docs(x10r,D-002H): preregister ricci_flow-scoped canonical run#683
Conversation
D-002H opens a fresh pre-registered lineage after D-002G structural closure (PR #682 merge 8cf5364). D-002H is scoped to ricci_flow substrate only; block_structured + temporal_coupling are explicitly excluded per the closure finding that they are seed-deterministic by construction (research/systemic_risk/d002c_substrates.py:401). This PR is documentation-only: - D002H_PREREGISTRATION.yaml (locked at this merge commit) - D002H_SCOPE_RATIONALE.md (8 sections) - D002H_CLAIM_BOUNDARY.md (verbatim block) - D002H_CANONICAL_RUN_AUTHORIZATION_GATES.md (7 gates A..G) - artifacts/d002h/prereg/d002h_preregistration_lock.json (schema v1) - tests/systemic_risk/test_d002h_preregistration.py (12 tests) - D002G_CANONICAL_RUN_BLOCKERS.md (append-only lineage-transition note) Non-binding scope statement: D-002H does NOT amend D-002G, does NOT rescue D-002G, does NOT update D002C_CLAIM_LEDGER.yaml, does NOT authorise canonical run, does NOT modify any source code. D-002C ledger sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd verified byte-exact unchanged. Substrate code byte-exact unchanged. Canonical D-002H run requires the explicit conjunction A AND B AND C AND D AND E AND F AND G per D002H_CANONICAL_RUN_AUTHORIZATION_GATES.md. Each gate is a separate downstream artifact; THIS PR passes Gate A only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7eba41cde4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| included list is forbidden. | ||
| - **Any aggregated claim across substrate types.** The aggregate | ||
| estimator denominator drops from 3 substrates to 1; statistical | ||
| power loss is √3 ≈ 1.7× standard-error reduction for any aggregated |
There was a problem hiding this comment.
Fix direction of standard-error change in scope rationale
This sentence states that narrowing from 3 substrates to 1 yields a 1.7× standard-error reduction, but with fewer independent substrate rows the standard error scales in the opposite direction (it increases by about √3). Keeping it as written inverts the statistical implication of the scope change and can mislead later interpretation of power/uncertainty tradeoffs in this governance record.
Useful? React with 👍 / 👎.
…detect-secrets baseline CI fail on PR #683 secrets-supply-chain: 3 sha256 hex hits across - artifacts/d002h/prereg/d002h_preregistration_lock.json:6 (parent_merge_sha) - docs/governance/D002H_PREREGISTRATION.yaml:30 (parent_merge_sha) - tests/systemic_risk/test_d002h_preregistration.py:50 (D-002G closure sha pin) All three are content-anchors over D-002G structural closure merge commit 8cf5364 — NOT credentials. Same canonical fix as PRs #681 / #682: regenerate .github/detect-secrets.baseline to register the 3 new hits as known-false-positives. Baseline grows 95 → 98 tracked files (3 new file entries added). Local verification: detect-secrets-hook --baseline .github/detect-secrets.baseline \ artifacts/d002h/prereg/d002h_preregistration_lock.json \ docs/governance/D002H_PREREGISTRATION.yaml \ tests/systemic_risk/test_d002h_preregistration.py → exit 0 pytest tests/systemic_risk/test_d002h_preregistration.py → 12 passed No prereg edit. No code change. No test change. No governance touch. D002C ledger sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd unchanged. Substrate code unchanged. Mechanism code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… invariant naming The Gate B agent landed 10 tests covering the necessary invariants under my naming convention. The operator's contract requires 8 additional explicit test names so the per-rung invariant naming matches the brief verbatim (and so future audits can grep for the exact contract names). Added 8 tests with the contract names: - test_gate_b_scope_ricci_flow_only - test_gate_b_reverifies_m1 - test_gate_b_reverifies_m3 - test_gate_b_forbids_block_structured - test_gate_b_forbids_temporal_coupling - test_gate_b_does_not_authorize_canonical_run - test_gate_b_preserves_prereg_lock - test_gate_b_no_cross_substrate_claim Each new test asserts the contract