Skip to content

docs(x10r,D-002H): preregister ricci_flow-scoped canonical run#683

Merged
neuron7xLab merged 2 commits into
mainfrom
docs/x10r-d002h-ricci-flow-scope-prereg
May 13, 2026
Merged

docs(x10r,D-002H): preregister ricci_flow-scoped canonical run#683
neuron7xLab merged 2 commits into
mainfrom
docs/x10r-d002h-ricci-flow-scope-prereg

Conversation

@neuron7xLab
Copy link
Copy Markdown
Owner

Promise

D-002H opens a fresh pre-registered lineage scoped to ricci_flow only, following the D-002G structural closure (PR #682 merge 8cf5364a). THIS PR is documentation-only and PASSES Gate A only of the 7-gate canonical-run authorisation conjunction.

Lineage relationship to D-002G

D-002H is not an amendment of D-002G. D-002H is not a rescue of D-002G or D-002C. The 4 negative-result PRs (#677 / #679 / #680 / #681) plus the structural closure (#682) remain sha-pinned as the append-only canonical record. D-002H opens a fresh lineage that explicitly acknowledges substrate exclusion and locks a narrowed canonical grid.

  • Parent closure sha (verified ancestor of origin/main): 8cf5364a3f3b605d8b134bccbfe5170098e0e197
  • Parent closure artifact: docs/governance/D002G_STRUCTURAL_CLOSURE_REPORT.md
  • Lineage transition note: appended to docs/governance/D002G_CANONICAL_RUN_BLOCKERS.md (append-only)

Scope

field value
substrate_scope.included [ricci_flow]
substrate_scope.excluded [block_structured, temporal_coupling]
null_mechanisms_allowed [M1_INDEPENDENT_SEED, M3_TOPOLOGY_CONDITIONED]
canonical_grid.total_cells 18 (1 substrate × 3 N × 6 λ)
canonical_run_authorized false
requires_explicit_authorization_artifact true
lineage_type fresh_preregistration
prereg_lock.edit_policy fresh_pre_registration_only

Exclusion root cause: research/systemic_risk/d002c_substrates.py:401BlockStructuredSubstrate.realize() discards seed by construction; TemporalKtSubstrate.realize() inherits via delegation at lines 481-483.

Allowed claims

  • "ricci_flow-scoped null-admissibility under M1 and M3 mechanism families"
  • "ricci_flow-scoped canonical sweep result (after explicit authorisation artifact passes all 7 gates)"

Forbidden claims (extract)

  • "cross-substrate robustness"
  • "general topology robustness"
  • "D-002G rescue"
  • "D-002C rescue"
  • "global systemic-risk conclusion"
  • "scientific PASS before canonical run"
  • "M4 inside D-002G"
  • "block_structured remains in scope"
  • "temporal_coupling remains in scope"

7 authorisation gates summary

  • Gate A — D-002H prereg locked (passes at THIS PR's merge commit).
  • Gate B — ricci_flow M1/M3 eligibility reverified → artifacts/d002h/eligibility/d002h_ricci_eligibility.json (downstream).
  • Gate C — canonical parameter grid declared → artifacts/d002h/canonical/d002h_canonical_grid.json (downstream).
  • Gate D — forbidden-claim scan clean (downstream).
  • Gate E — D002C ledger sha byte-exact at locked anchor (downstream).
  • Gate F — explicit authorization artifact under artifacts/d002h/authorization/d002h_canonical_run_authorisation.json (separate downstream PR).
  • Gate G — CI terminal green on the authorisation PR (downstream).

Conjunction: canonical run allowed iff A ∧ B ∧ C ∧ D ∧ E ∧ F ∧ G. THIS PR passes Gate A only. Gates B–G live in separate downstream artifacts.

