battle-load-profile]])
|
||||
- **Ship-design code rules (Ghidra, from SHIP_DESIGN_RULES.md §8)** — hidden default rider designs are built WITHOUT tech gating (where?); is section class-equality enforced or merely unoffered; confirm the turret class-accept table (`standard ← {standard,missile,grapple}`, `strafe ← {standard}`; grapple weakest); hull-class tech injection (`IND_CruisCon`/`IND_DreadCon`) + station exemption; option defaults/auto-upgrade and what `option_cost` multiplies; weapon cost per bank vs per mount; mass/speed formulas; `faiDes`/`dWep` meaning. (from [[SHIP_DESIGN_RULES]])
|
||||
- **Corrections from turn internals** — `ServerPlayer+0xf9` is the AI flag (not bTurnDone); `FUN_007d7f70` is encounter detection; ProcessTurn phase 2 is trade, not diplomacy; the spine's `FUN_00840fe0` 'income' is special projects — income is `FUN_00863030` ComputeBudget. `TECHBEN_*` data blocks are inert (effects hard-coded via the 116-entry tech-name table @0x00a19718). Open: TRA/TRP producers, `FPsp2` derivation, `PERGATETRAFFIC_*` readers, exact BnkEl/BnkPr expression. (from [[strategic-turn-internals]])
|
||||
- **`Mars::Application::Initialize` signature (P2-M0 finding)** — a C++ `__thiscall` detour that called the original crashed inside Initialize; the trace hook now uses a convention-agnostic asm stub. Verify the real signature (stack args? EDX use? return value?) before any `compare`/`replace` hook on it. Same caution for every `[unverified]` entry in `ghidra/addresses.json`. (from [[m0]])
|
||||
- **Formula gaps surfaced by the game/sim port (feed back to Ghidra)** — which bankruptcy limit carries the 3.3 factor and when the bankruptcy start turn is stamped; the suitability→carrying-capacity hazard curve shape; the trade-points→money system-income tail; the `POPBONUS_INC` population increment; the expense-slider request term; which running total the tech-income bonus / savings aid read; node-line speed clamp at the influence radius; whether `DecayAllResearch` also hits the current target. (from [[game-sim]])
|
||||
- **RESOLVED: Initialize signature** — `bool __thiscall Application::Initialize(this, AppStartup*)`, RET 4; Run = `void(this)`; OnTick = `bool(this)`. Plain thiscall wrappers are safe for Run/OnTick; Initialize needs the extra arg. (from [[loader-prototypes]])
|
||||
- **PARITY BUG (fix in mars/text + Python flat_kv): duplicate config keys are FIRST-occurrence-wins in the engine** (entry erased on use; duplicates log 'multiply defined'); our readers implement last-wins. Also the brace parser DROPS a final key/value pair that lacks a trailing newline, and uses whitespace-only delimiting (braces not delimiters) with `" ' \`` quotes and no escapes — mars/parse must match these for compare mode; verify on the 12 broken sections + a no-trailing-newline fixture. (from [[loader-prototypes]])
|
||||
- **Not traced end-to-end** — `Species/_NPC/weapons/*.weapon` loading and the `.effect` dictionary entry `EffectDictionary_Load` (0x008b42b0, unverified). (from [[loader-prototypes]])
|
||||
- **RESOLVED: End-Turn oracle** — deterministic and cross-process: compare autosaves by sha256, no masking. Only when diffing a re-save of a *loaded post-turn* autosave: mask `Player.Status` (→0) and recompute/ignore `Summary.Checksum` (additive). (from [[determinism-oracle]])
|
||||
- **SAVE_FORMAT tag corrections (fix Python reader + spec)** — real on-disk tags: `otnF` (not `ontF`) in Odes/Owep/Otch, `nextid` (not `nextId`) in NdGr2, Design = `FAIDes/DHide/DWep/DName`; `ords`/`wpts` are real tags. Python's positional R() matching hid these. RNG: float mapping `(float)(y*2^-32)`, `next_int` mask, and lazy-vs-eager twist at `left==0` still need binary confirmation. (from [[mars-stream]])
|
||||
- **RESOLVED: tech `allows` default** — unlisted species = 1.0 (confirmed in `FUN_005822d0` tree-creation roll, strategic-turn-internals §2); `game/data` uses 100. Still open from game/data: what the engine's converter does with the 34 malformed tokens (`force_right o`, `crew false`, `1.0f`, `0-5`, ``90\``); repeated scalars in a block are last-wins per the sequential if/else consumers (loader-prototypes §M3) — confirm on a fixture in compare mode. (from [[game-data]])
|
||||
- **RESOLVED: SAVE_FORMAT tag names** — all corrections confirmed by bytes and applied to the Python reader + spec (§10). Residual doc debt: `findings/objects/save-editor-structs.md` and `verify/design-rules/SHIP_DESIGN_RULES.md` still quote R1's `ontF/faiDes/nextId` spellings (R1-provenance; annotate rather than rewrite). (from [[SAVE_FORMAT]])
|
||||
- **RESOLVED (2026-09-08, lane S): `std::string` layout and size, once and for all** — `_Bx@0, _Mysize@0x10, _Myres@0x14, _Alval@0x18`, **sizeof 0x1c**, and there is exactly **one** instantiation in this binary. `struct-recovery.md` §0 was right (its §0 prose had `size`/`res` transposed — fixed); `turn-spine.md` §1.1 was wrong (already annotated); `loader-prototypes.md` and one `addresses.json` prototype said 0x18 — fixed. Lane X's `ObservedTech` 0x18 reading was a mis-attribution: `+0x24` is the string's trailing `_Alval`, not a data field, proved by three complete enumerations of the element (`ObservedTech::Write` 0x00817cf0, ctor 0x008562a0, copy ctor 0x0079a184) and generalised over the whole exe by `tools/strfootprint.py` (65 string members, 0 collisions inside the 0x1c span, 51/52 gaps exactly 0x1c). **Zero recovered struct tables were wrong** — `pswd` included. Standing rule that follows: *never size a struct member from the offsets the code touches* — this build's STL puts the empty allocator **last** in both `string` (0x1c) and `vector` (0x10), and an empty allocator is never loaded or stored, so a touch-scan undercounts by 4 every time. See `observedtech-append.md` §9. (from [[re-windows-2000s-howto]], [[observedtech-append]])
|
||||
- **RESOLVED: formula gaps (all 8)** — see [[formula-gaps]]; game/sim's low-confidence functions can now be pinned. **RESOLVED: std::string** = `_Bx@0,_Mysize@0x10,_Myres@0x14,_Alval@0x18`, sizeof 0x1c (struct-recovery §0 right; turn-spine §1.1 WRONG — annotated). **CORRECTION:** the 116-entry table @0x00a19718 is a name-membership list, not the effects table; use `g_TechIdNames` (196) + `OnTechResearched`. Open: values of the 6-entry AI-tech bonus table (0x00a17888); producer of ServerPlayer +0x224/+0x228/+0x22c beyond the setup-record copy (0x0077b620). (from [[tech-effects]])
|
||||
- **RESOLVED: RNG semantics** — `Seed` is `thiscall(this, uint32)` RET 4 (MT19937 init + immediate twist); `Twist` takes `this` in ECX only; **twist is LAZY** (`if (left==0) Twist()` inside the draw), `left` lives at `+0x9c4`, confirming the save blob layout. **float mapping, needs a targeted check (not a red flag):** `NextFloat` decompiles as returning `float10`, but that is simply how x86 float returns look (value in `ST(0)`), so it is weak evidence of extended-precision *computation*; a single `y * 2^-32` multiply rounds once either way. B3 should still compare the mapping explicitly (exact constant and whether the draw is `y*2^-32`, `(y>>8)*2^-24`, or divided by 2^32-1), and the x87-vs-SSE float-parity policy from the RE how-to is still needed before the x64 standalone. `RNG_NextInt` signature still unverified. (own Ghidra pass)
|
||||
- **Struct-modelling hazard (found by M2)** — an MSVC-2010 `std::vector` member is **three words**, so a naive C translation put the next pointer at `+0x18` when it is really at `+0x14`; the hook silently reported the unmodelled word (string bytes `"TION"`) as a real field. Any hand-modelled game struct must pin its size with `static_assert` and account for 3-word vectors. (from [[M2]])
|
||||
- **x87 precision-control mode at runtime** — 53-bit MSVC default vs 24-bit if D3D9 grabbed the FPU; moves only the last bit (~0.094% of words). `float_from_pc24()` models it and the B3 hook logs `fpu_cw` per call, so the first B3 trace settles it. (from [[B3]])
|
||||
- **Some truths are unreachable by compare** — B3's draw-divisor bug differed on 0.78% of draws yet flipped 0 decisions in 1e6, so a behavioural compare would have passed while the code was wrong. Static reading of the instruction stream remains necessary; compare validates, it does not discover. (from [[B3]])
|
||||
Use [campaign controls](README.md) to record and resolve them. The generated [board](board.md)
|
||||
shows open surprise records, dependencies and stop conditions. [The plan](backlog.md) defines
|
||||
priority; domain uncertainties and their historical resolutions remain alongside their scientific
|
||||
evidence in `../findings/`. This page is an entry point, not a second question ledger.
|
||||
|
|
|
|||
280
campaign/pilots/research-replacement.md
Normal file
280
campaign/pilots/research-replacement.md
Normal file
|
|
@ -0,0 +1,280 @@
|
|||
# Proposed pilot: completion-bearing research replacement
|
||||
|
||||
Status: **proposed**. This is a contract design, not replacement acceptance. Current architecture
|
||||
owner is `Astra pilot architect` in the `architecture-review` role on `openai/gpt-5.6-sol`;
|
||||
subsequent implementation and independent verification use distinct campaign executions.
|
||||
The target is a bounded replacement of `Game::TechTree::ProcessResearch`, its `SetResearched`
|
||||
cascade and required completion callback writes on explicitly certified workloads. Broad research
|
||||
displacement remains unproved. No new live address, remote deployment or dependency policy is
|
||||
authorized by this document.
|
||||
|
||||
## 1. Evidence inspected independently (2026-09-09)
|
||||
|
||||
Sources: `findings/subsystems/research-replace.md`; archived CR compare JSON, raw compressed
|
||||
traces, shim logs and saves; current engine research, tech-effect and event interfaces. Archived
|
||||
engine build is `cr-618ccb1-20260909T131556Z`, not the rollout's current source snapshot.
|
||||
|
||||
Recomputed SHA-256:
|
||||
|
||||
| RE-relative file | bytes | SHA-256 |
|
||||
|---|---:|---|
|
||||
| `verify/results/saves/turn3-state.sav` | 67219 | `978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921` |
|
||||
| `verify/results/saves/cr/cr-oracle-endturn.sav` | 67212 | `e00eed0c03a31d27a81b7470a9dcc9ba08a2ac48c20baeee4f34749164743e3f` |
|
||||
| `verify/results/saves/cr/cr-oracle-autosave.sav` | 67811 | `79df50475a7b83afa927d992b9f030dcf45710f4bda0133b8b1fa4800a72e420` |
|
||||
| `verify/results/saves/cr/cr-replace0-autosave.sav` | 67511 | `6b51db992b158caa5424d71b2dccf72924af7198b4165bfcfc870e0d438fb6d5` |
|
||||
| `verify/results/saves/cr/cr-replace1-autosave.sav` | 67537 | `8a4309ee4fe0b3177a2820600b5016c7c256d0f51b065df469ecd0b4f2342235` |
|
||||
|
||||
Local reproduction (diagnostic tool exit alone is not an equality verdict):
|
||||
|
||||
```sh
|
||||
python3 verify/state-checksum/state_checksum.py verify/results/saves/cr/cr-oracle-autosave.sav verify/results/saves/cr/cr-replace1-autosave.sav --limit 40
|
||||
```
|
||||
|
||||
This reports **16** exact-bit, unmasked leaf differences. Oracle -> R1: OutMod 1.25 -> 1.1;
|
||||
ConMod[0..2] 0.9 -> 1; ResTNm empty -> IND_Waldo; EvNxID 7 -> 5; events 5/6 absent and
|
||||
turn-bucket count 3 -> 1; observed-tech element 11 absent and count 11 -> 10; BnkPr/BnkEl,
|
||||
RepCur/RepMax and Summary.Checksum differ. These are five primary scalar fields, collection
|
||||
writes/counts and five derived leaves. They are not permission to patch five downstream values.
|
||||
|
||||
`verify/results/compare/cr-compare.json:289-357` reports partial coverage: three comparisons,
|
||||
six undeclared spans in one call and eight unmodelled notes. In
|
||||
`verify/traces/cr-R1.jsonl.gz`, call 1 is replace, allocation tech 144 / 2898, input turn 4,
|
||||
order counter 22, observed count 10, roll_pending false, RNG left 413 and CW 4735 (`0x127f`).
|
||||
Its RNG digest/index/left are unchanged. Logs `verify/results/shim/cr/cr-R1.log:116-118`
|
||||
count one completion and three unlocks, then two zero-point calls. `otch_appends=1` counts a
|
||||
decision; it does **not** mean an element was constructed live.
|
||||
|
||||
### Corrections to inherited narrative
|
||||
|
||||
1. R1 log lines 75-94 show seven drawsite detours and twelve probes in addition to the six
|
||||
sites enumerated in CR findings. Instrumentation is broader than the template-hook config.
|
||||
Every fresh run needs a complete installed-site manifest, not an “exhaustive config” assertion.
|
||||
2. R1 runtime CW is `0x127f`, including the research trace argument; initialization prints
|
||||
`0x027f`. Preserve the full measured word and precision/rounding separately.
|
||||
3. Runtime string lookup is already an engine interface (`research_events.h:95-105`,
|
||||
`app/event_phase.cpp:10-14`). The absence of bundled game prose does not establish that
|
||||
original `PostEvent` is mandatory. Runtime asset loading is a concrete route to investigate.
|
||||
4. `shim/hooks/tech_effects.cpp:354-365` already writes player state/design masks and delegates
|
||||
node-bore updates in replace mode. The research hook does not integrate that complete callback;
|
||||
calling the helper “host-tested” is not evidence its full live boundary is implemented.
|
||||
|
||||
## 2. Workloads and access paths
|
||||
|
||||
### W1 — primary positive workload, exact LOAD route
|
||||
|
||||
On a future explicitly leased lab with operator-supplied executable/data paths: restore the
|
||||
hashed turn3 input as the only selected input save; start a fresh process; use Load Game, select
|
||||
the input, enter its lobby/map at Turn 3, then one End Turn to Turn 4. Verify UI/state transitions
|
||||
rather than sleep-and-assume. Preserve both output saves before any reset. Bind save selection,
|
||||
route, process identity, executable hash, assets, shim hash, config and instrumentation to evidence.
|
||||
|
||||
Historical predictions to re-certify before measuring candidate results:
|
||||
- Exactly three research calls, owners 32/496/512 in order, allocations 144:2898, 90:0, 9:0.
|
||||
- One IND_Waldo completion: progress 5768 -> 7500, state 3 -> 4, turn_researched -1 -> 4,
|
||||
order -1 -> 22, counter 22 -> 23, refund 1166. Flag unchanged.
|
||||
- Nodes 132/136/142 unlock, costs 10000/16000/8000, available turn 4. Save tree slots are
|
||||
94/98/104; tech 144 is slot 106. Never equate tech id with serialized slot.
|
||||
- One full ObservedTech record, two full events (completion followed by unlocked-techs),
|
||||
event next id 5 -> 7; primary effect fields reach oracle values; target clears.
|
||||
- Zero RNG words in this workload. This is a negative RNG control, not evidence for draws.
|
||||
|
||||
### W0 — regression control, insufficient for completion acceptance
|
||||
|
||||
`verify/results/saves/turn2-state.sav`, one End Turn via LOAD, reaches the turn3 input above.
|
||||
This exercises the research pass/overbudget event and a RNG word, but zero completions. Re-certify
|
||||
its two-process oracle independently and pin its input hash before use. Do not substitute W0
|
||||
for W1, or use zero-allocation calls as the positive execution threshold.
|
||||
|
||||
### W2 — path to broader completion evidence (not yet certified)
|
||||
|
||||
Select a different, archived completion-bearing input from the unlock continuations, or generate
|
||||
one under an approved lab contract; record the input hash and exact LOAD/continuation route before
|
||||
prediction. Require a different tech/effect family, a positive RNG draw and a second completion
|
||||
that observes the advanced order counter. The existing U/V evidence motivates selection but is
|
||||
not a ready executable workload contract. Separate controls are required for that exact route.
|
||||
Until W2 exists, any accepted pilot claim is restricted to W1 plus its declared regression checks.
|
||||
|
||||
## 3. Full write boundary and responsibilities
|
||||
|
||||
| Boundary | Required state / behavior | Existing interface and current gap |
|
||||
|---|---|---|
|
||||
| Research pass | all node progress/state/flag writes; signed capped spend and refund accumulator; decay of other Available nodes; RNG state, left and next index | `sim::ProcessResearchTurn`, `ResearchCompletionHook`; current CR pass writes live |
|
||||
| Unlock cascade | node costRP, availability/researched turn, order; tree order counter; child/prerequisite availability; recursive zero-cost completions and ordering | `sim::TechGraph` / `SetResearched`; replace cascade opt-in exists, transcription failures can currently skip it |
|
||||
| Completion callback | target pointer/ResTNm; pending-roll flags; every applicable player economy float, masks, boolean/species flags, design-option masks; node-bore storage/lifetime | `ApplyTechCompletion`, `RunCompletionTail`, `tfx::ReadPlayerState`/`WritePlayerState`; integrate with research on pre-call inputs, avoid already-researched guard |
|
||||
| Observed technology | dedup/update semantics, entire 0x2c record (name, first/last turns, detected, with), vector content/count/capacity and allocator ownership | research hook currently alters scratch span only; full live construction and update semantics need evidence |
|
||||
| Events | complete turn buckets and ordered records: id, summary, message, location, position, image, action, chainId; next id; dedup and pruning; all owned allocations | `events::EventStorage`, `PostResearchPassEvents`; research hook is count-only/compare-only; runtime text and live ABI adapter missing |
|
||||
| Callback outcomes beyond player | owned-system AI flags/caps/addiction/plague; ships' plague state; recursive Zuul tech grants; pending research-event RNG and plague/rebellion consequences including allocations/cancel research | `TechApplyOutcome` reports work, does not execute it; broader closure remains incomplete |
|
||||
| Downstream observation | budget/bankruptcy/repair/checksum consequences of primary effects | let ordinary turn processing derive them; full oracle must expose them, never harvest original post-state or hardcode expected leaves |
|
||||
|
||||
The W1 observed write set is a subset of this boundary. The complete callback has conditional
|
||||
system/ship/object writes absent on W1. A narrow pilot must preflight its supported class and
|
||||
fail closed before mutating on unsupported branches. Suppressed writes, unavailable graph/text,
|
||||
unknown pointers, unreadable names, failed allocation, or unmodelled fired rolls are blockers,
|
||||
not successful no-ops. General displacement requires separate evidence for all reachable effects.
|
||||
|
||||
Events require exact formatting/dedup order, `FLT_MAX` no-position values, action conversion,
|
||||
the original prune-window behavior and preexisting event contents. `KeylessEventText` substitutes
|
||||
tokens for prose and must never be serialized as a passing oracle. Completion message length
|
||||
above 255 has an explicitly documented divergence/undefined-original boundary; exclude or resolve
|
||||
it explicitly. Seed comparisons from pre-call state, not the original callback's output.
|
||||
|
||||
## 4. Inputs and original dependencies
|
||||
|
||||
Required immutable input manifest before ready:
|
||||
- Exact engine and RE baseline commits plus actual source-content hashes; paired worktrees;
|
||||
compiler/toolchain/build flags, host and shim binaries, generated-address provenance.
|
||||
- The hashed W1 input and oracle archive above, plus selected W0/W2 inputs as applicable.
|
||||
- Operator-owned game executable and proxy originals with hashes. The archived trace reports exe
|
||||
SHA-256 `970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841`; remeasure it.
|
||||
- Explicit runtime data root, manifest of tech definitions/graph, tuning/constants/species inputs,
|
||||
localized string-table files and locale/encoding/load order. Existing parser data must come
|
||||
from user assets, not copies of game prose embedded in source. Missing table/key is not empty text
|
||||
for acceptance. Asset paths and hashes are not yet supplied for this pilot.
|
||||
- Full configs and actually installed interceptors (template hooks, init, FPU sampling, probes,
|
||||
drawsites), FPU CW per call, input route/process-reset record, output/log/trace file hashes.
|
||||
|
||||
Original dependency ledger (each needs a lead decision and explicit qualification):
|
||||
1. **Existing:** research calls original `TechTree::Cost` for effective cost and cascade cost
|
||||
lookup (`shim/hooks/research.cpp:568-573,916-919`). Formula and applicable bonus-tech discovery
|
||||
are not displaced by this pilot merely because a host formula exists.
|
||||
2. **Existing separate B2 hook:** original has-researched lookup and node-bore updater
|
||||
(`tech_effects.cpp:325-328,358-365`). Node-bore updater allocates/frees state; it is not
|
||||
read-only despite the source comment's analogy. Reuse requires disclosure and effect accounting.
|
||||
3. **Proposed, undecided:** original string lookup / allocator / event posting helpers versus a
|
||||
runtime-asset text adapter and compatible live allocation. No selected policy or guessed address.
|
||||
4. **Outside replaced root:** original turn driver, budget allocator and remaining simulation,
|
||||
asset loading and save serializer still run in the shim experiment. Whole standalone turn
|
||||
equality is a different acceptance axis and cannot be inferred from this partial replacement.
|
||||
|
||||
## 5. Executable acceptance to provide before ready
|
||||
|
||||
The contract must eventually name real, versioned commands and dependencies for this sequence;
|
||||
the following are precise requirements, not a presently implemented runner:
|
||||
|
||||
1. Fresh full gate on hashed source/inputs, expected test identities, positive corpus execution,
|
||||
asset-dependent tests and shim build. A host-only pass is insufficient. Bind full gate manifest
|
||||
and resulting binary to every experiment and reject source/input changes.
|
||||
2. Two fresh-process C1/C2 controls with hooks off, same proxy, input, assets and exact W1 route;
|
||||
both output pairs equal byte-for-byte. Archive independent process logs; one saved oracle
|
||||
copy is not independent proof that two processes agreed.
|
||||
3. Compare-neutral N with the candidate binary and complete instrumentation manifest; both
|
||||
output saves byte-equal controls; positive W1 counters and decoded state. Zero compared calls,
|
||||
partial required-region coverage or undeclared required writes cannot pass.
|
||||
4. Replace R, same baseline and binary, bypass original ProcessResearch and required displaced
|
||||
callback implementation (count explicit original helper calls separately). Require exactly
|
||||
one W1 completion/three unlocks, real element/event writes, zero failures/unreadable inputs,
|
||||
and full declared state validation including nonserialized order counter and RNG state.
|
||||
5. Require **post-turn** autosave byte equality, inflated equality and exact-bit unmasked state
|
||||
equality independently, with reader reconstruction coverage. Pre-turn EndTurn equality alone
|
||||
cannot satisfy acceptance. No masks for event text, callback fields or derived discrepancies.
|
||||
6. Negative controls must fail: archived R0 (27 differences) and R1 (16); zero-completion W0
|
||||
cannot satisfy W1 threshold; omit callback/event/ObservedTech write or use wrong input hash;
|
||||
remove a trace/log/output; mark unknown RNG as zero. Checker rejects all.
|
||||
7. Independently assigned verifier re-runs the checks and ties verdict to contract, source,
|
||||
binary, asset and evidence digests. Implementation worker cannot self-certify acceptance.
|
||||
Integration requires revalidation of integrated source; changed inputs invalidate evidence.
|
||||
|
||||
W2 and branch-specific tests must be added before expanding the claim to RNG-consuming,
|
||||
Zuul/early-completion, nonzero-decay, zero-cost recursion, prerequisite/no-auto-available,
|
||||
re-observed/deduplicated, temperance, plague or rebellion cases. Their absence is visible coverage
|
||||
debt, not satisfied execution. Local simulation tests alone do not establish live allocator safety.
|
||||
|
||||
### 5.1 Acceptance interface fixed before implementation (2026-09-10)
|
||||
|
||||
The accepted `research-completion-abi` contract closes the static record/container dependency only.
|
||||
It does not close live allocation safety or any replacement criterion. The pilot checker and run
|
||||
driver do not yet exist, so the commands below are required interfaces and remain blockers, not
|
||||
executable claims:
|
||||
|
||||
```sh
|
||||
python3 tools/research_replacement.py preflight --package MANIFEST.json --workload W1
|
||||
python3 tools/gate.py --engine ENGINE --corpus CORPUS --out NEW_GATE_DIR \
|
||||
--profile full --data DATA --shim --sots-input SOTS_EXE=EXE --sots-input SOTS_PROXY=PROXY
|
||||
python3 tools/research_replacement.py certify-controls --package MANIFEST.json --workload W1 \
|
||||
--c1 C1_DIR --c2 C2_DIR --compare N_DIR
|
||||
python3 tools/research_replacement.py check-replace --package MANIFEST.json --workload W1 \
|
||||
--replace R_DIR --oracle C1_DIR
|
||||
python3 tools/research_replacement.py negative-controls --package MANIFEST.json \
|
||||
--replace0 verify/results/saves/cr/cr-replace0-autosave.sav \
|
||||
--replace1 verify/results/saves/cr/cr-replace1-autosave.sav --w0 W0_DIR
|
||||
```
|
||||
|
||||
`MANIFEST.json` must bind paired source manifests, the full-gate manifest and shim binary, owner
|
||||
executable/proxy, generated addresses, data root and every consumed tech/tuning/species/string file,
|
||||
locale/encoding/load order, exact configs and installed-site manifest, W1/W0 saves, process route,
|
||||
and output/log/trace hashes. Each command must fail on an absent or extra required artifact, hash or
|
||||
source drift, stale output directory, zero required execution, unexpected skip, unreadable input,
|
||||
unsupported branch, or unknown RNG. `check-replace` must separately report file bytes, inflated
|
||||
bytes, exact-bit typed state, reader coverage, nonserialized order counter, complete RNG state and
|
||||
actual words, callback/helper counters, allocations and complete event/ObservedTech elements.
|
||||
|
||||
Before any implementation contract can become ready, an independent verifier must turn these
|
||||
interfaces into an executable falsifier plan covering archived R0 and R1, a wrong W1 hash, each
|
||||
missing callback/event/ObservedTech write, an omitted output/log/trace/site manifest, W0 presented
|
||||
as the positive, unknown RNG presented as zero, original displaced-root fallback, and same-HEAD
|
||||
source-byte drift. Verifier and implementer executions must be different sessions.
|
||||
|
||||
### 5.2 Bounded W1 architecture and dependency decisions
|
||||
|
||||
The replacement is one ordered coordinator with a dry-run preflight, not three independently
|
||||
acceptable leaf patches. Preflight reads all three owner calls and computes the complete W1 plan on
|
||||
scratch state before the first live write. It must positively identify the exact owner/allocation
|
||||
sequence, one tech-144 `IND_Waldo` completion, the three unlocks, no pending research roll, no
|
||||
unmodelled conditional system/ship/Zuul/plague/temperance/rebellion effect, and an explicit outcome
|
||||
for every recursive-completion and decay branch. The eventual immutable W1 manifest must state the
|
||||
certified expected outcomes; any mismatch is unsupported and blocks before mutation. This is a W1
|
||||
classifier, not a general research implementation.
|
||||
|
||||
The coordinator then preserves original order: research arithmetic; `SetResearched` node/order
|
||||
writes; full ObservedTech record operation; matched-target handling; full completion event; W1 player
|
||||
effects and common tail; unlocked-tech event; remaining pass writes. It must use pre-call state for
|
||||
all decisions. Allocation failure after mutation is an observed failed run and cannot pass; this
|
||||
plan does not claim transactional rollback that the original does not provide.
|
||||
|
||||
Original-helper policy for this bounded pilot is explicit:
|
||||
|
||||
1. **Retain and count `TechTree::Cost`** for effective and cascade costs. Independent cost
|
||||
replacement is excluded from the claim.
|
||||
2. **Retain and count `TechTree::HasResearched`** for the common callback tail and design masks.
|
||||
The replacement owns the resulting mask and field writes; the helper is lookup only.
|
||||
3. **Retain and count `ServerPlayer::UpdateNodeBoreParams`** at its original common-tail position.
|
||||
It may allocate/free through the game's CRT even when W1 does not select a bore tech.
|
||||
Independent node-bore maintenance is excluded.
|
||||
4. **Use the original MSVCR100 scalar new/delete family and accepted record/container ABI as a
|
||||
live memory bridge**, with every allocation/copy/destruction operation counted. This is
|
||||
original-runtime allocation assistance, not standalone allocator replacement.
|
||||
5. **Do not call original `ProcessResearch`, `SetResearched`, `OnTechResearched`,
|
||||
`RecordObservedTech`, `EventStorage::PostEvent`, or original string lookup** in replace mode.
|
||||
Runtime owner assets must supply localized text to an engine-side lookup; replacement code owns
|
||||
record contents, event IDs/order/dedup/pruning and callback effects. Keyless text is forbidden.
|
||||
6. The original turn driver, budget allocation, asset loading and save serializer remain outside
|
||||
the replaced root and must be disclosed separately from retained helpers.
|
||||
|
||||
Static ABI acceptance unlocks exactly one preparatory dependency: a live record-bridge contract
|
||||
must exercise ObservedTech, TurnEvents and PlayerEvent operations with empty/spare/full capacity,
|
||||
short/long strings, repeated observed names, exact duplicate and description-only-different events,
|
||||
normal destruction and a recorded failure path, under a lease. It owns only the bridge and fixtures
|
||||
and may not wire research replacement. Only after independent acceptance of that bridge may one
|
||||
complete W1 coordinator implementation own `src/shim/hooks/research.{cpp,h}` plus narrowly named
|
||||
bridge/effect/event files and tests. No two workers may concurrently own those files or the same
|
||||
VM/build directory.
|
||||
|
||||
## 6. Current blockers / stop conditions
|
||||
|
||||
- No executable pilot-specific acceptance runner or full input/asset manifest. W2 is not required
|
||||
for the W1-only pilot but remains required before any broader claim.
|
||||
- Live research callback integration, complete ObservedTech/event construction, broader callback
|
||||
outcomes and unsupported-path preflight remain unimplemented/unverified.
|
||||
- Static record/container ABI is accepted, but the live record bridge and its independent runtime
|
||||
safety evidence are missing. Retained Cost/HasResearched/node-bore/CRT helpers and forbidden
|
||||
displaced roots are fixed above; runtime asset paths and adapter execution remain unresolved.
|
||||
- Archived C1/C2 equality is documented but independent raw control-run bundles are not established
|
||||
by the single oracle pair inspected here. Fresh controls are mandatory.
|
||||
- Instrumentation and runtime FPU narrative need correction in acceptance inputs; archives are
|
||||
historical observations, not the current candidate's attestation.
|
||||
- Stop on control disagreement, silent fallback, missing data, branch outside approved class,
|
||||
unexpected writes/draws, stale evidence, source drift, or scope/architecture surprises; persist
|
||||
checkpoint and escalate to Astra before changing the contract.
|
||||
|
||||
This proposal authorizes planning only. Keep lifecycle **proposed** until required dependencies,
|
||||
input manifests, bounded implementation scope and executable acceptance exist.
|
||||
36
campaign/research/NEXT.md
Normal file
36
campaign/research/NEXT.md
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# Next RE / implementation boundary
|
||||
|
||||
Framework is complete. First research-completion static pass is now captured and cross-checked.
|
||||
Do not reopen general workflow development as a prerequisite for this slice.
|
||||
|
||||
## Recovered
|
||||
|
||||
- Original MSVCR100 scalar new/delete allocation family and import thunks.
|
||||
- ObservedTech 0x2c record constructor, copy construction, vector append/growth and old-element
|
||||
destruction path. Its copy helper has three cdecl-style stack arguments.
|
||||
- PlayerEvent 0x74 copy/append/destruction, with three independently owned strings. Its copy
|
||||
constructor uses ECX destination and one stack source argument instead.
|
||||
- Callback order: observation -> matched-target roll/clear -> completion event -> tech effects/tail.
|
||||
- Observed record uses internal tech key; completion event uses the display-name member.
|
||||
- Name-not-found versus capacity-full are distinct branches. NPC/non-rebellion and `_Root` tech
|
||||
predicates are part of observation eligibility. `_Root` comparison is case-insensitive.
|
||||
- Ghidra's non-returning-delete annotation omits real cleanup. Raw instruction captures recover
|
||||
the post-free pointer clear and return; no shared database mutation was needed.
|
||||
|
||||
## Smallest next work
|
||||
|
||||
Recover/cross-check the nested TurnEvents bucket constructor/growth and event duplicate/prune
|
||||
helpers (0x00885380, 0x00825d40, 0x00879eb0), including exceptional cleanup/ownership. Then build
|
||||
a narrowly scoped live-record adapter using the verified ABI contracts. First exercise short/long
|
||||
strings, spare/full capacity, and repeated-name/duplicate-event cases under a leased controlled
|
||||
workload before wiring it into complete research replacement.
|
||||
|
||||
An ABI bridge may use original-runtime allocation services as an explicitly declared dependency;
|
||||
that does not mean the original's RecordObservedTech or PostEvent game decisions may be counted
|
||||
as our replacement. Our code must own record contents, event IDs/order/dedup and callback effects.
|
||||
The original remaining turn driver is outside this scoped replacement. Full W1 original-vs-new
|
||||
acceptance still requires fresh controls and complete state comparison.
|
||||
|
||||
Evidence entry points: research-completion-abi.md, record-observation-crosscheck.md,
|
||||
research-callback-order.md and verify/results/{research-completion-abi,research-callback}/.
|
||||
Static recovery is not a claim of live allocator safety or a successful replacement.
|
||||
21
campaign/research/SESSION.md
Normal file
21
campaign/research/SESSION.md
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# Active phase: reverse engineering
|
||||
|
||||
User confirmed restart and asked for an explicit framework-to-RE transition. Framework is done;
|
||||
active work is `research-completion-abi`, recovering actual original record construction and
|
||||
ownership required by the research write-back pilot. No general orchestration expansion.
|
||||
|
||||
Normal loop lead and analyst: GPT-5.6 Sol through the existing bounded launcher. GPT-6 Astra is
|
||||
reserved for problem/surprise resolution. Canonical
|
||||
repositories remain at RE 3bfde5a / engine 7741d42 plus reviewed uncommitted rollout source.
|
||||
Config loader/model check and campaign validation passed after restart. No open surprises.
|
||||
|
||||
Scope split: analyst recovers ObservedTech/event allocation/string/container ABI from fresh
|
||||
read-only original-binary evidence. Lead checks completion effects and helper boundaries.
|
||||
Raw captures go to verify/results/research-completion-abi; decisions/handoff to campaign/research.
|
||||
No Windows/Ghidra mutation or replacement deployment under this analysis contract.
|
||||
|
||||
Lead checkpoint: fresh OnTechResearched and UpdateNodeBoreParams decompilations/disassembly
|
||||
captured under verify/results/research-callback. Original executable SHA matches fingerprint.
|
||||
Callback order and W1 numeric path confirmed from instructions. Ghidra's non-returning delete
|
||||
annotation demonstrably truncates pointer clearing/returns; affected lifetime claims require
|
||||
instruction-stream evidence. Details: research-callback-order.md. Analyst owns separate record ABI.
|
||||
53
campaign/research/record-observation-crosscheck.md
Normal file
53
campaign/research/record-observation-crosscheck.md
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# Independent cross-check: RecordObservedTech
|
||||
|
||||
GPT-6 Astra, local instruction stream from fingerprinted `dumps/sots.exe`, 2026-09-09.
|
||||
MD5 `9969481c39f4b33a8a21c48b62abee4c` exactly matches the analyst's ReVa program metadata;
|
||||
the same local file's SHA-256 is `970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841`.
|
||||
This closes the previously reported missing ReVa/local fingerprint linkage.
|
||||
|
||||
Fresh disassembly: `verify/results/research-callback/record-observed-tech-objdump.txt`.
|
||||
|
||||
## Corrections to the first analyst pass
|
||||
|
||||
- The constructor/push path is **name not found**, NOT vector full capacity. The function scans
|
||||
first at observer+0x274 through last at +0x278; +0x27c capacity is not read in this wrapper.
|
||||
Empty list or exhausted search reaches 0x007ba274. Capacity handling belongs to 0x007b7320.
|
||||
- The observer is stack argument 1 (`[ebp+8]`), not argument 2. Stack argument 2 (`[ebp+0xc]`)
|
||||
supplies observation eligibility bytes and the field used to select the with-mask bit.
|
||||
- Stack argument 3 is a TechDef-like object whose string starts at **object+4**. It is not a
|
||||
bare string pointer: source length is object+0x14 and capacity object+0x18. The comparison uses
|
||||
destination string at record+0x0c. Confirm semantic TechDef identity using the caller/schema.
|
||||
|
||||
## Pinned instructions / static callable boundary
|
||||
|
||||
Wrapper 0x007ba1a0 uses this in ECX, three stack arguments, returns with **ret 0x0c** at 0x007ba32b.
|
||||
Its ECX-derived object supplies the 16-bit turn at +0x0c. The owner callback caller prepares ECX
|
||||
from player+8 minus four and pushes (technology, player, player) in reverse argument order.
|
||||
|
||||
Before searching it requires three non-null arguments and rejects a subject with
|
||||
`NPC && !RebAI` (offsets +0xfb/+0xfc, names cross-checked with the existing serializer/address
|
||||
contract). It then calls 0x0057e6d0 on argument 3; a nonzero result suppresses recording.
|
||||
|
||||
Fresh disassembly now resolves that helper: read the technology's name string at def+4,
|
||||
find its **first underscore**, and compare the suffix with **`_Root` using `_stricmp`**.
|
||||
The literal is at 0x00a00040; imported comparator IAT is 0x009dd328 (MSVCR100.dll entry 115).
|
||||
Thus root technologies are excluded, case-insensitively. It is not a costly master-tree query;
|
||||
ECX is unused in this helper. Capture: observed-tech-exclusion-objdump.txt and
|
||||
observed-tech-exclusion-literal.txt. The underscore scan has no terminator check in the binary;
|
||||
valid tech-name syntax is a precondition, not evidence of safe arbitrary-string handling.
|
||||
|
||||
Search increments by **0x2c**, compares full names via 0x004236a0, and preserves an existing
|
||||
element if found. On absence it constructs a stack temporary (0x008562a0), appends via 0x007b7320,
|
||||
then operates on the newly appended element at last-0x2c:
|
||||
|
||||
- first/last turns are 16-bit offsets **+4/+6**;
|
||||
- name assignment targets the string at **+0x0c** via 0x00425430;
|
||||
- both new and existing paths update last turn **+6** and OR a bit into **+0x28**, using
|
||||
subject+0x28 as the x86 shift count;
|
||||
- existing-path first-turn/name stay unchanged in this wrapper.
|
||||
|
||||
Append is followed by conditional destruction of the TEMPORARY string when capacity >=16.
|
||||
The temporary lifetime does not permit stealing its buffer into the appended element. Copy/
|
||||
reallocation/destruction inside 0x007b7320 must be recovered before implementation.
|
||||
|
||||
These facts are static ABI/ordering evidence. They do not prove live allocation safety.
|
||||
76
campaign/research/research-callback-order.md
Normal file
76
campaign/research/research-callback-order.md
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
# Research callback: fresh instruction-stream findings
|
||||
|
||||
Lead: openai/gpt-6-astra, 2026-09-09. Static RE, not live replacement verification.
|
||||
Original binary: dumps/sots.exe, SHA-256
|
||||
`970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841` (matches recorded fingerprint).
|
||||
Fresh ReVa reads were cross-checked against local GNU objdump on that executable. No Ghidra edits.
|
||||
Raw/materialized captures: verify/results/research-callback/.
|
||||
|
||||
## Callback order is observable, not interchangeable
|
||||
|
||||
OnTechResearched starts at 0x00891790. The binary establishes this order:
|
||||
|
||||
1. Call RecordObservedTech at **0x008917dc**, passing the technology and the player twice;
|
||||
`ecx` is formed from the server reference at player+8 minus four (when non-null).
|
||||
2. Compare completing technology to player+0x294. If matched, optionally call the pending-roll
|
||||
handler at 0x0088df20, then clear player+0x3b4 and player+0x294.
|
||||
3. Unless silent, format and post the completion event at **0x008919b5**. Its text branches
|
||||
use the research progress-ratio result before applying economic effects.
|
||||
4. Execute the technology-specific scalar effects and common completion tail.
|
||||
|
||||
Thus the observed-record operation precedes target clearing, and the completion event precedes
|
||||
economic effect writes. A replacement should preserve this order; the earlier conceptual pipeline
|
||||
diagram was not an instruction-order specification.