invariant against the existing Gate B artifact (artifacts/d002h/eligibility/d002h_ricci_eligibility.json) or the Gate B report (docs/governance/D002H_GATE_B_REPORT.md). No artifact recomputation; no script change; no governance edit; no mechanism code touch. test_gate_b_preserves_prereg_lock pins the D-002H pre-registration sha256 at the PR #683 anchor (44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec) with inline # fmt: off + # noqa: E501 + # pragma: allowlist secret per the established pattern. test_gate_b_no_cross_substrate_claim scans the Gate B report for cross-substrate phrases outside denial context. Total Gate B tests now: 18 (10 prior + 8 contract aliases). All pass. Black + ruff format + ruff lint + mypy --strict clean. No change to artifact, script, or report. No mechanism / substrate / ledger / prereg touch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…etect-secrets baseline The 4be266d commit added user-contract test aliases including D002H_PREREG_SHA256 = "44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec" as an inline content-anchor over the D-002H pre-registration at the PR #683 merge. The inline `# pragma: allowlist secret` covers the literal, but detect-secrets-hook in baseline-validation mode also requires the baseline file to register the line. Same canonical fix as PR #681/#682/#683 baseline updates: regenerate .github/detect-secrets.baseline to include the new line as a known-false-positive. No code change. No test change. No governance touch. D002C ledger sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd unchanged. D-002H prereg sha unchanged. Mechanism + substrate code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…t codebase state Hook on CI was returning exit code 3 (baseline auto-mutated, commit required) because the pre-existing baseline's per-line entries were stale relative to the current branch's file states. The inline pragmas on the test file's two sha256 anchors (D002C_LEDGER_SHA256 + D002H_PREREG_SHA256) ARE respected by both `detect-secrets scan` and `detect-secrets-hook` — confirmed by exit-0 on both invocations post-regen. Canonical fix (same pattern as PR #683 ae3f8b3): regenerate baseline to reflect current codebase. The regen drops orphan entries for files whose hex strings no longer trigger on the current branch (105 → 101 files). The 4 dropped entries had no current matches; they are preserved in git history and will be re-added if the underlying files ever regress. Local verification: detect-secrets scan --baseline ... → regenerated detect-secrets-hook --baseline ... <changed-files> → exit 0 pytest tests/systemic_risk/test_d002h_gate_b_eligibility.py → 18 passed No code change. No test change. No governance touch. D002C ledger sha256 unchanged. D-002H prereg sha unchanged. Mechanism + substrate code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… artifact (#684) * docs(x10r,D-002H,gate-B): ricci_flow M1/M3 eligibility reverification artifact D-002H Gate B per D002H_CANONICAL_RUN_AUTHORIZATION_GATES.md §B: - run verify_m1_eligibility + verify_m3_eligibility on ricci_flow × {N=50,100,200} × λ ∈ {0.0, 0.05, 0.10, 0.20, 0.40, 1.0} (18 cells) - emit machine-readable verdict artifact at artifacts/d002h/eligibility/d002h_ricci_eligibility.json (schema v1) - 10-test scaffolding verifying schema + invariants + D002C ledger byte-exact unchanged - BLOCKERS.md append-only Gate B status section Reuses existing verifiers from research/systemic_risk/d002g_null_mechanisms.py (sha-pinned at the prior D-002G merge); no new mechanism, no new verdict literals, no new salt, no substrate/mechanism code edit. λ=0 cells emit N/A_M3_REQUIRES_LAMBDA_GT_ZERO per the M3 module's contract. M1 admissibility (no public verify_m1_eligibility symbol exists) is evaluated by invoking realize_null(strategy="M1_INDEPENDENT_SEED", ...) and translating its outcome (success / BitIdenticalNullError / unexpected) into ELIGIBLE_M1 / INELIGIBLE_M1_BIT_IDENTICAL / INDETERMINATE_M1_PROVENANCE_MISSING — no new verdict literal coined. Verdict: PASS (18/18 cells). At every λ>0 cell the M3 verifier returns