SLM-267 + SLM-296: bounded wiring-evidence slices (ProgramSpec sampling, teacher admission) - #893
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 15 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (16)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Tyler-R-Kendrick
changed the title
6 tasks
…ring evidence VSD2-02 asks for 10k/100k/1M-record ProgramSpec corpora comparing uniform against coverage-targeted sampling. The existing coverage-guided generator (SLM-5) samples from a fixed, exhaustible candidate grid, so those rungs are out of reach without a materially different generator. This scopes the issue to what the generator actually supports: a genuine uniform-random control arm (ProgramGenerator.generate_uniform, new), a deterministic (global_seed, shard_id, worker_id) sharding primitive, and an honest, reproducible measurement of the generator's own coverage-targeted-vs-uniform budget efficiency and state-space saturation point. - generate.py: refactor generate_one into _materialize + add generate_uniform (uniform-random candidate selection, no coverage bias) as a genuine control arm distinct from the existing greedy CoverageTracker.score() selection. - New harness (slm267_programspec_coverage_scaling.py) + CLI (generate_programspec_corpus.py) run both policies to a bounded budget, dedup by canonical-root fingerprint (in-memory), and report exhaustion point, unique roots, and programs-to-full-coverage per arm. - Fixture campaign (80 programs/shard x2 shards): coverage-targeted reaches full coverable-cell coverage in 19 programs vs uniform's 34-35; both exhaust the 3-component grid at 36 accepted (28 unique roots, 8 duplicate canonical roots via serialization collapse). - Disposition: inconclusive (wiring only) -- does not validate VSD-H7a/b/c, which require corpora/training several orders of magnitude larger than this fixture budget. Documented as explicit follow-up. Closes SLM-267. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg
AP-013 asks for >=500 accepted records from a capable separate-family teacher, filtered through G0-G10 + independent judgment + human audit, then a matched-budget fine-tune with grammar-on/off evaluation. This sandbox has no network access to a real teacher and no GPU -- SLM-266 already measured that even a local CPU teacher run is infeasible here (>=11 days extrapolated for 10k requests). Scoped down to a bounded wiring slice that exercises the two real safety mechanisms the acceptance criteria test: - generate.py's compiler-inverted ProgramSpec generator stands in as a deterministic offline candidate proposer (explicitly not a teacher), tagged source="teacher" (a verifier-stack weak source) so admitted rows structurally cap at Bronze tier regardless of gate passes -- "teacher self-judgment alone cannot assign Gold/Silver" is enforced by the real verify_record() tier rule, not asserted narratively. - check_family_independence() + a same-family "shadow judge" control: wiring independent_judge_passed=False for a same-family judge causes the real G11 gate to quarantine 10/10 sampled candidates; a different-family judge would pass. Locked-holdout decontamination excludes any candidate whose canonical root (SLM-171 diversity fingerprint) collides with a disjoint-seed holdout before counting yield (23/27 excluded in the fixture run, reflecting the generator's shared finite candidate grid already documented in SLM-267). Disposition: yield_limitation_no_real_teacher_available (wiring only) -- the >=500-record scale and grammar-on/off fine-tune comparison remain unaddressed in this sandbox and are documented as explicit follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg
Tyler-R-Kendrick
force-pushed
the
claude/inspiring-franklin-hns9t1
branch
from
July 25, 2026 14:41
ff75c10 to
85eeb94
Compare
3 tasks
Tyler-R-Kendrick
added a commit
that referenced
this pull request
Jul 27, 2026
…H3-11) (#906) * SLM-363: deterministic SemanticFrameV1 from canonical AST + structured schema (DSH2-02) Add SemanticFrameV1, CAP1SchemaV1, and derive_semantic_frame: entities, roles, relations, order, cardinality, closed-value alternatives, effects, and a required/optional/forbidden/unspecified fact partition, every fact carrying exact AST-path + schema-field provenance. Fail-closed throughout via UnsupportedSemanticFactError; no free-form/LLM-guessed fallback. Adds frame equivalence/conflict checks, an inverse frame-to-constraint path for candidate/ambiguity evaluation, and a proven one-fact counterfactual mutator. SLM-343 (the schema this issue references) has no merged code, so CAP1SchemaV1 derives from already-merged