|
||||
|
||||
The two records also use DIFFERENT strings. RecordObservedTech compares/copies the internal
|
||||
technology key from **TechDef+4**. The completion message fetches **TechDef+0x40**, with its
|
||||
capacity checked at +0x54 (0x0089180d..0x00891832), before formatting. This is the display-name
|
||||
surface seen in original event prose, not the internal key. Reusing `IND_Waldo` as event text
|
||||
would be wrong even if the observed-tech name were correct.
|
||||
|
||||
## W1 IND_Waldo scalar path
|
||||
|
||||
`MasterTechTree::IsTech` is tested with immediate **10001 / 0x2711** at 0x00891a05.
|
||||
The true branch reaches 0x00891a7f: subtract the qword constant at 0x009e2318 from construction
|
||||
modifiers +0x10c/+0x110/+0x114, store each as float32; add the qword constant at 0x009ed188 to
|
||||
output modifier +0x124 and store float32. Raw literals:
|
||||
|
||||
- 0x009e2318: `00 00 00 a0 99 99 b9 3f` = double-widened float32 0.1.
|
||||
- 0x009ed188: `00 00 00 40 33 33 c3 3f` = double-widened float32 0.15.
|
||||
|
||||
The common tail invokes bitmask rebuilding, the node-bore updater and species flags. W1's four
|
||||
numeric writes do not justify skipping the common tail or patching later bankruptcy/repair values.
|
||||
|
||||
## Decompiler hazard: missing post-delete control flow
|
||||
|
||||
Fresh ReVa decompilation marks operator_delete at 0x00924faa as non-returning. This truncates
|
||||
real logic: UpdateNodeBoreParams is reported as ending at 0x00818365, immediately after its delete
|
||||
call. Local executable disassembly shows:
|
||||
|
||||
- 0x00818361: call 0x00924faa;
|
||||
- 0x00818366: caller stack cleanup;
|
||||
- **0x00818369: write zero to player+0x308**;
|
||||
- **0x00818382: return**.
|
||||
|
||||
Its positive branch allocates **12 bytes** through 0x00924fb6 if the pointer is absent, constructs
|
||||
the object through 0x006e18c0, stores the pointer, and copies three words from selected parameters.
|
||||
It is not a read-only helper. Both allocation/free helpers are import thunks. Fresh PE import
|
||||
inspection pins them to **MSVCR100.dll**: 0x00924faa jumps through IAT 0x009dd1c8 to
|
||||
`??3@YAXPAX@Z` (scalar operator delete); 0x00924fb6 jumps through IAT 0x009dd1d0 to
|
||||
`??2@YAPAXI@Z` (scalar operator new). The import descriptor's first thunk is RVA 0x005dd15c;
|
||||
entries 27 and 29 resolve those slots. See pe-headers-and-imports.txt and allocation-import-thunks.txt.
|
||||
This provides a concrete original-runtime allocation boundary; it does not justify substituting
|
||||
the MinGW runtime allocator for memory the original's destructors will free.
|
||||
|
||||
The same false non-return annotation appears after long-string temporary cleanup in the main
|
||||
callback. At 0x008919d1 the binary calls delete, then falls through to effect processing at
|
||||
0x008919d9; the decompiler labels that branch non-returning. Therefore decompiled absence of a
|
||||
write/return after deletion cannot be evidence that the original lacks it.
|
||||
|
||||
## Astra decision / next RE action
|
||||
|
||||
Continue this read-only RE slice with raw instructions as authority on affected lifetime paths.
|
||||
Do not change the shared database during concurrent analysis. Retain the flawed decompilation
|
||||
as evidence of the limitation. No replacement or allocator-safety claim follows from these facts.
|
||||
Next: verify the analyst's ObservedTech/event ownership recovery against the binary, then issue
|
||||
the smallest concrete implementation handoff. The allocator import family is now pinned statically.
|
||||
87
campaign/research/research-completion-abi.md
Normal file
87
campaign/research/research-completion-abi.md
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
# Completion record ABI recovery
|
||||
|
||||
Static handoff only. The provenance index is
|
||||
`verify/results/research-completion-abi/reva-2026-09-09-index.md`; the regenerated instruction
|
||||
capture and interpretation are respectively
|
||||
`verify/results/research-completion-abi/objdump-2026-09-09-ownership.txt` and
|
||||
`verify/results/research-completion-abi/recovered-static.md`. The complete dedup/helper repair is
|
||||
`verify/results/research-completion-abi/objdump-2026-09-09-dedup-helper.txt`; its first-window raw
|
||||
provenance is superseded by the paired captures and identity record in
|
||||
`verify/results/research-completion-abi/objdump-2026-09-10-boundary-repair.md` under Astra decision
|
||||
`d-d2a9b8be6399a6abaa0e05a5`. Input identity is `dumps/sots.exe`,
|
||||
SHA-256 `970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841` / MD5
|
||||
`9969481c39f4b33a8a21c48b62abee4c`.
|
||||
|
||||
The ownership archive's terminal-byte provenance is likewise superseded by the complete package
|
||||
`verify/results/research-completion-abi/run-79357a65226f61d6a86c042d/` under Astra decision
|
||||
`d-d4c494ba02ada278030ef473`. Its six narrow/wide pairs, raw section-byte checks and full ten-window
|
||||
audit establish the encoded return immediates while preserving the static-only limitation. The
|
||||
package found three additional truncated historical stops (ObservedTech append/reallocator and
|
||||
string allocation/replacement); their widened streams are now the byte authority. No archive
|
||||
production-history inference or live-safety claim is made.
|
||||
|
||||
## Implementable machine boundaries recovered
|
||||
|
||||
* `0x008562a0`: ObservedTech default constructor, ECX receiver, EAX return, plain `ret`.
|
||||
* `0x007b7320`: ObservedTech vector append, ECX receiver plus one stack word, `ret 4`; stride `0x2c`.
|
||||
Its copy helper is `0x0079a150` (cdecl-style allocator/destination/source stack arguments), which copy-constructs the embedded string rather than copying a
|
||||
vector element header. Capacity growth is `0x007b5820` -> `0x007b34e0` -> `0x0057e590`.
|
||||
* `0x0057e590` calls `0x00924fb6` with `count * 0x2c`; reallocation destroys every old element via
|
||||
virtual slot 0 with zero and frees the array through `0x00924faa`. These are MSVCR100 scalar-new
|
||||
and scalar-delete import thunks, not clean-room allocator operations.
|
||||
* `0x0086c580`: PlayerEvent vector append, ECX receiver plus one stack word, `ret 4`; stride `0x74`.
|
||||
It grows via `0x00869500` and copy-constructs through `0x007693f0` (ECX destination, stack source,
|
||||
EAX destination return, ret 4), independently assigning all
|
||||
three strings. `0x0061ae90` releases each long string via `0x00924faa` when capacity is `>= 0x10`.
|
||||
* `0x004249a0` (reached by `0x00425430` assignment) allocates through `0x00924fb6` and releases a
|
||||
prior long destination buffer through `0x00924faa`. A temporary long string is therefore not
|
||||
transferable by raw header copy.
|
||||
* `0x00885380`: get-or-create TurnEvents bucket, ECX EventStorage receiver plus stack turn, EAX
|
||||
bucket return, `ret 4`. It returns the last existing matching turn. On absence it appends a deep
|
||||
copy of a zero/empty stack bucket through `0x00884cb0`, then writes the stored turn.
|
||||
* `0x00884cb0`: outer TurnEvents vector append, ECX vector receiver plus stack source, `ret 4`,
|
||||
stride `0x18`. Full-capacity growth is `0x008841a0` -> `0x00883a60`; allocation is
|
||||
`0x006e8f50` -> `0x00924fb6` with `count * 0x18`. Existing buckets are copy-constructed by
|
||||
`0x0077fed0`, including an independently allocated/copied nested PlayerEvent vector via
|
||||
`0x00779850` -> `0x0078af40` (`count * 0x74`) -> `0x007725a0` -> `0x007693f0`.
|
||||
* TurnEvents virtual slot zero resolves from vtable `0x00a0f07c` to `0x0062e120`. It destroys the
|
||||
nested vector through `0x00629580`; that destroys every `0x74` PlayerEvent, frees the nested block,
|
||||
and zeros its three pointers. Static unwind edges clean partial PlayerEvent and TurnEvents ranges
|
||||
and free the new outer block, but no allocation failure was executed live.
|
||||
|
||||
## Ordering / visible effects
|
||||
|
||||
RecordObservedTech's append predicate is name absence, not capacity. A matching existing record
|
||||
keeps first-turn/name and updates last-turn/with mask. `0x00825d40` scans a bucket's events in
|
||||
`0x74` steps, checking action, location, three floats, message and image before passing both
|
||||
description strings to `0x0046f8c0`. Fresh paired-boundary instructions establish that helper as
|
||||
caller-cleaned `bool string_not_equal(stored, candidate)`: it returns one for any byte/length
|
||||
difference and zero for equality, handling each operand's inline/heap representation at capacity
|
||||
`0x10`. FindDuplicate reaches the match return only on zero, so `EvDsc` equality is required and a
|
||||
description-only difference does not deduplicate. This statically contradicts the inherited
|
||||
description-omission claim; decision `d-2ff30c9f5355116bea822924` required the now-archived complete
|
||||
branch/helper repair. The later provenance correction does not itself prove these semantics: an
|
||||
independent verifier must reproduce the repaired package and predeclared falsifiers. The wrapper
|
||||
returns the first element equal in all fields and writes nothing.
|
||||
`0x00879eb0` prunes only a leading
|
||||
stale run (`EvTurn < turn-50`), deep-shifts from the run's last stale element, and therefore removes
|
||||
`n-1`: one stale bucket survives, a single stale bucket causes no write, and stale buckets after a
|
||||
fresh bucket are not inspected. The no-duplicate EventStorage path remains distinct from event-vector
|
||||
capacity: it is the path that appends a `0x74` PlayerEvent and changes IDs/vector contents. Caller
|
||||
text/position/action/defaulting and the exact PostEvent write order remain required inputs/effects.
|
||||
No RNG draw occurs in the recovered bucket, duplicate, prune, copy, allocation, or destruction
|
||||
boundaries.
|
||||
|
||||
## Original/runtime dependencies and limits
|
||||
|
||||
Any original-assisted allocation, string assignment or deletion must retain allocator-family
|
||||
compatibility: the recovered calls target the original MSVCR100 import thunks. A standalone
|
||||
replacement needs its own coherent allocation/destruction boundary; calling these original helpers
|
||||
is an original dependency, not independent replacement. Calling `0x0046f8c0` likewise retains an
|
||||
original string-layout/comparison dependency, though its equality behavior is implementable without
|
||||
allocation in a standalone boundary. Required unavailable proof inputs are a safe
|
||||
long-string/full-capacity pre/post fixture (or equivalent archived trace), same-bucket
|
||||
equal/description-only-different event fixtures covering short and long strings, exact exceptional
|
||||
cleanup outcomes under a live throw, and independent reproduction of the named static windows and
|
||||
falsifiers. This handoff makes no live
|
||||
allocator-safety, runtime event-construction, or replacement-acceptance claim.
|
||||
433
campaign/research/research-live-record-addresses.json
Normal file
433
campaign/research/research-live-record-addresses.json
Normal file
|
|
@ -0,0 +1,433 @@
|
|||
{
|
||||
"schema": "sots-live-record-addresses/1",
|
||||
"status": "incomplete-planning-input",
|
||||
"binary": {
|
||||
"path": "dumps/sots.exe",
|
||||
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841",
|
||||
"image_base": "0x00400000"
|
||||
},
|
||||
"tool": {
|
||||
"path": "/usr/bin/objdump",
|
||||
"version": "GNU Binutils 2.38",
|
||||
"sha256": "1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd"
|
||||
},
|
||||
"source_identity": {
|
||||
"engine": {
|
||||
"path": "/tmp/opencode/sots-final-research-engine",
|
||||
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||
"git_common_dir": "/home/alex/sots-engine/.git"
|
||||
},
|
||||
"re": {
|
||||
"path": "/tmp/opencode/sots-final-research-re",
|
||||
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||
"git_common_dir": "/home/alex/sots-re/.git"
|
||||
}
|
||||
},
|
||||
"fresh_capture": {
|
||||
"session": "run-eca0889c30beb7f00f4ac264",
|
||||
"cwd": "/home/alex/sots-re",
|
||||
"commands": [
|
||||
{
|
||||
"argv": [
|
||||
"/usr/bin/objdump",
|
||||
"-D",
|
||||
"-Mintel",
|
||||
"--start-address=0x0079a142",
|
||||
"--stop-address=0x0079a1e0",
|
||||
"dumps/sots.exe"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_bytes": 3452,
|
||||
"stdout_sha256": "f8f31b09ddb0a6d5b4016f84bfe86b994ed944be7372e264b90344fd560d4d05",
|
||||
"stderr_bytes": 0,
|
||||
"stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"argv": [
|
||||
"/usr/bin/objdump",
|
||||
"-D",
|
||||
"-Mintel",
|
||||
"dumps/sots.exe"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_bytes": 148427275,
|
||||
"stdout_sha256": "b748aef66fb4bb11be5223517a4c563eccd8c5117d86481c1459c20eded932c3",
|
||||
"stderr_bytes": 0,
|
||||
"stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"argv": [
|
||||
"/usr/bin/objdump",
|
||||
"-D",
|
||||
"-Mintel",
|
||||
"--start-address=0x007b7320",
|
||||
"--stop-address=0x007b73a1",
|
||||
"dumps/sots.exe"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_bytes": 2794,
|
||||
"stdout_sha256": "510efc3587feec6b34d52effccfd9afac6cec4ab3358de54ba7ad9aecfa73c67",
|
||||
"stderr_bytes": 0,
|
||||
"stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"argv": [
|
||||
"/usr/bin/objdump",
|
||||
"-D",
|
||||
"-Mintel",
|
||||
"--start-address=0x00425430",
|
||||
"--stop-address=0x00425519",
|
||||
"dumps/sots.exe"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_bytes": 5205,
|
||||
"stdout_sha256": "9f3ceb743ad7878d1d5900233d24acd2bd0bc86bc9f44acfcfccf0a6735e5c16",
|
||||
"stderr_bytes": 0,
|
||||
"stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
}
|
||||
]
|
||||
},
|
||||
"constructor_destructor_capture": {
|
||||
"session": "run-a247a9d6650d9e0954596cc0",
|
||||
"manifest": "verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/manifest.json",
|
||||
"scope": "Read-only constructor, scalar-deleting destructor, and vtable-slot capture; planning evidence only."
|
||||
},
|
||||
"reserve_recapture": {
|
||||
"session": "run-a52f7d5ebec657d8923d8402",
|
||||
"manifest": "verify/results/research-live-record-bridge/run-a52f7d5ebec657d8923d8402/manifest.json",
|
||||
"stdout": "verify/results/research-live-record-bridge/run-a52f7d5ebec657d8923d8402/observed-reserve.stdout.txt",
|
||||
"stdout_sha256": "2d011ed96329c4c4ff462cbfd65decac9dccf40558765244c769be1dedc92275",
|
||||
"comparison": "verify/results/research-live-record-bridge/run-a52f7d5ebec657d8923d8402/comparison.json",
|
||||
"scope": "Read-only byte-exact recapture of 0x007b5820..0x007b5898. Full comparison found the invalidated transcription omitted exactly eight presentation spaces; all 49 address/opcode/mnemonic/operand rows match. Planning evidence only."
|
||||
},
|
||||
"player_event_constructor_capture": {
|
||||
"session": "run-c1238a40bfc3bfa7c2ff9ba6",
|
||||
"manifest": "verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/manifest.json",
|
||||
"constructor_stdout": "verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-exact.stdout.txt",
|
||||
"eh_analysis": "verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-eh-analysis.json",
|
||||
"scope": "Read-only callable constructor and MSVC unwind capture; static planning evidence only, not live allocator or exception execution."
|
||||
},
|
||||
"player_event_copy_capture": {
|
||||
"session": "run-36c401e90eb0ec1db4d35865",
|
||||
"manifest": "verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/manifest.json",
|
||||
"copy_stdout": "verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-exact.stdout.txt",
|
||||
"eh_analysis": "verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-eh-analysis.json",
|
||||
"scope": "Read-only callable copy-constructor and MSVC unwind capture; static planning evidence only, not live allocator or exception execution."
|
||||
},
|
||||
"operations": {
|
||||
"observed_tech_default_construct": {
|
||||
"va": "0x008562a0",
|
||||
"rva": "0x004562a0",
|
||||
"callable_entry": true,
|
||||
"prototype": "ObservedTech *__thiscall observed_tech_default_construct(ObservedTech *destination)",
|
||||
"receiver": "ECX = writable uninitialized storage for one complete 0x2c-byte ObservedTech",
|
||||
"arguments": [],
|
||||
"stack_cleanup": "no stack arguments; helper ends in plain ret",
|
||||
"return": "EAX = destination ObservedTech pointer on normal return",
|
||||
"writes": [
|
||||
"vptr 0x00a2439c at destination +0x00",
|
||||
"zero dword at +0x04, covering both 16-bit turn fields",
|
||||
"zero byte at +0x08",
|
||||
"valid empty/SSO std::string rooted at +0x0c with size zero and capacity 0x0f",
|
||||
"zero dword at +0x28"
|
||||
],
|
||||
"ownership": "Field-wise construction creates one valid embedded string; it does not adopt or copy an owning header. The constructor establishes an SEH frame around empty-string setup through VA 0x00425550. On normal return the destination owns exactly its initialized name string and must later be destroyed exactly once.",
|
||||
"vtable_provenance": {
|
||||
"vtable_va": "0x00a2439c",
|
||||
"complete_object_locator_va": "0x00a81c78",
|
||||
"slots": [
|
||||
{"index": 0, "va": "0x00793610", "meaning": "scalar-deleting destructor"},
|
||||
{"index": 1, "va": "0x00817c40", "meaning": "Read"},
|
||||
{"index": 2, "va": "0x00817cf0", "meaning": "Write"}
|
||||
]
|
||||
},
|
||||
"captures": [
|
||||
"verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/observed-ctor.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/observed-vtable.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/manifest.json"
|
||||
]
|
||||
},
|
||||
"observed_tech_scalar_delete_destruct": {
|
||||
"va": "0x00793610",
|
||||
"rva": "0x00393610",
|
||||
"callable_entry": true,
|
||||
"prototype": "ObservedTech *__thiscall observed_tech_scalar_delete_destruct(ObservedTech *value, uint32_t flags)",
|
||||
"receiver": "ECX = one fully constructed live-layout ObservedTech",
|
||||
"arguments": [
|
||||
{
|
||||
"index": 0,
|
||||
"location": "[entry ESP+0x04] / [EBP+0x08]",
|
||||
"meaning": "scalar-deleting flags; bit 0 requests freeing the object storage"
|
||||
}
|
||||
],
|
||||
"stack_cleanup": "callee removes the one 4-byte flags argument with ret 4",
|
||||
"return": "EAX = input ObservedTech pointer on normal return, including the flags-bit-0 path",
|
||||
"writes": [
|
||||
"when name capacity at +0x20 is at least 0x10, frees the owned buffer pointer at +0x0c through VA 0x00924faa",
|
||||
"sets name capacity +0x20 to 0x0f, size +0x1c to zero, and first inline byte +0x0c to zero",
|
||||
"writes base vptr 0x009e22bc at +0x00",
|
||||
"when flags bit 0 is set, frees the ObservedTech storage through VA 0x00924faa"
|
||||
],
|
||||
"ownership": "Consumes the one name ownership exactly once. For stack temporaries, vector elements, and all other embedded values the bridge must pass flags=0 so only member lifetime ends and object storage is not freed. Reuse after return requires a fresh constructor; a second destructor call is forbidden.",
|
||||
"embedded_invocation": {
|
||||
"flags": 0,
|
||||
"required_reason": "Original vector reallocation pushes zero before virtual slot-0 dispatch over each old 0x2c-byte element; flags=1 would incorrectly scalar-delete embedded storage."
|
||||
},
|
||||
"captures": [
|
||||
"verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/observed-dtor.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/observed-vtable.stdout.txt",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/observed-realloc-wide.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/manifest.json"
|
||||
]
|
||||
},
|
||||
"observed_tech_copy_construct": {
|
||||
"va": "0x0079a150",
|
||||
"rva": "0x0039a150",
|
||||
"callable_entry": true,
|
||||
"prototype": "void __cdecl observed_tech_copy_construct(void *unused_allocator, ObservedTech *destination, const ObservedTech *source)",
|
||||
"arguments": [
|
||||
{
|
||||
"index": 0,
|
||||
"location": "[entry ESP+0x04] / [EBP+0x08]",
|
||||
"meaning": "allocator-shaped argument passed as vector+0x0c by both callers; not read by this helper"
|
||||
},
|
||||
{
|
||||
"index": 1,
|
||||
"location": "[entry ESP+0x08] / [EBP+0x0c]",
|
||||
"meaning": "destination ObservedTech pointer"
|
||||
},
|
||||
{
|
||||
"index": 2,
|
||||
"location": "[entry ESP+0x0c] / [EBP+0x10]",
|
||||
"meaning": "source ObservedTech pointer"
|
||||
}
|
||||
],
|
||||
"stack_cleanup": "caller removes 12 bytes; helper ends in plain ret",
|
||||
"receiver": "none; incoming ECX is not consumed as a receiver",
|
||||
"return": "no supported return-value contract; EAX is incidental/clobbered",
|
||||
"writes": [
|
||||
"destination vptr at +0x00",
|
||||
"16-bit fields at +0x04 and +0x06",
|
||||
"byte field at +0x08",
|
||||
"deep-constructed string rooted at +0x0c through VA 0x00425430",
|
||||
"32-bit field at +0x28"
|
||||
],
|
||||
"ownership": "Constructs destination field-wise. The destination string starts empty/SSO and is assigned from the source; no owning string header is copied. Entry SEH state covers the potentially allocating string operation.",
|
||||
"callers": [
|
||||
{
|
||||
"call_va": "0x007b7366",
|
||||
"containing_entry_va": "0x007b7320",
|
||||
"path": "source originally inside vector; source pointer recomputed after possible growth"
|
||||
},
|
||||
{
|
||||
"call_va": "0x007b738f",
|
||||
"containing_entry_va": "0x007b7320",
|
||||
"path": "source outside vector"
|
||||
}
|
||||
],
|
||||
"all_direct_callers_probe": "Full-image linear objdump contained exactly the two direct call rows above for target 0x79a150.",
|
||||
"interior_negative_control": {
|
||||
"va": "0x0079a184",
|
||||
"rva": "0x0039a184",
|
||||
"callable_entry": false,
|
||||
"reason": "Interior instruction depends on the 0x0079a150 prologue having established EBP, SEH state, ESI=destination and local construction state. No direct caller targets it."
|
||||
},
|
||||
"accepted_dependency_captures": [
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/observed-copy-control.stdout.txt",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/observed-push-wide.stdout.txt",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json"
|
||||
]
|
||||
},
|
||||
"observed_tech_vector_append": {
|
||||
"va": "0x007b7320",
|
||||
"rva": "0x003b7320",
|
||||
"callable_entry": true,
|
||||
"prototype": "void __thiscall observed_tech_vector_append(ObservedTechVector *vector, const ObservedTech *source)",
|
||||
"receiver": "ECX = live three-pointer vector header: first at +0x00, last at +0x04, end at +0x08; allocator-shaped storage begins at +0x0c",
|
||||
"arguments": [
|
||||
{
|
||||
"index": 0,
|
||||
"location": "[entry ESP+0x04] / [EBP+0x08]",
|
||||
"meaning": "source live-layout ObservedTech to deep-copy"
|
||||
}
|
||||
],
|
||||
"stack_cleanup": "callee removes the one 4-byte source argument with ret 4",
|
||||
"return": "no supported return-value contract; EAX is incidental after the copy helper",
|
||||
"source_location_branches": [
|
||||
"When source is in [first,last), computes its 0x2c-element index before any growth and recomputes source from the possibly replaced first pointer afterward.",
|
||||
"When source is outside [first,last), retains the caller pointer across possible growth. A pointer into unused capacity or exactly at last is not treated as a live in-vector source and is forbidden by the bridge precondition."
|
||||
],
|
||||
"no_growth": "Calls 0x0079a150 with vector+0x0c, destination=old last, and selected source; advances last by exactly 0x2c only after normal copy return. Existing elements and end are unchanged.",
|
||||
"growth": {
|
||||
"reserve_va": "0x007b5820",
|
||||
"reserve_prototype": "void __thiscall observed_tech_vector_reserve_additional(ObservedTechVector *vector, uint32_t additional_count)",
|
||||
"reserve_abi": "ECX=vector, one stack count, ret 4, no supported return; append passes additional_count=1 only when last==end.",
|
||||
"capacity_rule": "Rejects size+additional above 0x05d1745d elements; if required exceeds capacity, chooses at least required and otherwise approximately capacity+floor(capacity/2), capped through the same maximum check, then calls 0x007b34e0 with the chosen element capacity.",
|
||||
"reallocate_effects": "0x007b34e0 obtains count*0x2c storage through 0x0057e590 -> MSVCR100 scalar new thunk 0x00924fb6, deep-copy-constructs [old first,old last) into the new block through 0x0085e650, destroys each old element through virtual slot zero with flags=0, frees the old block through 0x00924faa, then writes end, last and first in that order. Append subsequently deep-copies the requested source at the new last and advances last by 0x2c.",
|
||||
"normal_postcondition": "All prior element values survive as independently owned deep copies; every old element is destroyed exactly once and old array storage is freed once through the matching runtime family."
|
||||
},
|
||||
"exceptional_ownership": "The append helper has no local handler and advances last only after copy construction returns. Reserve/reallocate install MSVC SEH state around allocation/range copy; 0x0085e650 tracks the current destination and has a partial-range destruction funclet. Static control flow therefore supports cleanup before propagation and leaves the published vector header update until after successful relocation, but no live throw has been exercised. The bridge must contain any propagated C++ exception at its MSVC DLL boundary, must treat the operation as failed with no accepted new element, and must validate zero outstanding allocation/partial element before this row can support live-safety acceptance.",
|
||||
"captures": [
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/observed-push-wide.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-a52f7d5ebec657d8923d8402/observed-reserve.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-a52f7d5ebec657d8923d8402/manifest.json",
|
||||
"verify/results/research-live-record-bridge/run-a52f7d5ebec657d8923d8402/comparison.json",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/observed-realloc-wide.stdout.txt",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/observed-alloc-wide.stdout.txt"
|
||||
]
|
||||
},
|
||||
"player_event_default_construct": {
|
||||
"va": "0x0084ee30",
|
||||
"rva": "0x0044ee30",
|
||||
"callable_entry": true,
|
||||
"prototype": "PlayerEvent *__thiscall player_event_default_construct(PlayerEvent *destination)",
|
||||
"receiver": "ECX = writable uninitialized storage for one complete 0x74-byte PlayerEvent",
|
||||
"arguments": [],
|
||||
"stack_cleanup": "no stack arguments; helper ends in plain ret",
|
||||
"return": "EAX = destination PlayerEvent pointer on normal return",
|
||||
"writes": [
|
||||
"vptr 0x00a21958 at destination +0x00",
|
||||
"EvEID zero at +0x04",
|
||||
"valid empty/SSO EvDsc std::string rooted at +0x08 with size zero, capacity 0x0f and first inline byte zero",
|
||||
"valid empty/SSO EvMsg std::string rooted at +0x24 with size zero, capacity 0x0f and first inline byte zero",
|
||||
"EvLoc zero at +0x40",
|
||||
"EvPos dwords at +0x44, +0x48 and +0x4c copied from 0x00af0dc8, 0x00af0dcc and 0x00af0dd0; each source word is 0x7f7fffff (FLT_MAX)",
|
||||
"valid empty/SSO EvImg std::string rooted at +0x50 with size zero, capacity 0x0f and first inline byte zero",
|
||||
"EvAct zero at +0x6c",
|
||||
"EvCID zero at +0x70"
|
||||
],
|
||||
"complete_layout": "The listed writes establish every logical field of the 0x74-byte object: 4-byte vptr, 4-byte EvEID, three independent 0x1c-byte strings, EvLoc, three position dwords, EvAct and EvCID. They do not overwrite inactive SSO union bytes or the allocator-shaped trailing dword in each 0x1c-byte string object; those bytes are not observable string value or ownership state. No owning header is imported from caller storage.",
|
||||
"string_initialization": "Each string is manually established as empty/SSO and then passed as ECX to 0x00425550 with stack arguments empty literal 0x009e100c and count zero. The bound zero-count path writes size zero and the inline terminator, performs no allocation or free, and returns the destination with ret 8. On normal return all three are distinct valid owned subobjects even though inactive storage bytes may retain their prior contents.",
|
||||
"exceptional_partial_construction": {
|
||||
"handler_thunk_va": "0x0099613e",
|
||||
"func_info_va": "0x00ac98a4",
|
||||
"func_info": "MSVC magic 0x19930522, maxState 3, unwind map 0x00ac988c, no try-block or IP maps, flags 1",
|
||||
"unwind_states": [
|
||||
"state 0 -> -1 through 0x00996120: restore base vptr 0x009e22bc through 0x00763a00",
|
||||
"state 1 -> 0 through 0x00996128: destroy completed EvDsc at destination+0x08 through 0x008e0610, then continue state 0 cleanup",
|
||||
"state 2 -> 1 through 0x00996133: destroy completed EvMsg at destination+0x24 through 0x008e0610, then continue states 1 and 0 cleanup"
|
||||
],
|
||||
"qualification": "The state is advanced immediately before the next empty-string helper call, so a hypothetical exception during construction of a string cleans only predecessor string subobjects plus the base; a failing current subobject is not treated as completed. For the constructor's fixed valid empty-literal/count-zero inputs, the bound 0x00425550 path does not allocate, free or call a failure helper. The third successful call is followed only by scalar stores on the observed path. This is static unwind topology; no throw or allocator behavior was executed."
|
||||
},
|
||||
"ownership": "On normal return the destination owns three independently destructible valid strings and must be destroyed exactly once. A failed construction must not be passed to the complete PlayerEvent destructor; only the compiler unwind actions for completed states may run.",
|
||||
"captures": [
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-exact.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-ehdata.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-funcinfo.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-cleanup-base.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-cleanup-string.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/string-empty-init.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-eh-record.bin",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/player-event-ctor-eh-analysis.json",
|
||||
"verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/manifest.json"
|
||||
]
|
||||
},
|
||||
"player_event_copy_construct": {
|
||||
"va": "0x007693f0",
|
||||
"rva": "0x003693f0",
|
||||
"callable_entry": true,
|
||||
"prototype": "PlayerEvent *__thiscall player_event_copy_construct(PlayerEvent *destination, const PlayerEvent *source)",
|
||||
"receiver": "ECX = writable uninitialized storage for one complete 0x74-byte PlayerEvent",
|
||||
"arguments": [
|
||||
{
|
||||
"index": 0,
|
||||
"location": "[entry ESP+0x04] / [EBP+0x08]",
|
||||
"meaning": "source fully constructed live-layout PlayerEvent"
|
||||
}
|
||||
],
|
||||
"stack_cleanup": "callee removes the one 4-byte source argument with ret 4",
|
||||
"return": "EAX = destination PlayerEvent pointer on normal return",
|
||||
"ordered_writes": [
|
||||
"writes vptr 0x00a21958 at destination +0x00, then copies source EvEID +0x04",
|
||||
"establishes destination EvDsc +0x08 as empty/SSO, then deep-assigns source EvDsc through 0x00425430 with offset zero and count 0xffffffff",
|
||||
"establishes destination EvMsg +0x24 as empty/SSO, then deep-assigns source EvMsg through 0x00425430 with offset zero and count 0xffffffff",
|
||||
"copies source EvLoc +0x40 and all three EvPos dwords +0x44, +0x48 and +0x4c",
|
||||
"establishes destination EvImg +0x50 as empty/SSO, then deep-assigns source EvImg through 0x00425430 with offset zero and count 0xffffffff",
|
||||
"copies source EvAct +0x6c and EvCID +0x70"
|
||||
],
|
||||
"complete_layout": "The ordered writes establish every logical field of the 0x74-byte destination. Each destination string receives its own valid SSO or heap ownership; no source string header, pointer, size/capacity tuple, or other owning header is transferred.",
|
||||
"exceptional_partial_construction": {
|
||||
"handler_thunk_va": "0x009862de",
|
||||
"func_info_va": "0x00ab9f0c",
|
||||
"func_info": "MSVC magic 0x19930522, maxState 3, unwind map 0x00ab9ef4, no try-block or IP maps, flags 1",
|
||||
"unwind_states": [
|
||||
"state 0 -> -1 through 0x009862c0: restore base vptr 0x009e22bc through 0x00763a00",
|
||||
"state 1 -> 0 through 0x009862c8: destroy completed destination EvDsc at +0x08 through 0x008e0610, then continue state 0 cleanup",
|
||||
"state 2 -> 1 through 0x009862d3: destroy completed destination EvMsg at +0x24 through 0x008e0610, then continue states 1 and 0 cleanup"
|
||||
],
|
||||
"qualification": "Construction state is set to 0 before the EvDsc assignment, 1 before the EvMsg assignment, and 2 before the EvImg assignment. Therefore a throwing current deep assignment is not treated as completed; only predecessor destination strings plus the base are unwound. After successful EvImg assignment, only scalar copies remain. This is static unwind topology; no allocation failure or throw was executed."
|
||||
},
|
||||
"ownership": "On normal return destination owns three independent deep copies and must later be destroyed exactly once. Source remains unchanged and retains all three original ownerships. A failed copy must not be passed to the complete PlayerEvent destructor; compiler unwind handles only completed destination subobjects.",
|
||||
"captures": [
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-exact.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-ehdata.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-funcinfo.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-cleanup-base.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-cleanup-string.stdout.txt",
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-eh-record.bin",
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-eh-analysis.json",
|
||||
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/manifest.json"
|
||||
]
|
||||
},
|
||||
"string_assign_substr": {
|
||||
"va": "0x00425430",
|
||||
"rva": "0x00025430",
|
||||
"callable_entry": true,
|
||||
"prototype": "std::string *__thiscall string_assign_substr(std::string *destination, const std::string *source, uint32_t source_offset, uint32_t count)",
|
||||
"receiver": "ECX = destination std::string",
|
||||
"arguments": [
|
||||
{
|
||||
"index": 0,
|
||||
"location": "[entry ESP+0x04] / [EBP+0x08]",
|
||||
"meaning": "source std::string pointer"
|
||||
},
|
||||
{
|
||||
"index": 1,
|
||||
"location": "[entry ESP+0x08] / [EBP+0x0c]",
|
||||
"meaning": "zero-based source byte offset"
|
||||
},
|
||||
{
|
||||
"index": 2,
|
||||
"location": "[entry ESP+0x0c] / [EBP+0x10]",
|
||||
"meaning": "maximum byte count; 0xffffffff means through source end"
|
||||
}
|
||||
],
|
||||
"stack_cleanup": "callee removes all 12 stack-argument bytes with ret 0x0c",
|
||||
"return": "EAX = destination std::string pointer on every normal return path",
|
||||
"bridge_invocation": {
|
||||
"source": "valid live-layout source string",
|
||||
"source_offset": 0,
|
||||
"count": "0xffffffff",
|
||||
"destination_precondition": "already initialized empty or otherwise valid live-layout string"
|
||||
},
|
||||
"writes": [
|
||||
"destination bytes or destination-owned heap buffer",
|
||||
"destination size at +0x10",
|
||||
"destination capacity at +0x14 when growth is required",
|
||||
"terminating zero byte"
|
||||
],
|
||||
"ownership": "Self-assignment uses two in-place erase operations. Non-self assignment selects source inline bytes when capacity is below 0x10 or its heap pointer otherwise. If destination capacity is insufficient it calls VA 0x004249a0 before copying; that worker uses the bound MSVCR100 new/delete thunks. The bridge must initialize destination first and must never transfer the source header.",
|
||||
"exception_boundary": "This helper has no local SEH frame. Invalid offset and excessive length call imported failure helpers; allocation can propagate from VA 0x004249a0. Bridge usage fixes offset=0/count=0xffffffff on a valid source, leaving allocation as the expected exceptional edge to be contained by the fixture DLL boundary.",
|
||||
"bridge_call_sites": [
|
||||
"0x0079a1bd copies ObservedTech name at +0x0c",
|
||||
"0x00769445 copies PlayerEvent EvDsc at +0x08",
|
||||
"0x00769464 copies PlayerEvent EvMsg at +0x24",
|
||||
"0x0076949b copies PlayerEvent EvImg at +0x50"
|
||||
],
|
||||
"accepted_dependency_captures": [
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/observed-copy-control.stdout.txt",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/player-copy-wide.stdout.txt",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/string-alloc-wide.stdout.txt",
|
||||
"verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json"
|
||||
]
|
||||
}
|
||||
},
|
||||
"forbidden_entries": [
|
||||
"0x0079a184"
|
||||
],
|
||||
"readiness": {
|
||||
"complete": false,
|
||||
"reason": "The ObservedTech default-construction, copy-construction, vector-append/growth and scalar-deleting destruction, PlayerEvent default-construction and copy-construction, and shared string-assignment rows are reconciled here. PlayerEvent append/destruction, every TurnEvents operation, and remaining exposed allocation operations still require exact generated rows and bound captures before implementation."
|
||||
}
|
||||
}
|
||||
200
campaign/research/research-live-record-bridge.md
Normal file
200
campaign/research/research-live-record-bridge.md
Normal file
|
|
@ -0,0 +1,200 @@
|
|||
# Live-record bridge readiness architecture
|
||||
|
||||
Status: **planning draft; contract remains proposed**. This is acceptance-before-implementation
|
||||
for `research-live-record-bridge`, not live-safety evidence. No game, VM, allocator, constructor,
|
||||
or bridge code was executed while producing it.
|
||||
|
||||
## 1. Bound facts and reconciliation result
|
||||
|
||||
The accepted dependency is the integrated static package
|
||||
`verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json`
|
||||
(binary `dumps/sots.exe`, SHA-256
|
||||
`970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841`). Its scope is static
|
||||
reproduction plus archived-save inspection, not live allocator safety.
|
||||
|
||||
Two current generated-header statements are unsafe to consume and must be replaced by a dedicated
|
||||
bridge fact channel before implementation:
|
||||
|
||||
* `include/generated/sots_addresses.h` says `EvDsc` is omitted from duplicate equality. The accepted
|
||||
repaired windows establish the opposite: after action, location, three floats, message and image,
|
||||
`0x00825d40` compares both descriptions through `0x0046f8c0`; a description-only difference is
|
||||
therefore **not** a duplicate.
|
||||
* The same header names `ObservedTech_copy_ctor = RVA 0x0039a184`, an interior inlined-copy site.
|
||||
Fresh pinned-binary reconciliation in
|
||||
`campaign/research/research-live-record-addresses.json` confirms callable helper entry VA
|
||||
`0x0079a150` (RVA `0x0039a150`). It is a three-stack-argument cdecl-style helper: unused
|
||||
allocator-shaped argument, destination, source; the caller removes 12 bytes after its plain
|
||||
`ret`. It has no supported return-value contract. Full-image linear disassembly found exactly two
|
||||
direct calls, both to `0x0079a150`; neither targets `0x0079a184`. The interior site depends on the
|
||||
entry prologue's EBP, SEH, ESI and construction-state setup and is therefore an executable negative
|
||||
control, never a fallback.
|
||||
|
||||
The dedicated package now records the ObservedTech default constructor `0x008562a0`
|
||||
(`ECX=this`, no stack words, `EAX=this`, plain `ret`) and scalar-deleting destructor `0x00793610`
|
||||
(`ECX=this`, one flags word, `EAX=this`, `ret 4`). Fresh raw captures and a capture manifest are at
|
||||
`verify/results/research-live-record-bridge/run-a247a9d6650d9e0954596cc0/`. The constructor creates
|
||||
the valid empty name string and all scalar defaults. The destructor frees a long name, resets that
|
||||
string, restores base vptr `0x009e22bc`, and frees object storage only when flags bit 0 is set. Vtable
|
||||
bytes at `0x00a2439c` put this destructor in slot zero; the accepted reallocation capture positively
|
||||
shows old embedded elements dispatched through slot zero with a pushed zero, so bridge calls must use
|
||||
flags=0 and must never repeat destruction.
