Self-hosting phase 4: the oracle split, the floor and view waves, and the honest 05 stay

[darko-mijic]

What this is

Phase 3 closed with three debts on the record, and this phase pays them in the order plan 20 prescribed. First, the golden corpus oracle — 3,888 lines in a single it() — was split so the first failure no longer masks every other law. Second, the two surfaces that each independently named the same six contract-dependent test files (the lint exemption and the test wrapper's preflight) now read from one shared module, so the clean-clone lint surprise of phase 3 cannot recur. Third, the biggest recorded corpus gaps — laws the engine already implements but no Spec carried — got their carrying Specs: the readiness floor's own clause tables, and the projection layer's view rules.

On that base, readiness matured from 51 ready / 36 defined to 71 ready / 37 defined with zero decorative promotions, and docs/concept/05 — the doc those gaps held in place — was re-audited for deletion and stays, two clauses short. That verdict is the audit working, not failing: the re-audit closed all three of its recorded phase-3 gaps and then surfaced two new ones (a per-team severity override and a team-overridable floor config, both designed-for deferrals stated nowhere else), and refused to stretch them into carried — the exact mis-grading the phase-3 review caught twice.

The phase ran as six sessions on plan 21 (plans/21-self-hosting-phase-4.md, now ✅ EXECUTED): five planned sessions, each closing on a fully green twelve-leg npm run check, plus a sixth remediation wave executing the owner's pre-PR review verdict on the branch. It was closed by an archived adversarial review (reviews/09 was phase 3's; this phase's is reviews/10) whose central method was again mutation testing with an independently designed mutation set — not a replay of the waves' own probes.

What landed

The golden oracle is split — 21 it()s over one hoisted extraction, zero assertion loss. test/self-hosting-graph.test.ts went from one 3,888-line it() to one it() per law, all sharing a single corpus extraction. The frozen expectations moved to ten authored transcription modules under test/self-hosting-oracle/ — one file per Spec family — so a conversion wave now touches one family file, never the monolith. The reconciliation is exact and was independently recomputed at review: 27 expect sites became 32 (the additions are length cross-checks and a "no Spec outside the families" law), and across all of test/ the count went 1313 → 1342 with every per-file delta non-negative. The count literals and the readiness histogram stay explicit, and the length cross-checks measure the authored arrays against those same literals — so the oracle cannot certify itself by moving both sides of a comparison at once. The corpus-test-granularity docket row, which had rolled forward since review-08, closes DONE.

One source of truth for the contract-dependent suites. contract-dependent-suites.mjs states the per-tree dependency rows once; vitest-test.mjs reads them to refuse fast when a generated tree is missing, and eslint.config.js derives its clean-room exemption list from the root row. When the phase's new bound suite arrived, it entered through one edit and both surfaces followed — and the review re-ran the negative control: remove the row and lint fails with exactly five no-unsafe-argument errors while the wrapper stops refusing fast. The coupling is load-bearing on both sides, proved rather than asserted.

The readiness floor now states its own law. spec:validation.readiness-floor was enriched from a one-sentence deferral into all four rungs in authored words — five idea clauses, three scoped, two defined, three ready, with cumulative evaluation stated explicitly — and the new spec:validation.kind-evidence carries the per-kind evidence table row for row, including the shared behavior/workflow/contract family, the contract row's named deferral, and the promoted-evidence honesty bound (an empty stub child is never evidence). The code table in src/validate/readiness-floor.ts remains the clause set's code-level source of truth; the Spec and the table are now one law read twice, and the Spec says so.

The projection laws the engine already implemented got carrying Specs. The derived-readiness banner (rendered beside the stated rung, raised only in the dishonest direction, naming the first unmet clause), the binding-language view rule (views render "Implementation binding / Verifier binding / Expected-outcome oracle / Runtime observation" — the internal delivery-fact names never render as text), the wholesale view rewrite (build to a temporary sibling, one atomic rename, no stale page survives; a failed run removes the view rather than leaving it readable-as-current), the one diagnostic rendering rule (location composed from the finding's structured fields, degrading cleanly by field, one diagnostic currency across the CLI and the Design Review), and validator self-testing.

Fifteen new bound points, every one mutation-probed red for the law it names. Five floor points, five view points, and five more from the remediation wave — including the one that took real design work: the wholesale-rewrite law is realized at two engine sites (the build's up-front invalidation and the view's temp-and-rename), and the original point survived deleting either site alone. The fix moved the world, not the engine: the example space now controls when the stale page is planted, so one point plants it late — after the invalidation has already run — and dies only when the swap itself is deleted, while its sibling isolates the invalidation. Each realizing site now has a point that goes red when that site alone is broken. The corpus holds 44 bound points across seven bound suites.