Tests

tests/systemic_risk/test_d002h_preregistration.py (12 tests, all PASS locally):

  • test_d002h_prereg_exists
  • test_d002h_scope_is_ricci_flow_only
  • test_d002h_excludes_block_structured
  • test_d002h_excludes_temporal_coupling
  • test_d002h_forbids_cross_substrate_claims
  • test_d002h_forbids_d002g_rescue_claim
  • test_d002h_forbids_canonical_run_without_authorization
  • test_d002h_preserves_d002c_ledger (pins D-002C ledger sha to f96ba9b5...d6dd)
  • test_d002h_parent_closure_sha_pinned
  • test_d002h_requires_fresh_lineage
  • test_d002h_claim_boundary_verbatim_present
  • test_d002h_no_substrate_code_touch (pins d002c_substrates.py sha to base-anchor 4b2e5d65...0eca)

Claim boundary (verbatim, from D002H_CLAIM_BOUNDARY.md)

D-002H is scoped to ricci_flow only. It does not claim cross-substrate robustness. It does not rescue D-002G. It does not update D-002C. It does not authorize canonical run until a separate authorization artifact passes all gates. Any result from D-002H is valid only inside the ricci_flow substrate boundary.

Forbidden interpretations (from D002H_CLAIM_BOUNDARY.md)

  • ❌ "D-002H proves D-002G's substrate grid was wrong" — D-002G's grid was pre-registered; closure recorded its structural impossibility on its own terms.
  • ❌ "D-002H result generalizes to block_structured or temporal_coupling" — explicitly excluded.
  • ❌ "D-002H closure of B1" — B1 was closed structurally on the original 3-substrate grid; D-002H operates on a new grid.
  • ❌ "D-002H rescues D-002C" — D-002C ledger is byte-exact unchanged.
  • ❌ "ricci_flow canonical run authorised by this PR" — this PR documents the 7 gates; the run itself requires a separate authorisation artifact passing all of them.

Test plan

  • 12 D-002H prereg tests pass locally
  • All prior d002g/d002h tests still pass (167 tests, no regressions)
  • ruff format --check clean on test file
  • ruff check clean on test file
  • black --check clean on test file
  • mypy --strict --follow-imports=silent clean on test file
  • D-002C ledger sha256 byte-exact at f96ba9b5...d6dd
  • Substrate code sha256 byte-exact at parent-closure base
  • Mechanism code sha256 byte-exact at parent-closure base
  • All locked governance files byte-exact unchanged

🤖 Generated with Claude Code

D-002H opens a fresh pre-registered lineage after D-002G structural
closure (PR #682 merge 8cf5364). D-002H is scoped to ricci_flow
substrate only; block_structured + temporal_coupling are explicitly
excluded per the closure finding that they are seed-deterministic by
construction (research/systemic_risk/d002c_substrates.py:401).

This PR is documentation-only:
- D002H_PREREGISTRATION.yaml (locked at this merge commit)
- D002H_SCOPE_RATIONALE.md (8 sections)
- D002H_CLAIM_BOUNDARY.md (verbatim block)
- D002H_CANONICAL_RUN_AUTHORIZATION_GATES.md (7 gates A..G)
- artifacts/d002h/prereg/d002h_preregistration_lock.json (schema v1)
- tests/systemic_risk/test_d002h_preregistration.py (12 tests)
- D002G_CANONICAL_RUN_BLOCKERS.md (append-only lineage-transition note)

Non-binding scope statement: D-002H does NOT amend D-002G, does NOT
rescue D-002G, does NOT update D002C_CLAIM_LEDGER.yaml, does NOT
authorise canonical run, does NOT modify any source code. D-002C
ledger sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd
verified byte-exact unchanged. Substrate code byte-exact unchanged.

Canonical D-002H run requires the explicit conjunction A AND B AND C
AND D AND E AND F AND G per D002H_CANONICAL_RUN_AUTHORIZATION_GATES.md.
Each gate is a separate downstream artifact; THIS PR passes Gate A
only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7eba41cde4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

included list is forbidden.
- **Any aggregated claim across substrate types.** The aggregate
estimator denominator drops from 3 substrates to 1; statistical
power loss is √3 ≈ 1.7× standard-error reduction for any aggregated
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Fix direction of standard-error change in scope rationale

This sentence states that narrowing from 3 substrates to 1 yields a 1.7× standard-error reduction, but with fewer independent substrate rows the standard error scales in the opposite direction (it increases by about √3). Keeping it as written inverts the statistical implication of the scope change and can mislead later interpretation of power/uncertainty tradeoffs in this governance record.

Useful? React with 👍 / 👎.