|
||||
|
||||
The dedicated package now also records the complete PlayerEvent default constructor `0x0084ee30`
|
||||
(`ECX=this`, no stack words, `EAX=this`, plain `ret`) in
|
||||
`verify/results/research-live-record-bridge/run-c1238a40bfc3bfa7c2ff9ba6/`. It establishes every
|
||||
logical field of the 0x74-byte object: vptr, zero ID/location/action/CID, three independent valid
|
||||
empty strings, and three `FLT_MAX` position words copied from `0x00af0dc8`; inactive SSO/allocator
|
||||
storage bytes are not overwritten. The fixed empty-literal/count-zero helper path allocates and
|
||||
frees nothing. Direct PE decoding of the constructor's
|
||||
MSVC FuncInfo records three unwind states: restore the base vptr, then destroy completed EvDsc,
|
||||
then destroy completed EvMsg. The current string is not treated as completed if its constructor
|
||||
helper throws. This establishes static partial-construction ownership only; no throw, allocation or
|
||||
live destructor was executed.
|
||||
|
||||
The dedicated package now also records the complete PlayerEvent copy constructor `0x007693f0`
|
||||
(`ECX=destination`, stack source, `EAX=destination`, `ret 4`) in
|
||||
`verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/`. It writes the vptr and
|
||||
EvEID, independently empty-initializes and deep-copies EvDsc then EvMsg, copies EvLoc and all three
|
||||
EvPos words, independently initializes and deep-copies EvImg, then copies EvAct and EvCID. Every
|
||||
string copy uses `0x00425430` with offset zero/count `0xffffffff`; no source owning header is
|
||||
transferred. Direct PE decoding binds three MSVC unwind states: base-vptr restore, completed EvDsc
|
||||
destruction, then completed EvMsg destruction. Construction state advances before each potentially
|
||||
allocating string assignment, so the currently failing string is not treated as complete. This is
|
||||
static partial-copy ownership only; no allocation failure, throw or live destructor was executed.
|
||||
|
||||
The dedicated package now also records ObservedTech vector append `0x007b7320`
|
||||
(`ECX=vector`, stack source, `ret 4`, no supported return). It distinguishes source inside the live
|
||||
range from source outside it, reserves one slot through `0x007b5820` only when full, deep-copies at
|
||||
the old/new last, and advances last only after normal return. Growth chooses at least
|
||||
`size+1` and normally 1.5x capacity, then follows `0x007b34e0` -> `0x0057e590` -> MSVCR100 new,
|
||||
deep-copies all old values, destroys the old range with flags zero, frees the old block through the
|
||||
matching thunk, and publishes the new three-pointer header. Static SEH state exposes partial-copy
|
||||
cleanup, but an actual throw remains unexecuted and cannot support live-safety acceptance.
|
||||
The reserve window is now bound to the direct raw capture and manifest at
|
||||
`verify/results/research-live-record-bridge/run-a52f7d5ebec657d8923d8402/`. Its full comparison records
|
||||
that the invalidated manual transcription omitted exactly eight presentation spaces while all 49
|
||||
address/opcode/mnemonic/operand rows match. Only the new 2472-byte stream is the current byte-exact
|
||||
capture; the old 2464-byte stream remains invalidated and must not be cited as raw evidence.
|
||||
|
||||
The following accepted boundaries may seed the dedicated package, but each callable row still needs
|
||||
its raw-window artifact and exact prototype in that package: PlayerEvent append `0x0086c580`
|
||||
(`ECX=vector`, stack source, `ret 4`); destructor `0x0061ae90`
|
||||
(`ECX=this`, plain `ret`); get/create TurnEvents `0x00885380` (`ECX=EventStorage`, stack turn,
|
||||
`EAX=bucket`, `ret 4`); TurnEvents append `0x00884cb0` (`ECX=outer vector`, stack source,
|
||||
`ret 4`); TurnEvents slot-zero destructor `0x0062e120`; string assignment entry `0x00425430`
|
||||
with allocating worker `0x004249a0` (`ret 8`); MSVCR100 scalar delete/new import thunks
|
||||
`0x00924faa`/`0x00924fb6`. Original `RecordObservedTech`, `EventStorage::PostEvent`, and every
|
||||
research completion root are forbidden.
|
||||
|
||||
## 2. Exclusive write set
|
||||
|
||||
One implementation lane owns exactly these new or modified paths in the assigned engine worktree:
|
||||
|
||||
* `include/generated/sots_live_record_addresses.h` (generated; never hand-maintained)
|
||||
* `src/shim/live_record/{abi.h,bridge.h,bridge.cpp,fixture_entry.cpp,CMakeLists.txt}`
|
||||
* top-level `CMakeLists.txt` only to add the isolated live-record targets
|
||||
* `tests/shim_live_record/{CMakeLists.txt,unit_tests.cpp}`
|
||||
* `tools/build-live-record-fixture.ps1`
|
||||
|
||||
It must not edit or link `src/shim/main.cpp`, `src/shim/hooks/research.cpp`, any research hook,
|
||||
or the standalone game model. The architecture/acceptance lane owns exactly:
|
||||
|
||||
* `campaign/research/research-live-record-bridge.md`
|
||||
* `campaign/research/research-live-record-addresses.json`
|
||||
* `tools/generate_live_record_addresses.py`
|
||||
* `verify/live-record-bridge/{check_package.py,expected-records.json,forbidden-symbols.txt}`
|
||||
* immutable run directories below `verify/results/research-live-record-bridge/`
|
||||
|
||||
Contract/checkpoint mutations remain canonical campaign transactions. Any expansion of either set
|
||||
requires contract revision before code changes.
|
||||
|
||||
## 3. Bridge-only invocation and ownership
|
||||
|
||||
Build a **32-bit MSVC-2010-compatible** `sots_live_record_fixture.dll`, separate from `binkw32.dll`.
|
||||
A PowerShell controller starts a disposable game process without advancing a turn, loads only this
|
||||
fixture DLL, invokes exported `DWORD WINAPI RunLiveRecordBridgeFixture(void*)`, and exchanges a
|
||||
versioned request/result through a named file mapping. The export validates PE fingerprint/module
|
||||
base and resolves only generated RVAs. The controller records loaded modules and rejects any run
|
||||
where `binkw32.dll` is the campaign proxy or any forbidden decision-root address appears in the
|
||||
fixture import/call audit. This route neither links nor initializes the normal shim entry point.
|
||||
|
||||
All owning objects stay inside the original process and one compiler/runtime family. The bridge
|
||||
never transfers a `std::string` or vector header across the mapping. Requests contain scalar fields
|
||||
and counted UTF-8 bytes; results contain scalar fields, copied string bytes, vector sizes/capacities,
|
||||
and operation counters. Construction is field-wise through accepted constructors/assignment/copy
|
||||
helpers. Append delegates to the accepted vector helper. Destruction is reverse-order, exactly once,
|
||||
with scalar-delete flags zero for embedded values; only array blocks created by the compatible
|
||||
original runtime are released through its matching service.
|
||||
|
||||
Each operation owns a journal state (`empty`, `object-constructed`, each string assigned,
|
||||
`element-appended`, `result-copied`, `destroyed`). A deterministic failpoint fires **before** each
|
||||
original call and unwinds only completed states. Actual MSVC allocation exceptions are caught inside
|
||||
the MSVC-built DLL and converted to a result code; no C++ exception crosses the exported WINAPI
|
||||
boundary. The contained-failure case is accepted only when counters show no accepted partial record,
|
||||
no outstanding allocation, no mismatched family, and one destruction per completed owned value.
|
||||
|
||||
## 4. Required cases and accounting
|
||||
|
||||
The fixture package must predeclare cases for empty, spare-capacity and full-capacity vectors; SSO
|
||||
and heap strings for every string field; repeated ObservedTech name update; exact event duplicate;
|
||||
description-only-different event; normal destruction; and one failpoint on a long-string/growth path.
|
||||
Every case records complete resulting ObservedTech, TurnEvents and PlayerEvent fields, first/last/end
|
||||
offsets, event ID/order, helper call counts, allocations by family and size, destructions/frees by
|
||||
object identity, failpoint, return status, forbidden-call count, and execution count. Zero cases,
|
||||
missing records, or unbalanced identities fail rather than skip.
|
||||
|
||||
## 5. Resources, manifests, and executable gates
|
||||
|
||||
No resource is currently leased. Host generation/tests use the assigned paired worktrees and a
|
||||
unique output directory. The 32-bit package requires an immutable compiler/linker/SDK manifest
|
||||
(exact VS2010 tool binaries and hashes), generated-address JSON/header hashes, source bindings,
|
||||
fixture DLL/PDB/controller hashes, original EXE/MSVCR100 hashes, expected-record fixture hash, and
|
||||
command/environment manifest. Runtime uses **VM144 only** after verifying MAC/IP, console/admin
|
||||
access, game/session/process state and housekeeping, then acquiring canonical lease `vm144`.
|
||||
VM140 is excluded. Building on CT111 or another shared host also requires its named campaign lease.
|
||||
|
||||
The eventual package must make these commands literal and zero-exit (output directory replaced by a
|
||||
new unique path each run):
|
||||
|
||||
```text
|
||||
python3 tools/generate_live_record_addresses.py --input campaign/research/research-live-record-addresses.json --output <engine>/include/generated/sots_live_record_addresses.h --check
|
||||
cmake -S <engine> -B <host-build> -DSOTS_LIVE_RECORD_TESTS=ON
|
||||
cmake --build <host-build> --target shim_live_record_unit_tests
|
||||
ctest --test-dir <host-build> -R '^shim_live_record_' --output-on-failure
|
||||
powershell -NoProfile -File <engine>/tools/build-live-record-fixture.ps1 -Source <engine> -Out <win-build> -Manifest <toolchain-manifest>
|
||||
powershell -NoProfile -File <run-controller> -Guest VM144 -Fixture <fixture.dll> -Cases <expected-records.json> -Out <vm-run>
|
||||
python3 verify/live-record-bridge/check_package.py --engine <engine> --re <re> --package <vm-run> --require-source-match --require-binary-match --require-fixture-match --require-all-cases --require-balanced-lifetimes --require-negative-controls
|
||||
```
|
||||
|
||||
`check_package.py` must include executable mutations for raw owning-header transfer, interior/wrong
|
||||
entry, wrong convention, allocator-family mismatch, omitted cleanup, double free, incomplete fields,
|
||||
forbidden roots, zero execution, missing artifacts and source/binary/fixture drift. Host success is
|
||||
not live acceptance. A different verifier session must reproduce the integrated package and at least
|
||||
one mutation after all evidence is bound to one integrated source manifest.
|
||||
|
||||
## 6. Readiness blockers and exact next probe
|
||||
|
||||
The contract remains proposed. Missing items are the generated address header and exact prototypes
|
||||
for PlayerEvent append/destruction, remaining allocation, and TurnEvents calls;
|
||||
verified VS2010 toolchain identity; controller and failure-containment implementation; literal VM144
|
||||
identity/preflight; expected records; checker; and immutable manifests.
|
||||
|
||||
The `0x0079a150` versus `0x0079a184` check is complete and recorded in
|
||||
`research-live-record-addresses.json`; it qualifies only the ObservedTech copy-construction row.
|
||||
The shared string-assignment check is also complete in the JSON: `0x00425430` takes ECX destination
|
||||
plus source/offset/count stack arguments, returns the destination in EAX, and removes 12 bytes with
|
||||
`ret 0x0c`. Bridge copy sites use offset zero and count `0xffffffff`; allocation exceptions may
|
||||
propagate, so the fixture boundary must contain them. The ObservedTech constructor/destructor pair is
|
||||
now complete in the JSON, including virtual-slot provenance and the flags-zero embedded-object rule.
|
||||
The ObservedTech vector append/growth boundary is now encoded, including both source-location
|
||||
branches, growth allocation/copy/destruction, unsupported return value, and the static-only
|
||||
exceptional ownership qualification. PlayerEvent default construction at `0x0084ee30` is now
|
||||
complete, including exact writes across the 0x74-byte layout, three string initialization states,
|
||||
ABI/return and static exceptional partial-construction cleanup. PlayerEvent copy construction at
|
||||
`0x007693f0` is now complete, including the full ordered write set,
|
||||
three independent deep-copy states, ABI/return and static partial-copy unwind. The next discriminating
|
||||
static check is PlayerEvent destruction at `0x0061ae90`: bind the complete callable window and encode
|
||||
the exact reverse string-destruction order, vptr transition, ABI/return behavior and any exceptional
|
||||
qualification before relying on it for fixture cleanup.
|
||||
Do not begin bridge implementation until every exposed ABI row is encoded in the dedicated
|
||||
generated-address package.
|
||||
74
campaign/rollout/RESULT.md
Normal file
74
campaign/rollout/RESULT.md
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
# Rollout result — 2026-09-09
|
||||
|
||||
Architecture/planning/resolutions: GPT-6 Astra. Three additional Astra architecture/review
|
||||
executions supported the lead. Bounded implementation/verifier workers used GPT-5.6 Terra;
|
||||
final Windows operations used GPT-5.5. No source-repository commit, push or deployment of a
|
||||
new game shim was performed. The Windows housekeeping changes were explicitly authorized.
|
||||
|
||||
## Delivered
|
||||
|
||||
- Versioned role prompts/model routing, AGENTS entry points, 40-step worker quanta, auto-compaction,
|
||||
regular durable checkpoints, no silent fallback and no nested worker delegation.
|
||||
- Canonical RE contracts, guarded lifecycle, independent source-bound evidence/verdicts,
|
||||
surprise/Astra decision records, atomic leases and source-isolated launch controls.
|
||||
- Replaced old board/coverage/Forgejo/displacement workflow and removed global Claude re-* agents.
|
||||
Current projections come from contracts and explicit content-addressed evidence selection.
|
||||
- Fresh snapshot gate with actual source/input/binary hashes, expected test inventory, positive
|
||||
corpus execution, explicit skips and full output capture; no reused remote overlay/build.
|
||||
- Separate file/inflated/state comparisons, retained output saves, measured-only reporter and
|
||||
optional equality requirement. Campaign acceptance is not inferred from equal hashes alone.
|
||||
- Fixed RNG draw accounting across twists/rejections, duplicate nested-player accounting,
|
||||
lost replay writes, empty/malformed corpus false-skips, and snapshot clean-room scanning.
|
||||
- Concrete proposed research write-set replacement pilot with archived workload, prerequisites,
|
||||
complete effect boundary, controls and remaining implementation dependencies.
|
||||
|
||||
## Validation
|
||||
|
||||
- Python: **71 unique tests passed** (37 campaign controls, 19 tooling, 8 publishing, 7 config/scanner).
|
||||
- Actual OpenCode loader/model availability checks passed. Real normal launcher runs completed
|
||||
for Astra architecture-review and Terra verifier roles, with actual session IDs, successful
|
||||
stop events, fresh canonical checkpoints and source identity records. Model request is explicit;
|
||||
emitted provider model metadata is unavailable and is not fabricated.
|
||||
- Fresh engine host build and MinGW shim cross-build passed. **59 CTest identities: 52 passed,
|
||||
7 explicit permitted asset/trace skips, 0 failed.** Four corpus suites each exercised **43 saves**.
|
||||
- Independent Astra review rehashed 524 engine + 10 RE execution-tool files, both binaries,
|
||||
all corpus inputs and the saved replay; all matched retained manifests.
|
||||
- Canonical turn remains **62 state differences** from the oracle. It is measured, not accepted.
|
||||
- `controls-bootstrap` reached **accepted** through independent verification and integrated
|
||||
source-bound verdict after R4/R6/R8 and handoff issues were resolved by Astra. Acceptance scope
|
||||
is the declared control-plane criterion, not engine/game fidelity.
|
||||
|
||||
Current selected gate: `campaign/evidence/8e14e00ee3ce7478ddfdef8de12183451e858c52d78dc28cffbdee47f5d087d8-gate.json`.
|
||||
Current selected replay: `campaign/evidence/87f92c2b54625ecbca1f3c0a37e57c43d03a4aff488edf4ea8a09a842cd6279d-replay.json`.
|
||||
Build/source/tool snapshots retained at `/home/alex/.local/share/sots-runs/rollout-host-20260909-c`.
|
||||
Actual replay output retained at `/home/alex/.local/share/sots-runs/rollout-replay-20260909`.
|
||||
Final independent controls verdict: `campaign/runtime/verdicts/controls-bootstrap.json`.
|
||||
Final integrated verifier run: `campaign/runtime/runs/run-97066391080a3d06dce27a80.json`.
|
||||
|
||||
## Five Windows guests
|
||||
|
||||
| VM | Verified IP | Cleanup/profile | Login evidence |
|
||||
|---|---|---|---|
|
||||
| 140 | 192.168.10.139 | compliant | existing console preserved; autologon config + key SSH verified |
|
||||
| 141 | 192.168.10.143 | compliant | reboot → automatic re console; key SSH recovered |
|
||||
| 144 | 192.168.10.144 | compliant | reboot → automatic re console; key SSH recovered |
|
||||
| 145 | 192.168.10.145 | compliant | reboot → automatic re console; key SSH recovered |
|
||||
| 146 | 192.168.10.146 | compliant | reboot → automatic re console; key SSH recovered |
|
||||
|
||||
Lead independently queried all five after completion: `re` console active; sshd Running/Automatic.
|
||||
Policy/task/consumer cleanup and per-VM result JSON are under `verify/results/housekeeping/`.
|
||||
The existing provisioned credential was located in the documented installation ISO and streamed
|
||||
privately into protected LSA autologon storage. No password reset or plaintext-registry password.
|
||||
Temporary ISO mount absent after cleanup; all VM/credential leases released.
|
||||
|
||||
Windows re-enabled a scheduled scan/OneDrive after login during verification. The repeatable
|
||||
`Apply`/`Verify` profile is therefore a required preflight after reboot and before each new oracle
|
||||
capture; old compliant JSON is not proof of current guest state. See the housekeeping guide.
|
||||
|
||||
## Next action
|
||||
|
||||
Review uncommitted rollout changes; prepare the research replacement pilot from the reviewed
|
||||
integration snapshot. Use source-identical verifier handoffs (baseline HEAD alone omits these
|
||||
uncommitted changes). Full asset/trace gate and live completion-bearing research replacement
|
||||
remain separate, unclaimed milestones. Restart OpenCode to load project configuration/agents;
|
||||
existing sessions retain their previously loaded configuration.
|
||||
38
campaign/rollout/architecture-decision.md
Normal file
38
campaign/rollout/architecture-decision.md
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# Architecture rollout — 2026-09-09
|
||||
|
||||
Authority: user approved implementation; architecture and plan-changing surprises are owned by
|
||||
`openai/gpt-6-astra` (the active lead). The user's correction supersedes SOL/MYTHOS routing.
|
||||
|
||||
## Decisions
|
||||
|
||||
- `sots-re` is the only campaign state authority. Contracts, checkpoints, decisions, evidence,
|
||||
leases and accepted results live here. Chat memory and engine docs are not campaign state.
|
||||
- Primary lead and resolver: GPT-6 Astra. Analysts, implementers and independent verifiers:
|
||||
GPT-5.6 Terra. Lab operator: GPT-5.5. Compaction: GPT-5.5. No silent model fallback.
|
||||
- One pilot, then at most two independent implementation slices. No worker subdelegation.
|
||||
- Workers checkpoint every 20 tool calls or 15 minutes, whichever comes first, and before
|
||||
compaction, handoff, experiments or stopping. Bounded sessions resume from repository state.
|
||||
- New slices use paired worktrees. This bootstrap alone uses exclusive FILE ownership in the
|
||||
clean canonical trees: the lead owns architecture/state/config/dashboard; gate-worker owns
|
||||
gate/evidence/reporter tooling; engine-worker owns accounting and engine tests. No shared-file
|
||||
writes, staging, commits, pushes, remote deployment or Ghidra mutations are authorized.
|
||||
- Replace obsolete live workflow documents and agents; history is in Git. Retain scientific
|
||||
evidence and domain findings. Historical observations do not become current acceptance.
|
||||
- Local gate builds a fresh source snapshot, hashes actual source and inputs, runs CTest once,
|
||||
enforces expected identities and required execution, and records limitations. Full acceptance
|
||||
additionally requires assets, shim build and slice-specific oracle criteria. No remote shared
|
||||
staging overlay; operators run the same gate on a leased lab host with explicit paths.
|
||||
- Reporter requires explicit binary and provenance, errors on missing/failed pairs or coverage,
|
||||
separates byte/inflated/state equality, and supports measurement versus acceptance explicitly.
|
||||
|
||||
## Bootstrap task ownership
|
||||
|
||||
| Worker | Model | Files | State |
|
||||
|---|---|---|---|
|
||||
| lead | openai/gpt-6-astra | architecture, AGENTS, configuration, campaign tool/state, dashboard | implementing |
|
||||
| gate-worker | openai/gpt-5.6-terra | tools/{gate.sh,gate.py,evidence.py,standalone_report.py}, verify/tooling/ | assigned |
|
||||
| engine-worker | openai/gpt-5.6-terra | src/app accounting, RNG support as necessary, tests/, CMake test properties | assigned |
|
||||
|
||||
Surprises must be recorded in the worker checkpoint with evidence and the proposed discriminating
|
||||
check, then escalated to the lead before changing architecture or scope. Ordinary implementation
|
||||
errors within a contract may be fixed without escalation.
|
||||
54
campaign/rollout/controls-followup.md
Normal file
54
campaign/rollout/controls-followup.md
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# Astra integration review — control-plane repairs
|
||||
|
||||
After your first bounded controls session completes, inspect this followup and latest independent
|
||||
review. Same owned files, model GPT-6 Astra, no delegates/commits/lab changes.
|
||||
|
||||
Lead inspected run_agent.py:
|
||||
|
||||
1. check_launch currently forbids unresolved surprises for ALL roles. This prevents the explicitly
|
||||
assigned resolver from launching to resolve the surprise. Permit Astra lead/resolver recovery on
|
||||
blocked contracts without a fresh worker checkpoint; keep ordinary workers blocked. Bind these
|
||||
recovery launches read/decision scope, not implementation permission. Add regression test.
|
||||
2. Prompt says 'Workers cannot change architecture' unconditionally even for lead/architecture-review.
|
||||
Render authority by role; user explicitly requires Astra architecture actors to do that work.
|
||||
3. Model availability plus a JSON event is not proof of successful run: detect `type:error` even
|
||||
when process exits zero, and require a successful completed step event, actual session ID and
|
||||
end checkpoint. Provider refusal/runtime error must not be recorded complete after old checkpoint.
|
||||
Missing observed_model can remain explicitly unavailable; never invent observed model.
|
||||
4. Check exact git worktree baseline again under run reservation lock (validation-to-use race),
|
||||
and validate no underlying canonical RE model/prompt/config mutation while launch executes.
|
||||
5. Verify normal noninteractive permissions actually permit the bounded worker to read assigned
|
||||
paired worktrees and checkpoint canonical RE. If necessary add --auto for this user-authorized
|
||||
launcher with explicit deny overrides or scoped external_directory grants. Test command/env; do
|
||||
not leave a launcher that always yields incomplete due to noninteractive permission prompts.
|
||||
6. Artifact restrictions currently permit only campaign/. Existing scientific evidence under
|
||||
verify/ must be referenceable without copying huge corpora into campaign. Permit immutable hashed
|
||||
artifact references anywhere within canonical RE EXCEPT secrets/outside symlinks; continue
|
||||
keeping control records under campaign/runtime. Document this separation and test path escapes.
|
||||
|
||||
Independent reviewer may find additional real defects. Address confirmed issues in owned files,
|
||||
add adversarial tests, checkpoint precise interface change for publishing/pilot/lead. Do not
|
||||
modify another worker's files. Main will run complete tests and normal launch smoke after.
|
||||
|
||||
## Independent Astra review R4/R6 — mandatory integration fixes
|
||||
|
||||
Read campaign/rollout/independent-review.md. R4 (HIGH) is real: baseline path+HEAD cannot bind
|
||||
uncommitted candidate/integrated sources. Add an explicit actual source-content binding to
|
||||
evidence/verdicts, checked at promotion against the referenced candidate/integrated worktrees.
|
||||
Use engine + relevant RE source file manifests/digests (with documented exclusions for mutable
|
||||
campaign state/evidence outputs to avoid self-reference), and immutable artifact/input hashes.
|
||||
Candidate source paths may be paired worktrees, integrated paths canonical; baseline still pins
|
||||
starting commits. Refuse old evidence/verdict after same-HEAD source byte changes. One source
|
||||
binding for all final integrated evidence must agree. Do not let a lead boolean substitute for
|
||||
this identity check. Exact arbitrary criterion meaning remains independent-review responsibility;
|
||||
document that boundary. Add test changing engine bytes without HEAD change and rejecting promotion.
|
||||
Update schema/sample/README; pilot agent's proposed contract has no evidence so should stay valid.
|
||||
|
||||
R6 durable recovery: OLD valid checkpoint is okay for STARTING a new quantum; require freshness
|
||||
only for handoff/promotion/end of this quantum. Do not demand fabricated fresh timestamps to
|
||||
resume next day. Verify basis/artifact/source identities independently of age on recovery. Test.
|
||||
|
||||
Runner config provenance must hash expanded role prompt + relevant effective config, not just
|
||||
JSON file containing a file-reference. Lead's tools/check_agent_config.py --resolved already
|
||||
verified live OpenCode loader resolves prompts/models correctly. Temporary fixture git commits
|
||||
are allowed ONLY inside disposable test repos for unit testing, never in the actual projects.
|
||||
195
campaign/rollout/controls-worker-state.md
Normal file
195
campaign/rollout/controls-worker-state.md
Normal file
|
|
@ -0,0 +1,195 @@
|
|||
# Controls worker checkpoint
|
||||
|
||||
Status: **approved R4/R6 and runner repairs implemented; independent integrated review pending**.
|
||||
Model openai/gpt-6-astra; current logical checkpoint session `rollout-controls-repairs` (actual
|
||||
harness session ID unavailable). Read the final repair handoff below; earlier sections are history.
|
||||
No delegation, staging, project commits or lab I/O. Temporary fixture Git commits are authorized.
|
||||
|
||||
## Interface announcement (2026-09-09)
|
||||
|
||||
Canonical state root is the absolute RE repository path passed as `--state-root`.
|
||||
Contracts live in `campaign/contracts/<id>.json`; every contract has required fields
|
||||
`id,title,status,owner,baseline,scope,inputs,effects,original_dependencies,dependencies,acceptance,predictions,stop_conditions,checkpoint`.
|
||||
`owner` is `{name,role}`. `baseline` is `{engine:{path,commit},re:{path,commit}}`
|
||||
with canonical absolute repository paths and full git commit IDs. `scope`, `inputs`, `effects`,
|
||||
`original_dependencies`, `dependencies`, `predictions`, `stop_conditions` are string arrays;
|
||||
dependencies are contract IDs. Acceptance is an array of `{id,axis,criterion}` objects.
|
||||
Checkpoint is null or a campaign-relative JSON path. Status is proposed/ready/implementing/
|
||||
verification/integration/accepted/blocked/needs-revision. Optional `evidence` is an array of
|
||||
source-bound records; exact schema and README follow. No scalar verified status.
|
||||
|
||||
Runtime directories: `campaign/runtime/checkpoints`, `surprises`, `decisions`, `verdicts`,
|
||||
`leases`, `runs`. Open surprise JSON has `contract`, `status:"open"`, `id`, summary/probe.
|
||||
Checkpoint JSON has `contract`, `summary`, `artifacts`, `next_action`, `model`, `session`,
|
||||
`actor`, `timestamp`. Paths to durable artifacts must be under canonical campaign/.
|
||||
|
||||
## Implementation checkpoint (2026-09-09, quantum in progress)
|
||||
|
||||
Schema, models registry, proposed controls-bootstrap contract, campaign CLI and runner now exist.
|
||||
No tests executed yet. `tools/campaign.py` exports `Campaign(root)` with `load`, `contracts`,
|
||||
`validate`, `open_surprises`; CLI list/status/validate/checkpoint/transition/surprise/resolve/
|
||||
evidence/verdict/lease. Model identity is explicitly a claim, not authentication.
|
||||
Evidence record is `{id,axis,path,sha256,source,integrated}`; source uses the exact baseline object.
|
||||
Evidence artifact contents are responsible for actual dirty-tree manifests (runner captures them).
|
||||
Independent passing verdict is bound to complete evidence digest + contract basis. Integrated
|
||||
evidence changes invalidate that digest, so acceptance requires another independent verdict.
|
||||
Checkpoint freshness is 15 minutes; runner end checkpoint must also be after start and match
|
||||
run-provided checkpoint session/model/actor/role. Run records retain requested versus observed model.
|
||||
|
||||
Coordination: read publishing checkpoint (its current.json gate manifest differs correctly from
|
||||
contract base source), review checkpoint (pilot now adopting schema), lead opencode.json (steps 40,
|
||||
matching role agents and GPT-5.5 compaction). No cross-cutting plan changes made.
|
||||
|
||||
## Pre-test checkpoint
|
||||
|
||||
Added campaign/README.md with strict fields, runtime formats, CLI examples, guarded lifecycle,
|
||||
checkpoint/model provenance limitations, and runner command. Added verify/campaign/test_controls.py:
|
||||
negative lifecycle/schema/source/model/checkpoint tests, actual concurrent lease contenders, fake
|
||||
OpenCode subprocesses for quantum completion, and disposable shared clones/linked worktrees for
|
||||
real Git identity tests. Tests never commit/stage or launch agents; all fixture writes are temporary.
|
||||
Source repository baseline object existence is now checked before ready/implementing. Ordinary
|
||||
needs-revision transitions also clear checkpoint/evidence. No test results yet.
|
||||
|
||||
Next action: run `python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v` and fix failures.
|
||||
No other worker checkpoints existed at initial inspection. Source bootstrap baseline:
|
||||
engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23,
|
||||
RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7 (current concurrent work is uncommitted).
|
||||
|
||||
## Final handoff checkpoint — 2026-09-09T21:35Z
|
||||
|
||||
### Delivered and tested
|
||||
|
||||
- Owned source files: tools/campaign.py, tools/run_agent.py, campaign/contract.schema.json,
|
||||
campaign/models.json, campaign/contracts/controls-bootstrap.json, campaign/README.md,
|
||||
verify/campaign/test_controls.py, campaign/runtime/ records and this checkpoint.
|
||||
- `python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v`: **23/23 passed**
|
||||
in 2.180s. Initial 22/23 caught Git 2.34 lacking worktree-list `-z`; fixed to porcelain lines
|
||||
with explicit unusual-path rejection. Closed subprocess stdout to remove ResourceWarning.
|
||||
- `python3 tools/campaign.py --state-root /home/alex/sots-re validate`: passed both
|
||||
controls-bootstrap and research-replacement. No acceptance transition performed.
|
||||
- Tests cover actual cross-process exclusive lease acquisition, token/owner/stale-release
|
||||
controls, fake process success/failure and missing checkpoint, model/config routing, real linked
|
||||
worktree/common-dir/baseline verification, schema/path/lifecycle/identity/WIP/surprise/evidence
|
||||
negatives and final integrated-package verdict refresh. Disposable shared clones reuse existing
|
||||
local history: **tests execute no git commit or staging**, addressing reviewer test restriction.
|
||||
- RE source identity remains baseline plus concurrent uncommitted changes. Owned file SHA-256:
|
||||
- tools/campaign.py: fa6fc0914ca792daa5decaac8c48b285499a331287d4ccef35d953cca4b0965b
|
||||
- tools/run_agent.py: fc2233fcbc09dd8878e66cae6b0a9b9985146ef02ae22bff3a10643e0c14784e
|
||||
- contract.schema.json: ae4796b1f8e8336ddb63e60d774a81ff965461e4b884b5a2488e3865c6a6c5e0
|
||||
- models.json: 95f507237a8e4fcf14189da4aa102dfae1dbaa536d4d8db6bcbfc30162ac5443
|
||||
- verify/campaign/test_controls.py: 894cf3ef92e540daf5017c46acc526b56d9ac7441def917c1a2910a086954e18
|
||||
|
||||
### Surprises / lead decisions required
|
||||
|
||||
Read campaign/rollout/independent-review.md after successful tests. Recorded both findings with
|
||||
`campaign surprise`; controls-bootstrap is machine-readably **blocked**. No affected interface
|
||||
changes made after these cross-cutting findings, per assignment escalation rule.
|
||||
|
||||
1. **R4 / s-410e48d5ae6cc4da0a6ae649**: current evidence binds baseline path/commit, artifact hash,
|
||||
axis and declared integrated boolean; it does not machine-bind actual candidate/integrated bytes.
|
||||
Reviewer correctly demonstrates that same-HEAD source changes evade this check. README already
|
||||
assigned actual manifests/criteria to independent human review, but that is insufficient for
|
||||
stronger automatic acceptance. Proposed decision: typed acceptance package binding candidate
|
||||
and integrated source manifests, binary, immutable input hashes and per-criterion outcomes;
|
||||
coordinate shape with gate/publishing. Probe changes bytes at unchanged HEAD and rejects old
|
||||
verifier/integration result. Evidence: independent-review.md R4, current check_evidence/verdict.
|
||||
2. **R6 / s-f1c41532e618c77d41538902**: launch uses 15-minute freshness, preventing next-day
|
||||
recovery; unconditional surprise rejection prevents resolver launch. Assignment explicitly said
|
||||
no open surprises at launch, so exception needs clarification. Proposed decision: recovery checks
|
||||
identity/basis/artifact integrity without age limit, fresh end checkpoint remains strict; permit
|
||||
explicit resolution-only Astra quantum while affected workers stay blocked. Probe old-valid vs
|
||||
missing/mismatched checkpoint and resolver vs implementer with open surprise.
|
||||
|
||||
Other known review limitation: runner hashes canonical config/overlay, not expanded prompt files
|
||||
or every effective configuration source. Claimed role/model and agent permissions are not security
|
||||
boundaries. No real OpenCode agent launched; actual effective-config/model execution remains an
|
||||
independent integration check. Interrupted running reservations deliberately do not auto-expire;
|
||||
manual lead inspection is currently required before clearing an interrupted record.
|
||||
|
||||
### ONE exact next action
|
||||
|
||||
Lead: record Astra resolutions for `s-410e48d5ae6cc4da0a6ae649` and
|
||||
`s-f1c41532e618c77d41538902`, specifying the source-package interface and recovery/resolver policy,
|
||||
then resume this controls worker from this checkpoint to implement and test those decisions.
|
||||
|
||||
## Repair handoff — 2026-09-09T21:54Z
|
||||
|
||||
### Authority, source and scope
|
||||
|
||||
- Recovered from the prior checkpoint and formally resolved surprises. Decisions
|
||||
`d-42c6d0b4ee5114e6f2e07c99` (R4) and `d-ab717735fc6c1661919f6894` (R6), plus
|
||||
controls-followup.md, authorize this implementation. Both surprise records are resolved.
|
||||
- Baselines rechecked: RE `3bfde5a70d874a723e797a695bbd847fd82c0aa7`, engine
|
||||
`7741d42fc5e4e761e6449bdaf0e4a61d00036a23`. Bootstrap exclusive canonical file ownership
|
||||
exception applies. Concurrent source remains uncommitted; final machine checkpoint artifacts
|
||||
hash the exact owned source/schema/test/README bytes. No engine edits or resource leases.
|
||||
- Changed: tools/campaign.py, tools/run_agent.py, campaign/contract.schema.json,
|
||||
campaign/contracts/controls-bootstrap.json (acceptance text), campaign/README.md,
|
||||
verify/campaign/test_controls.py, this handoff and canonical runtime checkpoints.
|
||||
Registry/config/agent files, pilot, gate/report and publishing ownership preserved.
|
||||
|
||||
### Precise interface changes for lead, publishing and pilot
|
||||
|
||||
1. Evidence now requires `source_binding`, `binaries`, `inputs`, `outcomes` in addition to existing
|
||||
fields. Source binding is `{engine:{path,commit,sha256},re:{path,commit,sha256}}`, generated by
|
||||
`campaign source-binding CONTRACT [--engine-worktree ABS --re-worktree ABS]`. No worktree args
|
||||
means canonical integrated trees. Actual Git manifests include dirty/untracked nonignored
|
||||
file bytes, modes and tracked deletions; fixed RE campaign-state/results and cache exclusions
|
||||
are documented in README. Source symlinks/submodules fail closed. Candidate paths must belong
|
||||
to paired repositories; integrated paths must be canonical. All final integrated evidence
|
||||
must share one binding. Every evidence/verdict/promotion check rehashes source content.
|
||||
2. `binaries` and `inputs` are nonempty immutable `{path,sha256}` arrays. `outcomes` exactly covers
|
||||
criterion IDs for each axis with `{criterion,status,artifact:{path,sha256}}`. Passing declared
|
||||
outcomes do not prove arbitrary criterion meaning: independent reproduction/review remains
|
||||
responsible for actual execution, scope/branch exposure and input/effect completeness.
|
||||
Verdicts bind evidence digest plus explicit `source_bindings_digest`. Old evidence/verdicts
|
||||
need regeneration/reproduction; proposed pilot with no evidence still validates.
|
||||
3. Scientific artifact references are canonical RE-relative, including existing `verify/`.
|
||||
Controls stay under campaign/runtime; absolute/traversing/outside-link/private-key/secret/Git
|
||||
artifact references fail. Both lexical path and resolved alias are checked. Hashing its own
|
||||
mutable contract in a checkpoint is explicitly rejected; contract metadata uses `basis`.
|
||||
4. Recovery accepts old intact checkpoints, checks basis/artifacts and source-bound evidence,
|
||||
and independently verifies paired Git baseline/worktree identities. Promotion/end retain
|
||||
15-minute freshness. Astra lead/resolver may enter blocked surprises without worker checkpoint
|
||||
under resolution-only prompt/permissions and unchanged paired source at completion. Normal
|
||||
architecture actors receive authority appropriate to role; affected ordinary workers block.
|
||||
5. Runner requires zero exit, no error event, successful `step_finish` reason `stop`, one actual
|
||||
nonempty session ID, consistent emitted model identity, and fresh matching end checkpoint.
|
||||
Missing observed model is explicitly unavailable. Canonical model/prompt/config fingerprints,
|
||||
expanded role prompt and effective live loader config hashes are recorded; config/contract
|
||||
changes around reservation/execution fail. Git HEAD/worktree validation repeats under lock.
|
||||
6. Noninteractive overlay grants read/search, normal worker shell and exact root/subtree external
|
||||
access to paired worktrees/canonical RE, preserving role edit denies. Task/question denied;
|
||||
resolution shell/edit permissions narrowed to read/decision state. Effective loader model,
|
||||
steps, expanded prompt and requested permission entries are checked. No `--auto` required.
|
||||
These remain operational guards, not authentication, shell sandboxing or continuous auditing.
|
||||
7. Gate remains `sots-gate/1` with `source.engine/re`; reporter is measured-only with
|
||||
`--require-match`. The new contract envelope references immutable gate/report packages rather
|
||||
than changing their schemas. No publishing acceptance/current pointers were changed.
|
||||
|
||||
### Measured verification
|
||||
|
||||
- `python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v`: **36/36 passed**, 6.530s.
|
||||
Includes real disposable Git/worktree same-HEAD candidate and integrated drift, add/delete/mode,
|
||||
source/path/secret escapes, criterion/input omissions, concurrent leases, old recovery/resolver
|
||||
policy, zero-exit errors (also error followed by success), missing successful step/session,
|
||||
baseline race recheck, config drift, role authority and permission/environment provenance.
|
||||
- Subsequently added checkpoint self-reference guard and exact-directory external grants:
|
||||
checkpoint bounds/self-reference regression **1/1 passed**, 0.098s; permission provenance and
|
||||
subprocess-success regressions **2/2 passed**, 0.391s. No unrelated changes after these checks.
|
||||
- `python3 tools/campaign.py --state-root /home/alex/sots-re validate`: **passed** both contracts.
|
||||
- Live `opencode debug config` with generated implementer env validated actual loader expansion,
|
||||
model, 40 steps and permissions. Prior overlay effective hash
|
||||
`25b06304c87586543d0607f0abc3f3d46c366cc664948f33c0900b38ab8b3248`, agent hash
|
||||
`5252aaec5ac9b7a8b3cc6265937651f09b00f87731e61e1582d9fbe2caa17b7a` (before additive exact-root
|
||||
grant). No real agent launch performed; normal-launch smoke belongs to the lead integration run.
|
||||
- Checkpoint `2f0fe9ac4ec15b15a983bd75` attached its own contract before pointer mutation and thus
|
||||
has an invalid artifact hash. It is superseded by subsequent checkpoints; the new guard prevents
|
||||
recurrence. Final checkpoint intentionally references stable source/docs and this handoff only.
|
||||
|
||||
### Acceptance and ONE exact next action
|
||||
|
||||
Implementation and local measurements delivered; contract remains needs-revision, not accepted.
|
||||
Independent verifier reproduction and integrated-tree/normal-launch smoke remain pending.
