[codex] test one-hop witnessed STR-1 frontiers

[TheGreenCedar]

STR-1: one-hop witnessed structural frontiers

ETR-1 validly selected no frontier at eb968e4f68e8999ce575ba25bee9d1c13b56cfdf. Its evaluation is 545a7d2ba1731d32bda7a4f1daf346d11b81f32bbbb732a3bb91673fad11c982; independent reconstruction is 2fc235d14d3477b8c7985d0a5078f2e4ab2e4a1c56c668a2d79b7d198a3e51b3. Both remain immutable. This contract exercises the latest user-authorized, single structural alternative. No third retrieval architecture is authorized after a valid failure.

Fixed inputs and authority

Stack the benchmark-only child on ETR head eb968e4f68e8999ce575ba25bee9d1c13b56cfdf, tree 8109976c4b3bede4a2c02961b71594be2fa89760. PR #2126 and its worktree remain the ETR receipt/replay record; PR #2120 remains unchanged. Integration head at registration is cd062c70527013fec221312537ca1bda3bb64519; no STR implementation or existing issue/PR was found there or in issue/PR title searches.

• ETR preparation: 30b84d4d848f96bd4fe799f2e0f28b9114971da0e47bf98ebe54fe36242199fd
• Fragment vectors: 7f604b30b823066bd5b0ed71106d10577c28495abd270444bc8ad5b7a63cb70a
• ETR run: c14da697d03707c0096f5f2fd7a97bff2ab5b4a6f9326c4a9a03da2066d545f2
• ETR validation: dd15c5842b68857c8c684b680cf3d1e307cd4b1a874736441c594490723e7145
• Questions: 8e7219a59c973c02f8ea93120bb680da46a75b8272153986c76e55bfb73ca3b6
• Annotations: 52b0cc223292bc70f1e4fa3f52b67bf42a91e4d4b9ed997aa12c648c068e9ade
• Retained source-only oracle: db9abe6ce37ab5ddb7900049192e4712e359b5ad5587a9ca982c23796fd137ef
• Model: 666db8df27c88570cdc07adca28646260038b8ca65354911d57b936ebf56efaa
• Tokenizer: 7465b93c945b7a266481e6785aa13e505c625562c1c046c4b762bb4da4d46082
• Model contract: cb0e3c00290f1eb21ecdcd873521d03331069b1efa766fcd1e493e6d4299b4b7

All ETR fragment identities, exact source, row costs, metadata, repository commits and 72 wording rows are retained. Graph inputs are the existing immutable core publications named by each retained witness preparation in definition-repair-source-c9c935d8-v1. Their complete database, pointer, preparation and source bindings are frozen before any candidate output. No rebuilding or repairing parsers/collectors against this corpus. A mismatched graph/source binding invalidates execution; absence of indexed coverage is a measured gap.

One fixed intervention

Control is the complete frozen ETR unconditioned frontier, including each S/D/H/L pool, score ordering and execution receipt. It is not replaced by the broad fragment oracle.

Candidate reconstructs and authenticates the same BM25 top-16 S with natural underfill. Before request timing it pins the named immutable core and builds read-only node/occurrence/incident indexes from that complete publication. It retains all source-bound graph metadata, not a question-derived file subset. The frozen fragment vector index is already prepared.

For each original seed in its BM25 order:

1. Anchor at every indexed non-file node whose explicit source line span intersects that exact seed fragment, and at both effective endpoints of any eligible relationship whose occurrence intersects the seed. Missing spans remain missing. No names or kind-dependent prompt rules influence anchoring.
2. Discover the incoming and outgoing incident relationships of those original anchors, once. A successor never becomes a discovery root. Every accepted edge has explicit certainty = Certain, effective endpoints present in that core, and an indexed occurrence with a nonempty authenticated source range. The edge's own explicit file/line occurrence is acceptable line-addressed provenance; otherwise an edge-owned reference occurrence supplies the range. No inferred certainty, synthesized relationship, shortest path or recursion.
3. Map both endpoints' explicit source spans and the relationship occurrence to every intersecting exact frozen fragment. Preserve direction, edge ID, raw/effective endpoint IDs, occurrence, source digest and discovery root privately. Unknown/outside-universe endpoints and occurrences produce boundary gaps; never add source outside the retained universe or expand a fragment.
4. Deduplicate by fragment ID. Exclude every S member and all previously retained candidate successors. Rank eligible fragments by normalized dot product with one freshly encoded unchanged raw question, then fragment ID only. Retain at most eight per original seed, at most 128 total and 144 including S. No cutoff, root requirement, quotas, name bonuses or relation credit.
5. Authenticate all selected descriptor sources and record exact D/H/L. Every source row is independently selectable under the existing 16-row/16-KiB full projection. No source substitution or partial-atom credit.

Raw-question encoding uses the pinned production client and native completion/token evidence. Encode once per wording when seeds exist, with no truncation. The same encoded vector ranks all structural candidates in that wording. No host queries, source-conditioned query, graph-to-text document, new model, production packet, or selector call occurs.