DslPack prop_order/backend slots instead of inventing a parallel schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-364: provenance-complete NL paraphrase provider + cache contract (DSH2-03) Add ParaphraseRequestV1/ResponseV1, a content-addressed cache key over exactly the reproducibility-determining fields (provider/model/prompt+ system digests/sampling/seed), a ParaphraseProvider protocol with a fully implemented deterministic offline provider plus a network-disabled API-key-shaped stub, and a quarantine-before-promotion store so a malformed/echoed/secret-leaking/rate-limited response can never reach a QuestionArtifactV1. build_prompt_payload sends only a schema+frame projection, excluding SemanticFrameV1.canonical_source (the literal DSL target text) and any label/split metadata. Stacked on the SLM-363 SemanticFrameV1 work this branch builds on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) - frame_paraphrases.py: four plan-declared styles (concise, descriptive, imperative, compositional) rendered from frame facts only — never from answer AST text; DSH2-03 provenance records per row; declared FrameLeakDetectorV1 rejects DSL production forms, marker surfaces, answer digests, and provenance fields; required-fact coverage and forbidden-fact absence enforced per row. - Offline deterministic fixture provider (DSH2-03 protocol); diversity metrics per frame/style/provider; exact + near-dup + repeated-template + cross-family dedup with rejected rows counted; accepted prompts linked to one canonical answer + equivalence set by fingerprint; grounding-floor stop rule drops leaking styles with a reason. - 29 new tests; slm365 component v1. * SLM-366: one-fact semantic counterfactuals + hard grounding contrasts (DSH2-06) - semantic_counterfactuals.py: typed one-fact mutations across six declared dimensions (role, order, cardinality, closed value, required child, relation) using only schema/grammar-licensed alternatives; one_fact_proof requires the declared dimension's diff non-empty and all others empty, distinct canonical fingerprints, both targets parse+validate+canonicalize, and inverse round-trip; two differing dimensions reject. - Prompts via the SLM-365 offline provider with matched style + length ratio control; marker surfaces permuted so surfaces are not a cue (prompts + proof byte-identical under permutation); embedding-close and inventory-matched topology negatives; constant/frequency baseline exactly 0.5; 11 coded rejections — uncontrolled pairs never counted. - Split family: counterfactual inherits source root family with a parent link; cross-family drift and cross-split reuse quarantined. - 44 new tests; slm366 component v1. * SLM-367: freeze two-pack generic CAP1 eval + schema-sensitivity suite (DSH2-07) - mini_pack.py + mini_flow.lark: complete test-only DslPack (lark authority, canonicalizer, static validator, CAP1SchemaV1 contract, SemanticFrameV1 provider, marker policy, fragment support); completeness_report + fail-closed require_complete_for_generic_claim; no OpenUI imports (AST-audited). - Cap1TwoPackSuiteV1: 41 rows, 2 packs x 2 base cases x 10 strata + excluded ambiguity row (original/empty/contradictory/reordered/ irrelevant schema, marker permutations, paraphrases, counterfactuals, ambiguity classes with accepted-set-or-exclusion recording, CAP0 identity retention); disjoint root families; sha256 rows + tamper-evident manifest + suite cards with full provenance; create-once freeze; fail-closed integrity. - score_schema_sensitivity (relevant must change, irrelevant invariant within tolerance); adjudicate_suite (canonical equivalence, required/forbidden facts, prompt invariance, determinacy calibration, CAP0 retention); gates with retention mandatory. - 35 new tests; slm367 component v1. * SLM-368: matched CAP1 grounding experiment — CERT_CAP1 rejected (DSH2-08) - Preregistered sha-locked block first: four arms (NL_NO_SCHEMA, SCHEMA_UNFILTERED, SCHEMA_FILTERED_SINGLE, SCHEMA_FILTERED_MULTI) differing only in declared data levers with family-stratified matched exposure; identical tiny tree-edit training, seeds {0,1}; two-pack train roots split-disjoint from the frozen SLM-367 suite. - Full evaluation on the frozen two-pack suite: schema replays (original/empty/contradictory/reordered/irrelevant causal probe), counterfactuals, marker permutations, ambiguity/determinacy, mandatory CAP0 retention; symbol-only audit; paired Wilson + exact McNemar; sharded within the cap; AgentV diagnostic. - Outcome: CERT_CAP1 rejected — underpowered (paired n=32 < 64) plus prediction_identical, ignores_schema, fails_hard_contrasts, cap0_regression