ELIGIBLE_M3 with the marginal-match report inside the locked M3 tolerances; M1 returns ELIGIBLE_M1 on every cell including λ=0. Gate B PASS is necessary but NOT sufficient for canonical run authorisation. Conjunction A ∧ B ∧ C ∧ D ∧ E ∧ F ∧ G is the contract; this PR addresses Gate B alone. Gates C–G remain open. Canonical run remains BLOCKED. D002C ledger sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd verified byte-exact unchanged. D-002H prereg sha256 44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec verified byte-exact unchanged at PR #683 anchor. detect-secrets baseline updated to register 35 known-false-positive sha256 hex hits across the new artifact + compute-script. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(x10r,D-002H,gate-B): add user-contract test aliases for explicit invariant naming The Gate B agent landed 10 tests covering the necessary invariants under my naming convention. The operator's contract requires 8 additional explicit test names so the per-rung invariant naming matches the brief verbatim (and so future audits can grep for the exact contract names). Added 8 tests with the contract names: - test_gate_b_scope_ricci_flow_only - test_gate_b_reverifies_m1 - test_gate_b_reverifies_m3 - test_gate_b_forbids_block_structured - test_gate_b_forbids_temporal_coupling - test_gate_b_does_not_authorize_canonical_run - test_gate_b_preserves_prereg_lock - test_gate_b_no_cross_substrate_claim Each new test asserts the contract invariant against the existing Gate B artifact (artifacts/d002h/eligibility/d002h_ricci_eligibility.json) or the Gate B report (docs/governance/D002H_GATE_B_REPORT.md). No artifact recomputation; no script change; no governance edit; no mechanism code touch. test_gate_b_preserves_prereg_lock pins the D-002H pre-registration sha256 at the PR #683 anchor (44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec) with inline # fmt: off + # noqa: E501 + # pragma: allowlist secret per the established pattern. test_gate_b_no_cross_substrate_claim scans the Gate B report for cross-substrate phrases outside denial context. Total Gate B tests now: 18 (10 prior + 8 contract aliases). All pass. Black + ruff format + ruff lint + mypy --strict clean. No change to artifact, script, or report. No mechanism / substrate / ledger / prereg touch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(x10r,D-002H,gate-B): register new D002H_PREREG_SHA256 anchor in detect-secrets baseline The 4be266d commit added user-contract test aliases including D002H_PREREG_SHA256 = "44b18b5a40ce9d188a9c3bd49339621f81a65a15f97a683247902450dd54acec" as an inline content-anchor over the D-002H pre-registration at the PR #683 merge. The inline `# pragma: allowlist secret` covers the literal, but detect-secrets-hook in baseline-validation mode also requires the baseline file to register the line. Same canonical fix as PR #681/#682/#683 baseline updates: regenerate .github/detect-secrets.baseline to include the new line as a known-false-positive. No code change. No test change. No governance touch. D002C ledger sha256 f96ba9b5a2057d2e0bff84afc28578ab316cff73f6dc6673fb0d6d543b8bd6dd unchanged. D-002H prereg sha unchanged. Mechanism + substrate code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Revert "fix(x10r,D-002H,gate-B): register new D002H_PREREG_SHA256 anchor in detect-secrets baseline" This reverts commit b54a3ea. * fix(x10r,D-002H,gate-B): correct stale .bak filter reference in detect-secrets baseline Prior baseline regenerations left a stale reference to `.github/detect-secrets.baseline.bak` in the `filename:` field of the `is_baseline_file` filter (line 92). This caused the filter to NOT match the actual baseline path, leaving the new D002H_PREREG_SHA256 inline pragma in test_d002h_gate_b_eligibility.py unrecognised by the hook. Two-line fix: - filename: ".github/detect-secrets.baseline.bak" → ".github/detect-secrets.baseline" - generated_at: timestamp bump After this fix, detect-secrets-hook exits 0 on the test file without adding a new baseline entry — the inline `# pragma: allowlist secret` is now