Execution and timing

The real synthetic canary uses the graph export, native query encoder, structural runner, authoritative validator and source-only evaluator. It covers mixed line endings/UTF-8, more than eight candidates, multiple seeds with interleaving IDs, incoming/outgoing discovery, underfill, a second-hop trap, uncertain and unwitnessed edges, outside-universe endpoints, duplicated witnesses, cancellation and invalid inputs.

The supervisor binds clean commit/tree, binaries, graph inputs, method, preparation, native events, process configuration, terminal status and outputs independently before annotation access. The validator reconstructs graph/source mappings, query scores, exclusions and every pool. A rehashed self-description is not authority. Annotations remain unopened by this experiment until all 72 candidate outputs, frozen control joins and execution bindings pass validation. Any failed row invalidates the whole run; no selective aggregation.

Request timing encloses BM25, seed authentication, raw query tokenization/encoding, graph frontier construction, candidate scoring/mapping and remaining source authentication. It records exclusive intervals and unaccounted time. Graph/vector index preparation, output serialization, validation and oracle evaluation are separate. The control's previously validated timing remains labelled retained ETR timing; it is not a new balanced installed timing comparison. Candidate adoption requires measured absolute prepared-state p95 at most 1.25 seconds. A global 30-minute request-run deadline and cancellation yield invalid/not-evaluated, never partial quality.

Evaluation and terminal rule

Reuse the accepted exact source-only optimizer and reproduce its retained fixtures. Optimize each acceptable alternative separately over that arm's L only, charging exact row and complete metadata costs, at most sixteen rows and 16 KiB. No compulsory discovery roots, relation atoms or invented evidence.

Aggregate three phrasings within each case, then cases within each group/corpus. A newly gained atom counts for a case only in at least two phrasings; a control case is incomplete for that test only in at least two phrasings.

Structural sufficiency requires mean feasible source recall >=85%, every group >=70%, complete acceptable-set rate >=75%, and 100% source/address authentication. Material value requires >=10 percentage points improvement in recall or complete-set rate over the paired retained control, no regression in the other, no group loss beyond two points, and a new required atom in at least half of eligible incomplete cases. Quality is evaluated before latency. Only passing both quality gates and p95 <=1.25 seconds selects structural_frontier_selected. A valid quality failure is no_frontier_selected and stops this structural alternative and automatic packet program. A valid latency failure likewise cannot authorize selection; no new latency-repair allowance is created for STR-1.

Invalid execution permits only restoration of this frozen contract and a full rerun from zero. It cannot change questions, graph/parser coverage, representation, model, traversal, limits, thresholds or optimizer. One implementer and the existing independent verifier execute the complete hostile matrix and reconstruct the exact final result. No additional reviewers.

A pass authorizes preparation of a separate SEL-1 contract over the frozen pools only. It does not authorize selector implementation, public routing/schema/skill changes, new corpora, production integration, calibration, versioning or release. All prior stops and downstream product gates remain unchanged.

Refs #2116; Refs #2119; Refs #2125; Refs #2126.

[TheGreenCedar]

STR-1 preregistration clarification: occurrence edges are already the hop

Before any corpus graph export or candidate output, the synthetic second-hop test exposed an ambiguity in the initial implementation wording. A seed's indexed relationship occurrence must admit that relationship and its endpoints directly. Promoting the remote endpoint to another traversal root would spend a second hop.

The fixed rule is: original seed-overlapping node spans are roots; eligible relationships either touch those roots or have an occurrence overlapping the original seed. Their remote endpoints never become roots. Both incoming and outgoing remain eligible. The implementation and hostile test enforce this on the full eligible pool, not merely the eight selected rows.

This clarifies the already-authorized one-hop bound. No corpus output, annotation, or measured quality informed the correction. Every other preregistered input, policy and gate remains unchanged. This clarification and the original contract are both hashed in the method freeze.

[TheGreenCedar]

STR-1 execution correction, before any corpus output

The real synthetic canary exposed control-row reserialization. The independent verifier also found that method/input authority, canary execution, and prelaunch request identity needed independent bindings. These are one execution-boundary correction; retrieval, source representation, thresholds, and the one-hop contract are unchanged.

The retained graph input registry is now frozen at SHA-256 668c990ee29b25a4bab0cb03e048d70eebd8ffe3dd62317d69b2e58b912a2c9f (graph-inputs.json). It names the twelve original prepared publications, their core database bytes, and publication pointers. No parser changes or new graph builds on the visible corpus are permitted.

The runner will retain immutable control-row references, enforce the registered method and ETR inputs, authenticate this registry before launch, and compare query/document engine identities. The supervisor freezes argv and execution context before dispatch. Corpus execution requires reconstruction of the actual synthetic native pipeline, validator, evaluator, and focused hostile tests.

The first canary remains invalid/not-evaluated. No STR-1 corpus result or annotation evaluation exists. After focused checks, the corrected clean head receives a fresh canary and correction-only verification from the existing verifier before a corpus run.

[TheGreenCedar]

STR-1: no frontier selected

The authoritative evaluator returned no_frontier_selected and stop_automatic_packet_program at source 73dfbac19fd74a112c96abcc6172cc398cfdb39c, tree 028e26a16106771294cba462d55b313e26e821a2. Independent final reconstruction accepted that result at the exact clean head. Automatic packet work is stopped; no further model or implementation work is running.