at fixture scale; NL CAP2 stays closed. Certificate machinery proven both ways (issue on synthetic win; all six stop codes). Suite clean, zero contamination, exposure exactly matched. - 20 new tests; slm368 component v1. * SLM-379: schema-grounded NL descriptions of operator applications (DSH3-11) - OperatorFrameV1: deterministic fail-closed derivation from operator declaration + typed args + before-state + ActionEffectV1; required edit facts (every effect delta), forbidden facts only under exact compiler coverage (no overclaim under bounded/approximate), state-reference facts through typed descriptor tables; per-fact provenance, equivalence, conflict checks, fingerprint. - operator_nl_turns.py: admission under the exact OperatorLegalSetV1 + accepted set with coded rejections (missing_legal_membership, not_in_accepted_set, ambiguous_state_reference, compatible_with_non_equivalent, accepted_set_not_named, leak); symbol-only targets across three views; offline provider reusing the DSH2-03 contract unchanged. - Measured disambiguation report: unambiguous and accepted-set-named families admit at 1.0; non-equivalent and shared-descriptor families record the honest symbolic_cap2_only stop-rule disposition (overall 0.5). Contract-level machinery, not an NL-CAP2 ship claim. - 18 new tests; slm379 component v1. * SLM-409: define exact SelectorRefV1 contracts and finite selector domains * SLM-409: define exact SelectorRefV1 contracts and finite selector domains Extend the existing typed-reference/ReferenceTableV1 machinery with a RefKind.SELECTOR that commits to a finite, pack-authorized, permutation-safe target set (component-type, single-schema-role, single-symbol-ref, and declared-role-descendant kinds) instead of a free-form query language. Selectors resolve only from current pack-authorized state and fail closed on stale state, cross branch/request use, wrong kind, changed membership, or fanout overflow. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-409: fix selector round-trip stability and re-attach idempotence Address CodeRabbit review on PR #910: - normalize SelectorDescriptorV1.compiler_facts (dedupe + sort) at construction so from_dict(to_dict(x)) == x for unsorted/duplicate facts - dedupe descriptors by fingerprint in attach_selectors so re-attaching an identical selector is idempotent instead of raising ref.duplicate - add regression coverage for both plus selector.cardinality_mismatch, selector.type_incompatible, and entry-ref stability across attach Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Satisfy the decode goals rather than only documenting them (#886) * Satisfy the decode goals rather than only documenting them The merged invariants work made the goals enforceable. Three of them were still only *stated*: a proven singleton could still cost a forward, speculative ranking was unreachable, and the shared ops vocabulary did not exist. This closes all three and reserves the vocabulary. I2 — a horizon-limited domain is not a contradiction. For the DSL-native codec `exact_forced_token_id` consulted only the pack completion domain, which needs budget to enumerate a terminal witness and returns coverage="none" when remaining_tokens is small (measured: none at <=4, complete at 8). It threw away a DFA proof that had already decided the position. It now falls through to that proof, while a *complete* domain naming several candidates still refuses. The whitespace veto is skipped for the native codec, because the native completion domain already excludes insignificant whitespace — applying it only in the fallback made one position disagree with itself depending on remaining budget. This turns `test_repair_exact_token_skips_forward_and_records_authority`, red on main since before the invariants doc existed, green. I3 — speculative ranking is reachable. Ships the committed table built train-split-only from the immutable certified corpus (openui_verified_v1: 1682 records, 89,415 native tokens, order 3, 523 contexts, templatized so it keys on symbols and never on free-form strings). `speculative_rank="ngram"` with no table named resolves to it. `--check` fails when artifact and builder disagree. It ranks real branch points confidently: `Stack(` at margin 1.0 after `root = ` (27 candidates), `<BIND_1>` at margin 1.59 after `root = Stack([` (25) — both decided from the symbol table with no forward. I4 — the scheduler gets a real checkpoint. `common_forced_run` proves the one thing available before position t is decided: if every legal candidate leads into the same length of forced lexemes, those positions are determined whatever the model