Feat/phase5 retired corpus#17
Closed
BunsDev wants to merge 12 commits into
Closed
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…s-k9s)
Cave implementation wraps route-1 data as { weaves, degraded } rather than
overloading a WeaveSummary[] with degraded entries — the wrapped shape avoids
any fabricated health fields on degraded familiars. Same-day alignment of the
2026-07-18 §2.7/R12 amendment.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
All 8 open questions resolved on Sage's recommended defaults: - ApprovalPath separate from Channel (load axis preserved) - Delayed apply only for veto windows (fail-closed posture) - Classify-first for harness regions - Deterministic + probe for invariants (not LLM-judge-only) - RFC #3/#4 blocker resolved (familiar-contract@2a5bb98) - Daemon contract before Cave ProposalView extension - Display labels preserved, typed variants internal - proposal_window_opened audit event lands with delayed apply Rename PHASE-5-PROPOSAL -> PHASE-5-APPROVAL-SEMANTICS to reflect open status. Co-authored-by: Nova <nova@opencoven.dev>
…uqx) Add substantive annotations from Sage and Echo review (2026-07-18): Decision #1: rationale callback — ApprovalPath is authoritative, Channel is derived; if enforcement rule shifts, revisit all eight decisions. Decision #2: audit implication — close event needs reason field (applied|vetoed|expired|superseded); delayed-apply without it is a post-hoc audit black hole. Decision #3: forward-only promotion — retroactive region projection corrupts authority trail with apparently-authored writes from before promotion. Decision #4: fail-closed on extraction ambiguity — not silent LLM fallback; ambiguity is an explicit ignored/blocked state. Decision #5: RFC provenance pointer added. Decision #6: Cave ProposalView labeled [DESIGNED, NOT SHIPPED] from the start. Decision #7: label-variant round-trip is daemon wire contract (load-time reject on drift); Cave has zero policy freedom over label strings. Decision #8: proposal_window_opened paired with close event; window is a first-class audit interval. threads-uqx.3 design constraints (Sage): evidence_replay_hash on ProposalClassification; VetoWindow.min_visible: Duration; label mapping as daemon wire contract. Co-authored-by: Sage <sage@opencoven.dev> Co-authored-by: Echo <echo@opencoven.dev> Co-authored-by: Nova <nova@opencoven.dev>
…(v0.1.4) Closes coven-threads#5. Unblocks coven#414. Changes: - AuditEventType::ApplyAudit variant + apply_audit CHECK tag - WardAuditRecord.detail: nullable JSON column for event-specific payload - WardAuditRecord::for_apply() constructor - apply_prev_sha256_hex() / apply_bytes_written() decode helpers - WARD_AUDIT_MIGRATION_V014_SQL: transaction rebuild for v0.1.3 stores - APPLY_AUDIT_DETAIL_KEY_PREV / _BYTES stable constants - Exhaustiveness test extended; 3 new tests (shape, roundtrip, migration) - Workspace version bumped 0.1.3 -> 0.1.4 - CHANGELOG.md created Design: prev_sha256+bytes_written ride in detail JSON (Option A); migration exports SQL constant, no rusqlite dep added (Option B-lite). Bead: threads-3ym
Addresses two Sage review notes (neither was blocking): 1. WARD_AUDIT_MIGRATION_V014_SQL now stamps PRAGMA user_version = 14 inside the transaction. Future migrations gate on 'user_version < N' instead of substring-sniffing sqlite_master DDL. Migration doc-comment updated to name the gate rule and explain the intentional non-idempotence of the CREATE step (double-run fails loudly, not silently). 2. WardAuditRecord::detail doc-comment now names the full invariant for ApplyAudit rows (prev_sha256 hex 64 chars + bytes_written u64) and explicitly states other event types MAY leave it None or use their own documented shape. Turns the implicit decoder contract into a searchable spec. CHANGELOG updated. Tests still green, clippy clean.
…alClassification (threads-uqx.3)
Adds crates/coven-threads-core/src/approval.rs with the Phase-5 core type
sketch from specs/PHASE-5-APPROVAL-SEMANTICS.md §3, decisions 1/2/7/8.
Types introduced:
- ApprovalPath (AutoRegression | FamiliarCoherence | HumanApproval |
HumanApprovalWithRationale) — promotion ceremony, separate from Channel
- ApprovalPathKind — variant without inner fields for label round-trip
- VetoWindow — delayed-apply only; min_visible + duration; deadline helpers
- ProposalClassification — channel, regions, tier floor, approval_path,
evidence_replay_hash (WARD-C7 generalised)
- SurfaceRegionId — opaque region ref, full predicate in uqx.5
- WindowCloseReason — applied | vetoed | expired | superseded (decision 2+8)
- ProposalWindowAuditDetail / ProposalWindowCloseAuditDetail — detail payloads
for proposal_window_opened and close events
- ApprovalPathWireEnvelope — daemon wire format {variant, label, veto_deadline}
Key constraints enforced:
- ApprovalPath != Channel (decision 1); highest ceremony wins
- VetoWindow is delayed-apply only; min_visible <= duration (decision 2)
- display_label() + from_display_label() round-trip is exhaustive; unknown
labels return None so daemon rejects at load (decision 7)
- evidence_replay_hash on ProposalClassification (WARD-C7)
Tests: 15 passing (all approval tests green; full suite 90 passing)
Closes #8
…ds-uqx.4) Adds crates/coven-threads-core/src/identity_invariants.rs. Types / implementations: - FamiliarNameInvariant: PatternPredicate over Blake3 content hash of an identity surface (e.g. IDENTITY.md). Fails closed on mismatch, snapped thread, or missing thread (decision 4: ambiguity → reject, not fallback). - ManifestAnchoredInvariant: PatternPredicate over manifest entry hash; holds under Forced channel (WARD-C1..C6: must survive compaction). - CompositeIdentityInvariant: all-components-must-hold composite predicate; identity invariant is a unit — no partial pass. - AdvisoryProbeResult: Gate-3 supplementary evidence shape; is_authoritative always false; confidence validated in [0.0, 1.0]. - AdvisoryProbes: the advisory_probes block (Q4 decision) — separate from deterministic probes block; empty means 'no advisory signals ran'. Key constraints enforced: - Predicate-first; no new strand kind (decision 3/4) - Fail-closed on ambiguity (decision 4) - advisory_probes structurally separate from probes; never sole authority - descriptor is derived, never enforced on (§2.3) Tests: 16 new (identity_invariants::tests), all passing. Full suite: 106 tests, 0 failures. Closes #9
Adds crates/coven-threads-core/src/surface_regions.rs. Types introduced: - MaterializedDiff / SurfaceDiff: pure diff input; predicates are pure functions of this (Gate-4 replay constraint — no Cave state, no stale metadata, no agent self-report) - RegionEvidence: predicate output; feeds ProposalClassification.affected_regions and evidence_replay_hash; includes replay_bytes for Gate-4 deadline check - SurfaceRegionDescriptor: derived, Cave-renderable, never enforced on - SurfaceRegionPredicate trait: materialize (authoritative) + describe (derived) - ExecutionPromptRegion: SOUL.md / AGENTS.md, tier-0 floor, human review - ToolDefaultsRegion: TOOLS.md, tier-1 floor, familiar review - HeartbeatBehaviorRegion: HEARTBEAT.md, tier-1 floor - SurfaceRegionRegistry: classify_all + descriptors + path_tier_floor helper Key constraints enforced: - Classify-first; threads stay source-bound (decision 3) - materialize is pure over MaterializedDiff — daemon-replayable at Gate-4 - replay_bytes are deterministic (sorted surface order) - path_tier_floor = min across evidence (most protective wins) - SurfaceRegionDescriptor never enforced on Tests: 12 new (surface_regions::tests), all passing. Full suite: 118 tests, 0 failures. Closes #10
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bind semantic identity evidence into Gate-4 validation, commit replay to the complete materialized diff, validate wire contracts, and make proposal audit lifecycle persistence fail closed while preserving legacy history. Bump the breaking public API to 0.2.0 and cover the retired invariant corpus, delayed approval semantics, schema migration paths, and append-only terminal behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Introduces a public, repository-authored synthetic corpus for Phase 5 retired-Ward approval semantics, including a canonical JSON generator example and digest-pinned conformance tests. Coverage now spans identity invariants, approval paths/labels, veto windows, region classification fidelity, and fail-closed unsupported cases. Also tightens `MaterializedDiff::try_new` to reject surfaces with neither `before` nor `after`, and unchanged surfaces, with matching unit tests and design-spec tracking updated in `PHASE-5-APPROVAL-SEMANTICS.md`.
There was a problem hiding this comment.
Pull request overview
This PR opens Phase 5 by recording approval-semantics design decisions in specs, and introduces the corresponding coven-threads-core primitives for approval paths, veto windows, identity invariants, surface-region classification, and expanded audit schema support.
Changes:
- Add Phase 5 decision/spec record and align Phase 4 Cave surface spec with the newer
/api/weavesresponse envelope. - Implement Phase 5 core types (
ApprovalPath,VetoWindow, proposal classification + wire envelope), surface-region predicates + replay hashing, and identity-invariant compilation/predicate integration. - Extend
ward_auditschema/types to support window-open events, provenance events, and applied-write audit (apply_audit), and bump crate version/changelog accordingly.
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| specs/PHASE-5-APPROVAL-SEMANTICS.md | Phase 5 decision record + proposal text for approval semantics over Phase 2 Ward. |
| specs/PHASE-4-CAVE-SURFACES.md | Update /api/weaves return type to a new envelope shape. |
| crates/coven-threads-core/tests/support/phase5_retired_ward_corpus.rs | Synthetic retired-Ward corpus generator used for Phase 5 conformance tests. |
| crates/coven-threads-core/tests/rfc0001_s5_conformance.rs | Update test helper to populate new MutationRequest.identity_context field. |
| crates/coven-threads-core/tests/phase5_retired_ward_corpus.rs | Conformance tests for approval labels, identity declarations, veto windows, region classification, and pinned corpus digest. |
| crates/coven-threads-core/src/weave.rs | Add weave coherence evaluation that threads candidate identity context into pattern evaluation. |
| crates/coven-threads-core/src/validate.rs | Extend MutationRequest with identity_context and pass it through Gate-4 coherence evaluation; add identity-aware validation test. |
| crates/coven-threads-core/src/surface_regions.rs | New region predicate framework, deterministic replay hashing, default registry, and tests. |
| crates/coven-threads-core/src/pattern.rs | Add default PatternPredicate::coherent_with_context hook for identity-aware predicates. |
| crates/coven-threads-core/src/lib.rs | Export new Phase 5 modules/types (approval, identity_invariants, surface_regions) and updated audit exports. |
| crates/coven-threads-core/src/identity_invariants.rs | Identity declaration parsing/compilation, candidate fact types, identity-aware pattern wrapper, advisory probes, and tests. |
| crates/coven-threads-core/src/audit.rs | Add audit schema versioning + migration helpers, new audit event types and detail payloads, and ApplyAudit support. |
| crates/coven-threads-core/src/approval.rs | New Phase 5 approval-path/veto-window types, classification record, audit-detail structs, and wire envelope validation. |
| crates/coven-threads-core/examples/generate_phase5_retired_ward_corpus.rs | Example binary to emit canonical synthetic corpus JSON. |
| CHANGELOG.md | New changelog documenting the 0.2.0 additions and schema approach. |
| Cargo.toml | Bump workspace version to 0.2.0 and add time serde well-known feature. |
| Cargo.lock | Lockfile updates reflecting the 0.2.0 workspace version bump. |
| .beads/interactions.jsonl | Beads interaction log updates referencing Phase progress/closures. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+506
to
+507
| _ => {} | ||
| } |
Comment on lines
+514
to
+530
| pub fn apply_prev_sha256_hex(&self) -> Option<String> { | ||
| let detail = self.detail.as_deref()?; | ||
| let v: serde_json::Value = serde_json::from_str(detail).ok()?; | ||
| v.get(APPLY_AUDIT_DETAIL_KEY_PREV) | ||
| .and_then(|x| x.as_str()) | ||
| .filter(|s| !s.is_empty()) | ||
| .map(|s| s.to_string()) | ||
| } | ||
|
|
||
| /// Decode `bytes_written` from the `detail` JSON for `ApplyAudit` rows. | ||
| /// | ||
| /// Returns `None` for non-`ApplyAudit` events or if the field is missing. | ||
| pub fn apply_bytes_written(&self) -> Option<u64> { | ||
| let detail = self.detail.as_deref()?; | ||
| let v: serde_json::Value = serde_json::from_str(detail).ok()?; | ||
| v.get(APPLY_AUDIT_DETAIL_KEY_BYTES).and_then(|x| x.as_u64()) | ||
| } |
Comment on lines
+475
to
+478
| /// Note: `AuditEventType::ProposalWindowOpened` will be added to | ||
| /// `AuditEventType` in issue #5 / the Cody implementation lane, which owns | ||
| /// the schema migration. This struct documents the shape so that migration | ||
| /// can be written correctly. |
Comment on lines
+175
to
+177
| /// The minimum approval path tier this region requires. | ||
| /// Feeds `ProposalClassification.path_tier_floor` (highest floor wins). | ||
| pub min_path_tier: u8, |
| | # | Route | Method | Returns | | ||
| |---|---|---|---| | ||
| | 1 | `/api/weaves` | GET | `WeaveSummary[]` — optional `?familiar=<id>` filter; degraded familiars surface per §2.7 + §4.R12 | | ||
| | 1 | `/api/weaves` | GET | `WeaveListView` — `{ "weaves": WeaveSummary[], "degraded": DegradedFamiliarView[] }` (§2.7); optional `?familiar=<id>` filter; degraded familiars render per §4.R12 | |
This was referenced Jul 21, 2026
Closed
Member
Author
|
Closing per Val's call (team review: Echo + Cody + Kitty). Why: #17 is a divergent sibling of #15 (both branched from Salvaged: the genuinely-valuable retired-ward corpus test fixtures (~467 lines across 3 files) are tracked in #20 for a future PR cherry-picked cleanly onto #15. Branch tip Canonical Phase 5 lineage: #16 → #15 → #18 (rebased onto #15) → daemon uqx.6 (in coven) → Nova attestation → Val freeze. |
BunsDev
added a commit
that referenced
this pull request
Jul 21, 2026
…re (threads-uqx.13) (#21) Salvage per #20: corpus fixtures from closed #17 (c6cdb60) cherry-picked onto post-#15 main. Includes MaterializedDiff::try_new fail-closed tightening (rejects absent-both and unchanged surfaces). Verified-loop iteration 2: PASS 97/100, all mandatory minima met (fail-closed 15/15). Closes #20. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a public, repository-authored synthetic retired-Ward Phase 5 corpus for approval-semantics conformance testing (tip commit
c6cdb60):examples/generate_phase5_retired_ward_corpus.rs)MaterializedDiff::try_newto reject surfaces with neitherbeforenorafter, and unchanged surfaces, with matching unit testsPHASE-5-APPROVAL-SEMANTICS.mdStacking
feat/phase-5-uqx3-approval-types) — its diff includes all of #15's commits plus one corpus commit on top. Merge #15 first, then this PR's diff reduces to the corpus commit alone.Merge order for the Phase 5 stack: #6 (spec) → #15 (core) → #17 (corpus) / #16 (Cave contract) / #18 (audit v0.2.0).
Beads / issues
Supports validation work toward threads-uqx.10 (#14 freeze gate). Corpus is synthetic and repository-authored — no real familiar data.
Body added by Echo 🪞 during the 2026-07-21 state review (branch pushed by Val 07:59 CDT; body was empty).