|
||||
Lead: run the complete integrated test suite and a normal noninteractive launcher smoke, then
|
||||
assign independent reproduction of this source-bound controls package before any promotion.
|
||||
59
campaign/rollout/controls-worker.md
Normal file
59
campaign/rollout/controls-worker.md
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
# Astra campaign controls architect
|
||||
|
||||
User explicitly requested three additional GPT-6 Astra agents for this architecture rollout.
|
||||
You are one, running openai/gpt-6-astra. Implement the following approved architecture, refining
|
||||
local details as necessary; report cross-cutting surprises to the lead through your checkpoint.
|
||||
Read campaign/rollout/architecture-decision.md. No delegation, commits, staging, push or lab I/O.
|
||||
Use apply_patch. Checkpoint every 20 tool calls/15min and before compaction/stopping in
|
||||
campaign/rollout/controls-worker-state.md. User wants ruthless replacement of old workflow.
|
||||
|
||||
OWNED FILES ONLY: tools/campaign.py, tools/run_agent.py, campaign/contract.schema.json,
|
||||
campaign/models.json, campaign/contracts/*.json EXCEPT research-replacement.json (pilot agent),
|
||||
verify/campaign/ tests, campaign/runtime/ runtime state, campaign/README.md.
|
||||
Lead owns AGENTS.md and guides/multi-agent-workflow.md, all OpenCode agent files and configs.
|
||||
Another architect owns board/backlog/dashboard and their generators. Gate worker owns
|
||||
tools/{gate.sh,gate.py,evidence.py,standalone_report.py}, verify/tooling/.
|
||||
|
||||
## Implement
|
||||
|
||||
Compact stdlib CLI tools with robust tests, no external server dependency. Models.json owns
|
||||
roles lead/resolver=openai/gpt-6-astra; analyst/implementer/verifier=openai/gpt-5.6-terra;
|
||||
lab=openai/gpt-5.5. No silent fallback. Explicit Astra architecture-review role allowed.
|
||||
Contract schema strict JSON, required: id,title,status,owner,baseline,scope,inputs,effects,
|
||||
original_dependencies,dependencies,acceptance,predictions,stop_conditions,checkpoint.
|
||||
Agree exact field structure in campaign/README.md and provide a valid bootstrap example.
|
||||
Lifecycle proposed -> ready -> implementing -> verification -> integration -> accepted,
|
||||
blocked/needs-revision possible. Separate evidence axes, not a verified scalar.
|
||||
Every transition guarded: ready has inputs/acceptance and baseline; implementing bounded WIP;
|
||||
verification has checkpoint/artifacts; integration requires independent verifier verdict tied to
|
||||
source/evidence; accepted requires integrated evidence and no open surprises. Avoid claiming
|
||||
machine-enforced model authority merely from an editable claimed model field.
|
||||
|
||||
CLI list/status, validate [contracts], checkpoint (persist bounded JSON summary, artifacts,
|
||||
exact next action, model/session, timestamp), surprise (create unresolved record + block contract),
|
||||
resolve (Astra decision record, invalidate affected claims/results; require explanation and probe),
|
||||
transition with clear fail-closed guards, lease acquire/release/show (atomic, owner tokens, no
|
||||
automatic stealing; stale lease requires explicit lead release). Store ALL durable state under
|
||||
RE campaign/. Runtime lock/checkpoint state belongs canonical RE even when workers have paired
|
||||
worktrees, via explicit --state-root absolute path (no sibling guesses in temporary worktrees).
|
||||
Machine-readable state is authority; board/dashboard are generated projections.
|
||||
|
||||
run_agent.py: explicitly choose role from models.json, pass --model to opencode CLI, no model
|
||||
fallback; validate contract role/status and no open surprises. For normal worker launches require
|
||||
two actual distinct git worktrees matching baseline engine/RE revisions, with cwd engine or RE
|
||||
explicit. Source repositories canonical baseline fields paths+commit. No auto commits. Support
|
||||
--dry-run, and fail if model not in `opencode models`. Run using repo-local role configuration
|
||||
(lead will provide `sots-lead`, `sots-analyst`, `sots-implementer`, `sots-verifier`, `sots-lab`,
|
||||
`sots-resolver` agents in RE opencode.json; launch with OPENCODE_CONFIG explicit path so engine
|
||||
worktrees use same definitions). Limit sessions to 40 steps via config; capture log/session/model
|
||||
in canonical campaign/runtime. At quantum end require fresh durable checkpoint or mark run
|
||||
incomplete. Next quantum starts fresh from contract+checkpoint; do not rely on chat resume.
|
||||
Compaction auto configured by lead, regular repository checkpoints + bounded fresh sessions are
|
||||
the reliable memory discipline. Record actual requested model and runner events when available.
|
||||
No fake token-threshold claim. Worker role edits architecture prohibited by instructions and
|
||||
where feasible permissions; ordinary tooling is not a security boundary against arbitrary shell.
|
||||
|
||||
Add unit tests for schema invalidity, lifecycle bypass, bad identity, pending surprise, concurrent
|
||||
lease acquisition, incorrect release token, WIP bound, bad role/model routing, missing/stale
|
||||
checkpoint. Keep it practical and document exact commands. On completion let lead know schemas
|
||||
and APIs in checkpoint so other architects can wire projections/pilot correctly.
|
||||
66
campaign/rollout/controls_evidence.py
Normal file
66
campaign/rollout/controls_evidence.py
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Capture this rollout's controls-suite evidence; never issue a verifier verdict."""
|
||||
import argparse
|
||||
import ast
|
||||
import json
|
||||
from pathlib import Path
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[2]
|
||||
sys.path.insert(0, str(ROOT / "tools"))
|
||||
from campaign import Campaign, ControlError, atomic_json
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("--integrated", action="store_true")
|
||||
parser.add_argument("--reuse", help="Existing canonical-RE-relative suite artifact, revalidated against source")
|
||||
args = parser.parse_args()
|
||||
campaign = Campaign(str(ROOT))
|
||||
contract = campaign.load("controls-bootstrap")
|
||||
source = campaign.source_binding(contract)
|
||||
if args.reuse:
|
||||
relative = args.reuse
|
||||
result = json.loads(campaign.artifact_path(relative).read_text())
|
||||
if result["source_binding"] != source or result["status"] != "passed":
|
||||
raise ControlError("existing test evidence is not this passed source snapshot")
|
||||
else:
|
||||
test_source = ROOT / "verify/campaign/test_controls.py"
|
||||
expected = sorted(node.name for node in ast.walk(ast.parse(test_source.read_text()))
|
||||
if isinstance(node, ast.FunctionDef) and node.name.startswith("test_"))
|
||||
command = [sys.executable, "-m", "unittest", "discover", "-s", "verify/campaign", "-v"]
|
||||
process = subprocess.run(command, cwd=ROOT, text=True, capture_output=True)
|
||||
actual = sorted(re.findall(r"^(test_\w+) .* \.\.\. ok$", process.stderr, re.M))
|
||||
ok = bool(expected) and expected == actual and process.returncode == 0
|
||||
result = {"schema": "sots-controls-test/1", "status": "passed" if ok else "failed",
|
||||
"source_binding": source, "command": command, "expected": expected, "passed": actual,
|
||||
"returncode": process.returncode, "stdout": process.stdout, "stderr": process.stderr}
|
||||
if campaign.source_binding(contract) != source:
|
||||
result["status"] = "failed"
|
||||
result["error"] = "source changed during control tests"
|
||||
relative = f"campaign/evidence/controls-suite-{time.time_ns()}.json"
|
||||
atomic_json(ROOT / relative, result)
|
||||
if result["status"] != "passed":
|
||||
raise ControlError(f"controls suite failed; see {relative}")
|
||||
artifact = campaign.artifact(relative)
|
||||
record = {"id": "controls-suite", "axis": "control-tests", **artifact,
|
||||
"source": contract["baseline"], "source_binding": source, "integrated": args.integrated,
|
||||
"binaries": [campaign.artifact("tools/campaign.py"), campaign.artifact("tools/run_agent.py")],
|
||||
"inputs": [campaign.artifact("verify/campaign/test_controls.py"),
|
||||
campaign.artifact("campaign/contract.schema.json"),
|
||||
campaign.artifact("campaign/rollout/controls_evidence.py")],
|
||||
"outcomes": [{"criterion": "controls-negative-paths", "status": "pass", "artifact": artifact}]}
|
||||
campaign.evidence(contract["id"], record, "rollout-lead", "lead", "openai/gpt-6-astra")
|
||||
print(json.dumps({"artifact": relative, "executed": len(result["passed"]),
|
||||
"integrated": args.integrated, "source_binding": source}, indent=2))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
main()
|
||||
except (ControlError, OSError, ValueError) as exc:
|
||||
print(str(exc), file=sys.stderr)
|
||||
sys.exit(1)
|
||||
18
campaign/rollout/engine-followup.md
Normal file
18
campaign/rollout/engine-followup.md
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
# Astra integration followup — engine accounting and invalid corpus handling
|
||||
|
||||
Your first worker session completed. Use a fresh bounded session and existing RE checkpoint.
|
||||
Same file ownership, model openai/gpt-5.6-terra, no delegation/commit/architecture changes.
|
||||
|
||||
Lead inspected diff: RNG and S13 fixes are present, but TWO assigned items are incomplete.
|
||||
|
||||
1. `RunStrategicTurn` replay leaf writes are still added before final r.leafWrites reset; preserve
|
||||
them exactly once. Add independent regression coverage proving replay contribution isn't lost
|
||||
(existing command replay executable preferred; no new CTest identity required).
|
||||
2. Configured empty corpus in tests/app/test_turn.cpp still returns skip 77. A specified directory
|
||||
with zero .sav is invalid input, must fail (also other configured corpus consumers). CTest skip
|
||||
regex can mask a failure if invalid-path messages say skipped. Ensure specified bad directories,
|
||||
empty corpus, unreadable saves produce nonzero and FAIL, not Skip. Only UNSET dependencies skip.
|
||||
Audit exactly the corpus tests you modified; add meaningful negative checks and report commands.
|
||||
|
||||
Do not run broad gate; lead coordinates after source stable. Focused test reruns appropriate.
|
||||
Update engine-worker-state.md with exact changes/results and completion. Stop after.
|
||||
64
campaign/rollout/engine-worker-state.md
Normal file
64
campaign/rollout/engine-worker-state.md
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
# Engine worker checkpoint
|
||||
|
||||
Updated: 2026-09-09
|
||||
|
||||
## Followup checkpoint (openai/gpt-5.6-terra)
|
||||
|
||||
- Source worktree: `/home/alex/sots-engine` at `7741d42fc5e4e761e6449bdaf0e4a61d00036a23`;
|
||||
RE state root: `/home/alex/sots-re` at `3bfde5a70d874a723e797a695bbd847fd82c0aa7`.
|
||||
- Preserved command-replay leaf writes during `RunStrategicTurn`'s final record fold, then added
|
||||
an `app_command_replay` regression that verifies an applied replay write changes the board and
|
||||
is included exactly once beyond all phase records.
|
||||
- Changed configured empty save directories from skips to failures in the modified app turn,
|
||||
app turn-record, design census, Mars save, and Mars domain corpus consumers. Unset dependencies
|
||||
retain their existing skip behavior; unreadable and parse-error saves remain failures without
|
||||
skip wording.
|
||||
- Observation: `git diff --check` passed before focused build/test execution. Existing unrelated
|
||||
rollout changes are present in the engine worktree and were left untouched.
|
||||
- `mars_stream_test_save` now stops after reporting parser errors, before accessing typed-shape
|
||||
assumptions. `mars_stream_domains` reports parse/read errors and omits those saves from its
|
||||
domain archive. This turned the malformed-save signal termination into ordinary nonzero test
|
||||
failures; it is a test-boundary fix within the assigned contract, not an architecture change.
|
||||
- Results: fresh `/tmp/opencode/sots-engine-followup` host build succeeded. With
|
||||
`SOTS_SAVES_DIR=/home/alex/sots-re/verify/results/saves`, `ctest --test-dir
|
||||
/tmp/opencode/sots-engine-followup --output-on-failure -R
|
||||
'^(app_command_replay|app_turn|app_turn_record|mars_stream_save|mars_stream_domains)$'`
|
||||
passed 5/5 twice, after the final test-boundary change.
|
||||
- Negative evidence: each modified corpus executable returned nonzero for the configured empty
|
||||
directory `/tmp/opencode/sots-empty-corpus`: app turn, app turn-record, Mars save, Mars
|
||||
domains, and design census (the census was given `SOTS_DATA_DIR=/tmp/opencode`). Each of the
|
||||
four applicable consumers returned a normal nonzero failure for configured malformed
|
||||
`/tmp/opencode/sots-invalid-corpus/malformed.sav`; no skip wording or signal termination.
|
||||
- Skip evidence: `env -u SOTS_SAVES_DIR -u SOTS_DATA_DIR ctest --test-dir
|
||||
/tmp/opencode/sots-engine-followup --output-on-failure -R
|
||||
'^(app_turn|app_turn_record|mars_stream_save|mars_stream_domains|game_design_census)$'`
|
||||
reported all five as CTest skipped. Only unset dependencies take that path.
|
||||
- `git diff --check` passed after the final edits. No broad gate was run. Existing unrelated
|
||||
rollout changes in both worktrees remain untouched.
|
||||
- Completion: followup contract implemented and focused evidence recorded. Next action: stop;
|
||||
lead may consume this checkpoint for the coordinated source-stable gate.
|
||||
|
||||
- Implemented nonserialized `MT19937::words_drawn()` accounting. It resets on `seed()` and
|
||||
successful `load_state()` and is not included in save serialization.
|
||||
- `CountingRandom` now measures bounded-integer rejection consumption from that monotone count,
|
||||
so a rejection loop may cross any number of twists.
|
||||
- Removed S13 wrapper aggregation of P01..P12 counters; appended player records are the only
|
||||
contributors to final turn totals.
|
||||
- Added MT boundary/rejection and reset/load tests, plus an app corpus test that validates
|
||||
reported RNG words against the independently persisted generator post-state.
|
||||
- Corpus absence now returns 77 for app/census tests; unreadable or parse-error saves fail and
|
||||
nonzero executed saves remain required. CTest skip properties were added to dependency tests.
|
||||
- Verification: fresh build at `/tmp/opencode/sots-engine-accounting` configured and built
|
||||
successfully. `SOTS_SAVES_DIR=/home/alex/sots-re/verify/results/saves ctest --output-on-failure`
|
||||
passed 52 of 59 tests; the remaining 7 were reported by CTest as skipped.
|
||||
- Skip inventory verified with verbose CTest: `game_config_replay` lacks `SOTS_M1_TRACE` and
|
||||
`SOTS_DATA_DIR`; `game_data_realdata`, `game_design_realdata`, and `mars_text_realdata` lack
|
||||
data inputs; `game_design_census` lacks `SOTS_DATA_DIR`; `game_sim_smoke_real_save` lacks
|
||||
`SOTS_SAVES_JSON`; `mars_vfs_realdata` lacks `SOTS_GOB_DIR`. No configured corpus failure was
|
||||
skipped: `app_turn`, `app_turn_record`, `mars_stream_save`, and `mars_stream_domains` executed
|
||||
against the required saves directory and passed.
|
||||
- Focused rerun passed `mars_rng_unit`, `app_turn`, and `app_turn_record`; `game_design_census`
|
||||
was CTest-skipped for its missing data-root dependency. `git diff --check` is clean.
|
||||
- Limitation: full asset-dependent acceptance remains unavailable locally because the listed asset
|
||||
and trace paths are unset. The configure cache does not consume `-DSOTS_SAVES_DIR`; the required
|
||||
path was supplied to CTest through its runtime environment.
|
||||
33
campaign/rollout/engine-worker.md
Normal file
33
campaign/rollout/engine-worker.md
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# Engine worker assignment
|
||||
|
||||
You are an implementation worker, model openai/gpt-5.6-terra. Read architecture-decision.md.
|
||||
Implement only accounting defects and honest test execution in /home/alex/sots-engine.
|
||||
Keep /home/alex/sots-re/campaign/rollout/engine-worker-state.md updated every 20 calls/15min,
|
||||
before compaction and stopping. You alone own src/app accounting changes, RNG support needed
|
||||
for accurate draw counts, tests/ and CMake test properties. Lead owns engine docs/config.
|
||||
No commits, staging, push, deployment, agents or architecture changes. Use apply_patch.
|
||||
|
||||
## Contract from Astra
|
||||
|
||||
1. Fix CountingRandom in src/app/turn.cpp counting inclusive integer RNG draws across twist(s)
|
||||
including rejection draws. Count actual words consumed; do not repair using modulo that assumes
|
||||
at most one twist. Preserve generator output and save layout. Minimal exact mechanism, focused
|
||||
tests with twist boundary and rejection coverage. Adding nonserialized monotone draw accounting
|
||||
to MT19937 is acceptable if needed; reset/load semantics must be explicit and tested.
|
||||
2. Fix final turn aggregation: S13 wrapper aggregates player phases then appended children are
|
||||
counted again; replay totals before reset disappear. Reports must count each operation exactly
|
||||
once, preserve replay writes, and reflect actual generator advance. Inspect existing architecture
|
||||
before edit. No game behavior or broader phase integration changes.
|
||||
3. Make missing dependency tests report CTest Skipped using CTest SKIP_REGULAR_EXPRESSION
|
||||
or return 77 + SKIP_RETURN_CODE consistently, including current seven asset/trace skip cases.
|
||||
Configured-but-invalid corpora must fail. app_turn currently can drive zero saves and still pass:
|
||||
fix unreadable/erroring saves to fail and require nonzero executed saves when configured.
|
||||
Test real state changes/accounting independently rather than trusting own logged counters.
|
||||
4. Avoid changing test count if new cases fit existing test executables. If new CTest identity is
|
||||
necessary record exact inventory change for lead/gate worker. Run fresh CMake host build in a
|
||||
NEW /tmp/opencode directory with SOTS_SAVES_DIR=/home/alex/sots-re/verify/results/saves; inspect
|
||||
actual skipped outputs, run regression suites appropriate to changes. Assets unavailable on
|
||||
local host is expected, not a surprise or permission to waive full acceptance.
|
||||
|
||||
Return checkpoint: code changed, test commands/results, remaining limitations; write any
|
||||
scope-changing surprise with concrete evidence for Astra, pause affected work until reviewed.
|
||||
122
campaign/rollout/formal-verifier-state.md
Normal file
122
campaign/rollout/formal-verifier-state.md
Normal file
|
|
@ -0,0 +1,122 @@
|
|||
# Controls formal verifier checkpoint
|
||||
|
||||
## Fresh verifier quantum plan — run-cb15199f9272fe496bd10a8a
|
||||
|
||||
Actor `controls-independent-verifier`; role `verifier`; requested model
|
||||
`openai/gpt-5.6-terra`; session `run-cb15199f9272fe496bd10a8a`. This is an
|
||||
independent re-execution, scoped only to `controls-bootstrap` /
|
||||
`controls-negative-paths`; it is neither original-assisted validation nor a
|
||||
partial/full engine comparison, independent replacement, or integrated replay.
|
||||
|
||||
Falsifiers defined before execution: (1) the current canonical source binding,
|
||||
declared executable/input/result hashes, contract basis, or no-open-surprise
|
||||
state differs from the handoff; (2) the complete suite has any failure, error,
|
||||
skip, or fewer than the declared 37 distinct tests; (3) old intact recovery,
|
||||
stale end checkpoint, and artifact-tampered recovery do not separate as
|
||||
required; (4) same-HEAD candidate or canonical-integrated byte mutation is not
|
||||
rejected before verdict/promotion; (5) the added verifier integration route
|
||||
allows owner overlap, source drift, or an open surprise; (6) the actual launch
|
||||
record lacks a real session, successful `stop`, matching fresh checkpoint,
|
||||
zero return, or source-before/source-after equality. Required branch/state
|
||||
exposures are valid-old/tampered/stale recovery; candidate/canonical-integrated
|
||||
same-HEAD mutation; verifier verification/integration entry versus owner,
|
||||
source-drift, and surprise negative controls; and real launch record versus
|
||||
fake-process unit simulation. No RNG/stateful game workload is in contract, so
|
||||
RNG accounting is inapplicable rather than assumed satisfied.
|
||||
|
||||
Pre-execution observations: all three recorded surprises are resolved;
|
||||
canonical and paired-worktree HEADs equal the pinned commits, while canonical
|
||||
trees are intentionally dirty and paired launch trees are clean. Candidate
|
||||
source binding is distinct from the canonical evidence binding and will not be
|
||||
substituted. The R8 correction invalidated the prior formal verdict; its new
|
||||
evidence claims 37 tests. Next: checkpoint this plan, then independently
|
||||
rehash/revalidate and run the full suite plus held-out negative controls.
|
||||
|
||||
## Fresh reproduction results — run-cb15199f9272fe496bd10a8a
|
||||
|
||||
Canonical `source-binding controls-bootstrap` produced the attached evidence's
|
||||
engine digest `ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd`
|
||||
and RE digest `6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8`.
|
||||
`campaign.py validate controls-bootstrap` passed. Independent byte hashes of
|
||||
the two declared binaries, three declared inputs, and outcome package all
|
||||
exactly match the contract. The package has 37 unique expected and 37 unique
|
||||
passed method names, with no missing or extra names, return code zero and
|
||||
`status: passed`.
|
||||
|
||||
`PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s verify/campaign
|
||||
-p 'test_*.py' -v` reproduced **37/37**, zero skips/errors/failures, in 7.049
|
||||
seconds. The independent held-out negative-control rerun of old recovery,
|
||||
same-HEAD verdict/promotion drift, canonical integrated RE mutation, and final
|
||||
integrated-verifier guards reproduced **4/4** in 1.093 seconds. Thus every
|
||||
defined control branch exposed by these tests behaved as predicted; no failed
|
||||
prediction was observed.
|
||||
|
||||
Independent parsing of the actual non-fake run record found 24/24 JSONL events,
|
||||
zero error events, one completed/observed actual session, return code zero, a
|
||||
`step_finish` reason `stop`, source-before equal source-after, and the matching
|
||||
checkpoint session. Its observed model remains `unavailable`; it is an actual
|
||||
Astra architecture-review launch, **not** a direct Terra normal-worker
|
||||
execution. This is a residual/provenance limitation, not evidence of a Terra
|
||||
execution, but does not falsify the narrowly worded unit-test criterion.
|
||||
|
||||
Decision: record a fresh scoped passing verifier verdict for the exact current
|
||||
nonintegrated evidence only. Do not claim integrated acceptance, whole-engine
|
||||
behavior, original comparison, replacement, replay, or game RNG/state
|
||||
coverage. Exact next action: lead may attach a source-bound integrated package,
|
||||
after which a fresh independent verdict must bind its changed evidence digest.
|
||||
|
||||
Actor `controls-independent-verifier`; role `verifier`; model
|
||||
`openai/gpt-5.6-terra`; session `controls-independent-20260909-formal-1`.
|
||||
|
||||
## Scope and pre-execution falsifiers
|
||||
|
||||
This is a source-bound verdict only for `controls-bootstrap` criterion
|
||||
`controls-negative-paths`, not engine, assets, research replacement, or an integrated package.
|
||||
The verdict would fail if the attached artifact/binary/input hashes or either canonical source
|
||||
manifest differed; if the suite had a failure, skip, or fewer than 36 tests; if old recovery
|
||||
accepted corrupted artifacts or rejected solely for age; if a same-HEAD byte change did not
|
||||
invalidate verdict/promotion; or if the purported normal launch lacked a real session, stop,
|
||||
fresh matching checkpoint, zero return, or unchanged paired-worktree state. Required distinct
|
||||
states were intact-old versus stale-end versus tampered recovery, candidate-engine versus
|
||||
integrated-RE same-HEAD mutation, and real normal launch versus fake-process unit simulation.
|
||||
|
||||
## Independent observations and reproduction
|
||||
|
||||
Read `AGENTS.md`, `campaign/README.md`, contract
|
||||
`campaign/contracts/controls-bootstrap.json`, current checkpoint
|
||||
`campaign/runtime/checkpoints/controls-bootstrap-243f539b3219e74f12ef0db7.json`, raw evidence,
|
||||
raw run JSON/JSONL/stderr, and Astra review `campaign/rollout/independent-review.md`.
|
||||
|
||||
`python3 tools/campaign.py --state-root /home/alex/sots-re source-binding controls-bootstrap`
|
||||
recomputed engine `7741d42fc5e4e761e6449bdaf0e4a61d00036a23` digest
|
||||
`ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd` and RE
|
||||
`3bfde5a70d874a723e797a695bbd847fd82c0aa7` digest
|
||||
`82fc34631b2baa2ee74557020f74d68cc4db3c031561210f9933a3f22d7ff7b6`, exactly matching
|
||||
the attached evidence. Independently rehashed all declared binaries, inputs, and result artifact;
|
||||
each matched its declared SHA-256. `campaign.py validate controls-bootstrap` passed.
|
||||
|
||||
`PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v`
|
||||
ran **36 tests**, all passed, zero skips, in 6.720 s. Held-out focused rerun:
|
||||
`python3 -m unittest -v verify.campaign.test_controls.Controls.test_old_recovery_checks_integrity_but_not_age verify.campaign.test_controls.Controls.test_same_head_source_mutation_rejects_verdict_and_promotion verify.campaign.test_controls.Controls.test_integrated_re_source_mutation_rejects_acceptance`
|
||||
ran 3/3 pass (0.722 s). The inspected tests require an old intact checkpoint to launch but reject
|
||||
its stale end-checkpoint use and a post-checkpoint artifact modification; they alter candidate
|
||||
engine and canonical RE bytes without changing HEAD and require source-content rejection before
|
||||
verdict/integration/acceptance.
|
||||
|
||||
The actual, non-fake normal-launch record
|
||||
`campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json` hashes to
|
||||
`65dd1c1286742cd4d2401af5a229d7d014f60dd329dadee0dee78c499f61d663`.
|
||||
Its JSONL has 24 parseable events, exactly one actual session
|
||||
`ses_f77cf5062ffeTknrMfnbJMmdNh`, a `step_finish` with reason `stop`, return code 0, zero error
|
||||
events, matching launcher checkpoint/session, and `source_before == source_after` for both paired
|
||||
worktrees. Raw stderr is empty. Observed model is correctly `unavailable`, not fabricated; this
|
||||
is an actual Astra architecture-review smoke, not evidence of a Terra worker launch.
|
||||
|
||||
## Decision and residual
|
||||
|
||||
Pass is justified only for the one declared controls test criterion and the exact nonintegrated
|
||||
binding above. Astra R8 remains a separately recorded residual: the current launcher permits a
|
||||
verifier in `verification` but not `integration`; it prevents the later fresh integrated-verifier
|
||||
launch and requires Astra resolution. It neither converts this reproduced nonintegrated suite into
|
||||
whole-engine acceptance nor is hidden as success. Exact next action: lead resolves R8, attaches
|
||||
an integrated controls package, then obtains a new independent verdict over its changed digest.
|
||||
32
campaign/rollout/formal-verifier.md
Normal file
32
campaign/rollout/formal-verifier.md
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# Independent controls verifier — bounded formal acceptance task
|
||||
|
||||
Model openai/gpt-5.6-terra; role verifier; actor controls-independent-verifier.
|
||||
No implementation/source/document edits, no delegates/commits/lab actions. Own only your
|
||||
canonical runtime checkpoint/verdict for controls-bootstrap, plus
|
||||
campaign/rollout/formal-verifier-state.md. Read canonical AGENTS, contract and current evidence.
|
||||
Do not rely on lead summary. Inspect recorded tests/raw stderr/source bindings and reproduce
|
||||
the complete control suite (now 37 tests after R8). Challenge old-checkpoint recovery,
|
||||
same-HEAD source drift and final integrated-verifier launch guards specifically.
|
||||
Read independent Astra review, noting it is distinct from this formal source-bound verdict.
|
||||
|
||||
Source-bound test package is already attached to controls-bootstrap, state verification.
|
||||
R8 is now formally resolved by Astra (d-6239404c8f40351310c8abf0); the one-line role/status
|
||||
fix and added guarded integration regression require refreshed source-bound verification.
|
||||
Validate ALL evidence/inputs/binaries/source_binding through campaign API/CLI, independently run
|
||||
the appropriate local unit suite, inspect the actual normal-launch record
|
||||
campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json and its JSON events/checkpoint to confirm
|
||||
real session/stop/no source mutation. Do not mistake fake-process tests for that real launch.
|
||||
|
||||
If running in integration: source/package revalidate the final integrated evidence; no repeat
|
||||
suite is needed if hashes match your just-reproduced verification package. New verdict must
|
||||
bind the changed integrated evidence digest. If contract criterion holds and no new blocker, record a passing
|
||||
verdict with campaign CLI: --actor controls-independent-verifier --role verifier
|
||||
--model openai/gpt-5.6-terra --session controls-independent-<unique> --verdict pass
|
||||
--explanation scoped to actual controls tests. If not, record fail with precise evidence.
|
||||
Never widen this to whole-engine/full-assets/research acceptance.
|
||||
|
||||
Write a checkpoint with your actual actor/model/role/session, immutable evidence artifact(s),
|
||||
test outcomes and exact next action. Lead will then promote same package to integration and ask
|
||||
for final source/package revalidation; no redundant tests needed if all source/input hashes are
|
||||
identical, but changed integrated evidence digest needs a new independent verdict.
|
||||
At completion stop. Checkpoint before 40-step quantum limit. No alias model substitution.
|
||||
56
campaign/rollout/gate-followup.md
Normal file
56
campaign/rollout/gate-followup.md
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
# Astra integration followup — repair gate/report acceptance gaps
|
||||
|
||||
First session delivered useful initial tooling but incomplete enforcement. Same file ownership,
|
||||
fresh bounded session openai/gpt-5.6-terra. Read independent-review.md if present and your checkpoint.
|
||||
No delegation, commits, live lab operations or architecture changes. This is a precise Astra
|
||||
approved repair contract, not permission to waive any of the initial requirements.
|
||||
|
||||
Fix these inspected defects and write adversarial tests proving them:
|
||||
|
||||
1. `corpusNonzero` cannot be absence of "0 save" in ctest --output-on-failure. Parse per-test
|
||||
JUnit system-out positive summary counts for all four corpus tests; require count equals manifest
|
||||
top-level saves count (tests scan top-level, do not hash nested unexecuted .sav as exercised).
|
||||
Missing summaries, zero/mismatched count and duplicates fail. JUnit executed identity multiset
|
||||
must exactly match discovered/expected inventory (including tests absent from XML -> fail).
|
||||
2. Source copy integrity: compare every copied byte hash/mode to pre-copy snapshot BEFORE build.
|
||||
`startswith('build')` excludes actual source filenames like build_turn.cpp. Exclude only top-level
|
||||
known build output directories or explicitly named runtime artifact directories. Track deleted
|
||||
files and symlink semantics or reject source symlinks explicitly. Snapshot includes untracked files.
|
||||
3. Require tools versions and complete hashes for actual supplied SOTS_* file/dir dependencies,
|
||||
assets and trace inputs. Explicitly sanitize inherited SOTS_* environment or validate/hash each
|
||||
consumed input. Record roots, actual env settings, compiler/build settings and skip limitations.
|
||||
4. --shim should be a boolean flag; use source cmake/toolchain-mingw-i686.cmake. Full requires
|
||||
--data and shim build; --shim on host also builds. Check resulting DLL hash. Initial --shim PATH
|
||||
requires directory but passes directory to CMAKE_TOOLCHAIN_FILE, unusable. Correct docs/help/tests.
|
||||
5. RE identity mutation: don't hash transient campaign runtime/publication state as executable
|
||||
source. Bind actual RE tooling inputs via immutable copies or hash list before+after; list excludes
|
||||
only runtime/evidence output areas explicitly. Engine source must be stable before+after. Gate
|
||||
should run while other independent campaign checkpoints change without falsely claiming tools
|
||||
are mutable. Detect actual gate/checksum/inventory source mutation.
|
||||
6. run/errors: subprocess exceptions need failed manifest, expected actual statuses must hold,
|
||||
input roots/output roots must not overlap, jobs positive, binary must exist for passing gate.
|
||||
All required checks explicitly present, not all(empty) success. `all` over strings is unsafe.
|
||||
7. Standalone reporter: verify passed gate schema and binary hash/source identity thoroughly.
|
||||
Preserve full stderr/stdout and complete paths/diffs. --roundtrip only if CLI semantics means
|
||||
verify then SIMULATE (inspect src/app/main.cpp; don't accidentally test identity instead of turn).
|
||||
Distinguish accepted ON SELECTED WORKLOADS from campaign replacement acceptance; reporter is
|
||||
measurement by default and --accept file equality criterion explicitly documented. Hash all
|
||||
engine-arg file inputs (commands/data) actually used, prevent extra args overriding --out/metric
|
||||
or injecting --roundtrip-only/etc. Detect binary/input mutation after run too. Keep required
|
||||
coverage and equality separation. Add negative-path tests missing pairs, binary mismatch,
|
||||
malformed/failed manifest, missing coverage, pair failure, wrong reference and unexpected args.
|
||||
|
||||
Do not rerun integrated gate until lead says source stable. Unit tests and fixture negative paths
|
||||
now; checkpoint exact manifest/CLI shape and results. Main will run fresh final gate later.
|
||||
|
||||
## Astra resolution of independent review R2
|
||||
|
||||
The equality reporter must NOT claim campaign acceptance. Replace --accept with --require-match
|
||||
(no legacy alias). This flag only requires all selected pairs to match and affects exit status;
|
||||
report status remains `measured` on a valid measurement, including when equality holds. Add
|
||||
`matchRequired` and `allPairsMatch` booleans and an explicit scope statement. A failed required
|
||||
match has status failed and retained residual evidence. ONLY campaign controls + independent
|
||||
verdict/integrated criteria can produce accepted status. This removes no-op-as-accepted semantics
|
||||
without pretending a general equality tool can infer whether a workload exercised research.
|
||||
Test identical input/oracle can be measured but never gets `accepted`; full gate source validation
|
||||
still required. Pilot provides required positive phase/branch controls separately.
|
||||
76
campaign/rollout/gate-worker-state.md
Normal file
76
campaign/rollout/gate-worker-state.md
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
# Gate worker checkpoint
|
||||
|
||||
Timestamp: 2026-09-09T22:05:00Z
|
||||
Model/session: openai/gpt-5.6-terra, bounded Astra-followup implementation session.
|
||||
|
||||
## Contract and source identities
|
||||
|
||||
- Active repair contract: `campaign/rollout/gate-followup.md`; read the prior worker checkpoint,
|
||||
`gate-worker.md`, `architecture-decision.md`, workflow, and reviewer checkpoint. No
|
||||
`independent-review.md` exists in this checkout.
|
||||
- RE source is `/home/alex/sots-re`; the worktree is already dirty with other lanes' changes.
|
||||
Owned files remain `tools/{gate.sh,gate.py,evidence.py,standalone_report.py}`, `verify/tooling/`,
|
||||
and this checkpoint. No staging, commits, or lab activity.
|
||||
- Engine inspected at `/home/alex/sots-engine`, HEAD
|
||||
`7741d42fc5e4e761e6449bdaf0e4a61d00036a23`, dirty from concurrent engine work. Its
|
||||
`src/app/main.cpp` confirms `--roundtrip` verifies untouched serialization and then calls
|
||||
`RunStrategicTurn`; it must remain part of the reporter invocation, not replace turn simulation.
|
||||
- The required shim toolchain is the source-relative
|
||||
`cmake/toolchain-mingw-i686.cmake`; its output target is `binkw32.dll`.
|
||||
|
||||
## Observations and decision
|
||||
|
||||
- Existing gate defects match the repair contract: source exclusion used `startswith("build")`,
|
||||
copy integrity was not verified, source symlinks/modes/deletions were not represented,
|
||||
inherited `SOTS_*` inputs were retained, JUnit completeness/corpus summaries were fail-open,
|
||||
`--shim` took an unusable directory/toolchain path, and manifest success used unsafe generic
|
||||
`all(checks.values())`.
|
||||
- Existing reporter only checked gate schema/status and binary hash; it permitted unsafe engine
|
||||
arguments and did not detect provenance/binary/input mutations after execution.
|
||||
- This is ordinary implementation repair within the approved contract. Do not run an integrated
|
||||
gate while the engine source is mutable.
|
||||
|
||||
## Implemented repair
|
||||
|
||||
- `tools/gate.py` now snapshots tracked and nonignored untracked engine files with complete
|
||||
SHA-256 and mode records, rejects source/input symlinks, excludes only exact top-level known
|
||||
build outputs, checks every copied file before the build, and detects additions/deletions/mode
|
||||
and content changes after the run. RE tooling identity is an explicit immutable list rather
|
||||
than mutable campaign runtime/publication state.
|
||||
- The gate sanitizes inherited `SOTS_*`, accepts declared extra dependencies as repeatable
|
||||
`--sots-input SOTS_NAME=PATH`, records roots, hashes full consumed file/directory inputs,
|
||||
compiler/tool versions, commands, and actual environment. Input/output root overlap and
|
||||
nonpositive jobs are rejected.
|
||||
- `--shim` is now boolean. Host is always built; `--shim` also builds the source-relative
|
||||
`cmake/toolchain-mingw-i686.cmake` configuration and hashes exactly one `binkw32.dll`. Full
|
||||
requires `--data --shim`.
|
||||
- JUnit records every testcase/system-out. Its executed identity multiset must be the expected
|
||||
inventory with no missing/duplicate identity; statuses must cover every expected test without
|
||||
failures or unexpected skips. Each of the four corpus tests must report exactly one positive
|
||||
`N save(s)` count equal to the top-level corpus save manifest count.
|
||||
- `tools/evidence.py` validates all passed-gate source, binary, test coverage and required-check
|
||||
fields. `tools/standalone_report.py` binds binary/provenance/pair/engine file inputs before and
|
||||
after execution, retains complete child stdout/stderr and differences, blocks output/metric/
|
||||
roundtrip argument overrides, and records that `--roundtrip` verifies serialization before
|
||||
`RunStrategicTurn`. Measurement remains scoped to selected workloads; `--accept` fails unless
|
||||
all selected pairs match on file, inflated and state digests.
|
||||
|
||||
## Validation
|
||||
|
||||
- `python3 -m py_compile tools/gate.py tools/evidence.py tools/standalone_report.py verify/tooling/test_tooling.py`: pass.
|
||||
- `python3 -m unittest verify/tooling/test_tooling.py -v`: pass, 15 tests. The expected argparse
|
||||
diagnostics occur in rejection tests. Tests exercise build-named sources, pre-copy mutation,
|
||||
symlink rejection, JUnit duplicate/positive counts, subprocess exception, incomplete/failed
|
||||
provenance, binary mismatch, unsafe arguments, missing pair, wrong reference and pair failure.
|
||||
- `git diff --check`: pass. `python3 tools/gate.py --help` and
|
||||
`python3 tools/standalone_report.py --help`: pass.
|
||||
- Per contract, no integrated gate, commits, staging, live lab operation, or architecture change
|
||||
was performed.
|
||||
|
||||
## Blocker and exact next action
|
||||
|
||||
- The engine checkout remains dirty/concurrently owned, so any integrated measurement is still
|
||||
invalid. This repair provides no acceptance result.
|
||||
- Exact next action: lead coordinates a stable baseline-pinned engine identity, then a fresh
|
||||
worker runs the documented gate CLI once in a new external output directory and independently
|
||||
verifies the resulting evidence package.
|
||||
50
campaign/rollout/gate-worker.md
Normal file
50
campaign/rollout/gate-worker.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
# Gate worker assignment
|
||||
|
||||
You are an implementation worker, model openai/gpt-5.6-terra. Read architecture-decision.md.
|
||||
Implement, do not merely advise. Work only in your owned files in /home/alex/sots-re:
|
||||
tools/gate.sh, tools/gate.py, tools/evidence.py, tools/standalone_report.py, verify/tooling/.
|
||||
Keep campaign/rollout/gate-worker-state.md updated every 20 tool calls/15min and before stopping.
|
||||
No commits, stage, push, deployment, other agents, architecture changes, or shared dashboard edits.
|
||||
Use apply_patch for edits. Scope changes/surprises go into checkpoint and back to the Astra lead.
|
||||
|
||||
## Contract from Astra
|
||||
|
||||
Replace the old remote overlay gate with a local, reproducible stdlib Python gate and tiny shell
|
||||
entrypoint. CLI: --engine PATH --corpus PATH --out NEW_DIR --profile host|full (default host),
|
||||
--data PATH optional, --jobs N, --shim optional (full requires shim and assets). Run locally only;
|
||||
documentation will tell operators to run same command on a leased lab host. Every build is fresh
|
||||
from a source snapshot (git tracked + nonignored untracked files; exclude .git/build outputs,
|
||||
never accidentally hash/copy build dirs). Manifest source relative paths + SHA256, git HEAD/dirty,
|
||||
tools versions, corpus hashes, input asset hashes when used, binary hash, all commands and complete
|
||||
logs. Detect source/input mutation across run. Out must be new, never delete/reuse existing output.