picks. Bounded at 8 candidates, 4 lexemes, 4 rows; any budget exceeded claims nothing and leaves device-window sizing in place. Replaces the `forced_run_lengths=None` placeholder. I13 — the reserved ops vocabulary now exists. `dsl/ops_vocab.py` holds 19 ops across ast/graph/set/topology/history, in a new `ops` token-id namespace placed above every codec range so no stored embedding row moves. Two properties make it more than another list: it is derived from the live operator registries, so an op cannot be in the vocabulary without an implementation or implemented without appearing in it; and `shared_token_ids()` is the only mapping, so "shared encoder<->decoder" is the same function called twice rather than a convention two towers are asked to honor. Grammar layering is asserted, NL is absent by construction, and the fingerprint is pinned and CI-gated. The open rung is the encoder-conditioned campaign — e803 tested decoder targets only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ * Fix a decode-contract assertion my merged PR broke `test_prompt_inventory_is_visible_to_decode_and_persisted` asserts exact equality on the persisted `decode_contract` metadata. #881 added three keys to it — `grammar_constrained`, `diagnostic_control`, `certifiable` — so a diagnostic-control sample can never later be mistaken for a certified serving generation. The keys are intentional; the assertion was not updated. Verified by bisect: passes at d45d43f (pre-881), fails on main. CI missed it because `check_changed` did not select `test_bad_outputs.py` for #881's diff. Not fixed here, for the record: `test_annotations.py::test_sample_api_generates` asserts a 200 from `/api/sample`, but the committed playground demo checkpoint is output-contract v0 and the serving path deliberately refuses pre-v2 checkpoints ("checkpoint output contract v0 is incompatible with required symbol_only/v2"), exactly as MODEL_CARD describes. It fails at d45d43f too. Resolving it means either a v2 demo checkpoint or a decision to change what the endpoint promises — a product call, not a drive-by. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ * Keep the I2 tests out of the slow legacy fast-path suite CI run 30148188085 was cancelled: the `python` job hit the repository's three-minute cap. Cause was mine — appending the two I2 tests to `tests/test_dsl/test_grammar_fastpath.py` made `check_changed` select that whole file, and its ~40 node-bridge cases alone exceed the budget. #881 never hit this because a three-dot diff excludes main's own edits to the file, so it was never selected there. Moves them to `tests/test_dsl/test_exact_forced_horizon.py` (43s, well inside the cap) and restores `test_grammar_fastpath.py` byte-identical to main so it drops out of selection. Same coverage, same assertions — only the file they live in changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-410: implement atomic bulk set-property operator over SelectorRefV1 Add openui.map_set_property(selector, role, value) as the first consumer of the DSH5-01 SelectorRefV1 contract: applies one schema-valid property update to every exact selected node atomically (all-or-nothing, no partial commits), emits one ActionEffectV1 with exact per-target deltas and CompilerCoverage.EXACT, and rebuilds a fresh post-commit reference table. Adds OpenUILocalOperatorContextV1.resolve_selector to consume the existing reference-table selector resolution, and a diagnostic-only primitive-lowering oracle to prove equivalence against repeated SET_PROPERTY actions. Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap Co-authored-by: Claude <noreply@anthropic.com> * perf: slim Vercel function bundle from ~10.4 GB to 16.6 MB (#915) The deployed FastAPI function failed to build: local run artifacts (outputs/ ~10 GB, .venv, node_modules) were uploaded because the function-level excludeFiles glob is ineffective, and the wheel packaged resources/static (~100 MB) including 69 MB of training records.jsonl, contaminated further by a stale build/ directory. - .vercelignore: exclude build/run artifacts (/outputs, /.venv, /node_modules, /build, /session, /_uv, /tests, caches), published training records.jsonl, sourcemaps, oversized historical docs/design JSON, and the fixture checkpoint (dead weight without a runtime) - web/requirements-vercel.txt: slim deploy-only deps without numpy/onnxruntime (~109 MB); wired via installCommand since Vercel prefers uv.lock over requirements files - web/vercel.py: lazy ONNX import; web/service.py: model-less deploys raise honest GenerationExhausted so /api/sample hands off to the browser path (verified