…detect-secrets baseline

CI fail on PR #683 secrets-supply-chain: 3 sha256 hex hits across
- artifacts/d002h/prereg/d002h_preregistration_lock.json:6 (parent_merge_sha)
- docs/governance/D002H_PREREGISTRATION.yaml:30 (parent_merge_sha)
- tests/systemic_risk/test_d002h_preregistration.py:50 (D-002G closure sha pin)

All three are content-anchors over D-002G structural closure merge commit
8cf5364 — NOT credentials.

Same canonical fix as PRs #681 / #682: regenerate
.github/detect-secrets.baseline to register the 3 new hits as
known-false-positives. Baseline grows 95 → 98 tracked files (3 new file
entries added).

Local verification:
  detect-secrets-hook --baseline .github/detect-secrets.baseline \
    artifacts/d002h/prereg/d002h_preregistration_lock.json \
    docs/governance/D002H_PREREGISTRATION.yaml \
    tests/systemic_risk/test_d002h_preregistration.py  → exit 0
  pytest tests/systemic_risk/test_d002h_preregistration.py  → 12 passed

No prereg edit. No code change. No test change. No governance touch.
D002C ledger sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd
unchanged. Substrate code unchanged. Mechanism code unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@neuron7xLab neuron7xLab merged commit 1b59ce5 into main May 13, 2026
15 checks passed
@neuron7xLab neuron7xLab deleted the docs/x10r-d002h-ricci-flow-scope-prereg branch May 13, 2026 10:42
neuron7xLab pushed a commit that referenced this pull request May 13, 2026
… invariant naming

The Gate B agent landed 10 tests covering the necessary invariants under
my naming convention. The operator's contract requires 8 additional
explicit test names so the per-rung invariant naming matches the brief
verbatim (and so future audits can grep for the exact contract names).

Added 8 tests with the contract names:
- test_gate_b_scope_ricci_flow_only
- test_gate_b_reverifies_m1
- test_gate_b_reverifies_m3
- test_gate_b_forbids_block_structured
- test_gate_b_forbids_temporal_coupling
- test_gate_b_does_not_authorize_canonical_run
- test_gate_b_preserves_prereg_lock
- test_gate_b_no_cross_substrate_claim

Each new test asserts the contract invariant against the existing Gate B
artifact (artifacts/d002h/eligibility/d002h_ricci_eligibility.json) or
the Gate B report (docs/governance/D002H_GATE_B_REPORT.md). No artifact
recomputation; no script change; no governance edit; no mechanism code
touch.

test_gate_b_preserves_prereg_lock pins the D-002H pre-registration
sha256 at the PR #683 anchor (44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec)
with inline # fmt: off + # noqa: E501 + # pragma: allowlist secret per
the established pattern. test_gate_b_no_cross_substrate_claim scans
the Gate B report for cross-substrate phrases outside denial context.

Total Gate B tests now: 18 (10 prior + 8 contract aliases). All pass.
Black + ruff format + ruff lint + mypy --strict clean.

No change to artifact, script, or report. No mechanism / substrate /
ledger / prereg touch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
neuron7xLab pushed a commit that referenced this pull request May 13, 2026
…etect-secrets baseline

The 4be266d commit added user-contract test aliases including
D002H_PREREG_SHA256 = "44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec"
as an inline content-anchor over the D-002H pre-registration at the PR
#683 merge. The inline `# pragma: allowlist secret` covers the literal,
but detect-secrets-hook in baseline-validation mode also requires the
baseline file to register the line.

Same canonical fix as PR #681/#682/#683 baseline updates: regenerate
.github/detect-secrets.baseline to include the new line as a
known-false-positive.

No code change. No test change. No governance touch. D002C ledger
sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd
unchanged. D-002H prereg sha unchanged. Mechanism + substrate code
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
neuron7xLab pushed a commit that referenced this pull request May 13, 2026
…t codebase state

Hook on CI was returning exit code 3 (baseline auto-mutated, commit
required) because the pre-existing baseline's per-line entries were
stale relative to the current branch's file states. The inline pragmas
on the test file's two sha256 anchors (D002C_LEDGER_SHA256 +
D002H_PREREG_SHA256) ARE respected by both `detect-secrets scan` and
`detect-secrets-hook` — confirmed by exit-0 on both invocations
post-regen.