|
||||
Capture an explicit expected test list checked into verify/tooling/host-tests.json (59 currently;
|
||||
engine worker may add tests so coordinate mismatch to lead). Compare discovered CTest json list
|
||||
exactly to this inventory. Execute CTest once with output junit and parse all test statuses; skips
|
||||
must be visible (engine worker is adding properties). host profile allows explicit skip list for
|
||||
asset/trace dependent tests (currently seven); corpus tests must run. full profile requires all
|
||||
tests not skipped; users supply needed SOTS_* dependencies, record/hash their paths too. Require
|
||||
nonzero save corpus and nonzero execution for corpus tests (parse their positive summaries).
|
||||
Run engine clean_room_check.sh + check_shim_configs.py, host build, optional shim build; preserve
|
||||
return codes. Emit out/manifest.json with schema sots-gate/1, status passed|failed, profile,
|
||||
source (engine identity and RE identity), inputs, binary {path,sha256}, tests {expected,passed,
|
||||
skipped,failed}, checks and limitations. Failed checks produce failed manifest and exit nonzero.
|
||||
Avoid self-referential source hashes if out lies inside RE: exclude output runtime area explicitly
|
||||
or require out outside source trees. No network required. Include focused unittest tests for
|
||||
missing input, stale output, source hash mutation, zero tests, skip classification, wrong inventory.
|
||||
|
||||
Rewrite standalone_report.py if simpler, no backward compatibility necessary. Require --binary,
|
||||
--provenance (gate manifest), --out NEW_DIR, --pair INPUT ORACLE (repeatable), --engine-arg repeated,
|
||||
--accept flag. Measurement permits divergences but returns nonzero on any invalid inputs,
|
||||
coverage failure, execution failure. --accept requires every selected pair to match exactly.
|
||||
Verify binary hash + passed gate manifest before running, explicit source binding via gate.
|
||||
Never choose another reference on failure. Record input/output hashes, full stdout/stderr,
|
||||
all named differences, source identity and gate hash; no overwritten canonical results.
|
||||
Fields fileByteMatch, inflatedByteMatch, stateDigestMatch. Coverage required on all saves.
|
||||
state_checksum may prove inflated rather than compressed roundtrip: label precisely.
|
||||
Avoid old byteMatch aliases or hardcoded stale RNG claims. Manifest schema sots-standalone/2,
|
||||
status measured|accepted|failed, pairs[], provenance. No leaf percentage for completeness.
|
||||
Add negative-path tests with fixture/fake runner as needed, and run real canonical pair using
|
||||
the lead's eventual gate build if available (otherwise defer that integration check).
|
||||
|
||||
At completion write checkpoint with modified files, exact tests/results, API shape and blockers.
|
||||
Do not claim full acceptance from host checks. Main agent will inspect and integrate.
|
||||
46
campaign/rollout/housekeeping-completion.md
Normal file
46
campaign/rollout/housekeeping-completion.md
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# Final housekeeping quantum — existing proven procedure, GPT-5.5 lab role
|
||||
|
||||
User confirmed passwords should be stashed. Previous Terra session found provisioning ISO password
|
||||
and proved VM146 console autologon after reboot using LSA path. Read its checkpoint PLUS last
|
||||
section of /tmp/opencode/sots-housekeeping-followup.log (completion details after stale checkpoint).
|
||||
Preserve source of credential privately, never print secret or command args. No password reset.
|
||||
|
||||
Use role lab / model openai/gpt-5.5, actor housekeeping-completion for NEW leases. Previous worker
|
||||
acquired vm140/vm144/vm146 and spicy-autounattend-credential leases under housekeeping-worker / verifier
|
||||
/ Terra; inspect lease JSON and completed processes before proceeding. You may ask lead to release
|
||||
those stale worker leases; do not impersonate its role/model. Lead is authorizing release after
|
||||
confirming previous worker process stopped, outstanding mount cleaned and SSH/access validated.
|
||||
Record which resources still held when ending. No delegates/commits or codebase architecture edits.
|
||||
|
||||
## Astra corrections/decisions
|
||||
|
||||
- VM141 canonical address is **192.168.10.143**. Previous 'No route' check incorrectly used .141.
|
||||
Do not diagnose guest outage until checking its verified .143 identity/MAC. Other addresses:
|
||||
VM140=.139, VM144=.144, VM145=.145, VM146=.146. Confirm actual identities from hypervisor.
|
||||
- Protected-secret presence alone was insufficient (VM144 failed); use existing PROVEN provisioned
|
||||
password via secure stream, validate LogonUser, set LSA, then reboot free guest to prove login.
|
||||
- VM146 succeeded. Its current consumer M365Copilot/OfficeHub process appeared after login and
|
||||
Remove-AppxPackage -AllUsers failed. Prefer targeted per-user removal or disabling its documented
|
||||
startup entry and stopping this identified consumer process; do not remove generic webview or
|
||||
system packages indiscriminately. Record any package removal blocked; don't hide it as compliant.
|
||||
- Active console/passive VNC is not itself a test. Non-disruptive cleanup is allowed if actual
|
||||
test/tool activity absent. Reboot only known free guests. VM140 already had a logged-in console;
|
||||
keep its session unless user/test activity demonstrably absent and a reboot is necessary.
|
||||
|
||||
## Finish
|
||||
|
||||
1. Verify current vm146 SSH+console result, cleanup any temporary credential ISO mount, release
|
||||
stale leases through lead as noted. Persist last session's actual outcomes to checkpoint.
|
||||
2. VM144 and VM145: apply proven protected autologon with ISO credential, reboot if free, verify
|
||||
console re + keySSH + intended debloat policies/startups. VM141 use CORRECT .143 address and
|
||||
perform same. VM140 verify existing login/config, apply missing non-disruptive cleanup.
|
||||
3. Ensure all five have targeted consumer startups disabled, update auto-restart/task interference
|
||||
controls set, no currently identified consumer nag process; preserve SOTS/graphics/runtime/access.
|
||||
4. Update guides/windows-lab-housekeeping.md and per-VM verify/results/housekeeping/*.json with
|
||||
exact current result, including actual reboot proof vs config-only. Record model/role accurately.
|
||||
5. At quantum end update campaign/rollout/housekeeping-worker-state.md and release YOUR leases;
|
||||
explicitly report any blocked guest/subtask. Stop at 40 steps with exact next action if needed.
|
||||
|
||||
Owned files: same tools/windows-housekeeping/, guides/windows-lab-housekeeping.md,
|
||||
verify/results/housekeeping/, housekeeping-worker-state.md. Routine execution only; Astra handles
|
||||
any new plan-changing surprise. Existing script mutation bugs may be fixed in own scope.
|
||||
42
campaign/rollout/housekeeping-followup.md
Normal file
42
campaign/rollout/housekeeping-followup.md
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
# Astra continuation — complete free guests and protected autologon
|
||||
|
||||
Read housekeeping-worker-state.md and lead-state.md. Same ownership, Terra model, no delegates.
|
||||
User asked for all five VMs plus passwordless logins; continue beyond policies on only two guests.
|
||||
|
||||
## Astra decision on activity
|
||||
|
||||
An active dedicated `re` console session or passive VNC proxy ALONE does not constitute a test.
|
||||
Inventory VM140/144/146 for actual SOTS/game, debugger, capture, UI automation, running scheduled
|
||||
test tasks and recent harness activity. If absent, apply non-disruptive policies serially without
|
||||
logging off/rebooting or closing user's tools. The user authorized removing consumer interference
|
||||
so OneDrive/Copilot presence alone is a target, not a blocker. Actual active test/interactive task
|
||||
must remain untouched. Report exact process/task/time evidence for any remaining blocked guest.
|
||||
Use the canonical lease CLI now provided in tools/campaign.py; no custom lock format needed.
|
||||
Clean up only your previously created empty custom directories if incompatible with new leases.
|
||||
|
||||
## Autologon investigation and implementation
|
||||
|
||||
Do not stop at "no protected-secret tool verified" without investigating. Supported Sysinternals
|
||||
Autologon stores password as an LSA secret and is suitable for dedicated lab accounts. Discover
|
||||
existing installation/infra procedure; use verified Microsoft download if needed. Alternatively
|
||||
Windows LsaStorePrivateData with a small reviewed script is the same protected-secret mechanism.
|
||||
Use the existing account password from the documented credential store, never change it or print
|
||||
it. Do not place it on command lines, in repository/temporary script files, stdout or logs. If a
|
||||
utility only accepts plaintext command-line passwords, use its UI securely or the LSA API with a
|
||||
secret passed over a protected channel/in memory, and zero memory when feasible. Preserve remote
|
||||
SSH key auth. Do NOT use DefaultPassword plaintext registry value. Inspect any existing autologon
|
||||
configuration without logging secrets; do not read/print password values in inventory.
|
||||
|
||||
Verify AutoAdminLogon + username/domain + existence (NOT CONTENTS) of protected secret. Need a
|
||||
free guest and recorded recovery path to reboot and prove actual autologon. If reboots cannot be
|
||||
done while viewer/session active, report configuration verified but login-after-reboot unverified.
|
||||
If credential store lacks the existing password, report that exact missing dependency for user;
|
||||
do not reset passwords or pretend config-only is demonstrated login.
|
||||
|
||||
## Debloat quality
|
||||
|
||||
Policies alone may leave current OneDrive/Copilot/Xbox/consumer scheduled startup active. Inventory
|
||||
startup entries, consumer processes and scheduled tasks, remove/disable targeted consumer startups
|
||||
and app packages only where safe for dedicated lab. Preserve all game/runtime/remote tooling.
|
||||
Record exact differences and idempotence verify all intended policy/task/startup settings.
|
||||
Keep guest-by-guest outcome in evidence and checkpoint. No false all-five completion.
|
||||
39
campaign/rollout/housekeeping-worker-state.md
Normal file
39
campaign/rollout/housekeeping-worker-state.md
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# Housekeeping Worker Checkpoint
|
||||
|
||||
Updated: 2026-09-09T21:33:40Z
|
||||
|
||||
- Verified targets: VM140 `192.168.10.139`, VM141 `192.168.10.143`, VM144 `192.168.10.144`, VM145 `192.168.10.145`, VM146 `192.168.10.146`; each matched its configured MAC and `SOTS-RE` hostname.
|
||||
- Model/session: `openai/gpt-5.6-terra`, current OpenCode session. Sources: `campaign/rollout/housekeeping-worker.md`, `campaign/board.md`, `findings/subsystems/running-the-game.md`, `/home/alex/trikilli/services/re-lab.md`, and `/home/alex/trikilli/hosts/spicy/AGENTS.md`.
|
||||
- Access: key-based SSH as the existing `re` lab account succeeded on all five guests. No credential was read, logged, or changed.
|
||||
- Activity inventory at 2026-09-09T21:29Z: VM140 had active `re` console session 1 but no SOTS, debugger, capture, UI automation, or running SOTS/test task; VM144 and VM146 had no console user and no matching process/task. The host had passive `qm vncproxy` processes for VM144 and VM146 only. Under the Astra clarification this does not block non-disruptive maintenance. VM141 became unreachable (`No route to host`) during later read-only tooling discovery and remains untouched this continuation.
|
||||
- Leases: custom directory locks for VM141/VM145 were acquired before the controls-worker lease CLI appeared. Both are now released after verification.
|
||||
- VM141: all eight policy values and all present selected tasks verify compliant in `verify/results/housekeeping/vm141-result.json`. `sshd` is automatic/running, no SOTS process exists, no reboot performed. The initial missing-value and registry-key recreation defects were corrected in the idempotent script before the final successful run.
|
||||
- VM145: all eight policy values and all present selected tasks verify compliant in `verify/results/housekeeping/vm145-result.json`. `sshd` is automatic/running, no SOTS process exists, no reboot performed.
|
||||
- VM140: acquired canonical lease `vm140` as `housekeeping-worker` / verifier / `openai/gpt-5.6-terra` at 2026-09-09T21:32:34Z. Applied the same policy/task cleanup without logging off or rebooting; all eight policy values and all present selected tasks verify compliant in `verify/results/housekeeping/vm140-result.json`. `sshd` remains automatic/running; six `msedgewebview2` processes remain in the active console and were deliberately not terminated because their owning application was not identified.
|
||||
- Exact changes on each completed VM: disable Windows consumer/soft-landing/spotlight/Copilot, feeds/widgets, Game DVR, OneDrive sync, and logged-in-user automatic-update restart policies; disable present WER QueueReporting, CEIP Consolidator/UsbCeip, and Defender scheduled scan tasks. Maps was already disabled; the OneDrive and Kernel CEIP tasks were absent.
|
||||
- Protected access: the former assertion that autologon was unconfigured is falsified for VM140: its verified result reports `AutoAdminLogon=1`, `DefaultUserName=re`, a present protected `DefaultPassword` LSA secret, and no domain value. The secret contents were not read. VM145's earlier direct inventory reported `AutoAdminLogon=0`, `DefaultUserName=re`, and the protected secret present; this difference needs per-guest verification. No plaintext registry password was used. Key-based SSH was verified before and after VM140 changes.
|
||||
- Autologon implementation investigation: no Sysinternals Autologon binary was found on VM145; the documented `pass` inventory did not list a SOTS/re-lab credential entry, while the provisioning ISO exists on `spicy` at its documented location. Added reviewed stdin-only LSA implementation to `tools/windows-housekeeping/Invoke-Housekeeping.ps1`: it validates the existing local `re` credentials using `LogonUser`, writes only the LSA `DefaultPassword` secret via `LsaStorePrivateData`, then sets the non-secret autologon registry fields. It zeroes its unmanaged secret buffer. It has not yet been invoked because VM140 was already configured and the credential source has not been safely exercised.
|
||||
- VM144 autologon pre-reboot checkpoint: the existing protected `DefaultPassword` secret was present, so `EnableExistingAutologon` set only `AutoAdminLogon=1`, user `re`, and domain `SOTS-RE`; no secret content was read or replaced. The guest had no console user/test activity, `sshd` was automatic/running, and key SSH had just succeeded. Recovery path if console autologon fails: key SSH remains available to set `AutoAdminLogon=0`; no credential reset or plaintext secret is required.
|
||||
- VM144 reboot result: SSH recovered with `sshd` automatic/running but `quser` reported no user after 30 seconds. Reverted only `AutoAdminLogon` to `0`, preserving the protected secret; final result is `verify/results/housekeeping/vm144-result.json` with all debloat controls compliant and autologon explicitly noncompliant. This is positive evidence that the inherited protected secret cannot be treated as the current credential.
|
||||
- Credential-source correction: `pass` has no SOTS/re-lab entry. The documented provisioning ISO was read under a canonical `spicy-autounattend-credential` lease through a temporary read-only mount, which was logged on the host. Its password is in `<Password><Value>...` (not the documentation's claimed `<AdministratorPassword>`); it is marked `PlainText=true`. An initial secure stream matched the incorrect tag and delivered no credential; no secret was exposed. The next action uses the corrected tag to stream directly into VM146's LSA configuration stdin, with no secret command-line argument, file, stdout, or log.
|
||||
- Next action: configure VM146 using the corrected provisioned-password stream, reboot this free guest, and verify actual `re` console autologon plus SSH; unmount the ISO and release both leases afterward. Do not reboot VM140 while its active console remains.
|
||||
|
||||
## 2026-09-09T21:57Z housekeeping-completion pre-reboot checkpoint
|
||||
|
||||
- Model/session: `openai/gpt-5.5`, actor `housekeeping-completion`, role `lab`, continuation from `campaign/rollout/housekeeping-completion.md`; no delegates/commits/staging. Prior VM146 and `spicy-autounattend-credential` stale leases were lead-released before this quantum.
|
||||
- Held leases before mutation: `vm140` token `f15ae24...`, `vm141` token `01112d...`, `vm144` token `e56f3a...`, `vm145` token `c9af3e...`, `vm146` token `09f644...`, `spicy-autounattend-credential` token `cac620...` under `housekeeping-completion` / `lab` / `openai/gpt-5.5`.
|
||||
- Confirmed hypervisor identities: VM140 MAC `BC:24:11:5E:1C:FF` at `192.168.10.139`, VM141 MAC `BC:24:11:8A:11:F0` at corrected `192.168.10.143`, VM144 MAC `BC:24:11:BF:74:10` at `.144`, VM145 MAC `BC:24:11:9A:01:AA` at `.145`, VM146 MAC `BC:24:11:F0:F5:92` at `.146`; all report hostname `SOTS-RE` and matching guest NIC MAC.
|
||||
- Activity check at 21:56Z: VM140 and VM146 have active `re` console sessions only; VM141/144/145 report no console user. No SOTS/game/debugger/capture/UI automation/running SOTS/test scheduled task was reported on any guest by the explicit process/task query. VM140 will not be rebooted because its active console is being preserved.
|
||||
- VM146 was re-verified after prior reboot: actual `re` console autologon and key SSH worked. First verify observed Defender scheduled scan re-enabled and `OneDrive.Sync.Service`; rerunning the idempotent Apply disabled/stopped them, and the final Verify was copied to `verify/results/housekeeping/vm146-result.json` with `compliant=true`, no managed consumer processes, OfficeHub absent, SSH running/automatic and protected autologon compliant.
|
||||
- Exact next action: copy the updated housekeeping script to VM140/141/144/145, apply targeted cleanup; stream the provisioned ISO credential privately into ConfigureAutologon for free VM141/144/145, reboot those free guests one at a time, then verify console autologon plus SSH and copy per-VM JSON artifacts.
|
||||
|
||||
## 2026-09-09T22:03Z housekeeping-completion final checkpoint
|
||||
|
||||
- Completed the routine assignment under `openai/gpt-5.5` / actor `housekeeping-completion` / role `lab`. No codebase architecture edits, commits, staging, FPU/game/config changes, password resets, blank passwords, or secret logging. The provisioned password was streamed only through stdin from a temporary read-only ISO mount on `spicy` into the guest-side LSA writer; no command-line secret or repository/temporary secret file was created. A post-run host mount check found no remaining autounattend ISO mount.
|
||||
- Source/tool identities used: `/home/alex/sots-re` current worktree; `tools/windows-housekeeping/Invoke-Housekeeping.ps1` with LSA `ConfigureAutologon`, targeted OfficeHub per-user removal and consumer process/task cleanup; `guides/windows-lab-housekeeping.md`; infrastructure docs `/home/alex/trikilli/services/re-lab.md` and `/home/alex/trikilli/hosts/spicy/AGENTS.md`; prior raw log `/tmp/opencode/sots-housekeeping-followup.log` lines 1500-1802 for continuation basis.
|
||||
- VM140 (`192.168.10.139`, MAC `BC:24:11:5E:1C:FF`): no active SOTS/game/debugger/capture/test task; preserved active `re` console and did not reboot. Applied updated cleanup; final artifact `verify/results/housekeeping/vm140-result.json` is `mode=Verify`, `compliant=true`, OfficeHub absent, no managed consumer processes, SSH running/automatic, protected autologon configured. Six generic `msedgewebview2` processes remain in the existing console and were not killed because the Astra correction said not to remove generic WebView/system packages indiscriminately.
|
||||
- VM141 (`192.168.10.143`, MAC `BC:24:11:8A:11:F0`): corrected address was reachable; no console user/test activity before mutation. Applied cleanup, configured LSA protected autologon with credential validation, rebooted, and proved actual `re` console autologon plus key SSH/sshd automatic. Final artifact `verify/results/housekeeping/vm141-result.json` is `compliant=true` with no consumer processes/packages and autologon compliant.
|
||||
- VM144 (`192.168.10.144`, MAC `BC:24:11:BF:74:10`): no console user/test activity before mutation. Replaced the previously failed inherited-secret approach by streaming the proven credential into LSA, rebooted, and proved actual `re` console autologon plus key SSH/sshd automatic. Final artifact `verify/results/housekeeping/vm144-result.json` is `compliant=true` with no consumer processes/packages and autologon compliant.
|
||||
- VM145 (`192.168.10.145`, MAC `BC:24:11:9A:01:AA`): no console user/test activity before mutation. Applied cleanup, configured LSA protected autologon, rebooted, and proved actual `re` console autologon plus key SSH/sshd automatic. Final artifact `verify/results/housekeeping/vm145-result.json` is `compliant=true` with no consumer processes/packages and autologon compliant.
|
||||
- VM146 (`192.168.10.146`, MAC `BC:24:11:F0:F5:92`): prior quantum's reboot proof was independently rechecked in this quantum (`re` console at 17:44 local, key SSH and sshd automatic). Idempotent Apply/Verify cleared a reappeared Defender scheduled-scan state and `OneDrive.Sync.Service`; final artifact `verify/results/housekeeping/vm146-result.json` is `compliant=true`, OfficeHub absent, no managed consumer processes, autologon compliant.
|
||||
- Artifacts updated: `verify/results/housekeeping/vm140-result.json`, `vm141-result.json`, `vm144-result.json`, `vm145-result.json`, `vm146-result.json`, `guides/windows-lab-housekeeping.md`, `campaign/rollout/housekeeping-worker-state.md`, and `/home/alex/trikilli/hosts/spicy/AGENTS_LOG.md` (host-operation note). All six `housekeeping-completion` leases (`vm140`, `vm141`, `vm144`, `vm145`, `vm146`, `spicy-autounattend-credential`) were released at 2026-09-09T22:03Z. Exact next action: report completion; no blocked guest/subtask remains.
|
||||
49
campaign/rollout/housekeeping-worker.md
Normal file
49
campaign/rollout/housekeeping-worker.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
# Windows lab housekeeping — user authorized 2026-09-09
|
||||
|
||||
User: "spawn one more agent: housekeeping, each of the 5 windows VMs needs to be de-bloated.
|
||||
MS bullshit is fouling the tests. also, passwordless logins, etc".
|
||||
|
||||
You are openai/gpt-5.6-terra, lab operator. Read applicable AGENTS.md and infrastructure docs in
|
||||
/home/alex/trikilli (services/re-lab.md) and sots-re findings about running game, VM access,
|
||||
current campaign/board.md VM rules before touching guests. Five likely guests VM140,141,144,145,146
|
||||
on spicy; confirm actual identities/IPs. Do not guess targets. No delegation, commits, staging,
|
||||
push, engine/research/tooling architecture changes. Use apply_patch to create/edit scripts.
|
||||
Owned repository files: campaign/rollout/housekeeping-worker-state.md,
|
||||
guides/windows-lab-housekeeping.md, tools/windows-housekeeping/, verify/results/housekeeping/.
|
||||
Checkpoint every 20 tool calls/15min, before reboot, compaction and stopping. Never print secrets.
|
||||
|
||||
## Scope and authority
|
||||
|
||||
Inventory then implement targeted de-bloating on all five Windows test guests. Remove/disable
|
||||
consumer app startup, OneDrive sync, widgets/news/consumer suggestions, Teams/Xbox overlays and
|
||||
game capture, notification/focus-stealing nags, scheduled consumer updaters, update auto-restarts
|
||||
and scheduled background scans that demonstrably interfere with deterministic lab runs. Prefer
|
||||
repeatable PowerShell script + before/after inventory and per-VM results over click automation.
|
||||
This is dedicated owned lab infrastructure. Preserve runtime dependencies, Windows servicing,
|
||||
DXVK/Vulkan/graphics/audio, VC runtimes, game data/saves, shim, tools, networking, SSH/remote access,
|
||||
Samba, guest agent, scheduled SOTS launch task and instrumentation. Do not uninstall random system
|
||||
packages wholesale, alter game/FPU settings, disable firewall globally, or wipe profiles.
|
||||
|
||||
Passwordless means unattended console autologon for the existing dedicated test account and
|
||||
key-based administrative access when supported; no blank passwords, unauthenticated RDP/SMB/SSH,
|
||||
or repository-stored credentials. Reuse documented secure credential store. Prefer supported
|
||||
autologon with protected secret storage. If only plaintext-registry autologon is available, stop
|
||||
that subtask and report choice to lead rather than silently expose credentials. Do not change the
|
||||
existing account password or remote authentication without verified access and explicit need.
|
||||
|
||||
First check actual guest processes and session activity, current runtime leases/checkpoints and
|
||||
host task state. No other rollout worker is authorized live VM work. If unrelated tests or agents
|
||||
are active, do not interrupt: report affected VM blocked and proceed to free ones. Existing board
|
||||
FREE text may be stale. Acquire exclusive lease using new campaign tool if ready; otherwise hold
|
||||
a canonical per-VM filesystem lock under campaign/runtime with owner/token and record it in your
|
||||
checkpoint; coordinate lock format with controls-worker or ask lead. Keep remote changes serial,
|
||||
verify administration access before/after, one guest at a time. Reboot only when free/needed and
|
||||
validate login + remote access + interference checks afterward. Record any snapshot/restore point
|
||||
IDs if using infrastructure's usual inexpensive snapshot procedure. No deleting snapshots/disks.
|
||||
|
||||
Required deliverable: idempotent script with inspect/apply/verify behavior and machine-readable
|
||||
per-VM inventories and results, exact changes, remaining interference, login method and verification,
|
||||
reboot/access status. No false green if a VM cannot be reached or operation is blocked. Capture
|
||||
commands, timestamps, guest identities but sanitize credentials and private session data.
|
||||
Any unexpected evidence requiring scope or architecture change -> checkpoint + Astra lead before
|
||||
proceeding on affected change. On complete report each VM separately. Continue unaffected work.
|
||||
376
campaign/rollout/independent-review.md
Normal file
376
campaign/rollout/independent-review.md
Normal file
|
|
@ -0,0 +1,376 @@
|
|||
# Independent rollout review
|
||||
|
||||
## Follow-up verdict — 2026-09-09
|
||||
|
||||
Independent execution: openai/gpt-6-astra, logical session `review-followup-1`;
|
||||
actual harness session ID unavailable. **Selected host/shim baseline passes the reviewed
|
||||
evidence-integrity scope. Controls require one additional correction (R8 below).**
|
||||
Full asset/live-game and research-replacement acceptance remain unestablished.
|
||||
This section supersedes the initial available-tree disposition for the source identities below;
|
||||
the original findings are retained as history.
|
||||
|
||||
### Independently reproduced measurements
|
||||
|
||||
- Tooling: **19/19**, publishing: **8/8**, config/source scanner: **7/7**, controls: **36/36**.
|
||||
Commands: `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s verify/DIR -p 'test_*.py' -v`,
|
||||
with DIR respectively `tooling`, `publishing`, `config`, `campaign`. Total **70 tests**.
|
||||
Disposable fixture repositories alone perform Git writes/commits.
|
||||
- `PYTHONDONTWRITEBYTECODE=1 python3 tools/check_agent_config.py --resolved`: PASS, actual
|
||||
OpenCode loader and exact model availability. No model execution inferred from availability.
|
||||
- `campaign/current.json` selected gate SHA-256
|
||||
`8e14e00ee3ce7478ddfdef8de12183451e858c52d78dc28cffbdee47f5d087d8` and replay
|
||||
`87f92c2b54625ecbca1f3c0a37e57c43d03a4aff488edf4ea8a09a842cd6279d`: actual retained bytes match.
|
||||
Gate/replay pass shared structural and publication validators; selection is measurement-only.
|
||||
- Under `/home/alex/.local/share/sots-runs/rollout-host-20260909-c`, independently rehashed host
|
||||
executable `78b2562ea2c56351f9f6f0f24d271afcced741eadbc148047780e6dfd101940b` and shim DLL
|
||||
`381c91aecf10a9093f651f58c884356cd88e0253e79cb3bab32753fff6612c7e`.
|
||||
**524 engine files and 10 RE execution-tool files** match both retained snapshots and current
|
||||
source in bytes and modes. All **43** corpus files match their manifest. Engine baseline
|
||||
`7741d42fc5e4e761e6449bdaf0e4a61d00036a23`; RE baseline
|
||||
`3bfde5a70d874a723e797a695bbd847fd82c0aa7`; dirty identities come from manifests, not HEAD alone.
|
||||
- Actual `ctest.xml` exactly matches embedded JUnit rows: **59 unique inventory identities,
|
||||
52 passed, 7 allowed skips, zero failures**. Positive final summaries are exactly `[43]` for
|
||||
`mars_stream_save`, `mars_stream_domains`, `app_turn`, `app_turn_record`. Every required check
|
||||
is true; eight recorded gate commands exit zero; every JUnit output exists without truncation.
|
||||
Skips: `game_config_replay`, `game_data_realdata`, `game_design_realdata`, `game_design_census`,
|
||||
`game_sim_smoke_real_save`, `mars_text_realdata`, `mars_vfs_realdata`.
|
||||
- Retained replay in `/home/alex/.local/share/sots-runs/rollout-replay-20260909` uses turn2 input
|
||||
and turn3 oracle. Recomputed file/inflated/typed-state hashes of all three saves and complete
|
||||
ordered diff list match: **62 state differences**, all three equality surfaces false.
|
||||
Status correctly remains **measured**. This review recalculated saved outputs; it did not rerun
|
||||
the full engine suite or build anything.
|
||||
- Additional independent mutations of the selected manifest rejected missing binary, omitted
|
||||
execution, duplicate execution, zero corpus count, omitted `outputComplete` requirement and
|
||||
false `outputComplete`. These were in-memory fixtures, leaving selected evidence untouched.
|
||||
|
||||
Reproduction recipe for artifact checks: load current pointers with `dashboard.pointer`, run
|
||||
`gate_valid`/`replay_valid`; rehash both binary paths; compare `gate.file_row` for every source row
|
||||
under manifest live roots and retained `source`/`re-tooling`; recompute each `input_manifest`;
|
||||
parse actual XML with `junit_statuses` and compare rows, inventory, allowed skips and corpus
|
||||
summary counts; use `standalone_report.save_state` and complete `state_checksum.diff` on retained
|
||||
pair paths. Temporary driver `/tmp/opencode/review_followup_checks.py` is disposable; this recipe,
|
||||
measurements and the content-addressed selected manifests are durable evidence.
|
||||
|
||||
### Prior findings disposition
|
||||
|
||||
| Finding | Current disposition |
|
||||
|---|---|
|
||||
| R1 | Closed for inspected gate/package: exact unique execution partition, positive per-test corpus summaries, bound executable and output completeness; negatives reproduced. |
|
||||
| R2 | Closed under lead's revised scope: reporter has no acceptance status/flag; equality is measured or failed, explicit inputs are hashed, inherited SOTS environment stripped, output retained. Equal-pair and require-match negatives pass. |
|
||||
| R3 | Closed: `--shim` is now boolean and uses the recorded snapshot's MinGW toolchain file; actual selected DLL/hash and successful configure/build are retained. Full assets still unavailable. |
|
||||
| R4 | Closed for approved controls implementation: current source bindings rehashed on evidence/verdict/promotion, immutable inputs/binaries and exact criterion outcomes required; same-HEAD candidate/integrated mutation tests reproduced. |
|
||||
| R5 | Closed for actual selected host package: shared validator/publication accept the explicit 52/7 partition and expose limitations. |
|
||||
| R6 | Closed: intact old recovery accepted, corrupt/missing state rejected, freshness retained at handoff/end, resolution-only Astra entry allowed with ordinary workers blocked; tests reproduced. |
|
||||
| R7 | Closed for reviewed snapshot-copy defect: copy checks bytes/modes on both sides; current and snapshot inventories match. Pre-copy mutation, symlink and build-named-source tests pass. |
|
||||
|
||||
Engine accounting review confirms S13 no longer duplicates child P counters; replay writes survive
|
||||
the final fold; runtime-only MT word count measures rejection across twists without changing the
|
||||
explicit serialized state layout. Corpus app tests independently compare committed generator state.
|
||||
No new engine defect established. Snapshot clean-room scanner and scoped tracecmp path checks pass.
|
||||
Gate RE identity explicitly covers execution tooling only, not every campaign/control file.
|
||||
|
||||
### Completed controls and actual runner evidence
|
||||
|
||||
Latest checkpoint `campaign/runtime/checkpoints/controls-bootstrap-620eb9d25a6ad2f06b68353c.json`
|
||||
passes basis/identity/artifact validation with recovery freshness disabled. Both R4/R6 surprise
|
||||
records are resolved by the named lead decisions; no open controls surprises existed at inspection.
|
||||
Actual smoke `campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json`, SHA-256
|
||||
`65dd1c1286742cd4d2401af5a229d7d014f60dd329dadee0dee78c499f61d663`, records successful
|
||||
**architecture-review/Astra** execution: 24 parsed events, no error events, successful stop,
|
||||
matching fresh session/actor/model checkpoint and intact artifacts. Actual session
|
||||
`ses_f77cf5062ffeTknrMfnbJMmdNh`; emitted model unavailable, honestly recorded as such.
|
||||
Canonical config/prompt hashes match. Independently rerunning the actual loader with runner overlay
|
||||
in recorded cwd reproduces effective hash `4cb65613de34e41eabf780e84cad062f14cbfcdd68569dc874514c50fa7baa5a`
|
||||
and agent hash `530f4bfeb28c09d36e45565706247ad9822f7c177161e1ee0a71fcb981a76b92`.
|
||||
This proves the recorded architecture route, not an actual normal Terra worker quantum.
|
||||
|
||||
### R8 — MEDIUM: launcher cannot start required final integrated verifier
|
||||
|
||||
**Locations:** `tools/campaign.py:156-159` (`ROLE_STATUS`), `tools/run_agent.py:87-89`.
|
||||
The verifier role permits only `verification`, while `Campaign.verdict` allows `integration`
|
||||
and final acceptance requires a fresh verdict after integrated evidence changes.
|
||||
Thus the prescribed explicit-role launcher cannot schedule that final verifier execution.
|
||||
|
||||
**Executed reproduction:** in a disposable `verify/campaign/test_controls.py::Controls` fixture,
|
||||
run `verification()`, `verdict()`, transition to `integration` as lead, add `evidence(integrated=True)`
|
||||
as lead, then call `run_agent.check_launch(case.c, case.c.load('slice'), 'verifier', 'independent')`.
|
||||
Observed `ControlError: role cannot launch in this contract status`. This is a launcher/lifecycle
|
||||
mismatch, not a bypass of the acceptance check. Fixture cleaned up; canonical state untouched.
|
||||
|
||||
**Required resolution/check:** lead formally resolves the new review finding; permit the independent
|
||||
verifier route for final integrated-package review with existing independence/checkpoint/surprise
|
||||
guards, or define an equally explicit supported final-verifier launch path. Regression must allow
|
||||
both verification and integration verifier entry and still reject owner/verifier overlap, stale
|
||||
package and unresolved surprises. No implementation correction made by reviewer.
|
||||
|
||||
### Exact remaining integration checks
|
||||
|
||||
1. Resolve R8, implement the approved launcher policy, independently rerun its focused regression
|
||||
and refresh source-bound controls measurements after that source change.
|
||||
2. Perform the documented normal noninteractive worker smoke under its actual worker role/model,
|
||||
paired baseline worktrees and intact recovery checkpoint; verify effective config, successful
|
||||
stop/session, fresh end checkpoint and unavailable-versus-emitted model provenance. Existing
|
||||
actual smoke covers architecture-review only; fake-process tests cover worker runner logic.
|
||||
3. Attach the actual integrated controls executable/interpreter, fixture inputs and criterion
|
||||
result package; obtain an independent verdict over that exact final binding through the supported
|
||||
lifecycle. `controls-bootstrap` presently remains `needs-revision` with **no evidence array**;
|
||||
this review is not a lifecycle promotion or machine verdict.
|
||||
4. Full-profile owner assets/trace inputs and research pilot completion-bearing live controls,
|
||||
complete writes/events/allocations/RNG/runtime inputs and original differential remain required
|
||||
for their separate acceptance scopes. Host/shim success and divergent replay do not satisfy them.
|
||||
|
||||
Additional reviewed source SHA-256 (gate/engine/reporter identities are retained in selected gate):
|
||||
|
||||
| Path | SHA-256 |
|
||||
|---|---|
|
||||
| `tools/campaign.py` | `ca4eb2c42e88c1222ec60d6b99c58fffcc72746411c499c4cb0246d899ebbd10` |
|
||||
| `tools/run_agent.py` | `0f5ccb53dcde59b64fe999768737b6cbd2dabcc1272e5605c1f1ecd86e5d5d2b` |
|
||||
| `campaign/contract.schema.json` | `a2c76ec042ca097a57c3c05c1e519e392d498d387a31808c7d0f70482d43c201` |
|
||||
| `verify/campaign/test_controls.py` | `656e5938fa5107022b73b32cf6fc05b6ff6e3e9ab239432d72b304b3f6ea1801` |
|
||||
| `tools/select_evidence.py` | `a6e648a77bcf799cc774ff9d0de83011283049ed0f0c44f6e08857a8410e9463` |
|
||||
| `tools/dashboard.py` | `c84aeeea6fb7d5e45ccec8882bacc59182149f108edd9eb1585eab9ede99911c` |
|
||||
| `tools/check_agent_config.py` | `93115532cb38105777a5c5c20a9f2a808043370e0d4f560a9c82fe8e800076ec` |
|
||||
|
||||
No implementation edits, delegates, actual-repository staging/commits, engine builds or lab mutation.
|
||||
|
||||
## Historical initial available-tree pass
|
||||
|
||||
Reviewer: openai/gpt-6-astra, independent review-worker execution, 2026-09-09.
|
||||
**Disposition: changes required; rollout acceptance is not established.** Workers were still
|
||||
implementing during this review. Findings below apply to the identified snapshots; fixes and
|
||||
final integrated-tree review are pending. No engine builds, lab operations, delegation, staging
|
||||
or commits were performed by this reviewer. Four selected Python tooling tests passed, but the
|
||||
adversarial probes below exposed gaps outside those tests.
|
||||
|
||||
Pilot delivered first:
|
||||
- `campaign/contracts/research-replacement.json` — **proposed**, validated by campaign CLI.
|
||||
- `campaign/pilots/research-replacement.md` — concrete archived W1 workload, full transitive
|
||||
write boundary, runtime assets/original dependencies, executable acceptance requirements
|
||||
and blockers. No replacement implementation or acceptance claim.
|
||||
|
||||
## Snapshot identities
|
||||
|
||||
Canonical RE HEAD `3bfde5a70d874a723e797a695bbd847fd82c0aa7`; engine HEAD
|
||||
`7741d42fc5e4e761e6449bdaf0e4a61d00036a23`. Both have concurrent uncommitted rollout work;
|
||||
HEAD alone does not identify reviewed content. SHA-256 at this pass:
|
||||
|
||||
| File | SHA-256 |
|
||||
|---|---|
|
||||
| `tools/gate.py` | `700f8fcf1a051a37322cd51e2e1bb774f35cd82e0abc622613dc2b79f37e9a42` |
|
||||
| `tools/evidence.py` | `8235dc7e3bc23e5a942fb6f80be0693a0d2c66057f24a783a41b512d0d31c137` |
|
||||
| `tools/standalone_report.py` | `6e4aae37ff5ca82f719d1994f1561cb21840d3cf7978f9a2e0a3f4b1019b71d8` |
|
||||
| `tools/dashboard.py` | `6d8e116f554f8dae222694e3e37daf7b03922187e5fd841d43ee4cd52c69a49a` |
|
||||
| `tools/campaign.py` | `bd563f43b536841677e49ed9b942e5ed46ad3c53456a921592f281b4f2f3c9a2` |
|
||||
| `tools/run_agent.py` | `c8aeec109340958bf7850d2a91b4d6b6e53ac0534e97973f6c0869e692a9b7ba` |
|
||||
| `campaign/contract.schema.json` | `ae4796b1f8e8336ddb63e60d774a81ff965461e4b884b5a2488e3865c6a6c5e0` |
|
||||
| `opencode.json` | `d24be7fcee57d5eb04c6b7189822a2ca055dd4a70daafbea67f09a120945d49f` |
|
||||
| engine `src/app/turn.cpp` | `a626ddf80a340de50b70f09bf91c0180d255c533e65edce1532d807fcf5109b4` |
|
||||
| engine `src/mars/rng/mt19937.cpp` | `0c60775e9437b8eaad49f67a96001c81947c8d9e6d2472e28b2b490515bac95b` |
|
||||
| engine `tests/app/test_turn.cpp` | `6d45b1d2d065528f14ae83d95314f2b6559e53cc23f1b9e2531c7c09b4b97eab` |
|
||||
|
||||
## Findings requiring correction
|
||||
|
||||
### R1 — HIGH: gate accepts incomplete execution and missing binary
|
||||
|
||||
**Locations:** `tools/gate.py:137-153,162-164`.
|
||||
|
||||
Discovery is compared with the 59-name inventory, but actual JUnit cases are not required to
|
||||
cover that inventory. Only four corpus names must appear in `passed`. There is no nonempty
|
||||
binary requirement. `corpusNonzero` checks that stdout lacks `"0 save"`; empty output passes,
|
||||
and CTest `--output-on-failure` normally suppresses successful test output anyway.
