chore(rivet): flip RQ-62-TABLEDANGLE to implemented — the hole was worse than the artifact predicted - #1140
Merged
Merged
Conversation
…rse than the artifact predicted #1138 closed the #1102 residual. Flipping with the evidence, because the finding is sharper than the artifact anticipated and should not live only in a PR body. THE HOLE WAS A DIFFERENT AND WORSE FAILURE MODE. #1102's form was an object that could not LINK. This one LINKS CLEAN: ARM Thumb-2 and A32 --relocatable, exit 0, object written, `UNDEF symbols: NONE`, `arm-none-eabi-ld` links it without complaint — because the declined function's code AND symbol are in NO OBJECT AT ALL. The dispatch table gets a slot no embedder can populate, and the call executes whatever that region holds. #1102 was at least loud at link time; this was silent all the way to execution. Reproduced independently on pre-fix main before merging, reading the symtab by SHT_SYMTAB TYPE (the ARM builder names its symtab with an EMPTY name, so a name-based read wrongly reports "no symtab"). THE DYNAMIC INDEX IS LOAD-BEARING, which is why this survived: with `i32.const 0` the ARM relocatable path devirtualizes the dispatch into a direct call and the table never materializes, so a constant-index fixture finds nothing. Suspicion held for exactly 2 of 5 paths, reported per backend rather than generalised — the failure this artifact exists to prevent is precisely the #1102 history of fixing aarch64 (#1013) and leaving RV32 live for a release because nobody checked the others. The RV32 leg is pinned BIDIRECTIONALLY, so if RV32 ever gains `call_indirect` the test goes red and forces the table question to be re-answered rather than inherited. Sweep control: all 171 repro fixtures compiled under the exact arm_corpus_sweep_973 leg, 0 hit the new gate, EXPECTED_DECLINES untouched. Verified on merged main: both previously-silent paths exit 1, write no object, and name the dead slot precisely ("slot 1 -> function 1"). NOTE ON THIS COMMIT: my first attempt added a SECOND `landed:` key beside the lane's, and `status_evidence_check` refused it — "duplicate-key defect in a release file (#1059)". That is #1059's own rule firing on the coordinator, which is the intended direction. Merged into one field rather than silenced. Refs #1102 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
avrabe
added a commit
that referenced
this pull request
Sep 3, 2026
…an discarding it My duplicate-key fix picked a winner by LINE LENGTH, which is arbitrary and dropped the fact that mattered — that the artifact closed on the integrator's confirmation rather than on our assessment. The lane's field described the delivery; mine described the closure basis. Both belong, so they are merged instead of one being chosen. The same heuristic ran on RQ-62-TABLEDANGLE (in PR #1140, unmerged) — checked, and there it kept the richer field, so no loss. Recorded because 'resolve a duplicate by keeping the longer string' is a bad rule that happened to work once and not twice. Refs #1131
avrabe
added a commit
that referenced
this pull request
Sep 4, 2026
…and add the sentence they asked for (#1141) * chore(rivet): close RQ-62-EMBEDDER on the integrator's confirmation, and add the sentence they asked for jess confirmed on #1131 that the contract unblocks the RT1176 cascade: "The document is sufficient. I audited jess's existing harness against it line by line and found no ambiguity I had to resolve by guessing." The artifact was held open after the code landed precisely so this clause closed on THEIR assessment rather than ours. THE DOCUMENT CAUGHT TWO LATENT DEFECTS IN A CONSUMER THAT WAS ALREADY GREEN: 1. They had read R11 out of synth's self-contained reset handler and treated it as authoritative — the exact method category (c) disclaims. That image carries TWO linear-memory bases (OPTIMIZED_LINMEM_BASE = 0x2000_0100, 0x100 above the handler's R11). A 1-in-2 guess, won. 2. Their C shim happened to compile to a bare `b.w` tail-branch, so GCC never allocated R11 as a frame pointer — conformance "by optimisation outcome, not by conformance". One more local variable and it would have silently produced a wrong linear-memory base on a flight control loop. Both now fixed on their side with -ffixed-r9/r10/r11 plus an assertion over EMITTED code rather than over the flag. CATEGORY (c) EXTENDED AT THEIR REQUEST with the sentence they say they would most have wanted three days earlier: A WORKING RESULT DOES NOT VERIFY THE METHOD THAT PRODUCED IT. Their harness matched a SIL reference bit-exact, which felt like confirmation and was not — it only meant the reading was not DETECTABLY wrong on that input. Also recorded honestly in verified-by: two of my three potency attempts on the audit gate were INVALID (one failed environmentally in both control and mutation, discriminating nothing; the other mutated a fact the doc explicitly disclaims). Only the third was a real test. RESIDUAL, now jess's top-priority ask on #1132: prose is not a gate for the EMBEDDER's side. They were wrong-but-green in two independent places and found it only by reading the doc afterwards. A mechanical check is tracked separately. (This