Canonical fix (same pattern as PR #683 ae3f8b3): regenerate baseline
to reflect current codebase. The regen drops orphan entries for files
whose hex strings no longer trigger on the current branch (105 → 101
files). The 4 dropped entries had no current matches; they are
preserved in git history and will be re-added if the underlying files
ever regress.

Local verification:
  detect-secrets scan --baseline ... → regenerated
  detect-secrets-hook --baseline ... <changed-files> → exit 0
  pytest tests/systemic_risk/test_d002h_gate_b_eligibility.py → 18 passed

No code change. No test change. No governance touch. D002C ledger
sha256 unchanged. D-002H prereg sha unchanged. Mechanism + substrate
code unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
neuron7xLab added a commit that referenced this pull request May 13, 2026
… artifact (#684)

* docs(x10r,D-002H,gate-B): ricci_flow M1/M3 eligibility reverification artifact

D-002H Gate B per D002H_CANONICAL_RUN_AUTHORIZATION_GATES.md §B:
- run verify_m1_eligibility + verify_m3_eligibility on ricci_flow ×
  {N=50,100,200} × λ ∈ {0.0, 0.05, 0.10, 0.20, 0.40, 1.0} (18 cells)
- emit machine-readable verdict artifact at
  artifacts/d002h/eligibility/d002h_ricci_eligibility.json (schema v1)
- 10-test scaffolding verifying schema + invariants + D002C ledger
  byte-exact unchanged
- BLOCKERS.md append-only Gate B status section

Reuses existing verifiers from research/systemic_risk/d002g_null_mechanisms.py
(sha-pinned at the prior D-002G merge); no new mechanism, no new verdict
literals, no new salt, no substrate/mechanism code edit. λ=0 cells emit
N/A_M3_REQUIRES_LAMBDA_GT_ZERO per the M3 module's contract.

M1 admissibility (no public verify_m1_eligibility symbol exists) is
evaluated by invoking realize_null(strategy="M1_INDEPENDENT_SEED", ...)
and translating its outcome (success / BitIdenticalNullError /
unexpected) into ELIGIBLE_M1 / INELIGIBLE_M1_BIT_IDENTICAL /
INDETERMINATE_M1_PROVENANCE_MISSING — no new verdict literal coined.

Verdict: PASS (18/18 cells). At every λ>0 cell the M3 verifier returns
ELIGIBLE_M3 with the marginal-match report inside the locked M3
tolerances; M1 returns ELIGIBLE_M1 on every cell including λ=0.

Gate B PASS is necessary but NOT sufficient for canonical run
authorisation. Conjunction A ∧ B ∧ C ∧ D ∧ E ∧ F ∧ G is the contract;
this PR addresses Gate B alone. Gates C–G remain open. Canonical run
remains BLOCKED. D002C ledger sha256
f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd
verified byte-exact unchanged. D-002H prereg sha256
44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec
verified byte-exact unchanged at PR #683 anchor.

detect-secrets baseline updated to register 35 known-false-positive
sha256 hex hits across the new artifact + compute-script.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(x10r,D-002H,gate-B): add user-contract test aliases for explicit invariant naming

The Gate B agent landed 10 tests covering the necessary invariants under
my naming convention. The operator's contract requires 8 additional
explicit test names so the per-rung invariant naming matches the brief
verbatim (and so future audits can grep for the exact contract names).

Added 8 tests with the contract names:
- test_gate_b_scope_ricci_flow_only
- test_gate_b_reverifies_m1
- test_gate_b_reverifies_m3
- test_gate_b_forbids_block_structured
- test_gate_b_forbids_temporal_coupling
- test_gate_b_does_not_authorize_canonical_run
- test_gate_b_preserves_prereg_lock
- test_gate_b_no_cross_substrate_claim

Each new test asserts the contract invariant against the existing Gate B
artifact (artifacts/d002h/eligibility/d002h_ricci_eligibility.json) or
the Gate B report (docs/governance/D002H_GATE_B_REPORT.md). No artifact
recomputation; no script change; no governance edit; no mechanism code
touch.

test_gate_b_preserves_prereg_lock pins the D-002H pre-registration
sha256 at the PR #683 anchor (44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec)
with inline # fmt: off + # noqa: E501 + # pragma: allowlist secret per
the established pattern. test_gate_b_no_cross_substrate_claim scans
the Gate B report for cross-substrate phrases outside denial context.