|
||||
|
||||
**Executed reproduction:** import gate; isolate fake engine/.git and one .sav in a temporary
|
||||
directory; mock source_manifest/copy_snapshot and command execution (no build); return all 59
|
||||
names from ctest_names, write JUnit with only mars_stream_save, mars_stream_domains, app_turn,
|
||||
app_turn_record, return exit 0 and empty stdout for commands, produce no binary. Call main with
|
||||
explicit engine/corpus/new out. Observed:
|
||||
|
||||
```text
|
||||
gate incomplete JUnit/no output/no binary: 0 passed 4 of 59 binary= {} corpusNonzero= True
|
||||
```
|
||||
|
||||
This tests the validator boundary, not actual CTest behavior. A truncated/misconfigured runner
|
||||
result must fail rather than rely on CTest usually producing complete output.
|
||||
|
||||
**Required fix/check:** exact JUnit identity partition (passed/skipped/failed), no duplicates or
|
||||
unknown/missing tests, explicit positive corpus counts from machine-readable results, required
|
||||
binary artifact existence/hash, and negative tests for each omission. Host allowances must be
|
||||
distinguished from required executed tests. Do not infer a positive count from absent text.
|
||||
|
||||
### R2 — HIGH: reporter labels equality-only, unbound execution as accepted
|
||||
|
||||
**Locations:** `tools/standalone_report.py:68-74,82-105`; `tools/evidence.py:12-16`.
|
||||
|
||||
Reporter requires only schema/status/binary hash from provenance. It does not validate full
|
||||
gate profile/checks/source/input completeness, required phase execution, missing runtime inputs,
|
||||
or workload coverage. Caller may supply the same save as input and oracle. `--accept` promotes
|
||||
three equal digests without any independent execution proof or contract binding.
|
||||
|
||||
**Executed reproduction:** use the real turn3 save as both input and oracle, a temporary dummy
|
||||
binary with matching minimal `{schema,status,profile:"host",binary:{sha256}}` manifest, and mock
|
||||
only subprocess.run to copy input to `--out` and return 0. Actual reader/reconstruction/digest
|
||||
checks run. Observed `reporter identical input/oracle, no execution: 0 accepted`.
|
||||
|
||||
This is a validation-boundary test, not a claim that current sots_turn is a copy-only program.
|
||||
`--roundtrip` checks conservation first but does not skip RunStrategicTurn (main.cpp:214-222,318).
|
||||
|
||||
**Required fix/check:** keep equality measurement usable, but scoped acceptance requires an
|
||||
explicit workload contract, full source-bound provenance, positive required phase/branch counts,
|
||||
known input/dependency completeness and independent verification/integration gates. No-op and
|
||||
empty/partial provenance fixtures must fail acceptance. Persist/hash all consumed external
|
||||
engine arguments (data/commands), verify files unchanged over execution, and retain output saves
|
||||
or a durable reproducible package: currently output files are removed with TemporaryDirectory.
|
||||
|
||||
### R3 — HIGH: full gate's toolchain argument rejects valid files and accepts directories
|
||||
|
||||
**Locations:** `tools/gate.py:100,107-108,154-156`.
|
||||
|
||||
`--shim` must be a directory, then that directory is passed as `CMAKE_TOOLCHAIN_FILE`.
|
||||
A normal existing toolchain `.cmake` file fails argument validation; a directory cannot supply
|
||||
the intended toolchain file. Full gate is required for acceptance but this route is unusable
|
||||
as a conventional CMake toolchain interface. Inspection finding; no build attempted.
|
||||
|
||||
**Reproduction:** supply a valid engine/corpus/data and existing toolchain file to --shim;
|
||||
observe parser rejection at line 108. A directory passes validation then is the literal
|
||||
`-DCMAKE_TOOLCHAIN_FILE=<directory>` in the configure command.
|
||||
|
||||
**Required fix/check:** define/document --toolchain file versus shim source/build artifact;
|
||||
resolve and hash it, validate configure command in a unit test. Bind produced shim binary as
|
||||
well as host binary. Full test inputs also include SOTS_M1_TRACE, SOTS_SAVES_JSON, SOTS_GOB_DIR;
|
||||
current gate inherits these without recording hashes and does not provide an explicit interface.
|
||||
|
||||
### R4 — HIGH: campaign acceptance source binding is only baseline path+commit
|
||||
|
||||
**Locations:** `campaign/contract.schema.json:26-32`; `tools/campaign.py:299-307,325-335,365-369`;
|
||||
`tools/run_agent.py:68-84,173,227`.
|
||||
|
||||
Runner records actual source manifests, but lifecycle evidence compares `source` only to the
|
||||
contract's baseline `{path,commit}`. Neither evidence nor verifier verdict references the runner's
|
||||
actual source digest or a candidate/integrated tree digest. The contract basis is a hash of
|
||||
task metadata; it is unchanged when uncommitted implementation changes. Integrated status is a
|
||||
lead-supplied boolean and axis coverage, with no connection to which integrated source was built.
|
||||
|
||||
**Reproduction by data flow:** create evidence for source A under a baseline, obtain a bound
|
||||
verdict, then change implementation bytes without changing HEAD or artifact/contract JSON.
|
||||
check_evidence and check_verdict have no source-content input to detect source B. Source_after
|
||||
in run records does not enter these checks. This is a stale-evidence gap even with honest actors;
|
||||
it is distinct from the documented limitation that editable role strings are not authentication.
|
||||
|
||||
**Required fix/check:** bind candidate/integrated source-manifest digests, build binary and
|
||||
immutable inputs through evidence and independent verdict; transition must validate that binding.
|
||||
Use per-criterion results or a typed acceptance package rather than treating any hashed artifact
|
||||
with the same axis label as execution proof. Add a test that changes source content at the same
|
||||
HEAD and rejects its old verifier/integration result.
|
||||
|
||||
Late-published README (lines 27-37) explicitly assigns dirty-source manifest evaluation to the
|
||||
independent reviewer, not the CLI. Thus this is an acceptance-robustness gap requiring a lead
|
||||
decision, not a claim that the controls author promised a machine interpretation of arbitrary
|
||||
criteria. The human procedure must at minimum compare the actual candidate/integrated manifests;
|
||||
baseline equality in CLI output cannot be presented as that check.
|
||||
|
||||
### R5 — MEDIUM: publication rejects valid host-profile skips
|
||||
|
||||
**Locations:** `tools/dashboard.py:93-101`; `tools/gate.py:146-150`.
|
||||
|
||||
Gate's expected list is all discovered tests, including permitted host skips. Publisher demands
|
||||
`expected <= passed`, contradicting host skip allowances. A correct host result cannot be
|
||||
published as scoped host evidence.
|
||||
|
||||
**Executed reproduction:** gate_valid with host status passed, nonempty source/input/binary
|
||||
identities, tests expected=[a,asset], passed=[a], skipped=[asset], failed=[] reports
|
||||
`required tests not executed`. Same outcome follows for the current 59/52/7 shape.
|
||||
|
||||
**Required fix/check:** shared schema distinguishes required executions and approved skips;
|
||||
validate exact partition and profile policy. Host results must visibly publish limitations,
|
||||
not be promoted to full acceptance. Gate currently initializes limitations=[] and never fills it.
|
||||
|
||||
### R6 — MEDIUM: recovery rejects old durable checkpoints and blocks resolver entry
|
||||
|
||||
**Locations:** `tools/run_agent.py:87-99`; `tools/campaign.py:266-278`.
|
||||
|
||||
check_launch reuses end-of-quantum freshness validation, requiring a checkpoint younger than
|
||||
15 minutes even when starting recovery from a successfully completed earlier session. Next-day
|
||||
resume therefore needs a fabricated new checkpoint before an agent can read/recover the old one.
|
||||
Separately, open_surprises is checked unconditionally for every role, so even a resolver cannot
|
||||
launch to investigate an unresolved surprise (despite resolver status mapping to blocked/revision).
|
||||
|
||||
**Reproduction:** a structurally valid, matching checkpoint older than 900 seconds fails
|
||||
check_launch; a resolver/blocked contract with an open surprise fails before role-specific work.
|
||||
Inspection/data-flow finding; final controls tests were not yet published.
|
||||
|
||||
**Required fix/check:** distinguish valid durable recovery state from a fresh end-run checkpoint;
|
||||
verify identities/basis/artifact hashes on recovery, and require freshness only after this quantum
|
||||
starts. Permit an explicitly assigned resolver's bounded investigation while affected workers stay
|
||||
blocked, or document a separate operational resolver launch path that does not pre-resolve evidence.
|
||||
|
||||
### R7 — MEDIUM: built snapshot is not itself verified against the source manifest
|
||||
|
||||
**Locations:** `tools/gate.py:29-49,57-61,119-129,157-158`.
|
||||
|
||||
Manifest hashes live source, then copy_snapshot copies paths without checking copied hashes;
|
||||
end check hashes live source again. A concurrent A -> B -> A change can copy B while both
|
||||
live manifests attest A. Filesystem modes and symlink identity/targets are not bound; every
|
||||
path component starting with `build` is excluded, including possible real source directories.
|
||||
RE tools/inventory are recorded once but then used live without a post-check.
|
||||
|
||||
**Reproduction:** hash source A, write B before copy_snapshot, restore A before after-manifest;
|
||||
before == after but destination is B. This needs no Git commit or modification of the gate.
|
||||
|
||||
**Required fix/check:** hash the copied snapshot and compare its exact file/mode/link manifest
|
||||
before building; reject unsupported escaping links/submodules and define explicit exclusions.
|
||||
Snapshot/hash tools and test inventory actually executed. Baseline-pinned isolated worktrees and
|
||||
leases remain necessary; a before/after check alone does not establish which bytes were built.
|
||||
|
||||
## Engine / lead configuration observations
|
||||
|
||||
- Engine S13 no longer aggregates child P01..P12 counters; the existing final fold can count
|
||||
child operations once. CountingRandom measures rejection words with the monotone MT counter;
|
||||
seed/load reset it, and save_state's explicit layout excludes it. New app test replays reported
|
||||
words against persisted generator state; new MT test exercises rejection across a twist.
|
||||
No defect established in these reviewed changes. Integrated independent execution remains pending.
|
||||
- New lead workflow/architecture clearly distinguish original assistance, partial/full/scoped
|
||||
evidence, unsupported inputs and roles. Explicit Astra/Terra/5.5 routing and 40-step bounds
|
||||
appear in config; runner checks model availability and aborts on known mismatch, with no fallback.
|
||||
- Config permissions primarily guard architecture edit paths and deny worker task calls. They
|
||||
do not constrain arbitrary shell or enforce exact string-array contract scope, as workflow
|
||||
correctly acknowledges. Reviewer has not exercised OpenCode's effective merged configuration;
|
||||
runner overlay binds model/steps but only canonical config bytes are hashed, not expanded prompt
|
||||
file bytes or all effective configuration. Include these in final provenance/config validation.
|
||||
- Controls lock is canonical and serialized; leases require matching token/owner and forbid
|
||||
automatic stealing. Active-run worktree reservations are checked under the same lock. No
|
||||
concurrency acceptance claim: independent contention/crash-recovery tests are still required.
|
||||
|
||||
## Research evidence surprises sent to lead
|
||||
|
||||
`verify/results/shim/cr/cr-R1.log:75-94` adds seven drawsites/twelve probes to the narrative's
|
||||
six interceptors: 25 sites total. Lines 109-115 and raw trace args show runtime CW `0x127f`,
|
||||
not initialization `0x027f`. Archive save hashes and R1's exact 16-leaf residual independently
|
||||
reproduced. These corrections and runtime asset text path are detailed in the pilot and checkpoint.
|
||||
|
||||
## Reproduction record and remaining review
|
||||
|
||||
Executed with PYTHONDONTWRITEBYTECODE=1:
|
||||
- `python3 tools/campaign.py --state-root /home/alex/sots-re validate research-replacement`: pass.
|
||||
- Selected unittest methods in `verify.tooling.test_tooling.ToolingTests`: inventory_is_explicit_and_unique,
|
||||
passed_gate_required, zero_discovered_tests_cannot_match_inventory,
|
||||
stale_report_output_is_rejected_before_execution (each prefixed `test_`): **4/4 pass**.
|
||||
- `/tmp/opencode/review_rollout_probes.py`: isolated boundary mocks described under R1/R2/R5;
|
||||
output recorded above. Temporary fixture files are disposable; this report preserves recipes/results.
|
||||
- Raw save diagnostic command in pilot: R1 exact-bit/unmasked **16 differences**.
|
||||
|
||||
No full local worker suite: one existing tooling test creates a temporary Git commit, excluded
|
||||
under this review assignment. No reviewer builds while engine source was being changed.
|
||||
At last inspection controls README/test directory were not yet present; schema and initial tools
|
||||
were inspected, not their promised completed validation package.
|
||||
|
||||
Final refresh at 2026-09-09T21:30:34Z: `campaign/README.md` appeared and was read. Its schema/API
|
||||
matches this pilot and documents manual criterion evaluation, baseline-versus-dirty-source limits,
|
||||
and the current fresh-checkpoint/no-open-surprise launch rules. It does not close R4's automatic
|
||||
source-drift gap or R6's recovery/resolver operational concern. Completed controls test execution
|
||||
and integrated evidence review remain pending; repository-creating tests need explicit permission
|
||||
for their temporary Git commits or a non-committing equivalent under this review assignment.
|
||||
|
||||
**Next review:** after owners fix/finish, resume from review-worker-state.md, check changed hashes,
|
||||
re-run these negative cases and finalized controls/publishing tests, then independently review
|
||||
one stable integrated source-bound gate/replay package. Until then Task B is an initial adversarial
|
||||
review with final integration review pending, not an approval of workers' future edits.
|
||||
83
campaign/rollout/lead-state.md
Normal file
83
campaign/rollout/lead-state.md
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
# Lead checkpoint
|
||||
|
||||
Authority/model: active session openai/gpt-6-astra. User authorized architecture rollout and later
|
||||
added five-VM debloating/passwordless lab access. Extra architecture agents explicitly corrected
|
||||
to GPT-6 Astra. No commits/pushes authorized or performed.
|
||||
|
||||
## Active assignments
|
||||
|
||||
- Controls, publishing and independent review/pilot: three explicit GPT-6 Astra CLI sessions.
|
||||
- Gate, engine accounting, Windows housekeeping: explicit GPT-5.6 Terra bounded workers.
|
||||
- Lead owns AGENTS/CLAUDE entry points, model prompts/config, engine architecture/README/contribution
|
||||
policy and integration. Bootstrap uses exclusive files in canonical trees; normal runner uses
|
||||
paired worktrees. Logs in /tmp/opencode/sots-*-worker.log are transport; durable checkpoints in RE.
|
||||
|
||||
## Changes / checks
|
||||
|
||||
- Added canonical AGENTS policy, six role prompts, project OpenCode configs with explicit model
|
||||
selection, auto compaction and 40-step quanta. Removed six old global Claude re-* agent files.
|
||||
- Replaced engine README's stale numerical claims; documented engine/adapters/phase contracts and
|
||||
existing generated wire-schema channel. Project configuration loads: opencode agent list includes
|
||||
all six SOTS roles. Need schema/model drift tests once controls registry is final.
|
||||
- Engine worker reports 52 pass / 7 explicit skips over fresh 59-test inventory and 43 saves.
|
||||
- Gate worker delivered first version but needs adversarial review fixes before acceptance:
|
||||
corpusNonzero absence check, missing JUnit completeness, toolchain argument shape, incomplete
|
||||
asset/input provenance, source-copy integrity and full-profile handling. Main has inspected these.
|
||||
|
||||
## Astra resolutions
|
||||
|
||||
1. Gate run during concurrent source mutation: invalid measurement, as flagged. No game-mechanism
|
||||
inference. Wait for engine/tool source quiescence, fresh gate snapshot and compare exact statuses.
|
||||
2. Research archive installs more hooks than narrative: archived 16-difference observation survives;
|
||||
complete instrumentation claim is overturned. Pilot requires complete installed-site manifest,
|
||||
runtime FPU value and neutral control under exact config/binary/assets. No replacement promotion.
|
||||
3. Default VM policy: a console login or passive VNC viewer alone is not a running test. Housekeeping
|
||||
may apply non-disruptive background policies when inventory shows no game/instrumentation/test
|
||||
execution; reboot/logoff requires stronger freedom and access recovery. Actual active work blocks.
|
||||
4. Independent R2: remove reporter acceptance authority. --require-match only enforces equality;
|
||||
valid result is measured. Campaign acceptance requires independent verdict + complete integrated
|
||||
criteria. R4 actual source-content binding and R6 durable recovery are mandatory control fixes.
|
||||
5. Snapshot clean-room scanner used git commands although gate snapshots have no .git; errors
|
||||
could lead to a false OK. Replaced with an actual-file scanner supporting canonical Git trees
|
||||
and plain snapshots, requiring nonzero inspected files and failing read errors. This closes
|
||||
a gate-integrity defect without changing scientific acceptance scope.
|
||||
6. Integrated gate b built host+shim and passed 52 tests/7 named skips, but correctly FAILED
|
||||
corpusNonzero: CTest JUnit truncated successful output at 1024 bytes, removing final counters.
|
||||
Set explicit output limits, capture verbose output once and fail if any JUnit output truncates.
|
||||
Keep b failed; run a fresh gate c. Prior run a hit harness timeout and has no accepted manifest.
|
||||
7. Password located in provisioning ISO and VM146 actual reboot/autologon succeeded using protected
|
||||
LSA storage. VM141 outage claim was based on .141 instead of confirmed .143; retry correct guest.
|
||||
Prior housekeeping session ended at quantum limit with outstanding leases; reconcile cleanup
|
||||
and actual access, explicitly release stale ownership, then GPT-5.5 lab worker finishes.
|
||||
|
||||
## Exact next action
|
||||
|
||||
Read independent review, repair bounded worker defects, validate controls/model config, run a
|
||||
fresh integrated host gate and canonical standalone measurement once sources are stable. Verify
|
||||
housekeeping guest-by-guest, resolve its access/autologon blockers without disabling authentication.
|
||||
Publish actual evidence/limitations to current pointers, regenerate projections, review both diffs.
|
||||
|
||||
## Integration checkpoint — 2026-09-09T22:03Z
|
||||
|
||||
- Fresh gate c passed: host + MinGW shim, 59 identities = 52 passed / 7 explicit skips,
|
||||
all four corpus summaries = 43. Source/copy/tool/input integrity and clean-room scan passed.
|
||||
- Canonical reporter measured 62 residual state differences; file/inflated/state mismatch remains.
|
||||
Gate/replay manifests retained under campaign/evidence and selected in campaign/current.json.
|
||||
- Independent Astra reviewer rehashed both binaries, 524 engine + 10 RE tool source files,
|
||||
all 43 corpus saves and reproduced the exact 62 diffs; 19 tooling/8 publishing/7 config tests pass.
|
||||
- Main re-ran final 36 controls + 7 config tests and live config/model validation, all passed.
|
||||
- REAL normal noninteractive paired-worktree Astra launch succeeded:
|
||||
campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json, status complete, actual session and
|
||||
fresh canonical checkpoint captured. No source edits; no --auto permission bypass on this smoke.
|
||||
- Remaining: final independent controls disposition and formal scoped promotion, housekeeping
|
||||
final per-VM login outcomes and cleanup. No original-game replacement or full-assets acceptance.
|
||||
|
||||
## Final checkpoint
|
||||
|
||||
Rollout complete; authoritative result `campaign/rollout/RESULT.md`. Controls contract accepted
|
||||
after source-identical paired handoff, real Terra verification/integration runs and fresh independent
|
||||
final verdict. All five Windows guest profiles compliant; four reboot/autologon proofs, VM140
|
||||
existing console preserved, all five independently reachable by key SSH with re console active.
|
||||
All VM/credential leases released; no agent processes remain. 71 Python tests; fresh host+shim
|
||||
build; 52 CTest passes/7 named skips over 43 saves; canonical replay measured with 62 residuals.
|
||||
Code remains uncommitted for review. Next: reviewed integration snapshot -> research pilot.
|
||||
54
campaign/rollout/publishing-worker-state.md
Normal file
54
campaign/rollout/publishing-worker-state.md
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# Publishing worker checkpoint
|
||||
|
||||
2026-09-09 — implementation complete, handoff; model openai/gpt-6-astra; session publishing architecture worker.
|
||||
No delegates, staging, commits, pushes, or lab actions.
|
||||
RE baseline HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7; exclusive-file bootstrap in
|
||||
/home/alex/sots-re (concurrent uncommitted workers); engine baseline from controls checkpoint
|
||||
7741d42fc5e4e761e6449bdaf0e4a61d00036a23; no engine edits or lab resources used.
|
||||
|
||||
Inspected architecture, controls assignment, dashboard, displacement and Forgejo tools and
|
||||
their dependents. Controls README/schema/checkpoint not yet present. Gate schema is in flight.
|
||||
Implemented explicit current.json validation/projections and replaced owned strategy/plan/policy.
|
||||
Read controls checkpoint/schema and engine checkpoint; contract schema now validated directly.
|
||||
Next exact action: lead reviews publishing diff and current.json interface alongside completed
|
||||
controls/gate interfaces before selecting any durable current evidence.
|
||||
No accepted evidence selected; no campaign acceptance claimed.
|
||||
|
||||
## Verification and coordination
|
||||
|
||||
- `python3 -m unittest discover -s verify/publishing -v`: 8 tests pass, including missing baseline,
|
||||
malformed current data, unsupported schema, missing file/bad hash, stale source, zero/missing/
|
||||
duplicate execution, failed gate/pair, empty replay, accepted mismatch, stale provenance/binary,
|
||||
dirty identity display, visible skips, and overwriting an earlier success with invalid output.
|
||||
- `python3 tools/dashboard.py`: exit 0; generated board/dashboard show baseline and replay not
|
||||
established, controls-bootstrap and research-replacement proposed, explicit dependencies.
|
||||
- `git diff --check`: pass. No live experiments or engine builds executed by this worker.
|
||||
- Read controls schema/checkpoint and gate/engine checkpoints. Gate expected list includes host
|
||||
skips: adapted publisher to require exact expected union, positive skipClassification/corpus/
|
||||
inventory/source checks, and no full-profile skips plus shimBuild. No inferred acceptance.
|
||||
- Gate worker reports failed/mutating integration source and ephemeral failed evidence. Those
|
||||
artifacts were not selected. Lead must resolve its recorded surprise before a new baseline run.
|
||||
- Controls campaign/README.md was still absent at final read; links intentionally target that
|
||||
assigned forthcoming interface. Publisher validates current controls contract.schema.json.
|
||||
|
||||
## Delivered
|
||||
|
||||
Owned README, strategy, method rules, backlog and questions replaced with concise current entry
|
||||
points/policy; scientific domain findings unchanged. Board/dashboard now generated from contracts,
|
||||
explicit current pointers and runtime surprises. Removed obsolete displacement and Forgejo publisher
|
||||
after dependent inspection. Publishing docs and focused tests are under tools/ and verify/publishing/.
|
||||
The script performs read-only evidence validation; only generated Markdown is written on invocation.
|
||||
Potential follow-up: if controls extends its JSON Schema beyond the currently used subset, extend
|
||||
the local schema adapter deliberately; if gate/replay schema changes, update adapters and tests.
|
||||
|
||||
Implemented interface: current.json uses schema sots-current/1, source identities selected explicitly,
|
||||
nullable gate/replay path+sha256 pointers, and a next_action. Missing pointers mean not established;
|
||||
invalid selected evidence produces visibly invalid output and nonzero exit, never old green output.
|
||||
source is null initially or the exact gate.source object (engine/re manifests including files).
|
||||
Controls source baseline is a different object (path/commit), intentionally not substituted for
|
||||
actual gate manifests. Gate/replay adapters use currently implemented sots-gate/1 and sots-standalone/2.
|
||||
|
||||
Cross-ownership references for lead: findings/subsystems/research-replace.md lines 6 and 496 and
|
||||
findings/subsystems/nav-classifier-live.md line 11 refer to obsolete tools/displacement.py.
|
||||
These are historical scientific findings; annotate references as historical rather than deleting
|
||||
evidence. No executable dependents of displacement/Forgejo publishing found in initial search.
|
||||
40
campaign/rollout/publishing-worker.md
Normal file
40
campaign/rollout/publishing-worker.md
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# Astra publishing architecture
|
||||
|
||||
User requests ruthless reorganization; historical work is in Git. You are openai/gpt-6-astra.
|
||||
Read rollout/architecture-decision.md. No delegates, commits, staging, push or live lab actions.
|
||||
Use apply_patch; checkpoint every 20 calls/15min and before compaction/stopping to
|
||||
campaign/rollout/publishing-worker-state.md. Own only:
|
||||
campaign/board.md, campaign/backlog.md, campaign/open-questions.md, campaign/DASHBOARD.md,
|
||||
tools/dashboard.py, tools/DASHBOARD_README.md, tools/displacement.py,
|
||||
scripts/forgejo_campaign.py, README.md, findings/00-strategy.md, guides/method-rules.md.
|
||||
Lead owns other architecture docs/config, controls architect owns tools/campaign.py and contracts
|
||||
schema, gate worker owns verification tooling. Coordinate by reading their rollout checkpoints.
|
||||
|
||||
Replace live planning stack with one concise plan and machine-derived status. No legacy appendix,
|
||||
coverage percentage, displacement score, old verified-table parser or Forgejo second source of
|
||||
truth. Preserve scientific findings/evidence. Delete obsolete displacement and Forgejo publishing
|
||||
scripts after inspecting dependents; remove/update references in owned files. Report references
|
||||
outside ownership for lead to fix, do not silently modify another worker's files.
|
||||
|
||||
Board + dashboard generated from campaign/contracts/*.json and explicitly selected current
|
||||
evidence pointers under campaign/current.json (you own current.json). Exact schemas come from
|
||||
controls-worker; inspect campaign/README.md/checkpoint once ready. Until available implement
|
||||
clear adaptable interface; do not invent accepted contracts/results. Current gate schema sots-gate/1
|
||||
includes status passed|failed, profile host|full, source identities, inputs, binary, tests and
|
||||
limitations. Standalone schema sots-standalone/2 status measured|accepted|failed, pairs and
|
||||
provenance. Never infer freshness from current HEAD or existence of old artifacts. Label historical
|
||||
as historical, dirty snapshots by manifest identity; source mismatch stale. Prefer current.json
|
||||
explicit path+sha256 for gate/replay pointers, validate hash/schema/status and fail on stale/bad
|
||||
pointer. Missing current baseline should say not established, not green. Summary should show
|
||||
capabilities/workloads, executed tests/skips, original dependencies, open blockers/surprises,
|
||||
and next action; no LOC or target percentages. Update dashboard docs + test its negative paths
|
||||
(you may own verify/publishing/ for focused tests).
|
||||
|
||||
Current priority: rollout baseline; then complete research write-set replacement pilot; then
|
||||
command payload semantics and ship construction; then recorded-command standalone replay.
|
||||
Pilot remains proposed/blocked pending executable criteria and lease/control evidence. Do not
|
||||
claim it implemented. Collapse strategy and earned-method rules into concise current policy:
|
||||
write-set boundaries; complete state inputs; distinct-state/branch coverage; synthetic boundary
|
||||
tests + real differential; honest failure; original-assisted != independent; Astra resolves
|
||||
surprises; source-bound evidence; no silent stale status. Domain-level old detail remains in
|
||||
findings, not giant active board. Replace README with current entry points and operational commands.
|
||||
38
campaign/rollout/review-followup.md
Normal file
38
campaign/rollout/review-followup.md
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# Independent Astra integration verification
|
||||
|
||||
Resume from your RE checkpoint in a fresh bounded GPT-6 Astra session. Same owned review/pilot
|
||||
files; no implementation edits, delegation, commits, lab mutation or engine builds.
|
||||
|
||||
Lead resolved R4/R6 formally; controls architect currently implementing followup. Review GATE,
|
||||
REPORTER, ENGINE and CONFIG first while it finishes. Gate and engine source are now stable.
|
||||
Current source-bound host+shim baseline is selected by campaign/current.json and retained in
|
||||
campaign/evidence. Actual build/source/tool snapshot artifacts live durably under
|
||||
/home/alex/.local/share/sots-runs/rollout-host-20260909-c; prior b FAILED on CTest output
|
||||
truncation (52 passes/7 skips but missing positive corpus summaries); prior a harness timeout.
|
||||
Gate c captures verbose/JUnit with large explicit limits and rejects truncation. It PASSED.
|
||||
Reporter canonical pair is measured, nonmatching, source bound, retained output save and full
|
||||
diffs at /home/alex/.local/share/sots-runs/rollout-replay-20260909. Reporter has NO acceptance
|
||||
authority: --require-match only affects equality/exit; status measured or failed. Changes in
|
||||
lead-state.md. Check all prior R1/R2/R3/R5/R7 claims against ACTUAL current files/artifacts.
|
||||
|
||||
Changes since your first pass: snapshot clean-room scanner works without .git and requires
|
||||
actual source files; gate exact positive per-test corpus summary parsing; outputComplete; source
|
||||
engine/re keys (RE execution-tool subset, copies kept with hashes including save_reader and
|
||||
tracecmp dependencies); fixed source-copy checks; safe scoped snapshot CMake tracecmp dir;
|
||||
shared evidence.validate_gate structural validation used by reporter/publisher; full output saves
|
||||
retained; reporter strips inherited SOTS env and validates explicit args; scope no fake accepted.
|
||||
Lead added tools/check_agent_config.py --resolved and select_evidence.py, focused config tests.
|
||||
Lead independently ran 19 tooling tests and 8 publishing tests; configuration loader/model check
|
||||
passed. Engine worker passed focused positives and configured-empty/malformed negative corpus.
|
||||
|
||||
Verify manifest executable/source/input hashes and required checks, exact test identity partition
|
||||
and positive counts. Validate selection and reporter semantics. Run local Python test suites and
|
||||
negative cases without rebuilding. You may rerun small existing binaries if a concrete concern
|
||||
needs it, but no full repeated engine test suite. Source mutation in disposable test fixtures and
|
||||
git operations confined to disposable fixture repos are permitted (never commit actual repos).
|
||||
|
||||
When controls checkpoint says complete, independently run verify/campaign tests and review R4/R6
|
||||
sourcebinding/recovery fixes plus runner effective configuration/actual checkpoints. If still in
|
||||
flight, checkpoint gate verdict and exact remaining controls checks; lead will resume you.
|
||||
Any unresolved real issue: precise severity/path/repro, don't invent requirements outside scope.
|
||||
Architectural acceptance is separate from host-pass and still-missing full asset/live-game gate.
|
||||
172
campaign/rollout/review-worker-state.md
Normal file
172
campaign/rollout/review-worker-state.md
Normal file
|
|
@ -0,0 +1,172 @@
|
|||
# Independent reviewer checkpoint
|
||||
|
||||
## CURRENT HANDOFF — follow-up review complete, 2026-09-09
|
||||
|
||||
Model openai/gpt-6-astra; logical session review-followup-1; actual harness ID unavailable.
|
||||
Owned review files only changed. No delegates, implementation edits, builds, lab operations,
|
||||
actual-repository staging/commits or held leases. Disposable fixture Git mutations authorized.
|
||||
Verdict and durable recipes/source hashes: campaign/rollout/independent-review.md, follow-up section.
|
||||
70/70 Python tests passed: tooling 19, publishing 8, config 7, controls 36. Actual loader/model
|
||||
check passed. Selected host/shim package integrity reproduced: 524 engine+10 RE source rows,
|
||||
43 saves, exact 59 JUnit identities (52 pass/7 permitted skips), four positive [43] summaries.
|
||||
Retained replay hashes/diffs reproduced: measured/nonmatching, 62 state differences.
|
||||
Prior R1-R7 closed within the documented revised scope; full asset/live acceptance remains absent.
|
||||
Latest controls checkpoint integrity passed. Actual architecture-review smoke events/checkpoint
|
||||
and effective config reproduced (run-df1472c13f31db3a4d5361f0); emitted model unavailable.
|
||||
New surprise R8, MEDIUM, independently reproduced: campaign.py:156-159 permits verifier only in
|
||||
verification; run_agent.py:87-89 rejects verifier in integration despite required final verdict
|
||||
refresh. Recorded for lead in owned review; canonical surprise mutation outside owned scope was
|
||||
not performed. Controls acceptance remains pending lead resolution and scoped correction.
|
||||
Remaining checks: R8 regression/review, actual normal worker-role smoke (existing actual smoke is
|
||||
architecture-review), final integrated controls evidence/verdict, separate full asset/live gates.
|
||||
ONE exact next action: lead records and resolves R8 from independent-review.md, then assigns the
|
||||
bounded launcher correction and independent integration-verifier regression before promotion.
|
||||
|
||||
## Follow-up quantum 1 — 2026-09-09, pre-experiment
|
||||
|
||||
Model openai/gpt-6-astra; logical session review-followup-1 (harness ID unavailable).
|
||||
Recovered owned assignment/checkpoint, campaign README/policy and initial R1-R7 findings.
|
||||
Controls repair handoff now says complete; no resource leases or lab/build operations.
|
||||
Selected gate digest 8e14e00ee3ce7478ddfdef8de12183451e858c52d78dc28cffbdee47f5d087d8;
|
||||
selected replay digest 87f92c2b54625ecbca1f3c0a37e57c43d03a4aff488edf4ea8a09a842cd6279d.
|
||||
Read current gate/evidence/reporter code: positive per-test counts, exact JUnit partition,
|
||||
copy byte/mode checks, explicit shim boolean and measured-only reporter implemented.
|
||||
These are observations, not yet independent artifact validation or acceptance.
|
||||
Next exact action: run local tooling/publishing tests and read-only selected-package hash,
|
||||
JUnit, corpus and retained replay checks, then inspect completed controls and run their tests.
|
||||
|
||||
### Follow-up checkpoint 2 — stable package reproduced
|
||||
|
||||
Selected gate/replay digests above independently rehashed. Both binaries match (host
|
||||
78b2562ea2c56351f9f6f0f24d271afcced741eadbc148047780e6dfd101940b;
|
||||
shim 381c91aecf10a9093f651f58c884356cd88e0253e79cb3bab32753fff6612c7e).
|
||||
All 524 engine + 10 RE execution-tool files match current and retained snapshot bytes/modes;
|
||||
43 corpus files match. Actual ctest.xml equals embedded rows, 59 unique expected identities,
|
||||
52 pass/7 permitted skip/0 fail; all four corpus summaries [43]; no output truncation.
|
||||
All eight recorded gate commands exit 0. Recomputed retained input/oracle/output state and byte
|
||||
hashes plus all 62 state diffs match replay manifest (turn2 -> turn3, measured/nonmatching).
|
||||
Tooling 19/19, publishing 8/8, config 7/7 passed. Additional missing binary/execution,
|
||||
duplicate execution, zero corpus and missing/false outputComplete probes rejected.
|
||||
Recipe currently /tmp/opencode/review_followup_checks.py; durable results are this checkpoint
|
||||
and selected immutable manifests. Source review of campaign.py/run_agent.py performed;
|
||||
R4/R6 tests and canonical checkpoint validation not yet executed. No builds/lab/delegation.
|
||||
Next exact action: run verify/campaign tests and live resolved config check, then inspect
|
||||
canonical controls checkpoint/run records and persist final scoped verdict.
|
||||
|
||||
### Follow-up checkpoint 3 — controls reproduction and final probe
|
||||
|
||||
Controls 36/36 passed (6.815s), live check_agent_config.py --resolved passed. Read complete
|
||||
controls tests, source-binding/lifecycle/recovery/runner code and formal R4/R6 decisions;
|
||||
both recorded surprises resolved. Canonical latest controls checkpoint is
|
||||
controls-bootstrap-620eb9d25a6ad2f06b68353c.json. Found actual lead-run smoke record
|
||||
run-df1472c13f31db3a4d5361f0.json: architecture-review/Astra, complete, 24 events, observed
|
||||
model explicitly unavailable. Need independently check event/checkpoint/config hashes.
|
||||
Potential new operational issue: campaign.py ROLE_STATUS allows verifier only in verification,
|
||||
but acceptance requires refreshed final-package verdict in integration. Runner check_launch
|
||||
will reject that independent integration session. Probe in disposable controls fixture prepared;
|
||||
affected launcher acceptance remains pending resolution if reproduced. No source edits/leases.
|
||||
Next exact action: run /tmp/opencode/review_controls_checks.py to validate actual controls/smoke
|
||||
artifacts and reproduce the integration-verifier launch guard, then persist scoped review verdict.
|
||||
|
||||
Updated: 2026-09-09T21:30:34Z (handoff checkpoint 6). Model: openai/gpt-6-astra.
|
||||
Session: review-worker initial rollout assignment (no external harness session ID supplied).
|
||||
Phase: pilot delivered; available-tree independent review delivered; integrated re-review pending.
|
||||
Owned files: research-replacement contract/pilot, independent-review, this checkpoint.
|
||||
No delegation, builds, lab I/O, staging or commits performed.
|
||||
|
||||
## Progress / next action
|
||||
- Read architecture-decision, controls assignment, CR findings, archived compare JSON and R1 log.
|
||||
- Contract README/schema not published at first inspection; keep pilot proposed and wait for actual API.
|
||||
- Next: inspect raw compressed traces/save differences and engine callback/event interfaces; draft pilot,
|
||||
then review available worker code. Gate/report tooling currently modified; workers still implementing.
|
||||
|
||||
## Surprise for lead: CR narrative understates instrumentation
|
||||
`verify/results/shim/cr/cr-R1.log:75-94` shows seven successful drawsite detours and twelve
|
||||
successful probes in addition to the six detours described in findings/subsystems/research-replace.md:317-332.
|
||||
Thus archived R1 has 25 installed interception sites, not six. Lines 109-115 also show runtime
|
||||
FPU CW 0x127f, whereas findings line 334 says 0x027f in every run (same reported precision/rounding,
|
||||
different full word). Do not inherit narrative as a complete instrumentation manifest.
|
||||
Discriminating check: inspect N/R0 logs and trace metadata; fresh controls must bind complete
|
||||
installed-site manifests and actual runtime FPU words to the same binary/config/assets.
|
||||
|
||||
## Current blockers
|
||||
- Research replace still omits callback effects, actual ObservedTech element and full event records.
|
||||
- Archived compare is partial (six undeclared spans, eight unmodelled notes), not acceptance.
|
||||
- No current runnable pilot acceptance/dependency decision or controls schema yet observed.
|
||||
|
||||
## Checkpoint 2 evidence
|
||||
- Rehashed all four CR saves and turn3 input; hashes match archive narrative. Re-ran exact-bit,
|
||||
unmasked state checksum: R1 has exactly 16 differences (five primary fields, event/otch records
|
||||
and counts, five derived leaves). Raw R1 trace confirms allocation 144/2898, RNG left 413,
|
||||
full runtime CW 4735 = 0x127f. No current acceptance inferred.
|
||||
- `sots-engine/src/game/events/research_events.h:95-105` supplies runtime TextLookup;
|
||||
`src/app/event_phase.cpp:10-14` already adapts caller-supplied strings. Therefore CR's claim
|
||||
that event text inherently requires original PostEvent is too strong. Runtime user assets
|
||||
are an existing architectural path; the live allocator/ABI adapter and policy remain unresolved.
|
||||
- Existing `src/shim/hooks/tech_effects.cpp:354-365` DOES have player writeback and an original
|
||||
node-bore updater dependency. Missing is research-cascade integration and full callback effects,
|
||||
not the total absence of a tech-effect writeback implementation. Use ApplyTechCompletion, not
|
||||
the already-researched-guarded ApplyTechEffect (tech_effects.h:156-162).
|
||||
- Full callback writes can extend to systems, ships, recursive grants and rebellion objects;
|
||||
CR's five primary player fields are the observed workload subset, not a full write set.
|
||||
|
||||
## Checkpoint 3
|
||||
- Pilot narrative written: campaign/pilots/research-replacement.md (proposed; no acceptance).
|
||||
- Controls interface now published in controls-worker-state.md and contract.schema.json;
|
||||
use its string arrays, acceptance {id,axis,criterion}, null checkpoint and full baseline IDs.
|
||||
- Current HEAD identities independently read: RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7;
|
||||
engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23; concurrent changes are uncommitted.
|
||||
- Early gate/report inspection shows potential fail-open paths: gate corpusNonzero checks absence
|
||||
of text rather than positive execution; JUnit completeness unbound; reporter unconditional
|
||||
--roundtrip and --accept checks equality only. Record precise findings after current-code check.
|
||||
- Read new lead workflow and engine architecture: consistent with separating scoped evidence.