Result

All 72 wording rows completed and passed validation. The 24 retained fragment-oracle fixtures reproduced. Paraphrases were aggregated within each of the 24 cases before corpus and group statistics.

Frozen mechanism	Feasible source recall	Complete acceptable source sets
Unconditioned semantic control	71.19%	40.28%
ETR-1 source-conditioned semantic retrieval	72.52%	41.67%
STR-1 one-hop witnessed structural retrieval	37.16%	18.06%
Required absolute gate	85%	75%

STR-1 group recall was 10.74% for cross-file relationships, 16.99% for debugging/impact/change, 52.78% for known locations, and 68.12% for unknown-name concepts. Every group missed the 70% floor. Relative to its frozen control, STR-1 lost 34.03 percentage points of recall and 22.22 points of complete-set rate. Only 3 of 13 eligible incomplete cases gained a required atom in at least two phrasings.

Both sufficiency and material-value gates failed. Latency was not evaluated for acceptance because quality failed first; no latency repair is authorized. These are answer-aware frontier feasibility scores, not actual packet accuracy or installed-agent success.

Decision and scope

The permitted structural alternative failed. Automatic packet work stops under the accepted plan. No SEL-1 contract, selector implementation, production migration, model change, parser repair against the corpus, fresh confirmation corpus, version bump, calibration, or release work follows.

This does not establish that the product thesis is impossible. It rejects the frozen semantic and structural mechanisms tested here. A frontier oracle still could not meet the accepted capability thresholds; it cannot authorize a working-packet claim.

PR #2126 remains the ETR-1 implementation and valid-failure record. PR #2128 remains a draft benchmark-only stacked child targeting codex/etr1-frontier. PR #2120 and earlier failure/stop receipts remain unchanged. Production routing, schemas, compiler, plugin guidance, graph behavior, model, and release version were not changed.

Execution corrections and verification

The real native canary exposed control-row floating-point reserialization. The correction retained original immutable row references and independently bound fixed inputs, native engine identities, canary execution, and prelaunch requests. A subsequent command-entry import cycle was reproduced, corrected across supervisor/validator/evaluator, and covered by a canary invoking the actual command entries. Unvalidated runs remain invalid/not-evaluated; none contributed quality metrics or partial query reuse.

Focused Rust benchmark tests passed 14/14 per binary on the unchanged native implementation; the final JavaScript suites passed 24/24. Generalization checks and whitespace checks passed. Canary-5 exercised actual preparation, native document encoding, paired control, retained graph indexing/export, structural retrieval, CLI validation/evaluation, underfill, overflow, empty seeds, and hostile contracts.

The sole independent verifier authenticated all twelve repositories and graphs, 10,369 fragments/vectors, 38,097 nodes, and 4,668 certain source-witnessed relations. It independently matched all 72 rows, 62,214 scores (zero numerical error), 1,152 seed steps, 580 successors, 1,732 pooled fragments, 144 arm optima, 24 case aggregates, timing equations, gates, and the terminal decision. All seventeen hostile mutations were rejected. Original source and evidence bytes/mtimes remained unchanged.

Immutable identities

Artifact	SHA-256
Source/configuration freeze	eb7f050da5840c07664655379458f29932b6ccebd803e91b0ff315f5b66a03e5
Native STR binary	e21be9b56276355c52bfb9ca81eb5aba884802db237233c4b90e8c57c81c4751
Method	0902f8f8f6771fce5c6addf09bbdef061fd3706be0da050c32baead80fb171fc
Retained graph input registry	668c990ee29b25a4bab0cb03e048d70eebd8ffe3dd62317d69b2e58b912a2c9f
Graph output	e00c089fcdab6be8f31f89cddc5c96b11799183ad9bfffac9b5aa1c2c6a630c1
Run output	b6a8b4cc7a394b96f7b45565f4849022640899bfaf7009c02d5950473b1e8ea0
Graph execution receipt	d482c281fc1ff48742d31c97eb09c2bff5a78ccd2fc42c9838f4b9db84ab6d92
Run execution receipt	8c6aef865fefce8610a469ea364497bc304712e65f48d60216311ec35722550f
Validation	271e2075e9b23199db77860ad94b5552d0f9b3da3c3710d9ac4f2fed45de71a8
Evaluation	5d83b8dfb078d574e35e03be558973b917793049db05172caccb0265447aef7c
Canary-5	21b687260aad9bdff58bc8247497ee6138c177ed282b8638043bb4f734ee2cb2
CLI-boundary independent verification	6c74b54d3dc51e3ef64aef3ce2c7fde24d2eacea8545ec3f5c81fa202dda93f7
Independent final reconstruction	23c05d4a044a9d506412bc8f2e8be48594d1cf8242b301779ed13c1064a42fef

Raw artifacts remain in the private external STR-1 evidence directory. No evidence or generated report was added to production source. This closes the authorized experiment at its stop condition, not the downstream 0.18 product or release obligations.

Closes #2127

Refs #2116, #2125, #2126, #2119, #2120