Total Gate B tests now: 18 (10 prior + 8 contract aliases). All pass.
Black + ruff format + ruff lint + mypy --strict clean.

No change to artifact, script, or report. No mechanism / substrate /
ledger / prereg touch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(x10r,D-002H,gate-B): register new D002H_PREREG_SHA256 anchor in detect-secrets baseline

The 4be266d commit added user-contract test aliases including
D002H_PREREG_SHA256 = "44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec"
as an inline content-anchor over the D-002H pre-registration at the PR
#683 merge. The inline `# pragma: allowlist secret` covers the literal,
but detect-secrets-hook in baseline-validation mode also requires the
baseline file to register the line.

Same canonical fix as PR #681/#682/#683 baseline updates: regenerate
.github/detect-secrets.baseline to include the new line as a
known-false-positive.

No code change. No test change. No governance touch. D002C ledger
sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd
unchanged. D-002H prereg sha unchanged. Mechanism + substrate code
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Revert "fix(x10r,D-002H,gate-B): register new D002H_PREREG_SHA256 anchor in detect-secrets baseline"

This reverts commit b54a3ea.

* fix(x10r,D-002H,gate-B): correct stale .bak filter reference in detect-secrets baseline

Prior baseline regenerations left a stale reference to
`.github/detect-secrets.baseline.bak` in the `filename:` field of the
`is_baseline_file` filter (line 92). This caused the filter to NOT match
the actual baseline path, leaving the new D002H_PREREG_SHA256 inline
pragma in test_d002h_gate_b_eligibility.py unrecognised by the hook.

Two-line fix:
- filename: ".github/detect-secrets.baseline.bak" → ".github/detect-secrets.baseline"
- generated_at: timestamp bump

After this fix, detect-secrets-hook exits 0 on the test file without
adding a new baseline entry — the inline `# pragma: allowlist secret`
is now correctly recognised once the filter targets the real path.

No baseline file count change (105 files preserved). No test change.
No governance touch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(x10r,D-002H,gate-B): regenerate detect-secrets baseline to current codebase state

Hook on CI was returning exit code 3 (baseline auto-mutated, commit
required) because the pre-existing baseline's per-line entries were
stale relative to the current branch's file states. The inline pragmas
on the test file's two sha256 anchors (D002C_LEDGER_SHA256 +
D002H_PREREG_SHA256) ARE respected by both `detect-secrets scan` and
`detect-secrets-hook` — confirmed by exit-0 on both invocations
post-regen.

Canonical fix (same pattern as PR #683 ae3f8b3): regenerate baseline
to reflect current codebase. The regen drops orphan entries for files
whose hex strings no longer trigger on the current branch (105 → 101
files). The 4 dropped entries had no current matches; they are
preserved in git history and will be re-added if the underlying files
ever regress.

Local verification:
  detect-secrets scan --baseline ... → regenerated
  detect-secrets-hook --baseline ... <changed-files> → exit 0
  pytest tests/systemic_risk/test_d002h_gate_b_eligibility.py → 18 passed

No code change. No test change. No governance touch. D002C ledger
sha256 unchanged. D-002H prereg sha unchanged. Mechanism + substrate
code unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(x10r,D-002H,gate-B): fix required_python_symbols schema in commit acceptor

CommitAcceptor pydantic schema expects required_python_symbols as a
list of dotted-path STRINGS (e.g. "research.systemic_risk.module.symbol"),
matching the format used by all prior D-002G acceptors (e.g.
x10r-d002g-p3-constant-payload-null-recovery.yaml).

The Gate B agent produced a list of object literals {module, symbol},
which trips 4 string_type validation errors in
tests/governance/test_typed_models.py::test_canonical_acceptor_corpus_parses.

Fix: flatten the 4 entries to dotted-path strings. No semantic change —
the symbols and the modules they live in are unchanged; only the
representation is corrected.