|
||||
- Next exact action: write schema-conforming proposed research-replacement.json, then run local
|
||||
tooling unit checks/adversarial reproductions outside repositories and persist review findings.
|
||||
|
||||
## Checkpoint 4
|
||||
- Both pilot files written; JSON conforms structurally to newly published schema, validation next.
|
||||
- Available reviewer scope: gate/reporter/evidence, dashboard projection, engine accounting diffs,
|
||||
lead workflow/architecture/config, controls schema/models. Controls CLI/runner/README not yet all
|
||||
published at last read; final controls review remains pending rather than inferred from intent.
|
||||
- Engine accounting changes remove parent aggregation and use nonserialized MT word count;
|
||||
tests now compare persisted generator state. No engine build/run by reviewer.
|
||||
- Correction to preliminary concern: reporter's --roundtrip validates untouched serialization but
|
||||
engine then DOES execute RunStrategicTurn; it is not an early-return bypass.
|
||||
- Prepared `/tmp/opencode/review_rollout_probes.py` for isolated mock-boundary tests: incomplete
|
||||
JUnit/empty execution output/missing binary gate; equality-only reporter acceptance; host-skip
|
||||
projection mismatch. Uses real save reader for reporter pair; mocks child process/build only.
|
||||
No commits/staging in probes. Existing worker test_source_manifest_detects_mutation creates a
|
||||
temporary commit, so reviewer will omit that test under this assignment's no-commit instruction.
|
||||
- Next exact action: run PYTHONDONTWRITEBYTECODE=1 python3 /tmp/opencode/review_rollout_probes.py.
|
||||
|
||||
## Checkpoint 5 — local results / escalation
|
||||
- Probe output: pilot schema subset PASS; gate returned 0/passed with 4 of 59 JUnit cases,
|
||||
empty stdout and binary {}; reporter returned 0/accepted for copy-only mocked process with
|
||||
real identical input/oracle checksums; dashboard rejected an allowed host skip.
|
||||
- Four selected tooling tests passed. Omitted temporary-commit test; no repository/engine tests
|
||||
or builds run. Full controls tests/README still absent at last check.
|
||||
- Actual controls CLI validation now PASS:
|
||||
`PYTHONDONTWRITEBYTECODE=1 python3 tools/campaign.py --state-root /home/alex/sots-re validate research-replacement`.
|
||||
- Read newly published campaign.py/run_agent.py: baseline evidence source identity is only path+HEAD;
|
||||
end-run source hashes are not tied into acceptance schema. Runner startup also applies 15-minute
|
||||
checkpoint freshness to resume and rejects open surprises even for resolver role. Review pending
|
||||
finalized controls docs/tests. No canonical runtime mutated by reviewer.
|
||||
- Next exact action: persist severity-ranked independent-review.md with precise reproduction,
|
||||
source SHA-256 identities, available-scope review and remaining integration review requirements.
|
||||
|
||||
## Handoff checkpoint 6
|
||||
- Delivered all four owned files, untracked/uncommitted; no worker source edits.
|
||||
- `campaign/contracts/research-replacement.json` remains proposed. Actual campaign CLI validation
|
||||
passed; controls README now published/read and format matches. Pilot SHA-256:
|
||||
contract `1108d30bf7e28f30b2446014503fc3200a8b8198a8fab0b866b873a81bf7b8b9`;
|
||||
narrative `3101b8959f28ba2c6ffbac02a82b5ae0e841e7d78bd1f40f05b9d1d2278490ad`.
|
||||
- `campaign/rollout/independent-review.md` records seven findings (R1-R4 high, R5-R7 medium),
|
||||
exact code locations/source hashes, reproduced R1/R2/R5 boundary failures, test results,
|
||||
historical evidence corrections and specific follow-up gates. Owners need to review/fix;
|
||||
reviewer does not alter their files or certify future changes.
|
||||
- Controls README confirms human evaluation of dirty-source evidence and criteria. R4 is explicitly
|
||||
framed as source-binding robustness gap for lead decision, not a false claim of a schema promise.
|
||||
- Outstanding: worker fixes/final controls tests, stable integrated-tree gate/replay reproduction,
|
||||
runtime assets and executable pilot acceptance/dependency decisions. No held resource leases.
|
||||
- Next exact action: lead resumes this reviewer after worker completion to re-read changed file
|
||||
hashes and re-run R1/R2/R5 adversarial reproductions against the integrated rollout.
|
||||
28
campaign/rollout/review-worker.md
Normal file
28
campaign/rollout/review-worker.md
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# Astra independent reviewer and pilot architect
|
||||
|
||||
User requested three extra Astra agents. You run openai/gpt-6-astra. No delegates, commits,
|
||||
staging, pushing or live VM/Ghidra operations. Read architecture-decision.md. Use apply_patch.
|
||||
Checkpoint every 20 calls/15min and before compaction/stopping to
|
||||
campaign/rollout/review-worker-state.md. Own only:
|
||||
campaign/contracts/research-replacement.json, campaign/pilots/research-replacement.md,
|
||||
campaign/rollout/independent-review.md and your checkpoint.
|
||||
|
||||
Task A: build a concrete research replacement pilot contract from actual CR findings and
|
||||
archived artifacts, not author summaries alone. Inspect findings/subsystems/research-replace.md,
|
||||
actual trace/compare/oracle artifacts, engine interfaces and event handling. Describe full write
|
||||
set, asset inputs, paths to completion-bearing workloads, original dependencies, positive
|
||||
execution/controls, acceptance criteria and exact current blockers. No replacement code now.
|
||||
Use contract schema and API from controls-worker (read campaign/README.md and checkpoint once
|
||||
published); leave status proposed until executable acceptance and required dependencies exist.
|
||||
Avoid declaring known missing functions already complete. No guessed live addresses/policy.
|
||||
|
||||
Task B: independent adversarial review of rollout once workers produce it. Gate worker changes
|
||||
tools/{gate.sh,gate.py,evidence.py,standalone_report.py}, verify/tooling; engine worker accounting
|
||||
and tests; lead configs/architecture docs; controls worker campaign.py/run_agent.py/schema;
|
||||
publishing worker dashboard and state projections. Review scope enforcement and bypasses, model
|
||||
routing (Astra authority, appropriate workers, no fallback), compaction/checkpoint durability,
|
||||
stale/incomplete evidence, self-certified acceptance, concurrency races and source hashing.
|
||||
You may run local read-only/unit tests with temporary artifacts outside repos. Do not duplicate
|
||||
worker edits or run builds while engine worker is mutating source. Report findings with severity,
|
||||
reproduction and precise file/line; if worker work not yet available complete pilot first, record
|
||||
review pending and lead will resume you. Send surprises to main Astra through checkpoint.
|
||||
64
campaign/rollout/sync_verifier_snapshot.py
Normal file
64
campaign/rollout/sync_verifier_snapshot.py
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Populate clean, disposable paired worktrees with the exact uncommitted integration source."""
|
||||
import argparse
|
||||
from pathlib import Path
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[2]
|
||||
sys.path.insert(0, str(ROOT / "tools"))
|
||||
from campaign import Campaign, ControlError, git_value, source_manifest
|
||||
|
||||
|
||||
def files(root):
|
||||
return {name for name in git_value(root, "ls-files", "-z", "--cached", "--others", "--exclude-standard").split("\0") if name}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("--engine-worktree", required=True, type=Path)
|
||||
parser.add_argument("--re-worktree", required=True, type=Path)
|
||||
args = parser.parse_args()
|
||||
campaign = Campaign(str(ROOT))
|
||||
contract = campaign.load("controls-bootstrap")
|
||||
for kind, target in (("engine", args.engine_worktree), ("re", args.re_worktree)):
|
||||
target = target.resolve()
|
||||
source = Path(contract["baseline"][kind]["path"])
|
||||
if target == source or not str(target).startswith("/tmp/opencode/sots-final-"):
|
||||
raise ControlError("only rollout-owned sots-final-* temporary worktrees may be populated")
|
||||
if git_value(target, "status", "--porcelain", "--untracked-files=all"):
|
||||
raise ControlError("snapshot destination must be clean; never overwrite existing work")
|
||||
if git_value(target, "rev-parse", "--path-format=absolute", "--git-common-dir") != git_value(source, "rev-parse", "--path-format=absolute", "--git-common-dir"):
|
||||
raise ControlError("destination is not a linked worktree of this repository")
|
||||
if git_value(target, "rev-parse", "HEAD") != contract["baseline"][kind]["commit"]:
|
||||
raise ControlError("destination baseline mismatch")
|
||||
before = source_manifest(source, kind)
|
||||
names = files(source)
|
||||
for name in files(target) - names:
|
||||
path = target / name
|
||||
if path.is_file():
|
||||
path.unlink()
|
||||
for name in names:
|
||||
if name.startswith(("campaign/runtime/", "campaign/evidence/")):
|
||||
continue
|
||||
src, dst = source / name, target / name
|
||||
if src.is_symlink():
|
||||
raise ControlError("source symlink unsupported")
|
||||
if src.is_file():
|
||||
dst.parent.mkdir(parents=True, exist_ok=True)
|
||||
shutil.copy2(src, dst)
|
||||
elif dst.is_file():
|
||||
dst.unlink() # Reproduce tracked source deletions in this disposable tree.
|
||||
after, actual = source_manifest(source, kind), source_manifest(target, kind)
|
||||
if after != before or actual["sha256"] != before["sha256"]:
|
||||
raise ControlError("source changed or copied integration snapshot differs")
|
||||
print(f"{kind}: exact integration source {actual['sha256']} at {target}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
main()
|
||||
except (ControlError, OSError, ValueError, subprocess.SubprocessError) as exc:
|
||||
print(str(exc), file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "rollout-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/decisions/d-2570bf9c76ae66711bdac461.json",
|
||||
"sha256": "2927a18704e12af380045a08e276f35c0198ba0ef57df8babf419c25405f06b5"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "0dfee4fbd75e35fde1b90350",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Independent verifier: read current evidence and decision d-2570bf9c76ae66711bdac461. Rehash unchanged source/package and inspect relevant raw logs by explicit run ID. No full-suite rerun: same bytes were independently reproduced. If valid issue current scoped verdict and fresh runner-session checkpoint. Do not treat historical informal checkpoints as current instructions.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-scope-correction",
|
||||
"summary": "Astra resolution d-2570bf9c76ae66711bdac461 closes false count contradiction: Astra df147 run has 24 events, Terra cb151 run has 67; prior checkpoint session is author, not run under review. Both observations survive. No source/input changes. Reused the same already independently reproduced 37-test artifact and exact hashes.",
|
||||
"timestamp": "2026-09-09T22:20:49.584979+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"actor": "controls-architect",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "tools/campaign.py",
|
||||
"sha256": "54aba1ec42f9c2f495e29a103254ed30c1529b8bad615a3992660b57f5e2aeb4"
|
||||
},
|
||||
{
|
||||
"path": "tools/run_agent.py",
|
||||
"sha256": "7ca44ace935426df5e2fa8a16ef8252178f538864d0ab423b60e679229d00b8b"
|
||||
},
|
||||
{
|
||||
"path": "campaign/contract.schema.json",
|
||||
"sha256": "a2c76ec042ca097a57c3c05c1e519e392d498d387a31808c7d0f70482d43c201"
|
||||
},
|
||||
{
|
||||
"path": "verify/campaign/test_controls.py",
|
||||
"sha256": "52f93be6eb4147e93deef76e353e55abfb69b1b33297b534acc62bde9ac8847e"
|
||||
}
|
||||
],
|
||||
"basis": "1167f2f44aa39b1b6453e9af3e5046c4653ecea9bdee5281f4fcaea60b16e9a9",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "177cfb68c95114436c939aaa",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Run python3 -m unittest discover -s verify/campaign -p test_*.py -v and repair ordinary failures.",
|
||||
"role": "architecture-review",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-controls-repairs",
|
||||
"summary": "Pre-test checkpoint: implemented source_binding engine/re actual Git file content digest, canonical integrated paths, immutable binaries/inputs and per-criterion outcomes; source-binding CLI; canonical RE artifact references with secret/escape rejection. Runner now separates old recovery from fresh end checkpoints, resolution-only Astra blocked launches, role authority, expanded prompt/effective config hashing, under-lock baseline recheck, config drift detection, successful stop step/session and error-event checks. Added adversarial tests; not executed yet. Owned modified source identities attached. Bootstrap canonical exclusive ownership; same baseline commits as prior checkpoint. No lab/resources/delegation/commits. Logical session rollout-controls-repairs; actual harness session ID unavailable. Decisions R4/R6 implemented pending tests and documentation.",
|
||||
"timestamp": "2026-09-09T21:47:48.364874+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "rollout-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/rollout/lead-state.md",
|
||||
"sha256": "51647e07c8f076249b99d635b5dc5a72ec974b534153e5db9b6fd865347c30cc"
|
||||
},
|
||||
{
|
||||
"path": "campaign/rollout/independent-review.md",
|
||||
"sha256": "b51c529af83f0ed0bb683bdd31100dc5df22fa21043bc43801342d94c6c854c0"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "243f539b3219e74f12ef0db7",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Independent verifier reproduces controls evidence and records verdict, then lead integrates identical source-bound package.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-integration",
|
||||
"summary": "Astra-approved R4/R6 repairs integrated; 36/36 control tests passed against actual source binding, alongside the independent gate/report/config review and successful normal Astra paired-worktree launcher smoke. See source-bound controls-suite evidence and independent-review.md. This checkpoint requests independent verifier review, not self-certification.",
|
||||
"timestamp": "2026-09-09T22:05:53.940738+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"actor": "controls-architect",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "tools/campaign.py",
|
||||
"sha256": "3c7bbba6e67081279a9a1effbf57674b838af184518c278cec68e0bc78e75488"
|
||||
},
|
||||
{
|
||||
"path": "tools/run_agent.py",
|
||||
"sha256": "6d8a8a2a408c3e8e2beeaf756d9746ed510f65674719e957222fd01031a10689"
|
||||
},
|
||||
{
|
||||
"path": "campaign/contract.schema.json",
|
||||
"sha256": "a2c76ec042ca097a57c3c05c1e519e392d498d387a31808c7d0f70482d43c201"
|
||||
},
|
||||
{
|
||||
"path": "verify/campaign/test_controls.py",
|
||||
"sha256": "b0676746dde22e2a2e938d394c19dda8b4d6a4377b315c05911f4a9dad97f41e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/README.md",
|
||||
"sha256": "19e3cd4303c2a6ceb550df1fab9c91dda42ea74c30a19bc34de47a8ab66be48e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/contracts/controls-bootstrap.json",
|
||||
"sha256": "62fd6d9c4e096a6bdf2193245572a92bc99d04413a31b3e4d5ac6bc61473eb2f"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "2f0fe9ac4ec15b15a983bd75",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Run the final scoped controls suite and campaign validate, then checkpoint the measured handoff for lead independent integration review.",
|
||||
"role": "architecture-review",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-controls-repairs",
|
||||
"summary": "32-test initial repaired suite passed in 5.698s. Added further adversarial candidate-worktree/canonical integration, source add/delete/mode/link, error-then-success and recovery authority/permission checks; final suite pending. Live OpenCode debug config validated generated implementer overlay, expanded prompt/model/40 steps and requested permissions (effective SHA256 25b06304c87586543d0607f0abc3f3d46c366cc664948f33c0900b38ab8b3248; agent SHA256 5252aaec5ac9b7a8b3cc6265937651f09b00f87731e61e1582d9fbe2caa17b7a); no agent launched. README now specifies source_binding, binaries/inputs/outcomes, fixed exclusions, verdict digests, artifact/control separation, recovery/event/config checks and gate sots-gate/1 compatibility. Bootstrap acceptance text updated for approved repairs, so previous checkpoint basis superseded. Source hashes attached. Same canonical bootstrap ownership and baseline identities as recovery; no lab/leases/commits/delegation. Actual harness session unavailable.",
|
||||
"timestamp": "2026-09-09T21:52:00.945120+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-2598ca81c443c330e0a4d5b2.json",
|
||||
"sha256": "7f496b73173f7a764f7cf3690ce17efd36a5d3505a785440450320cc04868bf5"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "49f5c4565f76d2fe5efb4452",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Run the complete controls unit suite from /tmp/opencode/sots-final-re, compare its observed test inventory against the declared 37 outcomes, then execute an independent held-out duplicate-key contract validation negative control.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-97066391080a3d06dce27a80",
|
||||
"summary": "Pre-experiment verifier checkpoint. Observations: canonical and both /tmp/opencode/sots-final-* worktrees have expected baseline HEADs (RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7; engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23), matching canonical Git common directories, and candidate source-binding digests exactly matching integrated evidence (engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8). validate and status pass; status integration; no open surprises; no leases/lab actions. Falsifiers before reproduction: any missing/unexpected test, nonzero result, source/input/binary hash drift, actual worktree/common-dir mismatch, a self-certified-only package, or held-out negative rejection failure blocks integrated pass. Required distinct exposures: lifecycle/identity/checkpoint/evidence/lease/runner config-event paths plus old-valid recovery and resolution-only positive cases. Decision: run source-identical suite from RE worktree and independently exercise a held-out malformed JSON duplicate-key control, then inspect actual source-binding rather than counters. No implementation edits.",
|
||||
"timestamp": "2026-09-09T22:34:32.212060+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "rollout-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-2598ca81c443c330e0a4d5b2.json",
|
||||
"sha256": "7f496b73173f7a764f7cf3690ce17efd36a5d3505a785440450320cc04868bf5"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "4ecea4a353281ce34e064768",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "INTEGRATION verifier: same source-identical sots-final-* worktrees as your preceding successful reproduction. Rehash current integrated package and same code/input/outcome identities; independently attest its final changed integrated digest. Do not regress to old baseline-only handoff or conflate run IDs. Issue scoped integrated pass if valid, then fresh checkpoint.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-identical-final",
|
||||
"summary": "Independent verifier reproduced all 37 tests from source-identical isolated sots-final-re and revalidated canonical and paired content hashes. No canonical or paired code/input bytes changed since run-2598ca81c443c330e0a4d5b2. Same package now marked integrated under canonical binding; final current-digest verdict requested.",
|
||||
"timestamp": "2026-09-09T22:33:35.882911+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/verdicts/controls-bootstrap.json",
|
||||
"sha256": "5c9e747fe3e95a04033e3b933bf6f3d72b84d104f09bb1b356a3220cf0cd979a"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-2598ca81c443c330e0a4d5b2.json",
|
||||
"sha256": "7f496b73173f7a764f7cf3690ce17efd36a5d3505a785440450320cc04868bf5"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "5643d7cec1edd289b0465d5f",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Astra lead: inspect the current independent verdict and then perform any authorized lifecycle acceptance decision; do not infer universal engine or security acceptance beyond this controls-bootstrap control-tests package.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-97066391080a3d06dce27a80",
|
||||
"summary": "Final verifier checkpoint for bounded quantum. Decision: issued a scoped PASS verdict for the current integrated controls package; contract status remains integration and no lifecycle/status transition was attempted (verifier lacks that authority). Observations: handoff-alone reproduction in /tmp/opencode/sots-final-re ran `python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v`: exactly 37/37 passed in 6.963s with no skips. Declared inventory and branch/state exposures cover lifecycle bypass, schema/identity, stale/missing checkpoints, evidence source drift and immutable inputs/outcomes, lease collision/WIP, runner model/completion/config errors, plus old-valid recovery and resolution-only positives. Held-out nested duplicate JSON key negative control rejected with ControlError. Actual package state independently rehashed: engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 / digest ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7 / digest 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8; paired common dirs match canonical and evidence binary/input hashes match. No leases, lab actions, implementation edits, open surprises, RNG/game-state or original-assisted workloads. Residual scope: tests/control instrumentation and this exact source package only; no security/authentication or general engine correctness claim. Validation passed after verdict.",
|
||||
"timestamp": "2026-09-09T22:35:44.097174+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"actor": "rollout-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "57763c163ec839aa23b3641f",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "As verifier, execute canonical campaign/rollout/formal-verifier.md against the canonical source-bound package, not old baseline worktree code. Independently reproduce 37 tests and record scoped pass/fail plus a checkpoint using the runner-provided session.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-r8-integration",
|
||||
"summary": "R8 fixed under recorded Astra decision: final verifier may launch in integration; all independence, surprise and source guards retained. Fresh 37/37 control tests and new source-bound evidence attached. No source mutation planned during independent verification.",
|
||||
"timestamp": "2026-09-09T22:12:02.854363+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"actor": "controls-architect",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/rollout/controls-worker-state.md",
|
||||
"sha256": "8ec378244f75c36b95856c46b370cc80e046d1ca3d441d8f4d4a0964667adb98"
|
||||
},
|
||||
{
|
||||
"path": "campaign/README.md",
|
||||
"sha256": "867e4de48e1a1506fea968e94223270e1bf0f2ad05e56b1576d14f14067ca023"
|
||||
},
|
||||
{
|
||||
"path": "campaign/contract.schema.json",
|
||||
"sha256": "ae4796b1f8e8336ddb63e60d774a81ff965461e4b884b5a2488e3865c6a6c5e0"
|
||||
},
|
||||
{
|
||||
"path": "campaign/models.json",
|
||||
"sha256": "95f507237a8e4fcf14189da4aa102dfae1dbaa536d4d8db6bcbfc30162ac5443"
|
||||
}
|
||||
],
|
||||
"basis": "1167f2f44aa39b1b6453e9af3e5046c4653ecea9bdee5281f4fcaea60b16e9a9",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "59f425233f0deb9293f550f9",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Lead records Astra resolutions for s-410e48d5ae6cc4da0a6ae649 and s-f1c41532e618c77d41538902, specifying source-package and recovery/resolver interfaces, then resumes controls worker from the handoff checkpoint.",
|
||||
"role": "architecture-review",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-controls",
|
||||
"summary": "Implemented strict schema/models, guarded campaign CLI, explicit-model bounded paired-worktree runner and 23 passing control tests. Contract validation passed controls-bootstrap and research-replacement. Source identities, tested file hashes, API coordination and exact test results are in controls-worker-state.md. Independent-review R4/R6 were recorded as surprises s-410e48d5ae6cc4da0a6ae649 and s-f1c41532e618c77d41538902; affected interface changes are blocked pending lead resolution. No delegation, staging, commits, actual agent launches or lab I/O.",
|
||||
"timestamp": "2026-09-09T21:36:14.773967+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"actor": "controls-architect",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/rollout/controls-worker-state.md",
|
||||
"sha256": "02ff66f3f0fa978819e5c100e24cfd3752b9041590e2aed36f6abd62ce790f4e"
|
||||
},
|
||||
{
|
||||
"path": "tools/campaign.py",
|
||||
"sha256": "ca4eb2c42e88c1222ec60d6b99c58fffcc72746411c499c4cb0246d899ebbd10"
|
||||
},
|
||||
{
|
||||
"path": "tools/run_agent.py",
|
||||
"sha256": "0f5ccb53dcde59b64fe999768737b6cbd2dabcc1272e5605c1f1ecd86e5d5d2b"
|
||||
},
|
||||
{
|
||||
"path": "campaign/contract.schema.json",
|
||||
"sha256": "a2c76ec042ca097a57c3c05c1e519e392d498d387a31808c7d0f70482d43c201"
|
||||
},
|
||||
{
|
||||
"path": "verify/campaign/test_controls.py",
|
||||
"sha256": "656e5938fa5107022b73b32cf6fc05b6ff6e3e9ab239432d72b304b3f6ea1801"
|
||||
},
|
||||
{
|
||||
"path": "campaign/README.md",
|
||||
"sha256": "00f7c793efcb4f4e0d479342fbea6b942d7b782375ddc5ac46a354f93e4383d1"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "620eb9d25a6ad2f06b68353c",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Lead runs complete integrated tests and one normal noninteractive launcher smoke, then assigns independent reproduction of the source-bound controls package before promotion.",
|
||||
"role": "architecture-review",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-controls-repairs",
|
||||
"summary": "Final repair handoff in controls-worker-state.md. Approved R4/R6 source bindings/immutable binaries+inputs/criterion outcomes/verdict identity and old recovery/resolution-only policies implemented, plus all runner followups and adversarial tests. 36/36 controls suite passed in 6.530s; subsequent checkpoint self-reference regression 1/1 in 0.098s and exact-root permission/subprocess regressions 2/2 in 0.391s. Both contracts validate; pilot remains proposed without evidence. Live OpenCode debug config validated generated implementer routing/prompt/permissions; no agent launch. Source HEADs rechecked RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7, engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23; exact owned bytes attached. Bootstrap canonical exclusive ownership exception; concurrent work preserved. Gate/report source schemas preserved. No project commits, delegation, lab I/O or leases. Actual harness session ID unavailable; logical session rollout-controls-repairs. Contract unaccepted pending independent integrated reproduction and lead smoke. Prior self-referential checkpoint 2f0fe9ac4ec15b15a983bd75 is superseded and guarded against recurrence.",
|
||||
"timestamp": "2026-09-09T21:54:48.101952+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"actor": "controls-independent-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/rollout/formal-verifier-state.md",
|
||||
"sha256": "f28012c46c1d7ff51fb7ace8e9a506400a7ce4091414c2d5d2e28b3d414c9fc9"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "6243ba8b2c2da77e7df666a0",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Lead resolves R8, attaches the changed integrated controls package, and obtains a new independent verdict over that exact digest.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "controls-independent-20260909-formal-1",
|
||||
"summary": "Independent formal verification reproduced the exact nonintegrated controls package. Current engine binding 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE binding 3bfde5a70d874a723e797a695bbd847fd82c0aa7/82fc34631b2baa2ee74557020f74d68cc4db3c031561210f9933a3f22d7ff7b6 match attached evidence; declared binaries, inputs and result artifact rehash. validate controls-bootstrap passed. Fresh independent suite: 36/36 pass, zero skips, 6.720s; focused old-recovery/candidate-drift/integrated-RE-drift challenge: 3/3 pass, 0.722s. Actual run-df1472c13f31db3a4d5361f0 is complete, return 0, 24 events, zero errors, one stop session, matching checkpoint, and equal source-before/source-after; emitted model unavailable, so it evidences Astra architecture-review smoke only, not Terra-worker execution. Decision: scoped pass for controls-negative-paths only. Residual: Astra review R8 blocks a future integration-status verifier launch and needs resolution/new integrated verdict; no whole-engine or integrated acceptance claimed. No source implementation edits, commits, delegation, lab access, leases or test skips.",
|
||||
"timestamp": "2026-09-09T22:08:41.670609+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "rollout-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/decisions/d-2570bf9c76ae66711bdac461.json",
|
||||
"sha256": "2927a18704e12af380045a08e276f35c0198ba0ef57df8babf419c25405f06b5"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "6d3ec66be6274ceb67c32959",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Final-controls-verifier: this is INTEGRATION. Compare current integrated package/source/input/outcome hashes to your preceding run-7924472fe12e745111fa4997 verdict. Same tested bytes; integrated marker is the intended digest change. Rehash and issue final integrated scoped verdict if valid, with a fresh checkpoint for current runner session. Prior run-scope correction is resolved; no code changes or redundant suite run needed.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-final-digest",
|
||||
"summary": "Final-controls-verifier independently passed same exact 37-test source/package after explicit run-scope resolution. Only the evidence integrated marker/digest now changes; source, executables, inputs and outcome bytes are identical. Ready for final scoped verifier attestation.",
|
||||
"timestamp": "2026-09-09T22:24:16.301936+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/surprises/s-abd1c3613c9922cc94c608d5.json",
|
||||
"sha256": "67899b5dca7185a8cff63027f7e4694009390157bd02f9d1d38866a83999e42d"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/decisions/d-2570bf9c76ae66711bdac461.json",
|
||||
"sha256": "2927a18704e12af380045a08e276f35c0198ba0ef57df8babf419c25405f06b5"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "711ee56eb917dc02eafc1f8a",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Astra must resolve s-abd1c3613c9922cc94c608d5 by either authorizing canonical-only integrated verification with explicit scope or providing source-identical paired worktrees; then a fresh verifier must reproduce the full suite and held-out runner-event ablation before issuing any verdict.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-e459b5bcb1b0a0a7cbe960f5",
|
||||
"summary": "Stop checkpoint after reproducibility surprise. Observation: canonical integrated source binding independently equals evidence (engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8); every declared binary, immutable input and outcome artifact hash matches. Assigned paired worktrees are clean at baseline commits but bind differently (engine 949dfb46cb8c42afe3a371e988d63adf1c1f18d7cca50565fd558e5a466cf93b; RE 67b7b60509fe43c8d23382003fed069fb32549094eea0c039b75475e32a7a9eb). The paired RE does not contain tools/campaign.py or verify/campaign/test_controls.py, so cannot reproduce evidence from handoff alone. This falsified the required worktree reproducibility assumption; surprise s-abd1c3613c9922cc94c608d5 is open and contract is blocked. Decision: pause all affected reproduction, held-out ablation, and final verdict; do not treat canonical hash agreement or reported 37 tests as acceptance. No source edits, leases, lab operations, staging, commits, or verdict. Failed prediction/residual: isolated assigned worktree would expose the tested package; it exposes only the pinned baseline. Exact preliminary commands/results: canonical source-binding matched evidence; paired source-binding differed; sha256sum of six declared files matched the contract. Blocker: Astra resolution or provision of source-identical paired worktrees.",
|
||||
"timestamp": "2026-09-09T22:26:05.482787+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/rollout/controls-worker-state.md",
|
||||
"sha256": "02ff66f3f0fa978819e5c100e24cfd3752b9041590e2aed36f6abd62ce790f4e"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "7a272d19b65f489baf99208c",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "From /tmp/opencode/sots-final-re run the controls unittest suite, then independently inspect held-out test behavior and raw runner event/session/source records.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-2598ca81c443c330e0a4d5b2",
|
||||
"summary": "Fresh verifier quantum pre-experiment. Observations: all five surprises are resolved; contract is verification with no open surprises. Assigned paired worktrees have the pinned HEADs (RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7; engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23), share their canonical Git common directories, and their independently recomputed source-binding digests equal canonical/evidence bytes: RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8, engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd. Declared paired code/input hashes match; evidence JSON itself is deliberately canonical runtime/evidence data and absent from the paired source inventory. Falsifiers before execution: a source/hash mismatch, missing test or raw evidence, any failed/skip/zero test, or a held-out mutation not rejected blocks acceptance and is a surprise if the stated control assumption is falsified. Required exposures: positive 37-test suite plus distinct same-HEAD drift, malformed-input, pending-surprise, and runner event/session states; independently inspect raw run state/event counts rather than counters. No resources leased or lab actions. Decision: reproduce only; no source edits or promotion.",
|
||||
"timestamp": "2026-09-09T22:30:36.564366+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json",
|
||||
"sha256": "65dd1c1286742cd4d2401af5a229d7d014f60dd329dadee0dee78c499f61d663"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-cb15199f9272fe496bd10a8a.json",
|
||||
"sha256": "b59375a6559534adb0b5a9cd159ea0ec787e7b6438e9747ac8a7a469698e0849"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "7fb3c73bd64bba6cf3d2081b",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Run an isolated held-out source-binding test using a fresh temporary Git fixture with an unlisted executable-mode change at unchanged HEAD; then count/validate raw JSONL events and decide whether to record a verdict.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-2598ca81c443c330e0a4d5b2",
|
||||
"summary": "Mid-quantum verifier checkpoint before held-out experiment. Reproduction from assigned /tmp/opencode/sots-final-re completed: python3 -m unittest discover -s verify/campaign -p test_*.py -v => 37 tests, 6.849s, OK; no skips or zero execution. Suite exposed lifecycle acceptance refresh, same-HEAD engine and RE source drift rejection, malformed/schema/immutable input failures, pending-surprise launch blocking, lease collision, and runner error/stop/session/config branches. Direct code inspection confirms evidence rehashes source bindings plus binary/input/outcome artifacts and verdict binds evidence/source-binding digests. Raw records identify distinct smoke run df147 (24 events) and earlier Terra verifier cb151 (67), with respectively unavailable observed model, zero errors, return 0 and one actual session as claimed; decision d-2570 scopes that distinction. Current launcher record is running and has source_before only, as expected. Residual: raw JSONL event parsing still to be independently counted and held-out boundary must test an unlisted filename/mode-style same-HEAD alteration; no claim of acceptance or integrated evidence. No leases/lab actions/source edits.",
|
||||
"timestamp": "2026-09-09T22:31:21.248574+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/verdicts/controls-bootstrap.json",
|
||||
"sha256": "603b60dd3eb6c74e3caea0f9f0848d52853c10fcdd9e8596499b6c39a7155c58"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json",
|
||||
"sha256": "65dd1c1286742cd4d2401af5a229d7d014f60dd329dadee0dee78c499f61d663"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-cb15199f9272fe496bd10a8a.json",
|
||||
"sha256": "b59375a6559534adb0b5a9cd159ea0ec787e7b6438e9747ac8a7a469698e0849"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "86940a479b01400dd7ca6069",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Lead: attach the current source-bound controls package as integrated evidence in integration, then launch a fresh independent verifier to attest that integrated package before considering acceptance.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-2598ca81c443c330e0a4d5b2",
|
||||
"summary": "Final checkpoint for fresh bounded verifier quantum. Source identities: canonical and assigned paired RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7, engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23; paired common directories are canonical and independent source-binding digests match evidence exactly (RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8; engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd). Observations: declared tools/test/schema/evidence hashes match; source-identical paired reproduction ran 37 controls tests in 6.849s with all passing/no skips. Held-out isolated Git fixture retained HEAD while a previously unlisted tracked file mode change altered source manifest (46557a99 to c4f155d3); expected campaign/runtime exclusion did not alter it. Raw JSONL independently parsed: df147 24 and cb151 67 events, each zero errors, one session, one stop, return 0 and source_before==source_after. No game RNG workload exists; prompt mentions are not treated as RNG accounting. Decision: wrote verifier-scoped pass verdict only; it is independent control-test reproduction, not original-assisted, partial/full game comparison, integrated replay, or acceptance. No failed predictions/surprises, source edits, resource leases, lab actions, staging, commits or promotion. Blocker/residual: contract remains verification with unintegrated evidence; lead must attach source-bound integrated evidence then arrange a fresh independent verifier attestation in integration before any acceptance.",
|
||||
"timestamp": "2026-09-09T22:32:57.255625+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "rollout-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/rollout/sync_verifier_snapshot.py",
|
||||
"sha256": "4133e536bfdb0e206ecdfc072062e7674b07b973c7f8b9d7f1a268520523d6eb"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "92b718f7ad621b7dad325071",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Verifier: confirm both paired source digests equal current canonical evidence and code/fixtures exist, run controls criterion from assigned sots-final-re snapshot, rehash package, and issue scoped verdict plus fresh checkpoint. Review open-surprise resolutions; only output path differs, content is identical. Do not use old baseline-only sots-launch trees.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-identical-handoff",
|
||||
"summary": "Source-identical isolated paired integration trees now exist; canonical and paired engine/RE content digests match exact tested package. Previous baseline-only trees were only smoke environments. Code and fixture source present in sots-final-re. No canonical source changes; previous independently reproduced 37-test artifact remains byte-identical.",
|
||||
"timestamp": "2026-09-09T22:29:15.076468+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/decisions/d-2570bf9c76ae66711bdac461.json",
|
||||
"sha256": "2927a18704e12af380045a08e276f35c0198ba0ef57df8babf419c25405f06b5"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json",
|
||||
"sha256": "65dd1c1286742cd4d2401af5a229d7d014f60dd329dadee0dee78c499f61d663"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-cb15199f9272fe496bd10a8a.json",
|
||||
"sha256": "b59375a6559534adb0b5a9cd159ea0ec787e7b6438e9747ac8a7a469698e0849"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "9868af5d440d819d8d542903",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Before any test execution, independently compare current paired-worktree manifest entries to evidence/run source manifests; if the difference reaches controls code/input/binary files, record a surprise and pause verdict work; otherwise run the held-out negative-control test and reproduce the suite.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-7924472fe12e745111fa4997",
|
||||
"summary": "Observations: canonical README, contract, latest checkpoint, workflow, decision d-2570bf9c76ae66711bdac461, evidence artifact, handoff, run records and leases were read. validate passed; contract is verification with no open surprises. Engine/RE paired worktrees are distinct, at baseline commits 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 and 3bfde5a70d874a723e797a695bbd847fd82c0aa7, but current candidate source-binding is engine 949dfb46cb8c42afe3a371e988d63adf1c1f18d7cca50565fd558e5a466cf93b and RE 67b7b60509fe43c8d23382003fed069fb32549094eea0c039b75475e32a7a9eb, not the evidence binding (ccd8... / 6696...). This is a source-identity boundary that must be resolved by inspecting manifests before relying on old evidence. Decision scope correction claims raw counts 24 (df147) and 67 (cb151); both records state unavailable observed model, so claimed model remains requested only. All inspected lab leases are released; none used. Decision: no verdict or source edits; first checkpoint is a verifier recovery record, not acceptance.",
|
||||
"timestamp": "2026-09-09T22:21:59.627146+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/runtime/verdicts/controls-bootstrap.json",
|
||||
"sha256": "ee9ad47b7391e25b7dbaf5406ddfa0f495988438b6d67b61f7f35429537eb6d1"
|
||||
},
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/decisions/d-2570bf9c76ae66711bdac461.json",
|
||||
"sha256": "2927a18704e12af380045a08e276f35c0198ba0ef57df8babf419c25405f06b5"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json",
|
||||
"sha256": "65dd1c1286742cd4d2401af5a229d7d014f60dd329dadee0dee78c499f61d663"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-cb15199f9272fe496bd10a8a.json",
|
||||
"sha256": "b59375a6559534adb0b5a9cd159ea0ec787e7b6438e9747ac8a7a469698e0849"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "99a1715514099c8493be8715",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Lead/integrator: attach a complete source-bound integrated controls evidence package at the canonical integrated binding, then commission a fresh independent verifier verdict because the evidence digest changes; do not promote the present nonintegrated pass.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-7924472fe12e745111fa4997",
|
||||
"summary": "Final verifier checkpoint. Observations: canonical source-binding exactly equals attached evidence: engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd, RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7/6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8; binaries/inputs/outcome rehashed. Paired trees are baseline-pinned/clean; their distinct bindings are expected (canonical evidence was not substituted). validate passed before and after verdict. Reproduction: PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s verify/campaign -p test_*.py -v -> 37/37 pass, 7.087s, no skips/errors/failures. Held-out negative controls old-recovery, same-HEAD candidate drift, canonical-integrated drift, and integration verifier guards -> 4/4 pass, 1.106s. A first selected command incorrectly targeted Runner.test_error_followed_by_success_still_fails as Controls and produced one collection AttributeError; corrected Runner command -> 1/1 pass in 0.246s. This verifier-command residual is not a product pass. Independent raw JSONL parse: df147 24 lines and cb151 67, matching respective records; both zero errors, one session, one stop, return 0 and source_before==source_after. observed_model_status is unavailable in both; requested models are not authenticated. No RNG/stateful game workload applies to this control contract; source state comparison was independently checked. All leases inspected released; none acquired/used. Decisions: issued pass verdict only for exact nonintegrated controls package; no engine/assets/original/replay/RNG/integrated acceptance and no source/lab/architecture mutation. Blocker: contract evidence remains integrated:false, so no acceptance/promotion.",
|
||||
"timestamp": "2026-09-09T22:23:37.140581+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "controls-independent-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-cb15199f9272fe496bd10a8a.json",
|
||||
"sha256": "b59375a6559534adb0b5a9cd159ea0ec787e7b6438e9747ac8a7a469698e0849"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "af5cd91c318bf4c4fde759bc",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Independently rehash canonical integrated package, run complete controls suite, and execute held-out CLI negative control.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-f4ee1aa70be8601ad527689f",
|
||||
"summary": "Fresh verifier quantum pre-experiment checkpoint. Observations: canonical RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7, engine worktree HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23, RE worktree HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7; paired worktrees are clean and distinct. Canonical RE is intentionally dirty with controls package; its attached integrated evidence binds canonical source hashes engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Candidate clean-worktree binding differs (engine 949dfb46cb8c42afe3a371e988d63adf1c1f18d7cca50565fd558e5a466cf93b; RE 67b7b60509fe43c8d23382003fed069fb32549094eea0c039b75475e32a7a9eb) and is not evidence substitution. All three surprises are resolved. Contract is integration; validate passed. Falsifiers before execution: declared hashes/binding fail to revalidate; suite has zero/skipped/missing named tests; held-out corruption is accepted; actual run lacks a nonempty session, stop, no errors, fresh matching checkpoint, or preserves sources. Required states: valid package, invalid immutable input, old intact recovery, same-HEAD drift, successful versus malformed/error run event. No source edits, staging, commits, lab actions, leases or architecture decisions. Next action: independently rehash canonical package, run complete controls suite, and execute held-out CLI negative control.",
|
||||
"timestamp": "2026-09-09T22:16:32.579898+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"actor": "controls-independent-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-cb15199f9272fe496bd10a8a.json",
|
||||
"sha256": "b59375a6559534adb0b5a9cd159ea0ec787e7b6438e9747ac8a7a469698e0849"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/surprises/s-4a7d66ebd7d8a8f3ec59f11d.json",
|
||||
"sha256": "113048249417c2c9f612bc1c577b94612ceca317142c4e90901c7e61c9df2bb7"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "afbcef41803eb3ff4be76392",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Astra resolves s-4a7d66ebd7d8a8f3ec59f11d after its discriminating raw-log probe, explicitly deciding invalidation/remediation scope before verifier reruns final package validation.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-f4ee1aa70be8601ad527689f",
|
||||
"summary": "Fresh verifier quantum stopped on an open contradiction. Identity observations: canonical RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7 and engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23; both assigned paired worktrees were clean, distinct, baseline-pinned. Canonical source-binding rehash exactly matched attached integrated evidence: engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd, RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Independently rehashed all declared binaries, inputs and outcome artifact; all match. validate passed. Reproduction: complete suite 37/37 passed in 6.868s, no skips/errors/failures. Held-out negative-control subset exercised old intact recovery, same-HEAD candidate drift, same-HEAD integrated RE drift and final verifier integration launch guards: 4/4 passed in 0.924s. Independent raw run-state audit found run-cb15199f9272fe496bd10a8a has 67 JSONL events, zero error events, one stop, one actual session, return 0 and source_before==source_after; this agrees with its run record except older verdict/checkpoint incorrectly claimed 24 parsed events. Failed prediction/residual: prior 24-event assertion is false; emitted provider model remains unavailable, so the record proves requested Terra routing and completion guards but not authenticated provider model identity. Recorded open surprise s-4a7d66ebd7d8a8f3ec59f11d and paused: contract is blocked, no new verdict. No source edits, commits, staging, lab/resource actions, leases, delegation or architecture decisions. Exact next action: Astra resolves s-4a7d66ebd7d8a8f3ec59f11d after its discriminating raw-log probe, explicitly deciding invalidation/remediation scope before verifier reruns final package validation.",
|
||||
"timestamp": "2026-09-09T22:17:53.864591+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"actor": "controls-independent-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/rollout/formal-verifier-state.md",
|
||||
"sha256": "2fbac02f5f22b45e94ee33f9f53779fa059c5e93282d3c2f5ad0af027029a1f4"
|
||||
},
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/verdicts/controls-bootstrap.json",
|
||||
"sha256": "f048f57462778cd9abc715e4e76e9d56b873e0deebbd21222bf07f68be191a81"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "b467c2d772260f1f03637133",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Lead: attach a source-bound integrated controls package; then commission a fresh independent verifier verdict over that changed evidence digest.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-cb15199f9272fe496bd10a8a",
|
||||
"summary": "Fresh bounded verifier quantum completed. Observations: all open-surprise records are resolved; canonical and paired worktree HEADs equal their baseline commits; canonical source binding exactly matches the current attached evidence (engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd, RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8); paired candidate binding is distinct and was not substituted. Independently rehashed declared binaries/inputs/outcome. validate passed before and after verdict. Tests: full canonical controls suite 37/37 passed, no skips/errors/failures, 7.049s; held-out recovery/same-HEAD candidate+canonical-integrated drift/integration-verifier negative controls 4/4 passed, 1.093s. Actual non-fake launch record independently parsed as 24 events, zero errors, one session, stop, return 0, matching checkpoint and unchanged sources; its emitted model is unavailable and it is Astra architecture-review, not Terra normal-worker proof. Decisions: fresh verifier pass recorded only for the exact nonintegrated controls evidence. No source edits, commits, staging, lab/resource actions, architecture changes, or integration/engine/RNG/replay claims. Blocker/residual: no integrated evidence/package exists; actual smoke does not establish Terra execution. Exact next action: lead attaches a source-bound integrated controls package, then commission a fresh independent verdict bound to that changed evidence digest.",
|
||||
"timestamp": "2026-09-09T22:14:45.615476+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"actor": "final-controls-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/decisions/d-2570bf9c76ae66711bdac461.json",
|
||||
"sha256": "2927a18704e12af380045a08e276f35c0198ba0ef57df8babf419c25405f06b5"
|
||||
},
|
||||
{
|
||||
"path": "campaign/rollout/controls-worker-state.md",
|
||||
"sha256": "02ff66f3f0fa978819e5c100e24cfd3752b9041590e2aed36f6abd62ce790f4e"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "c5548c12161e48a3db015d61",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Independently rehash the declared evidence inputs/binaries/outcome/source bindings, then run the complete controls test suite and a held-out runner-event ablation from the paired RE worktree.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-e459b5bcb1b0a0a7cbe960f5",
|
||||
"summary": "Pre-experiment verifier checkpoint. Observations: canonical contract is integration with no open surprises; candidate paired worktrees are clean and at engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 and RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7. Contract evidence claims the 37 named controls tests passed, binds candidate source digests engine ccd8e020... and RE 6696fd52..., and is marked integrated. Falsifiers defined before reproduction: (1) any source/binary/input/outcome hash or source binding mismatch; (2) zero/partial/unexpectedly skipped test execution; (3) negative branches lack distinct state exposure; (4) held-out malformed runner event sequence is accepted; (5) claimed run event counts do not match JSONL records. Required branch exposures: lifecycle/checkpoint, source/input/outcome tamper, model/surprise/lease/WIP, runner error/session/stop/config. Distinct states: accepted/rejected invalid inputs, clean/dirty identity, open/resolved surprise, complete/incomplete run, lease winner/loser. Decision: no verdict yet. No leases/lab actions. Next execution will independently rehash package and run reproduction plus held-out ablation.",
|
||||
"timestamp": "2026-09-09T22:25:03.799359+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"actor": "controls-architect",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "tools/campaign.py",
|
||||
"sha256": "ca4eb2c42e88c1222ec60d6b99c58fffcc72746411c499c4cb0246d899ebbd10"
|
||||
},
|
||||
{
|
||||
"path": "tools/run_agent.py",
|
||||
"sha256": "6d8a8a2a408c3e8e2beeaf756d9746ed510f65674719e957222fd01031a10689"
|
||||
},
|
||||
{
|
||||
"path": "campaign/contract.schema.json",
|
||||
"sha256": "a2c76ec042ca097a57c3c05c1e519e392d498d387a31808c7d0f70482d43c201"
|
||||
},
|
||||
{
|
||||
"path": "verify/campaign/test_controls.py",
|
||||
"sha256": "b6ea75ff7d83bad68d4a09d05e8079b6a7f1bb45bea9226373f724e74f2d3717"
|
||||
},
|
||||
{
|
||||
"path": "campaign/README.md",
|
||||
"sha256": "00f7c793efcb4f4e0d479342fbea6b942d7b782375ddc5ac46a354f93e4383d1"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "d0b99f8ee3e86db13fa8808d",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Run the checkpoint bounds/self-reference regression, write final controls-worker-state.md handoff, and persist/validate final checkpoint.",
|
||||
"role": "architecture-review",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-controls-repairs",
|
||||
"summary": "Final expanded controls suite passed 36/36 in 6.530s; campaign validate passed controls-bootstrap and proposed research-replacement. Git HEAD rechecked: RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7; engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23. Identified checkpoint self-reference in prior checkpoint 2f0fe9ac4ec15b15a983bd75: attaching the same contract before saving checkpoint pointer invalidated that artifact hash. Added guard and regression assertion; this checkpoint supersedes the invalid self-referential record and attaches only stable owned files. Targeted guard test pending. R4/R6 decisions remain authority; implementation measurements only, no acceptance or independent verification claim. No lab/resources/delegation/commits; actual harness session ID unavailable.",
|
||||
"timestamp": "2026-09-09T21:52:54.003215+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "controls-architect",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/rollout/controls-worker-state.md",
|
||||
"sha256": "8ec378244f75c36b95856c46b370cc80e046d1ca3d441d8f4d4a0964667adb98"
|
||||
},
|
||||
{
|
||||
"path": "campaign/rollout/controls-followup.md",
|
||||
"sha256": "44d0c95978cbc0953d6b1feab4463b29fab68c9d8dad2eca5fd562bb5aee1578"
|
||||
}
|
||||
],
|
||||
"basis": "1167f2f44aa39b1b6453e9af3e5046c4653ecea9bdee5281f4fcaea60b16e9a9",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "d37e0242ac92252f62aa6207",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Read verify/campaign/test_controls.py and campaign/contract.schema.json, then implement R4/R6 and runner followup repairs in owned files.",
|
||||
"role": "architecture-review",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-controls-repairs",
|
||||
"summary": "Recovery read completed from controls-worker-state.md and prior canonical checkpoint. Lead decisions d-42c6d0b4ee5114e6f2e07c99 (R4) and d-ab717735fc6c1661919f6894 (R6) authorize source binding and recovery repairs. Bootstrap exclusive file ownership exception applies in canonical RE; baseline engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23, RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7; concurrent uncommitted files preserved. No edits or tests yet. Harness model openai/gpt-6-astra; actual session ID unavailable, logical session rollout-controls-repairs. No leases or lab operations. Gate stays sots-gate/1 source engine/re; reporter measured with require-match. Next inspect tests/schema/config then implement owned controls.",
|
||||
"timestamp": "2026-09-09T21:43:13.719089+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "rollout-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/runs/run-cb15199f9272fe496bd10a8a.json",
|
||||
"sha256": "b59375a6559534adb0b5a9cd159ea0ec787e7b6438e9747ac8a7a469698e0849"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "ee6d1533aec6504184af4c52",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "As independent verifier read campaign/rollout/formal-verifier.md. Revalidate final integrated evidence against previously reproduced identical hashes, inspect real Terra run-cb15199f9272fe496bd10a8a events and checkpoint, and record final scoped verdict plus fresh runner-session checkpoint. No redundant full suite if source/input bytes unchanged.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "rollout-final-integration",
|
||||
"summary": "Independent Terra verification passed 37/37 and guarded recovery/source/integration-entry tests on exact canonical source. Actual normal Terra verifier run run-cb15199f9272fe496bd10a8a completed with real session, stop, fresh checkpoint and unchanged paired source. Identical canonical package now marked integrated; final independent digest-bound verdict required.",
|
||||
"timestamp": "2026-09-09T22:15:27.121092+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "controls-independent-verifier",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/rollout/formal-verifier-state.md",
|
||||
"sha256": "089470f08ef084331c84a1b5340765e0e8ab75a43ab4213cfb369cad86bbc8cd"
|
||||
},
|
||||
{
|
||||
"path": "campaign/evidence/controls-suite-1788991911311171323.json",
|
||||
"sha256": "bd6ae3eba3d3df606e0410676819db47a46094571d0680edbf9b907bf90d693e"
|
||||
}
|
||||
],
|
||||
"basis": "3c54cfd9a34913e0725e7eaa9f5ee04243a1a60d6edb10d0e2971e02dbf0a5d4",
|
||||
"contract": "controls-bootstrap",
|
||||
"id": "f5aec983257c6d5851cf00dd",
|
||||
"model": "openai/gpt-5.6-terra",
|
||||
"next_action": "Run canonical source-binding and evidence validation, then execute the complete controls suite and held-out negative-control methods.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-cb15199f9272fe496bd10a8a",
|
||||
"summary": "Pre-experiment verifier checkpoint. Observations: AGENTS, README, contract, latest lead checkpoint, raw evidence/run, independent Astra review and all surprise records were read. All three surprises are resolved. Canonical RE/engine and paired worktree HEADs match pinned baseline commits; canonical trees are dirty and paired trees clean, so candidate binding is not interchangeable with canonical evidence. Plan/falsifiers and distinct state/branch exposures are in campaign/rollout/formal-verifier-state.md. Decision: run no lab actions or source edits; independently rehash/revalidate, reproduce all 37 controls tests, and challenge recovery, same-HEAD drift, and integration-verifier guards. Blocker: no integrated evidence exists; no integrated acceptance will be claimed.",
|
||||
"timestamp": "2026-09-09T22:13:29.322611+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"actor": "launcher-smoke",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/agents/lead.md",
|
||||
"sha256": "7661bbfca972be50a52c735b7f15f5be740158542c3d0cdbdf9a6a2590c7f1ea"
|
||||
}
|
||||
],
|
||||
"basis": "dcdc05132c3da6c058873b664d864c731cb2cfdf5a6d015da2c18a48507f0e2c",
|
||||
"contract": "launcher-smoke",
|
||||
"id": "9e8a62fea4de50abd96f27d6",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Lead inspects run-df1472c13f31db3a4d5361f0 actual event/session/checkpoint binding and final before/after source identities.",
|
||||
"role": "architecture-review",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-df1472c13f31db3a4d5361f0",
|
||||
"summary": "Observations: explicit Astra launcher reached canonical RE state from paired worktrees; no source mutation. Read canonical AGENTS.md, campaign/README.md, guides/multi-agent-workflow.md, launcher-smoke contract and both surprise records (both resolved; no open surprises found). Contract checkpoint is null; documented architecture bootstrap permits this fresh smoke. Git rev-parse and git status --porcelain succeeded: engine /tmp/opencode/sots-launch-engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 common-dir /home/alex/sots-engine/.git; RE /tmp/opencode/sots-launch-re HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7 common-dir /home/alex/sots-re/.git; both clean and baseline-matched. Run record campaign/runtime/runs/run-df1472c13f31db3a4d5361f0.json records requested openai/gpt-6-astra, architecture-review, launcher-smoke, paired source-before manifests and 40-step overlay; actual emitted model/session and final runner completion remain for lead inspection, not self-attested acceptance. Artifact campaign/agents/lead.md read. Decisions: remain smoke-only, write this checkpoint and stop; no implementation, delegation or promotion. Tests: read-only worktree identity/status checks only; no build or lab tests. Resources: no leases acquired or used, no lab access or mutation; lease directory inspected only, existing ownership untouched; cleanup not applicable. Blockers: none for checkpoint; live-launch acceptance pending independent lead inspection of completed runner provenance.",
|
||||
"timestamp": "2026-09-09T22:02:10.570990+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "research-problem-resolver",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/result-run-eba7860308317f839eb35392.md",
|
||||
"sha256": "cc32d547e4aa56d573710b457cbe130617441a22db80624ecc549237ba4a9ca2"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-eba7860308317f839eb35392/manifest.json",
|
||||
"sha256": "898d24d660226dc0ef050edd1e892296c61d1412165d3857298b5aba45853ebb"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "0097da20f564f89191a49da6",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Inspect the three ownership raw terminal windows against the archive and record a scoped Astra provenance-repair decision through campaign resolve.",
|
||||
"role": "resolver",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-7cc79c9a0461bcbeac0abf28",
|
||||
"summary": "Resolution-only progress. Read canonical instructions, contract, latest verifier checkpoint, sole open surprise s-4f71bf4a5df4e5fc992bb6b2 and verifier result. Observation: three ownership archive terminal ret bytes contradict declared narrow stop commands; verifier reports hash-matched input/tool and positive static execution. No game-mechanism inference or archive production-history inference. Fresh git checks: assigned engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/common /home/alex/sots-engine/.git; assigned RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7/common /home/alex/sots-re/.git. Dirty inventories observed, untouched; runner source_before records exact launch inventory. Historical bindings engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd, RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8 not freshly recomputed here. No experiments, source edits, delegation or lab access; no lease acquired. Initial relative-path campaign command denied by resolver allowlist; use authorized absolute CLI. Affected verification remains blocked pending raw review and decision.",
|
||||
"timestamp": "2026-09-10T00:48:48.074888+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"actor": "research-abi-analyst",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-boundary-repair.md",
|
||||
"sha256": "e7e1fed33fc16c336e1897afa1de01275fc1014a01425b750aaf4347679089c2"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-dedup-narrow.stdout.txt",
|
||||
"sha256": "1c2408cd49cc10383bad9fe06d3287476b103205f4155adf64c8a50ccd5205e8"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-dedup-narrow.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-dedup-wide.stdout.txt",
|
||||
"sha256": "3c9f83d3a98d95ffa68e0595e47f6c3beab3016aa97cd44bf39ac72ed3ec0a84"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-dedup-wide.stderr.txt",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"path": "campaign/research/research-completion-abi.md",
|
||||
"sha256": "c5448feee5d8430e26dea4c07f314c8f8443deb32411b301c318dec3e5893d20"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/reva-2026-09-09-index.md",
|
||||
"sha256": "5cde612099160f3c7ed01afc04c9acacf871879f152cfcf61bb1a78ef19a5cd4"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/recovered-static.md",
|
||||
"sha256": "a59de10a3756f8655ce6b923035d816db2729a2d69f98282ef59d15fb023a2cd"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "0ff5933d1610e27b1a3b6bed",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Lead schedule a fresh independent verifier quantum to reproduce the repaired narrow/wide captures from the pinned binary/tool identities and execute the predeclared ABI branch, equal-versus-description-different, and NaN falsifiers before any semantic promotion.",
|
||||
"role": "analyst",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-60351a432e82f814e23b5f6f",
|
||||
"summary": "Mandatory fresh quantum-end checkpoint. OBSERVATIONS: contract remains needs-revision with no open surprises; requested and registry model are openai/gpt-5.6-sol. Assigned engine worktree is /tmp/opencode/sots-final-research-engine at HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23, common Git /home/alex/sots-engine/.git, source-content SHA256 ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd. Assigned RE worktree is /tmp/opencode/sots-final-research-re at HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7, common Git /home/alex/sots-re/.git, source-content SHA256 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Both retain pre-existing dirty inventories; only owned canonical campaign/research/research-completion-abi.md and verify/results/research-completion-abi/ were edited. Owner binary hash matched SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 / MD5 9969481c39f4b33a8a21c48b62abee4c. /usr/bin/objdump SHA256 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd reports 2.38. MEASURED: exact separate narrow stop 0x00825e65 and wide stop 0x00825e67 commands exited zero with empty stderr. Each stdout has 120 instruction lines; all preceding lines match byte-for-byte; terminal 0x00825e64 is c2 versus complete c2 08 00. Narrow stdout SHA256 1c2408cd49cc10383bad9fe06d3287476b103205f4155adf64c8a50ccd5205e8; wide 3c9f83d3a98d95ffa68e0595e47f6c3beab3016aa97cd44bf39ac72ed3ec0a84. Wide matches historical first-window content after rstrip except one terminal blank line. DECISION: Astra stop-boundary prediction held; supersede only old first-window production provenance, not infer its history or self-promote dedup semantics. Updated owned handoff/index/static note and added identity report. TESTS: corrected paired-boundary Python hash/count/terminal/stderr assertions PASS; campaign validate PASS. Two interim ad-hoc assertions failed from overly exact whitespace and then a command typo; corrected check passed and artifacts were unchanged. BLOCKERS: independent-cross-check still requires a distinct verifier reproduction and semantic/NaN challenge; live same-bucket short/long fixtures, full-capacity memory, allocation failure, allocator compatibility, runtime construction and RNG remain unexecuted. No game/lab/Ghidra/VM operation, lease, staging, commit, architecture change or delegation; held resources none and cleanup none.",
|
||||
"timestamp": "2026-09-10T00:35:20.891518+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"actor": "campaign-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/run-79357a65226f61d6a86c042d/manifest.json",
|
||||
"sha256": "9961d182f025c669b116cab8e522fb840798d90776773b70a7dd602a79e1c224"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/run-79357a65226f61d6a86c042d/comparison.json",
|
||||
"sha256": "1b1ba9b7f274b0277ee079c85c17c454f03ccb555160aa2da61a78774a24bc38"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/run-79357a65226f61d6a86c042d/report.md",
|
||||
"sha256": "d5a28f01002f1711cf8575ffd817a8f0998b413c6280d656e6cdad5a90a04477"
|
||||
},
|
||||
{
|
||||
"path": "campaign/research/research-completion-abi.md",
|
||||
"sha256": "698bdc5e6a96f1b8bf116b28fe61b203c692bbb82741fec80acadd1973ba8837"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "0ffeab0aee67fe85d202ef5d",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Transition to verification and launch research-abi-independent to reproduce complete repaired ownership and dedup windows, challenge truncated and complete boundaries, finish static ownership/NaN/archived-state checks, and preserve explicit runtime limitations.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "overnight-lead-loop-2",
|
||||
"summary": "Reviewed resolved Astra decision d-d4c494ba02ada278030ef473 and analyst repair run run-79357a65226f61d6a86c042d. The source, binary, and tool identities remained pinned. Twenty-two objdump commands and a full ten-window audit repaired six truncated ownership terminal boundaries; narrow/wide preceding lines and raw bytes agree, with no interior drift. Historical captures remain intact and only terminal-byte provenance is superseded. No open surprises remain. This checkpoint authorizes independent static verification only and makes no live allocator-safety or replacement-acceptance claim.",
|
||||
"timestamp": "2026-09-10T01:05:57.693007+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"actor": "research-abi-independent",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/verification-plan-run-7d85d45cb2196e07025e5096.md",
|
||||
"sha256": "57d96ded9d273f7157257837dbeb5325346c014a21d91f5301be4beda8d5fa05"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/reproduce_run_7d85d45cb2196e07025e5096.py",
|
||||
"sha256": "0681a9a4f877b7f511d382ca2b010a1b4a9eb5e4863e46b3aed372e895778bfb"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-7d85d45cb2196e07025e5096/manifest.json",
|
||||
"sha256": "e59149945c90adb0b099552069a0e4a0a6c7271dafd40e13f0ec357d7365d784"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-7d85d45cb2196e07025e5096/independent-state.json",
|
||||
"sha256": "6463816f322803b2b7b479e1fc116c4ffa33fb2772a3005d492422a00acea433"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/result-run-7d85d45cb2196e07025e5096.md",
|
||||
"sha256": "838e19ee3093a44fa7c11408841b03fe676c16a621bceda67af95a278e8f9178"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/verdicts/research-completion-abi.json",
|
||||
"sha256": "4f72aec2b1dd577ca230b8369ffba075ff2a85fce449ba638a102217228ac9cf"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "10b85ed419fa99a4c148a351",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Lead reviews the scoped non-integrated PASS and, if integration is authorized, transitions/packages one integrated source-bound evidence array before launching a fresh independent integrated verifier.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-7d85d45cb2196e07025e5096",
|
||||
"summary": "QUANTUM END. DECISION: Recorded scoped PASS verdict for the current two-record NON-INTEGRATED evidence array; contract remains verification and verifier made no transition. CLASSIFICATION: independent static reproduction plus archived-state inspection only, not original-assisted runtime, partial/full live compare, independent replacement or integrated replay. OBSERVATIONS: assigned identities after work remain engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/common /home/alex/sots-engine/.git/binding ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7/common /home/alex/sots-re/.git/binding 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8; neither assigned tree was edited. Binary SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841, objdump 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd, save 978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921 and all evidence hashes match. TESTS/REPRODUCTION: python3 verify/results/research-completion-abi-independent/reproduce_run_7d85d45cb2196e07025e5096.py exited 0, executing 22 static windows plus strict save/checksum (24 positive subprocesses, no skips/stderr); py_compile passed; campaign validate passed after verdict. Seven narrow/wide boundaries, 0x2c/0x74 strides, deep-copy and three-delete paths, description and unordered-coordinate branches reproduce. Held-out direct PE parser independently confirmed terminal bytes, plain-ret preceding-byte negative control and defaults. Actual state has EvNxID 4, turn-3 bucket count 2, event ID 3 values; checksum rebuilt 609080 bytes, root e9c161e311f8ef8fad6f1aa1903dcf3f; actual RNG leaf is 2503 bytes/digest 0978fdf34ff7962f76c2de810dc93e0a. No prediction failed/new surprise; prior provenance failures remain historical failures. RESIDUALS/BLOCKERS: no live short/long, capacity, duplicate/NaN, unwind/failure, allocator-family or original differential execution; one archived save does not generalize. No resource/lease/lab action or cleanup.",
|
||||
"timestamp": "2026-09-10T01:29:09.385280+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"actor": "research-problem-resolver",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-09-dedup-helper.txt",
|
||||
"sha256": "3bc3c368f30f2ef2b0d291acad9c0f898b74f4436393d47bf8c942571793dd06"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/result.md",
|
||||
"sha256": "257c48f099c3efd92debbbe66ce5bad8241d0d941ff0d6725b07926e71577b53"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "1381c2e77b8c4a68c6809a23",
|
||||
"model": "openai/gpt-6-astra",
|
||||
"next_action": "Inspect resolve control semantics and dependent claims, then record a durable Astra repair-only decision for s-5c58b6a921997731f5b5ae1f.",
|
||||
"role": "resolver",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-1334385869fb7d5b940d5423",
|
||||
"summary": "Resolution-only recovery. Read canonical AGENTS, README, workflow, contract, latest verifier checkpoint, sole open surprise s-5c58b6a921997731f5b5ae1f, verifier plan/result and raw dedup archive. Observation: archive declares stop 0x825e65 yet displays c2 08 00 at 0x825e64; verifier reports exact-command c2 and three other matching windows, positive zero-exit static commands, no runtime execution. Direct git identity checks: engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/common /home/alex/sots-engine/.git; RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7/common /home/alex/sots-re/.git. Historical bindings ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8 not freshly recomputed: source-binding command denied by resolver permission overlay. Binary SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 is verifier-reported, not independently hashed here. No experiment, source edit, delegation or lab access; no lease acquired or cleanup needed. Decision pending: invalidate exact-command provenance, authorize only bounded read-only repair by an authorized subsequent worker, retain affected interpretation/acceptance hold pending raw paired-boundary capture. No stale-build or game-mechanism diagnosis.",
|
||||
"timestamp": "2026-09-10T00:22:50.344764+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"actor": "research-abi-analyst",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-09-turnevents.txt",
|
||||
"sha256": "f95bbd2674aaa074feb70ebb13ec4877b3ceef3d2aafe5810b8b0ec337cfbb8b"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/recovered-static.md",
|
||||
"sha256": "411a57a689f18aa29c92a57485884399fb6b0804ecf069dde24249e920be19bd"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/reva-2026-09-09-index.md",
|
||||
"sha256": "b7124dac96f23866c1983b9b98bbdbb92611a3e2a08cd200a244001ad70ff62a"
|
||||
},
|
||||
{
|
||||
"path": "campaign/research/research-completion-abi.md",
|
||||
"sha256": "35cad2b199eab53f310d6b30f49cb3ba22f5264931770fe56634ad935b2828ce"
|
||||
},
|
||||
{
|
||||
"path": "campaign/runtime/surprises/s-8996365dab2cd6dc0e17bb9f.json",
|
||||
"sha256": "0749e5f0710a572a5682f5fac4e951892f543356433c261d293f1b32ac5b7bd1"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "26d1c4fa6bd58b6a442e0241",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Launch an openai/gpt-6-astra resolver for surprise s-8996365dab2cd6dc0e17bb9f to characterize helper 0x0046f8c0 and decide whether EvDsc participates in 0x00825d40 dedup before any affected ABI work resumes.",
|
||||
"role": "analyst",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-8566a5bc5aa2bd9a1936b201",
|
||||
"summary": "End-of-quantum checkpoint; affected work paused. Source identities: assigned engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23, binding ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; assigned RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7, binding 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Both are linked to the canonical common dirs and baseline commits. Canonical RE digest observed as e74ef6cff202ee35a6fdc38d63842b4826a074e34502dfc2981a33ffea912bd4 and was not substituted. Binary dumps/sots.exe SHA-256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 matched prior provenance. Measured static observations: new GNU objdump 2.38 capture covers 0x00885380/0x00825d40/0x00879eb0 and transitive outer TurnEvents append/growth/count*0x18 allocation/deep copy/destruction, nested PlayerEvent count*0x74 allocation/copy/destruction, and static partial-construction unwind. Get-or-create returns the last matching turn and on miss appends a deep-copied empty bucket before setting turn. Prune checks only a leading stale run and removes n-1 via deep shift; zero/one stale and stale-after-fresh are distinct branches. No recovered helper draws RNG. Static unwind edges are observed but live allocation failure and allocator safety remain unexercised. Conflict: FindDuplicate calls 0x0046f8c0 with candidate/stored +8 description strings after action/location/position/message/image checks and accepts only a false AL result, contrary to inherited prose that EvDsc is omitted. Decision: recorded open surprise s-8996365dab2cd6dc0e17bb9f; contract is blocked and dedup interpretation is explicitly unresolved pending Astra. I did not inspect that helper after the block. Verifier-facing falsifiers now name description-only difference, zero/one/two stale buckets, stale-after-fresh, duplicate turn buckets, spare/full outer capacity, and empty/nonempty nested vectors. Artifact hashes: new raw capture f95bbd2674aaa074feb70ebb13ec4877b3ceef3d2aafe5810b8b0ec337cfbb8b; recovered-static 411a57a689f18aa29c92a57485884399fb6b0804ecf069dde24249e920be19bd; provenance index b7124dac96f23866c1983b9b98bbdbb92611a3e2a08cd200a244001ad70ff62a; handoff 35cad2b199eab53f310d6b30f49cb3ba22f5264931770fe56634ad935b2828ce. Tests: source-binding commands succeeded; campaign validate listed all four contracts without error; status confirms blocked/open surprise; sha256sum matched all listed artifacts. No commit/stage/push. Resources: all canonical leases observed released; this actor holds none; no VM, Ghidra, build-host, or ReVa mutation; no cleanup required. Blockers: Astra resolution of dedup conflict; no live long-string/full-capacity fixture; no executed allocation failure; no live allocator-safety proof; 0x0084ee30 full local window remains a verifier cross-check.",
|
||||
"timestamp": "2026-09-09T23:49:54.354638+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"actor": "research-abi-independent",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/verification-plan-run-eba7860308317f839eb35392.md",
|
||||
"sha256": "9d8626c8c3556c1d430484acbc1a5dd4fd3284706ac6e04c3fa95ed1854780f2"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "47d1fd3aedce21f0ac2b2e7b",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Run fresh unfiltered narrow/wide dedup and ownership/TurnEvents objdump captures against the hash-matched executable, then independently inspect decoded branches and archived save state.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-eba7860308317f839eb35392",
|
||||
"summary": "PRE-EXPERIMENT CHECKPOINT. OBSERVATIONS: contract is in verification; campaign status reports no open surprises and validate passes. Paired engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/common /home/alex/sots-engine/.git/binding ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; paired RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7/common /home/alex/sots-re/.git/binding 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Both have pre-existing dirty inventories; verifier has not edited either paired tree. Canonical owner input dumps/sots.exe hashes to 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841; /usr/bin/objdump hashes to 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd and reports GNU 2.38. Prior provenance surprise is resolved by Astra and repaired handoff asks fresh independent reproduction. DECISION: fixed falsifiers, branch exposures, distinct states, NaN held-out challenge and narrow-boundary ablation in attached owned plan before execution. No VM/Ghidra/shared resource used; no lease held. BLOCKERS/LIMITS: no live allocator or game execution is authorized; result can only be independent static reproduction plus archived-state checking.",
|
||||
"timestamp": "2026-09-10T00:40:37.977204+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"actor": "research-abi-independent",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/verification-plan.md",
|
||||
"sha256": "a18737d98e6009ea314e9d37b077042e853d886d3ea2cf438b8b4340845aa008"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "49350005b48eb04a30cd156f",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Run the four unfiltered objdump commands from the analyst handoff against the independently rehashed dumps/sots.exe into a verifier-owned raw capture, checking exit status and requested range coverage.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-6c7a726f5a2849ef0407876f",
|
||||
"summary": "Pre-experiment verifier checkpoint. Observation: contract is in verification, campaign status and validate succeed, and all six canonical surprises are resolved with none open for this contract. Requested model matches campaign/models.json verifier registry. Assigned engine worktree HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23, common dir /home/alex/sots-engine/.git, binding ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; assigned RE worktree HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7, common dir /home/alex/sots-re/.git, binding 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Both have the expected pre-existing dirty inventories; no source worktree edits were made. Input independently hashes SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 and MD5 9969481c39f4b33a8a21c48b62abee4c; GNU objdump is 2.38. Decision: fixed falsifiers, branch exposures, distinct states, scope labels, and a held-out NaN negative control in the attached verifier-owned plan before reproduction. No lab resource is leased or touched. Tests so far are identity/hash/status checks only; no independent instruction reproduction has started. Blocker: live allocator safety and live empty/short/long fixtures remain unavailable and cannot be promoted by static work.",
|
||||
"timestamp": "2026-09-10T00:15:54.329971+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{
|
||||
"actor": "campaign-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-boundary-repair.md",
|
||||
"sha256": "e7e1fed33fc16c336e1897afa1de01275fc1014a01425b750aaf4347679089c2"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-dedup-narrow.stdout.txt",
|
||||
"sha256": "1c2408cd49cc10383bad9fe06d3287476b103205f4155adf64c8a50ccd5205e8"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/objdump-2026-09-10-dedup-wide.stdout.txt",
|
||||
"sha256": "3c9f83d3a98d95ffa68e0595e47f6c3beab3016aa97cd44bf39ac72ed3ec0a84"
|
||||
},
|
||||
{
|
||||
"path": "campaign/research/research-completion-abi.md",
|
||||
"sha256": "c5448feee5d8430e26dea4c07f314c8f8443deb32411b301c318dec3e5893d20"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "4ac63c901e8518e992ada67c",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Transition the repaired contract to verification and launch a fresh independent verifier to reproduce the repaired package and execute its predeclared static ABI, dedup-description, prune-boundary, and NaN challenges.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "lead-continuation-20260910",
|
||||
"summary": "Reviewed Astra decision d-d2a9b8be6399a6abaa0e05a5 and the completed analyst repair run run-60351a432e82f814e23b5f6f. The analyst independently rebound paired source identities, owner binary and /usr/bin/objdump 2.38; separate narrow and wide raw stdout/stderr streams confirm identical preceding instructions and the predicted c2 versus c2 08 00 terminal bytes. The historical archive was retained and only its first-window provenance was superseded. Contract has no open surprises. This lead checkpoint records lifecycle handoff only and makes no semantic, live allocator-safety, or replacement-acceptance claim.",
|
||||
"timestamp": "2026-09-10T00:37:31.919594+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"actor": "research-lead",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "campaign/research/NEXT.md",
|
||||
"sha256": "26d68c2ae39955dad2e32ae6e2a9e5e2b4cd556a95396c8afc30390ff39cc2cc"
|
||||
},
|
||||
{
|
||||
"path": "campaign/research/research-completion-abi.md",
|
||||
"sha256": "febea2b2dc987d2007b2c4fbefec412baea348369669bfd9e61fef5443ad25c4"
|
||||
},
|
||||
{
|
||||
"path": "campaign/research/record-observation-crosscheck.md",
|
||||
"sha256": "2c5bce97a156fd15b5f443d07c22baaef2dca97d08ffa901e20a44f0eed2ca53"
|
||||
},
|
||||
{
|
||||
"path": "campaign/research/research-callback-order.md",
|
||||
"sha256": "2a45e484e33012a0096951f615d88e685323ce57b5bed3f33c149d98fa6dd8d4"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-callback/INDEX.md",
|
||||
"sha256": "e563a0f942b5e2d8959058c40c7c9a3a090efb2043f5d7982038fc7ba7dc20aa"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi/recovered-static.md",
|
||||
"sha256": "2a8c2bcd5cdbd4bcf57e6d959e0d3d889af26eb452bdbcd1fca24a7f073fa32a"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "4d159f96e28ddbec063de65c",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Launch the bounded Sol analyst on nested TurnEvents construction/growth and event duplicate/prune functions 0x00885380, 0x00825d40 and 0x00879eb0, checking raw instructions and exceptional cleanup.",
|
||||
"role": "lead",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "sol-routing-resume",
|
||||
"summary": "User changed normal campaign loop routing to openai/gpt-5.6-sol and reserved openai/gpt-6-astra for problem resolution. Existing static ABI evidence remains unchanged; no open surprises or lab leases. Campaign/model/OpenCode validation and 43 routing/control tests pass. The prior Astra checkpoint remains historical provenance and is superseded for recovery by this Sol checkpoint.",
|
||||
"timestamp": "2026-09-09T23:37:15.850763+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"actor": "research-abi-independent",
|
||||
"artifacts": [
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/verification-plan-run-eba7860308317f839eb35392.md",
|
||||
"sha256": "9d8626c8c3556c1d430484acbc1a5dd4fd3284706ac6e04c3fa95ed1854780f2"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/result-run-eba7860308317f839eb35392.md",
|
||||
"sha256": "cc32d547e4aa56d573710b457cbe130617441a22db80624ecc549237ba4a9ca2"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/reproduce_run_eba7860308317f839eb35392.py",
|
||||
"sha256": "8587d1d7e7bb787e1cb7e54d56c5a149669d01c0f5c9b6ea74081adb486800d2"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-eba7860308317f839eb35392/manifest.json",
|
||||
"sha256": "898d24d660226dc0ef050edd1e892296c61d1412165d3857298b5aba45853ebb"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-eba7860308317f839eb35392/dedup-wide.stdout.txt",
|
||||
"sha256": "cb10ca40246bc57fd5431ab099008727fe5be90c22bd7f57fad1cb30301f002c"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-eba7860308317f839eb35392/observed-alloc.stdout.txt",
|
||||
"sha256": "9ba611f8263c9bf08e9c0ee915000f97184698c1b0bbd64ea416c65b4a237cbc"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-eba7860308317f839eb35392/player-append.stdout.txt",
|
||||
"sha256": "4981f5eb0ffeaa800f2f8f8c04739a53964c2f3f3f47dffd58fbab9488faf895"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-eba7860308317f839eb35392/player-copy.stdout.txt",
|
||||
"sha256": "7f3faf8b68de34d1e5ac0214a8949e205c03473c2a1772be3d42452c94307460"
|
||||
},
|
||||
{
|
||||
"path": "verify/results/research-completion-abi-independent/run-eba7860308317f839eb35392/turn3-save-reader.json",
|
||||
"sha256": "3524bb954988f167503345d37349b3f9f529e10e45eb5eccd3aab1ab365bd929"
|
||||
}
|
||||
],
|
||||
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||
"contract": "research-completion-abi",
|
||||
"id": "54f3ffbf418146a024f7681e",
|
||||
"model": "openai/gpt-5.6-sol",
|
||||
"next_action": "Launch an authorized openai/gpt-6-astra resolver for surprise s-4f71bf4a5df4e5fc992bb6b2 to inspect the three truncated ownership captures and prescribe provenance repair before any affected ABI verification resumes.",
|
||||
"role": "verifier",
|
||||
"schema": "sots-checkpoint/1",
|
||||
"session": "run-eba7860308317f839eb35392",
|
||||
"summary": "QUANTUM-END CHECKPOINT. VERDICT: FAIL/BLOCKED for independent-cross-check; open surprise s-4f71bf4a5df4e5fc992bb6b2. OBSERVATIONS: paired identities independently matched handoff: engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/common /home/alex/sots-engine/.git/binding ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7/common /home/alex/sots-re/.git/binding 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Pre-existing dirty inventories were not edited. Input SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 and objdump SHA256 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd/version 2.38 matched. Fresh owned reproducer ran 28 windows: all subprocesses return 0, disassembly outputs nonempty, stderr empty. Direct bytes support repaired dedup: EvDsc helper call, caller cleanup, zero-to-match, inline/heap and byte/length inequality. Held-out NaN challenge supports mismatch for unordered coordinates via fucompp/fnstsw/test ah,0x44/jp. Narrow ablation reproduces c2 truncation versus wide c2 08 00. Strict save parse directly recovers event id 3, exact strings, loc 0/action 1/CID 0 and three 0x7f7fffff words; archived parse only. FAILED PREDICTION/SURPRISE: ownership archive exact commands stop one byte into ret 4 at 0x57e5e3, 0x86c62d, 0x7694bf yet archive prints complete c2 04 00; fresh same commands print c2 only. Affected ownership provenance cannot pass. Manifest instruction_lines is explicitly invalid as a coverage count because it includes the function-label line; raw bytes/address inspection is authoritative. DECISION: paused affected interpretation and recorded surprise rather than treating matching semantics as success. TESTS: campaign validate passes after surprise; campaign status is blocked with that open surprise. CLASSIFICATION: independent static reproduction plus archived-state check only, not original-assisted runtime, partial/full compare, replacement, integrated replay, allocator safety or RNG execution. BLOCKERS: Astra provenance disposition/repair; live ownership/event fixtures, allocation failure, RNG and integrated replay remain absent. RESOURCES: no VM/Ghidra/shared lab action, no lease, no cleanup required. No commit/stage/push.",
|
||||
"timestamp": "2026-09-10T00:46:50.822111+00:00"
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Reference in a new issue