commit's first attempt added a SECOND `landed:` key and status_evidence_check refused it — #1059's rule firing on the coordinator for the second time today. Merged rather than silenced.) Refs #1131 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(rivet): merge the closure fact into EMBEDDER's landed rather than discarding it My duplicate-key fix picked a winner by LINE LENGTH, which is arbitrary and dropped the fact that mattered — that the artifact closed on the integrator's confirmation rather than on our assessment. The lane's field described the delivery; mine described the closure basis. Both belong, so they are merged instead of one being chosen. The same heuristic ran on RQ-62-TABLEDANGLE (in PR #1140, unmerged) — checked, and there it kept the richer field, so no loss. Recorded because 'resolve a duplicate by keeping the longer string' is a bad rule that happened to work once and not twice. Refs #1131 --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Sep 4, 2026
…ommit exactly as designed (#1147) Merging #1144 turned main red on R10: FAIL R10: delivery-shaped commit in the release window is attributable to NO release artifact: 'fix(ci): authenticate the federated externals sync ...' — no known artifact id or issue number in the subject, and no artifact's `landed:`/`verified-by:` names its PR (#1119: work landed, every artifact silent). That rule shipped ten commits ago in #1124, and this is the first time it has fired on real work. It fired on MINE, which is the right direction: I merged a CI fix with no artifact, and the gate refused to let the release plan stay silent about it. Fixed by creating the artifact, not by exempting the commit. RQ-62-FEDAUTH records the finding, which is worth more than the fix: THE ERROR MESSAGE ACTIVELY MISLEADS. "could not read Username for https://github.com" reads as a permissions failure. All seven siblings are PUBLIC, so an anonymous clone needs no credentials — git only prompts AFTER the transport refuses, and a throttled anonymous response on a tty-less runner surfaces as "No such device or address". The cause is a rate limiter on unauthenticated traffic, hardest from datacenter address space, which is where the self-hosted fleet lives. THE PASSES DO NOT PROVE THE FIX, recorded so nobody later claims they did. #1141 and #1142 passed WITHOUT it at 21:25; #1140 failed without it at 06:14; #1144 passed with it at 21:29. Every failure sits in one contiguous window and everything outside succeeds — the limiter eased on its own. The fix is still right for a reason those passes do not show: it removes the dependence on which side of a window a run lands. AN INTERMITTENT LIMITER IS WORSE FOR SIGNAL THAN A PERMANENT ONE. A job that flaps teaches maintainers to stop reading it — which is precisely what happened: I described this job's failure from memory twice in the org-wide review and was wrong both times. What the job got right and keeps: advisory so nothing was blocked, and it FAILS CLOSED — the non-vacuity guard was skipped rather than passing vacuously, the #1012 lesson working as designed. ARTIFACT_FLOOR re-derived at 519 with `rivet list`. Refs #1143, #1119, #1062 Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#1138 closed the #1102 residual. Flipping with the evidence, because the finding is sharper than the artifact anticipated.
The hole was a different and worse failure mode
#1102's form was an object that could not link. This one links clean:
So the dispatch table gets a slot no embedder can populate, and the call executes whatever that region holds. #1102 was at least loud at link time; this was silent all the way to execution. Reproduced independently on pre-fix main before merging, reading the symtab by
SHT_SYMTABtype (the ARM builder names its symtab with an empty name, so a name-based read wrongly reports "no symtab").The dynamic index is load-bearing
With
i32.const 0, the ARM relocatable path devirtualizes the dispatch into a direct call and the table never materializes — a constant-index fixture finds nothing. That is why this survived #1104.Reported per backend, not generalised
--relocatable--cortex-mself-containedcall_indirectdeclines upstreamThe failure this artifact exists to prevent is exactly #1102's own history: fixed on aarch64 (#1013), left live on RV32 for a release, because nobody checked the others.
Two things worth noting
The gate keys on
funcref_region_slots+ the op stream, so #1116's index-label completeness claim is neither reused nor extended — an extension would have needed its own compile-and-read verification.The RV32 leg is pinned bidirectionally: if RV32 ever gains
call_indirect, the test goes red and forces the table question to be re-answered rather than inherited.Sweep control: all 171 repro fixtures compiled under the exact corpus leg, 0 hit the new gate,
EXPECTED_DECLINESuntouched.On this commit
My first attempt added a second
landed:key beside the lane's, andstatus_evidence_checkrefused it — "duplicate-key defect in a release file (#1059)". That is #1059's own rule firing on the coordinator, which is the intended direction. Merged into one field rather than silenced.Refs #1102