correctly recognised once the filter targets the real path. No baseline file count change (105 files preserved). No test change. No governance touch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(x10r,D-002H,gate-B): regenerate detect-secrets baseline to current codebase state Hook on CI was returning exit code 3 (baseline auto-mutated, commit required) because the pre-existing baseline's per-line entries were stale relative to the current branch's file states. The inline pragmas on the test file's two sha256 anchors (D002C_LEDGER_SHA256 + D002H_PREREG_SHA256) ARE respected by both `detect-secrets scan` and `detect-secrets-hook` — confirmed by exit-0 on both invocations post-regen. Canonical fix (same pattern as PR #683 ae3f8b3): regenerate baseline to reflect current codebase. The regen drops orphan entries for files whose hex strings no longer trigger on the current branch (105 → 101 files). The 4 dropped entries had no current matches; they are preserved in git history and will be re-added if the underlying files ever regress. Local verification: detect-secrets scan --baseline ... → regenerated detect-secrets-hook --baseline ... <changed-files> → exit 0 pytest tests/systemic_risk/test_d002h_gate_b_eligibility.py → 18 passed No code change. No test change. No governance touch. D002C ledger sha256 unchanged. D-002H prereg sha unchanged. Mechanism + substrate code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(x10r,D-002H,gate-B): fix required_python_symbols schema in commit acceptor CommitAcceptor pydantic schema expects required_python_symbols as a list of dotted-path STRINGS (e.g. "research.systemic_risk.module.symbol"), matching the format used by all prior D-002G acceptors (e.g. x10r-d002g-p3-constant-payload-null-recovery.yaml). The Gate B agent produced a list of object literals {module, symbol}, which trips 4 string_type validation errors in tests/governance/test_typed_models.py::test_canonical_acceptor_corpus_parses. Fix: flatten the 4 entries to dotted-path strings. No semantic change — the symbols and the modules they live in are unchanged; only the representation is corrected. Local verification: pytest tests/governance/test_typed_models.py::test_canonical_acceptor_corpus_parses → PASS No code change. No test change. No governance touch. No baseline change. D002C ledger sha unchanged. D-002H prereg sha unchanged. Mechanism + substrate code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Gate C of the locked 7-gate D-002H authorisation conjunction (A AND B AND C AND D AND E AND F AND G) closes here as a pure declaration: the canonical parameter grid is pinned, byte-equivalent to the ``canonical_grid`` block of the locked D-002H pre-registration (sha256 44b18b5a...0dd54acec, PR #683 anchor), as a content-addressed artifact at artifacts/d002h/canonical/d002h_canonical_grid.json under schema D002H-CANONICAL-GRID-v1. * substrates: [ricci_flow] (exclusions per prereg) * N: [50, 100, 200] * lambda: [0.0, 0.05, 0.10, 0.20, 0.40, 1.0] * total: 18 cells (3 N x 6 lambda) * n_seeds: 20 * n_bootstrap:16 * base_seed: 42 (matches Gate B base_seed) * null_seed_M3: 12345 Gate C does NOT authorise canonical run. It does NOT execute any sweep. It does NOT produce results. canonical_run_authorized stays false; downstream_gates_remaining == ["D","E","F","G"]. The 7-gate conjunction is the canonical-run authorisation contract; this PR addresses Gate C alone. Locked-file invariants preserved (byte-exact): * D-002H prereg sha256 unchanged at PR #683 anchor. * D-002C claim ledger sha256 unchanged at the canonical anchor. * substrate + null-mechanism module shas unchanged. * No edit to any prior gate artifact or report. * No new mechanism, no new verdict literal, no new salt. Files (5): * artifacts/d002h/canonical/d002h_canonical_grid.json (new, schema v1) * docs/governance/D002H_GATE_C_CANONICAL_GRID.md (new report) * tests/systemic_risk/test_d002h_gate_c_grid.py (10 invariant tests) * .claude/commit_acceptors/x10r-d002h-gate-c-canonical-grid.yaml * docs/governance/D002G_CANONICAL_RUN_BLOCKERS.md (append-only) Plus .github/detect-secrets.baseline