Local verification:
  pytest tests/governance/test_typed_models.py::test_canonical_acceptor_corpus_parses → PASS

No code change. No test change. No governance touch. No baseline
change. D002C ledger sha unchanged. D-002H prereg sha unchanged.
Mechanism + substrate code unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
neuron7xLab added a commit that referenced this pull request May 13, 2026
Gate C of the locked 7-gate D-002H authorisation conjunction
(A AND B AND C AND D AND E AND F AND G) closes here as a pure
declaration: the canonical parameter grid is pinned, byte-equivalent
to the ``canonical_grid`` block of the locked D-002H pre-registration
(sha256 44b18b5a...0dd54acec, PR #683 anchor), as a content-addressed
artifact at artifacts/d002h/canonical/d002h_canonical_grid.json
under schema D002H-CANONICAL-GRID-v1.

* substrates: [ricci_flow]                  (exclusions per prereg)
* N:          [50, 100, 200]
* lambda:     [0.0, 0.05, 0.10, 0.20, 0.40, 1.0]
* total:      18 cells (3 N x 6 lambda)
* n_seeds:    20
* n_bootstrap:16
* base_seed:  42  (matches Gate B base_seed)
* null_seed_M3: 12345

Gate C does NOT authorise canonical run. It does NOT execute any
sweep. It does NOT produce results. canonical_run_authorized stays
false; downstream_gates_remaining == ["D","E","F","G"]. The 7-gate
conjunction is the canonical-run authorisation contract; this PR
addresses Gate C alone.

Locked-file invariants preserved (byte-exact):
* D-002H prereg sha256 unchanged at PR #683 anchor.
* D-002C claim ledger sha256 unchanged at the canonical anchor.
* substrate + null-mechanism module shas unchanged.
* No edit to any prior gate artifact or report.
* No new mechanism, no new verdict literal, no new salt.

Files (5):
* artifacts/d002h/canonical/d002h_canonical_grid.json   (new, schema v1)
* docs/governance/D002H_GATE_C_CANONICAL_GRID.md        (new report)
* tests/systemic_risk/test_d002h_gate_c_grid.py         (10 invariant tests)
* .claude/commit_acceptors/x10r-d002h-gate-c-canonical-grid.yaml
* docs/governance/D002G_CANONICAL_RUN_BLOCKERS.md       (append-only)

Plus .github/detect-secrets.baseline regenerated to cover the new
grid JSON + report hex anchors (governance hashes, not credentials).

Quality gates (local, scoped):
* pytest gate-C:       10/10 PASS
* pytest typed_models: 12/12 PASS (acceptor parses Pydantic v2)
* pytest d002h+d002g k-filter: all PASS
* ruff format --check / ruff check: clean
* black --check: clean
* mypy --strict --follow-imports=silent: clean
* detect-secrets-hook: exit 0

Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
neuron7xLab pushed a commit that referenced this pull request May 13, 2026
…baseline

CI fail on PR #687 secrets-supply-chain: artifacts/d002h/locks/
d002h_locked_file_pins.json contains 16 content-anchor sha256 entries
(one per locked file pinned at Gate D anchor 077073e). JSON does not
support inline pragma comments — the agent's L2 application covered
only the test file's 2 inline anchors, missing the JSON's 16.

Same canonical fix as PRs #681/#682/#683/#684 baseline updates:
regenerate .github/detect-secrets.baseline to register all 16 JSON hits
as known-false-positives.

Local verification:
  detect-secrets-hook --baseline ... d002h_locked_file_pins.json → exit 0
  pytest tests/systemic_risk/test_d002h_gate_e_locked_files.py → 25 passed

No code change. No test change. No governance touch. No prereg edit.
No source code edit. All 16 pinned shas remain byte-exact at Gate D
anchor: D002C ledger f96ba9b5...d6dd unchanged, D-002H prereg unchanged,
substrate + mechanism code unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
neuron7xLab added a commit that referenced this pull request May 13, 2026
* test(x10r,D-002H,gate-E): locked-ledger verification artifact

Gate E of the 7-gate D-002H canonical-run authorisation conjunction
(A AND B AND C AND D AND E AND F AND G). Pure declaration + byte-exact
sha verification: emits a machine-readable artifact at
artifacts/d002h/locks/d002h_locked_file_pins.json (schema
D002H-GATE-E-v1) and a human-readable report at
docs/governance/D002H_GATE_E_LOCKED_FILE_REPORT.md.