Readiness matured only where a verifier honestly landed — and the sweep refused 37 times. Every new rule Spec promoted to ready carries a resolving verifier landed in the same change. The S4 sweep then dispositioned all 37 then-defined Specs per-Spec with zero promotions: every one of them clears the ready floor structurally, and not one carries has-verifier, so any promotion would have manufactured the exact honesty/gaps warning the promotion law forbids. No verifier was invented to unlock one. One refusal deserves its own line: spec:validation.validator-self-testing stays defined because its only mechanical verifier would read the test corpus for should-fail/should-pass pairs — policing the delivery process, which checks never do.

A three-phase-old false record was caught and corrected. The review's one major finding was not a verifier defect: the frozen GWT then key had been written indirectly (["t","hen"].join("")) at 66 sites. Review-06 had called that out; the phase-1 remediation fixed it; a same-cluster commit silently reintroduced it nine hours later; and two later plans then recorded the fix as verified-intact — false when written. Nothing in the toolchain requires the indirection (no lint rule, no gate leg, no scanner reads test files for GWT shapes). Every occurrence is now the plain key, the product site carries a one-line constraint comment, bracketed errata sit beside the false claims in the historical plans (nothing rewritten), and AGENTS.md gained the discipline the episode teaches: a "verified" row is re-measured against the tree, never inherited from the prior row.

The reviews, closed on the branch

Two layers of review closed before this PR.

The archived adversarial review (reviews/10-self-hosting-phase-4-pre-close-review.md) ran 22 independently designed mutations. All ten then-existing points went red for the law they name; 17 of 18 point-directed mutations killed exactly one point, and the 18th killed exactly the two whose Spec text shares a clause. The oracle split held under corruption: a wrong descriptor reddens exactly its family's it(); a deleted entry is caught by the length cross-checks. Ten findings, all terminal — one major (the then key), one minor fixed by enrichment (the gap-signal's recomputed-facts clause now lives on spec:validation.warn-level-signals instead of resting on validator source), two ledger rows sharpened from measurement, two record slips corrected, one declined with a reason, one carried to the docket.

The owner's pre-PR review graded the branch sound to open, with a fix list. The remediation wave (S6) executed it: the under-bound wholesale-rewrite law got its teeth (three new points isolating the swap, the invalidation, and the failed-run removal), the pack-member table half of the binding-language rule is bound (the label-shorthand mutation on the pack table now dies while the index point stays green), the Design Review diagnostic twin is bound (em-dash cell, pipe escaping, and location composition all mutation-probed), the dead RenderedFinding shape is deleted after re-measuring that it truly has no producer, and the records items (errata, discipline line, the 07 §6 ④ four-line quote) landed. One line was refused honestly: the --check-clean double-render refusal stays unbound, because divergence is not honestly inducible in a world — the renderer is deterministic by its own Spec, and a world that supplies a lying renderer asserts nothing about the engine. The refusal and its reason are in the conversion ledger.

Verification

• npm run check green on the full twelve-leg chain at every blessed commit across all six sessions, and again on a fresh git clone --no-local → npm ci → full chain at the close tip, reproducing identical numbers.
• The self-hosting graph at close: 108 Specs · 1 Pack · 80 anchors → 189 nodes · 371 edges, 0 errors · 0 warnings. Kind mix: 44 example · 21 decision · 21 rule · 12 behavior · 8 model · 1 contract · 1 workflow · 1 constraint. --check-clean clean on both generated trees.
• Readiness: 71 ready / 37 defined (zero idea/scoped). All 71 ready Specs carry has-verifier in the graph; none of the 37 defined Specs does — which is the sweep's uniform, recorded refusal reason. Zero honesty/gaps warnings.
• The suite: 594 tests (540 in the parallel pool, 54 in the dedicated CLI process). No test file deleted, no residual case lost, no matcher loosened; the S1 reconciliation was verified at the diff level.
• The worked example at close: 11 specs · 1 pack · 5 anchors → 17 nodes · 32 edges, 0 errors · 1 warning — the frozen invalid-cart warning the tracer bullet exists to show.
• Both reviews are archived/recorded with every finding in a terminal disposition.

Three things that need your conscious yes

This phase ran autonomously — no live owner gate occurred during execution, and plan 21's gate ledger records that ratification happens here. Three items in particular:

1. 05 stays, two clauses short. Gaps 13 and 14 (the per-team severity override; the team-overridable floor config) are recorded precisely and were independently re-verified — a repository-wide sweep finds them named only in 05 itself and in the plan's audit rows. The next phase owns exactly two cheap carries: one clause on spec:validation.warn-level-signals, one on spec:validation.readiness-floor beside the MD-13 posture it already states. With those carried, 05 deletes in one session — the deletion-cost inventory in plan 21 §5a already lists every re-pointing it will cost, down to the two pinned quotes in check-carrier-truth.mjs.
2. The then-key normalization touches product code (one line in src/extract/markdown-body-owner-behavior.ts plus 65 test and oracle sites). It is byte-neutral at runtime and proven through the full gate and the clean clone — but it lands on a review finding rather than a plan ruling, and it reverses a shape that survived three phases. It survived them as a silent regression under a false verification, not as precedent; the errata now make that unmistakable in the historical record.
3. spec:validation.validator-self-testing ships at defined with no verifier, yet is graded carried by the 05 audit. The dissolution decision asks that a law be carried by a Spec, not that the Spec be ready — this is the first time the corpus leans on that reading. When someone later binds should-fail/should-pass evidence, the Spec promotes then; nobody should invent a meta-validator to force it earlier.