regenerated to cover the new grid JSON + report hex anchors (governance hashes, not credentials). Quality gates (local, scoped): * pytest gate-C: 10/10 PASS * pytest typed_models: 12/12 PASS (acceptor parses Pydantic v2) * pytest d002h+d002g k-filter: all PASS * ruff format --check / ruff check: clean * black --check: clean * mypy --strict --follow-imports=silent: clean * detect-secrets-hook: exit 0 Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…baseline CI fail on PR #687 secrets-supply-chain: artifacts/d002h/locks/ d002h_locked_file_pins.json contains 16 content-anchor sha256 entries (one per locked file pinned at Gate D anchor 077073e). JSON does not support inline pragma comments — the agent's L2 application covered only the test file's 2 inline anchors, missing the JSON's 16. Same canonical fix as PRs #681/#682/#683/#684 baseline updates: regenerate .github/detect-secrets.baseline to register all 16 JSON hits as known-false-positives. Local verification: detect-secrets-hook --baseline ... d002h_locked_file_pins.json → exit 0 pytest tests/systemic_risk/test_d002h_gate_e_locked_files.py → 25 passed No code change. No test change. No governance touch. No prereg edit. No source code edit. All 16 pinned shas remain byte-exact at Gate D anchor: D002C ledger f96ba9b5...d6dd unchanged, D-002H prereg unchanged, substrate + mechanism code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(x10r,D-002H,gate-E): locked-ledger verification artifact Gate E of the 7-gate D-002H canonical-run authorisation conjunction (A AND B AND C AND D AND E AND F AND G). Pure declaration + byte-exact sha verification: emits a machine-readable artifact at artifacts/d002h/locks/d002h_locked_file_pins.json (schema D002H-GATE-E-v1) and a human-readable report at docs/governance/D002H_GATE_E_LOCKED_FILE_REPORT.md. The artifact pins 16 files at the Gate D merge anchor (077073e, PR #686): - 4 D-002C governance anchors (claim ledger + prereg + canonical-run report + null-audit falsification report). - 6 D-002G governance anchors (prereg + non-degenerate null design + acceptance rules + P3/M3 prereg + structural closure + negative space map). - 4 D-002H governance anchors (prereg + scope rationale + claim boundary + canonical-run authorisation gates doc). - 2 source-code modules (d002c_substrates.py + d002g_null_mechanisms.py). The test suite tests/systemic_risk/test_d002h_gate_e_locked_files.py (25 tests = 10 base contract tests + 15 parametrised pin cases over the 16 pinned files) recomputes sha256 from disk bytes for each pin and asserts byte-exact equality. Any single-byte mutation in any pinned file fails Gate E. Scope (per the operating law): - NO canonical run. NO sweep. NO results. - NO new mechanism. NO new verdict literal. - NO substrate / mechanism code edit. - NO D-002C ledger mutation (sha pinned at f96ba9b5...d6dd). - NO D-002H prereg edit (sha pinned at 44b18b5a...4acec). - NO claim "Gate E PASS -> canonical run authorised"; the 7-gate conjunction A AND B AND C AND D AND E AND F AND G is the contract. D-002G_CANONICAL_RUN_BLOCKERS.md gains an append-only "D-002H Gate E" section after the Gate D section. .github/detect-secrets.baseline: timestamp-only refresh (no new entries; the two inline hex anchors in the test file carry # pragma: allowlist secret per the Gate D acceptor's pattern). Gates A, B, C, D, E closed. Gates F, G remain open. Canonical run remains BLOCKED until A AND B AND C AND D AND E AND F AND G. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(x10r,D-002H,gate-E): register 16 JSON pin shas in detect-secrets baseline CI fail on PR #687 secrets-supply-chain: artifacts/d002h/locks/ d002h_locked_file_pins.json contains 16 content-anchor sha256 entries (one per locked file pinned at Gate D anchor 077073e). JSON does not support inline pragma comments — the agent's L2 application covered only the test file's 2 inline anchors, missing the JSON's 16. Same canonical fix as PRs #681/#682/#683/#684 baseline updates: regenerate .github/detect-secrets.baseline to register all 16 JSON hits as known-false-positives. Local verification: detect-secrets-hook --baseline ... d002h_locked_file_pins.json → exit 0 pytest tests/systemic_risk/test_d002h_gate_e_locked_files.py → 25 passed No code change. No test change. No governance touch. No prereg edit. No source code edit. All 16 pinned shas remain byte-exact at Gate D anchor: D002C ledger f96ba9b5...d6dd unchanged, D-002H prereg unchanged, substrate + mechanism code unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…OMPLETE (#689) D-002H Gate G TERMINAL closure of the 7-gate canonical-run authorisation conjunction (A ∧ B ∧ C ∧ D ∧ E ∧ F ∧ G all PASS). Phase 0 verification of prior gate CI: A #683 1b59ce5 — ALL_REQUIRED_PASS at merge B #684 b97daae — ALL_REQUIRED_PASS at merge C #685 a9d852d — ALL_REQUIRED_PASS at merge D #686 077073e — ALL_REQUIRED_PASS at merge E #687 e1d3ae3 — ALL_REQUIRED_PASS at merge F #688 0e598ff — ALL_REQUIRED_PASS at merge This PR emits the TERMINAL authorisation state: status: CANONICAL_RUN_AUTHORIZED canonical_run_authorized_final: true authorisation_scope: ricci_flow substrate only The canonical sweep itself is a SEPARATE downstream PR; Gate G does NOT execute the sweep. D-002C ledger byte-exact unchanged (f96ba9b5...d6dd). D-002H prereg byte-exact unchanged (44b18b5a...acec). No substrate / mechanism / governance source touch. Co-authored-by: Yaroslav Vasylenko <neuron7x@ukr.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Promise
D-002H opens a fresh pre-registered lineage scoped to
ricci_flowonly, following the D-002G structural closure (PR #682 merge8cf5364a). THIS PR is documentation-only and PASSES Gate A only of the 7-gate canonical-run authorisation conjunction.Lineage relationship to D-002G
D-002H is not an amendment of D-002G. D-002H is not a rescue of D-002G or D-002C. The 4 negative-result PRs (#677 / #679 / #680 / #681) plus the structural closure (#682) remain sha-pinned as the append-only canonical record. D-002H opens a fresh lineage that explicitly acknowledges substrate exclusion and locks a narrowed canonical grid.
origin/main):8cf5364a3f3b605d8b134bccbfe5170098e0e197docs/governance/D002G_STRUCTURAL_CLOSURE_REPORT.mddocs/governance/D002G_CANONICAL_RUN_BLOCKERS.md(append-only)Scope
substrate_scope.included[ricci_flow]substrate_scope.excluded[block_structured, temporal_coupling]null_mechanisms_allowed[M1_INDEPENDENT_SEED, M3_TOPOLOGY_CONDITIONED]canonical_grid.total_cellscanonical_run_authorizedfalserequires_explicit_authorization_artifacttruelineage_typefresh_preregistrationprereg_lock.edit_policyfresh_pre_registration_onlyExclusion root cause:
research/systemic_risk/d002c_substrates.py:401—BlockStructuredSubstrate.realize()discards seed by construction;TemporalKtSubstrate.realize()inherits via delegation at lines 481-483.Allowed claims
Forbidden claims (extract)
7 authorisation gates summary
artifacts/d002h/eligibility/d002h_ricci_eligibility.json(downstream).artifacts/d002h/canonical/d002h_canonical_grid.json(downstream).artifacts/d002h/authorization/d002h_canonical_run_authorisation.json(separate downstream PR).Conjunction: canonical run allowed iff A ∧ B ∧ C ∧ D ∧ E ∧ F ∧ G. THIS PR passes Gate A only. Gates B–G live in separate downstream artifacts.
Tests
tests/systemic_risk/test_d002h_preregistration.py(12 tests, all PASS locally):test_d002h_prereg_existstest_d002h_scope_is_ricci_flow_onlytest_d002h_excludes_block_structuredtest_d002h_excludes_temporal_couplingtest_d002h_forbids_cross_substrate_claimstest_d002h_forbids_d002g_rescue_claimtest_d002h_forbids_canonical_run_without_authorizationtest_d002h_preserves_d002c_ledger(pins D-002C ledger sha tof96ba9b5...d6dd)test_d002h_parent_closure_sha_pinnedtest_d002h_requires_fresh_lineagetest_d002h_claim_boundary_verbatim_presenttest_d002h_no_substrate_code_touch(pinsd002c_substrates.pysha to base-anchor4b2e5d65...0eca)Claim boundary (verbatim, from
D002H_CLAIM_BOUNDARY.md)Forbidden interpretations (from
D002H_CLAIM_BOUNDARY.md)Test plan
ruff format --checkclean on test fileruff checkclean on test fileblack --checkclean on test filemypy --strict --follow-imports=silentclean on test filef96ba9b5...d6dd🤖 Generated with Claude Code