The artifact pins 16 files at the Gate D merge anchor
(077073e, PR #686):
  - 4 D-002C governance anchors (claim ledger + prereg + canonical-run
    report + null-audit falsification report).
  - 6 D-002G governance anchors (prereg + non-degenerate null design +
    acceptance rules + P3/M3 prereg + structural closure + negative
    space map).
  - 4 D-002H governance anchors (prereg + scope rationale + claim
    boundary + canonical-run authorisation gates doc).
  - 2 source-code modules (d002c_substrates.py + d002g_null_mechanisms.py).

The test suite tests/systemic_risk/test_d002h_gate_e_locked_files.py
(25 tests = 10 base contract tests + 15 parametrised pin cases over
the 16 pinned files) recomputes sha256 from disk bytes for each pin
and asserts byte-exact equality. Any single-byte mutation in any
pinned file fails Gate E.

Scope (per the operating law):
  - NO canonical run. NO sweep. NO results.
  - NO new mechanism. NO new verdict literal.
  - NO substrate / mechanism code edit.
  - NO D-002C ledger mutation (sha pinned at f96ba9b5...d6dd).
  - NO D-002H prereg edit (sha pinned at 44b18b5a...4acec).
  - NO claim "Gate E PASS -> canonical run authorised"; the 7-gate
    conjunction A AND B AND C AND D AND E AND F AND G is the contract.

D-002G_CANONICAL_RUN_BLOCKERS.md gains an append-only "D-002H Gate E"
section after the Gate D section. .github/detect-secrets.baseline:
timestamp-only refresh (no new entries; the two inline hex anchors in
the test file carry # pragma: allowlist secret per the Gate D
acceptor's pattern).

Gates A, B, C, D, E closed. Gates F, G remain open. Canonical run
remains BLOCKED until A AND B AND C AND D AND E AND F AND G.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(x10r,D-002H,gate-E): register 16 JSON pin shas in detect-secrets baseline

CI fail on PR #687 secrets-supply-chain: artifacts/d002h/locks/
d002h_locked_file_pins.json contains 16 content-anchor sha256 entries
(one per locked file pinned at Gate D anchor 077073e). JSON does not
support inline pragma comments — the agent's L2 application covered
only the test file's 2 inline anchors, missing the JSON's 16.

Same canonical fix as PRs #681/#682/#683/#684 baseline updates:
regenerate .github/detect-secrets.baseline to register all 16 JSON hits
as known-false-positives.

Local verification:
  detect-secrets-hook --baseline ... d002h_locked_file_pins.json → exit 0
  pytest tests/systemic_risk/test_d002h_gate_e_locked_files.py → 25 passed

No code change. No test change. No governance touch. No prereg edit.
No source code edit. All 16 pinned shas remain byte-exact at Gate D
anchor: D002C ledger f96ba9b5...d6dd unchanged, D-002H prereg unchanged,
substrate + mechanism code unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
neuron7xLab added a commit that referenced this pull request May 13, 2026
…OMPLETE (#689)

D-002H Gate G TERMINAL closure of the 7-gate canonical-run
authorisation conjunction (A ∧ B ∧ C ∧ D ∧ E ∧ F ∧ G all PASS).

Phase 0 verification of prior gate CI:
  A #683 1b59ce5 — ALL_REQUIRED_PASS at merge
  B #684 b97daae — ALL_REQUIRED_PASS at merge
  C #685 a9d852d — ALL_REQUIRED_PASS at merge
  D #686 077073e — ALL_REQUIRED_PASS at merge
  E #687 e1d3ae3 — ALL_REQUIRED_PASS at merge
  F #688 0e598ff — ALL_REQUIRED_PASS at merge

This PR emits the TERMINAL authorisation state:
  status: CANONICAL_RUN_AUTHORIZED
  canonical_run_authorized_final: true
  authorisation_scope: ricci_flow substrate only

The canonical sweep itself is a SEPARATE downstream PR; Gate G does
NOT execute the sweep. D-002C ledger byte-exact unchanged
(f96ba9b5...d6dd). D-002H prereg byte-exact unchanged
(44b18b5a...acec). No substrate / mechanism / governance source touch.

Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant