Conversation
…validated and inert
Treatment-only step of the A2 staging (docs/notes/p037-formal-kernel.md §10.3):
the extractor now writes `functions[].guarded_facts`, the raw record of what
flows into each relevant call and what each eligible `if` tests, keyed by
declared parameter ordinal. Neither engine reads it; the legacy `body` stays
authoritative; no path under the A2.0 instrument freeze is touched, so the
after-takes on M1 compare directly against the R baselines with
population_commit = T.
Producer (frontend/roslyn/OwnSharp.Extractor/Program.cs):
- calls[]: one per call a disposable candidate local or an owned parameter
flows into (argument or reduced-extension receiver); site {line, column} of
the invocation plus statement_line as the join identity with the legacy ops;
form statement|initializer|expression; callee/sig or null when unresolved;
first_party; args bound by declared ordinal (named args resolved, extension
receiver = 0, params/ref/out = opaque, unresolved callee = source position).
- arg kinds (raw facts only, §10.2): var{name}, param{source_param[,negated]},
bool_const{value}, null_literal, object_creation, call_result{callee,sig},
opaque. No const-pos/id/neg and no fresh_owned are ever written.
- guards[]: one per eligible `if` on a stable by-value parameter — truth on a
bool, is_null/not_null on a reference or Nullable<T>; G-V4 stability is
whole-body write exposure (assignment, ++/--, ref/out, ref alias, address).
Ineligible guards get no entry: absence is the fail-closed signal.
- Self-check: a sidecar that violates its own vocabulary makes the run refuse
to write facts at all (exit 2), so a producer defect never reaches a door.
Contract (spec/ownir.schema.json, spec/OwnIR.md §5.2, §4.2):
- closed $defs guardedFacts/guardedCall/guardedArg/guardedGuard/sourceSite;
the sidecar is optional and additive, OWNIR_VERSION stays 0.
- sourceSite is deliberately UNBOUND (type only): the doors do not read the
sidecar in A2.1, and §4.2 forbids a schema narrower than the door on a
coordinate the door does not check. tests/test_ownir_defensive_limits.py
classifies it as the one UNBOUND entry; the instrument step that registers
the sidecar at the doors moves it to BOUND.
Controls:
- corpus/p037-shapes: all 11 shapes re-recorded with the sidecar (body ops,
params and both engines' verdicts byte-identical to before), status
pending_a2 -> anchored, and a2_expect contract checks per shape that fail by
name (scripts/p037_fact_shapes.py check).
- tests/test_p037_sidecar.py pins the schema enums against the producer's
vocabularies and the raw-fact boundary.
- scripts/p037_sidecar_inertness.py (CI dogfood step): for every census shape
and the samples tree, the emitted, stripped and contradictory sidecars yield
identical lowered/summaries/verdicts layers on both engines, python == rust,
and the control is non-vacuous (39 sidecars over 12 documents locally).
Known A2.1 boundary, owed by A2.2 (honest emission for every relevant call):
object-creation arguments (`new X(handle, leaveOpen: true)`) are not yet a
call fact; A2.1 covers invocation expressions.
Refs #304
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfeUtLRm6KFRWcTGQZxQQb
Four after-takes (MOS repo, MOS corpus, verdict/python, verdict/rust) at A2.1 treatment commit dce26ed, population held at terminal-green T (4a8e658), in the same preserved M1 measurement environment used for the T baseline. All four compare UNCHANGED against the R-recorded baseline: MOS repo facts_moved=1, MOS corpus facts_moved=36, both verdict engines report no verdict moved. Evidence-only: no instrument, treatment, spec, or CI file touched; built directly on A, not rebased onto R. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011wKL9pEApQTK4dE3eXv8g8
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Repository: PhysShell/Own.NET/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PhysShell
added a commit
that referenced
this pull request
Sep 19, 2026
Supersedes 2cbd6c6 (PR #362), whose source_commit (dce26ed) had the call-relevance bug fixed by the parent commit. Four after-takes (MOS repo, MOS corpus, verdict/python, verdict/rust) at A2.1 treatment commit 5a0de07, population held at terminal-green T (4a8e658), in the same preserved M1 measurement environment used for the T baseline. All four compare UNCHANGED against the R-recorded baseline: MOS repo facts_moved=1, MOS corpus facts_moved=36 (both counts unchanged from the pre-fix run — the fix's edge cases do not appear in this population), both verdict engines report no verdict moved. Evidence-only: no instrument, treatment, spec, or CI file touched; built directly on A', not rebased. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011wKL9pEApQTK4dE3eXv8g8
Owner
Author
|
Superseded — independent review found a real contract bug in this PR's Fixed in Closing without merging. |
Merged
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dce26ed: the A2.1 treatment — the Roslyn extractor emits a validatedguarded-fact sidecar; the legacy body is unchanged and both consumption
doors ignore it (demonstrably inert).
2cbd6c6: evidence-only commit recording the M1 after-run comparisonagainst the T-baseline (R, already in
mainvia P-037 A2.0: evidence harness hardening + terminal-green baseline (T, R) #361). Same preservedmeasurement environment, same pinned toolchain, population held at T.
Test plan (all done pre-merge on this VPS)
UNCHANGED,facts_moved=1,python_mos_moved=0,rust_mos_moved=0UNCHANGED,facts_moved=36,python_mos_moved=0,rust_mos_moved=0UNCHANGED, no verdict moved (137 files)UNCHANGED, no verdict moved (137 files);own-cliqualified sha == executed sha,
post_run_intact=true2cbd6c6): 30/30 checksdiff main..Scollapses to exactly the two commits aboveKnown pre-existing observation (not fixed here, tracked in the evidence
manifest):
scope_cache_sites[].filecarries an absolute path rather thanrepo-relative — present since T, does not affect measured MOS/verdict
surface, out of scope for this evidence-only PR.
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_011wKL9pEApQTK4dE3eXv8g8
🤖 Generated with Claude Code