What remains for full self-hosting

1. Gaps 13 and 14, then the 05 deletion. Two narrow clauses on existing Specs (never new Specs — keep the dissolution cheap), then the one-session deletion the inventory already prices, including re-pointing the DECISIONS registry rows (MD-13, MD-9) and the CONTEXT.md section pointer at the carrying Specs.
2. The strongest promotion candidate is named. spec:consumers.design-review no longer refuses on the phase-3 tranche reason — the view wave built exactly that world. It stays defined on evidence: verifiers are direct and never transitive, so its children verify themselves, never their parent. It needs one point of its own.
3. Two honestly-unbound readings stay on the record: the --check-clean double-render refusal (divergence not honestly inducible) and the no-half-written-view concurrency reading (needs a concurrent reader mid-write). Both are stated in the conversion ledger with their reasons, not papered over.
4. The 06/07 gap tails stand, out of scope by design: the impact graph's two assist roles, bySymbol's frozen-shape status, the discipline ≈ kind/section mapping, the distribution chart, the per-PR hosted preview, the Mermaid and reference-projection surfaces, the two open questions, and measure-what-hurts. Six of the twelve phase-3 gaps closed this phase; each Spec authored against the tail is a step toward 06 and 07 dissolving on their own audits.
5. The readiness tail is honest, not lazy. The 37 defined Specs refused promotion for named reasons — the 21 decisions, the whole-pipeline worlds (the CLI pipeline, the reader over a full graph fixture, the clean-room rebuild that is the close's own proof), and the vocabulary parents whose executable path lives on children. They mature as the verification layer grows non-decorative verifiers for them.
6. The docket tail carries with reasons: the Markdown Pack syntax ruling, the gen-1 .feature adapter, the no-reparse read seam, temporal-guard token assembly, the editor-association gap, control-character latitude, and the separate example-id namespace — each row with its standing reason in plan 21 §4.

https://claude.ai/code/session_01SoBtqnPU6EQrd1tgrUdxcw

Greptile Summary

The PR expands and strengthens the repository’s self-hosting specification corpus and verification infrastructure.

• Splits the monolithic golden graph oracle into per-family expectation modules and independently reported laws.
• Centralizes generated-contract-dependent test suites for the Vitest preflight and ESLint configuration.
• Adds bound Specs and tests for readiness-floor evidence, projection behavior, diagnostic rendering, and wholesale view replacement.
• Normalizes the authored GWT then key and records corrections to historical verification claims.
• Updates plans, reviews, and concept documentation to reflect phase-4 outcomes and remaining gaps.

Confidence Score: 5/5

The PR appears safe to merge; no concrete changed-code defect was identified.

The shared suite registry covers the current generated-contract importers, and the split oracle preserves the existing checks while adding independent count, partition, and duplicate protections.

T-Rex Logs

What T-Rex did

• T-Rex executed the full gate of the general contract validation and observed an exit code of 1, blocked by an environment-generated .greptile-internal/security-findings.json.
• T-Rex then ran the narrow suite of checks, which exited with code 0 and reported validators 17/17, projections 10/10, and graph 21/21.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
contract-dependent-suites.mjs	Introduces a shared registry covering all current test suites that import either generated-contract tree.
eslint.config.js	Derives clean-room typed-lint exemptions from the shared root-contract suite registry without broadening them to unrelated tests.
vitest-test.mjs	Replaces the duplicated generated-contract dependency table with the shared registry while retaining existing filter and preflight behavior.
test/self-hosting-graph.test.ts	Splits the golden corpus verification into isolated laws over one read-only extraction while adding explicit length and family-exhaustiveness checks.
test/self-hosting-projections.test.ts	Adds bound projection worlds covering binding labels, atomic view replacement, failure cleanup, and diagnostic table rendering.
test/self-hosting-validators.test.ts	Expands bound validator coverage for readiness-floor and kind-evidence rules.
src/cli/output.ts	Removes an unused alternate finding shape and keeps formatting constrained to the canonical Finding contract.
src/extract/markdown-body-owner-behavior.ts	Replaces indirect GWT result-key construction with the direct frozen then property.

_{Reviews (1): Last reviewed commit: "docs(plans): record the clean-clone proo..." | Re-trigger Greptile}