fix: correct stale prose in the cascade oracle (it claimed 3 stages were missing) + add an image provenance pin - #188
Merged
Merged
Conversation
…ere missing) + add an image provenance pin SELF-VERIFY (overdue) came back 7/7 CONFIRMED, with claim 1 STRENGTHENED: the verifier rebuilt the fused cascade independently (0 skips, 5/5 T symbols), added a negative control jess had not run (the v0.59.0 RELEASE synth on the same input gives 3 skips, 0 T symbols), and established that THE COMMITTED IMAGE IS BIT-REPRODUCIBLE — a fresh pipeline build yields a byte-identical SHA256 from two independent builds. THE REAL INCONSISTENCY: the oracle's own header comment still described the previous 2-of-5 image — "loom 1.2.0 / synth 0.55 / 65,452 B" and, flatly false of the committed ELF, "iekf/position/attitude entry points are NOT in this image ... the single remaining upstream gate". The test cases were correct; only the prose lied. It mattered because THIS FILE IS THE EVIDENCE cited upstream for the 5/5 claim. The stale 214,696 instruction count also survived in the robot and one TEST-PIX-031 paragraph (correct: 213,439). Both corrected. STRUCTURAL GAP (the more valuable finding): CI runs the robot against the COMMITTED ELF and never rebuilds the meld->loom->synth chain — so CI gated EXECUTION but not PROVENANCE, and a hand-swapped image would have passed. Closed half of it with an IMAGE PROVENANCE PIN (SHA256 asserted in the robot, negative-controlled — a mutated digest fails). Honest scope stated in the file: the pin detects that the bytes changed, it does NOT prove the pipeline produced them. The full gate needs meld/loom/synth in the runner. Pinning is meaningful here precisely because the image was shown bit-reproducible; pinning an unreproducible blob would be theatre. Verified: oracle now 3/3 OK; provenance pin negative-controlled (mutated digest fails); rivet validate PASS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SELF-VERIFY (overdue — four features since the last, and two claims had gone upstream to synth#1069) came back 7/7 CONFIRMED, with claim 1 strengthened:
TsymbolsTsymbolsc692f50d…) from two independent buildsThe real inconsistency — stale prose in the evidence itself
The oracle's own header comment still described the previous 2-of-5 image:
loom 1.2.0/synth 0.55/65,452 B— actual: loom 1.4.1, source synth, 94,907 BThe test cases were correct and non-vacuous; only the prose lied. That mattered because this file is the evidence cited upstream for the 5/5 claim — anyone opening it to check would read a comment saying three stages were missing. The stale
214,696instruction count also survived in the robot and one TEST-PIX-031 paragraph (correct: 213,439). Both corrected.The more valuable finding — CI gated execution but not provenance
CI runs the robot against the committed ELF and never rebuilds the meld→loom→synth chain. So a hand-swapped or drifted image would have passed.
Closed half of it: an image provenance pin — SHA256 asserted in the robot, negative-controlled (a mutated digest fails). Honest scope, stated in the file: the pin detects that the committed bytes changed; it does not prove the pipeline produced them. The full gate needs meld/loom/synth in the runner and is follow-on work.
Pinning is meaningful here precisely because the image was shown bit-reproducible — pinning an unreproducible blob would be theatre.
Oracle now 3/3 OK.
rivet validate→ PASS.🤖 Generated with Claude Code