gw#587: prove-produces-the-mint — self-mint captures the executor's real warmup; publish only after the proof passes

[PaulFidika]

Defect (live-found, byte-level forensics)

The 0.39.2 self-mint minted via compile_cache.mint_artifact -> _warm_call — the old PRODUCER single-stage synthetic warm loop — BEFORE the warmup proof ran. The resulting cell differed from the known-good forge cell in 20/490 FX graph keys (same kernels, xnumel=14080 vs 8160: broadcast vs per-token modulation — the gw#586 defect class resurfacing INSIDE the self-mint). The new warmup proof correctly caught it and failed closed (compile_cell_failed ... cache_hits=0, cache_misses=8); the worker refused to serve. Evidence: ~/cozy/samples/selfmint-proof/{selfmint,forge}-meta.json.

Fix: invert mint-then-prove into prove-produces-the-mint

The published artifact is now BYTE-DERIVED from the same execution the proof observed. There is no second code path that re-creates serving's execution — the parity treadmill (gw#586, gw#577, and this defect) is structurally closed on the fleet path.

• compile_cache.begin_fleet_mint(pipe, cfg, capture): latch inductor at a fresh capture dir + arm the declared targets cold (GUARDED). No synthetic warm call. The executor's real warmup — the endpoint's own serving code — performs the only compile the mint ever sees.
• compile_cache.finish_fleet_mint(...): pack the capture a PASSED proof populated. Called only from the proof loop.
• fleet_cells.enable_compiled MISS returns a PendingSelfMint: cell key/ref computed from static axes (cell_key.compute, the one brain — unchanged) so the th#910 self-attested fence ref is advertisable at arm time; digest empty until finalize.
• Executor warmup-proof loop: a pending mint's successful compiled call (calls>0) IS its proof — a fresh capture has nothing on disk to HIT against; requiring a hit would fail every honest self-mint by construction. Delivered (store-served) cells keep requiring real cache hits — their proof semantics are untouched. Proven pending mints are finalized (pack -> advertise real blake3 digest -> background publish); everything else is abandoned (never packed, never published) and mandatory lanes fail closed exactly as today. This also closes the publish-before-proof window.
• Same-key sibling pipes of one record share ONE capture (the union family cell — the qwen edit shape); a different key while a capture is pending declines loudly into the ordinary miss policy (one TORCHINDUCTOR_CACHE_DIR per process).
• Synthesized warmups (no custom warmup()) accept the cold-mint signature via cold_proof_ids.

Invariants held

• Never silent-eager: unproven mandatory-lane boots raise CompiledLaneUnavailable exactly as today.
• Store-served boot semantics identical (delivered cell -> digest receipt -> warmup proof -> serve).
• cell_key computation untouched; cell_selection_bug receipt untouched; PR gw#587: runtime assertion — store-served boot must pay ~0 compile time #338's STORE_SERVED_BOOT_COMPILED alarm stays delivered-only.
• cozy-local (local_cells) untouched — local-store mint, never the fleet publish route.

Tests (outcome-level, real Executor rig)

Revert-turns-red both directions:

• (a) test_pending_self_mint_boot_packs_and_publishes_only_the_proven_capture — publish strictly AFTER warmup; published tar bytes contain the graphs the warmup compiled; advertised digest == blake3 of the published bytes. Verified RED against a reverted proof loop, GREEN restored.
• (b) test_pending_self_mint_unproven_fails_closed_and_never_publishes — fail closed, zero publish (pytest.fail sentinel), capture discarded.

Plus test_fleet_cells.py rewritten to the two-phase flow (pending-without-pack, finalize-packs-proven-capture w/ published-bytes digest check, abandon-never-publishes, same-key sibling join, publish-refusal non-fatal). 90 targeted tests green; mypy 125 files clean; ruff clean.

Part of the gw#587 self-mint wave (th#910). Ships as gen-worker 0.39.3.

🤖 Generated with Claude Code