live: 200 + fallback_required, never a 500) - pyproject.toml: tool.uv package=false (entrypoint imports from the uploaded source tree; installed copy was pure duplication) and wheel exclude-package-data for records/governance/maps - vite configs: sourcemap=false; committed static 24 MB -> 6.1 MB - bundle policy test locks the new exclusions Verified: preview deploy succeeds; lambda 73 MB -> 16.6 MB; /api/health and /api/sample exercised via vercel curl. * Add SLM-298 local factorial harness (#898) * SLM-412: define OperatorTransactionV1 base-state and conflict contracts * SLM-412: define OperatorTransactionV1 base-state and conflict contracts Add PreparedOperatorActionV1, OperatorReadWriteSetV1, and OperatorTransactionV1 schema/safety contracts: several actions prepared against one shared base state get semantic read/write footprints derived from their exact effects (never operator names), a dependency/conflict graph, and one canonical, permutation-invariant transaction identity keyed by semantic action ID. Reuses merge.py's effect-target extraction and commutativity gate rather than duplicating conflict logic. Schema/validation only — no commit/execution path is wired, per the issue's own agent contract. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-412: normalize OperatorTransactionProofV1.checks for round-trip stability An independent adversarial review found the same bug shape CodeRabbit caught on SLM-409: to_dict() force-sorted and deduped `checks`, but __post_init__ never normalized the field, so from_dict(to_dict(x)) == x could fail for input built with unsorted/duplicate checks -- including the exact literal order build_operator_transaction constructs the proof with in production. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Add deterministic autotrain Grok workflow (#917) Encode the autotrain skill as a host-owned Rhai workflow under .grok/workflows with exact slm command plans, parallel data legs, durable state, and OpenWiki/contracts prompts. Allow .grok in repository policy and pin a feature-flag null-coercion regression. * SLM-267 + SLM-296: bounded wiring-evidence slices (ProgramSpec sampling, teacher admission) (#893) * SLM-267: bounded uniform-vs-coverage-targeted ProgramSpec sampling wiring evidence VSD2-02 asks for 10k/100k/1M-record ProgramSpec corpora comparing uniform against coverage-targeted sampling. The existing coverage-guided generator (SLM-5) samples from a fixed, exhaustible candidate grid, so those rungs are out of reach without a materially different generator. This scopes the issue to what the generator actually supports: a genuine uniform-random control arm (ProgramGenerator.generate_uniform, new), a deterministic (global_seed, shard_id, worker_id) sharding primitive, and an honest, reproducible measurement of the generator's own coverage-targeted-vs-uniform budget efficiency and state-space saturation point. - generate.py: refactor generate_one into _materialize + add generate_uniform (uniform-random candidate selection, no coverage bias) as a genuine control arm distinct from the existing greedy CoverageTracker.score() selection. - New harness (slm267_programspec_coverage_scaling.py) + CLI (generate_programspec_corpus.py) run both policies to a bounded budget, dedup by canonical-root fingerprint (in-memory), and report exhaustion point, unique roots, and programs-to-full-coverage per arm. - Fixture campaign (80 programs/shard x2 shards): coverage-targeted reaches full coverable-cell coverage in 19 programs vs uniform's 34-35; both exhaust the 3-component grid at 36 accepted (28 unique roots, 8 duplicate canonical roots via serialization collapse). - Disposition: inconclusive (wiring only) -- does not validate VSD-H7a/b/c, which require corpora/training several orders of magnitude larger than this fixture budget. Documented as explicit follow-up. Closes SLM-267. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg * SLM-296: bounded verifier-filtered teacher-admission wiring evidence AP-013 asks for >=500 accepted records from a capable separate-family teacher, filtered through G0-G10 + independent judgment + human audit, then a matched-budget fine-tune with grammar-on/off evaluation. This sandbox has no network access to a real teacher and no GPU -- SLM-266 already measured that even a local CPU teacher run is infeasible here (>=11 days extrapolated for 10k requests). Scoped down to a bounded wiring slice that exercises the two real safety mechanisms the acceptance criteria test: - generate.py's compiler-inverted ProgramSpec generator stands in as a deterministic offline candidate proposer (explicitly not a teacher), tagged source="teacher" (a verifier-stack weak source) so admitted rows structurally cap at Bronze tier regardless of gate passes -- "teacher self-judgment alone cannot assign Gold/Silver" is enforced by the real verify_record() tier rule, not asserted narratively. - check_family_independence() + a same-family "shadow judge" control: wiring independent_judge_passed=False for a same-family judge causes the real G11 gate to quarantine 10/10 sampled candidates; a different-family judge would pass. Locked-holdout decontamination excludes any candidate whose canonical root (SLM-171 diversity fingerprint) collides with a disjoint-seed holdout before counting yield (23/27 excluded in the fixture run, reflecting the generator's shared finite candidate grid already documented in SLM-267). Disposition: yield_limitation_no_real_teacher_available (wiring only) -- the >=500-record scale and grammar-on/off fine-tune comparison remain unaddressed in this sandbox and are documented as explicit follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg * Refresh SLM-267 evidence after rebase --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-397: freeze a sanitized typed OperatorActionViewV1 model boundary (DSH3-22) (#918) Adds OperatorPolicyInputV1/OperatorActionViewV1/ReferenceModelViewV1 as the only allowed model input for DSH3 M6/M7 learned operator policies: an immutable, row-indexed snapshot over a verified-fresh ReferenceTableV1 + OperatorLegalSetV1 pair. Row-local joins (parent_row, candidate_rows) replace every raw opaque/semantic identity; recursive forbidden-field validation guards the boundary structurally. build_operator_policy_input fails closed on a stale reference table or a mismatched operator registry. Covers the ticket's verification matrix and adversarial controls: index parent/position resolution, partial-coverage explicitness for unbounded repeated slots, opaque-ID/candidate-order permutation equivalence, and allocation-seed-only changes (which vary every downstream application/proof hash) leaving the sanitized view byte-identical. Registers model.operator_policy_view v1 in versions.json. Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS Co-authored-by: Claude <noreply@anthropic.com> * SLM-396: make LocalFlatHead optimizer-visible and checkpoint-stable (#897) Per-action embeddings were a plain dict, invisible to model.parameters() and thus never trained. Replace with a registered nn.ParameterDict, add explicit materialize()/checkpoint contracts that fail closed on registry/shape mismatch, and canonicalize action keys so opaque request/reference ids can't fragment the parameter table. LocalFlatHead stays a documented O(distinct-actions) diagnostic head, not a fake generalization claim. model.quantization bumped v5->v6. Claude-Session: https://claude.ai/code/session_01GbtSeD33wb4okHTpYrs4vJ Co-authored-by: Claude <noreply@anthropic.com> * SLM-386: export operator decision-state traces from existing legal-set contracts (#903) DSH4-01: reuse the DSH3-06 OperatorLegalSetV1 legal-action enumeration and the SPV2-03 TeacherTraceManifest provenance envelope to export certified operator decision-state traces instead of building a duplicate distillation data stack. Adds operator_decision_state.py (capture, accepted-trajectory replay, and a fail-closed export_for_teacher_query stop-rule gate), a fixture runner, tests, and a docs/design evidence pair. Bumps harness.distill to v3. Claude-Session: https://claude.ai/code/session_01HVU3Spui6zSHYvkmxi6iNL Co-authored-by: Claude <noreply@anthropic.com> * SLM-387: one-teacher ceiling over exact operator legal sets (DSH4-02) (#922) Implements the full teacher-vs-baseline comparison harness required before any operator legal-set distillation work: a synthetic, explicitly non-real stand-in teacher adapter (SyntheticDescriptorTeacherV1) behind the same interface a real LLM teacher would use; frequency, deterministic compiler-order, current-scorer, and descriptor-similarity baselines plus an oracle upper bound; accepted-set mass/MRR/NDCG/calibration/selective-risk/ verifier-regret-correlation metrics; a candidate-order/opaque-id/ description-length/prompt-template perturbation-robustness harness; paired bootstrap significance; and a stop-rule gate. Run honestly against the synthetic teacher on deterministic fixture data (scripts/run_dsh4_02_operator_teacher_ceiling_fixture.py), the harness reports DEFER (do not distill): the synthetic teacher does not significantly beat any required baseline on paired MRR and its scores negatively correlate with verifier-backed outcomes, though perturbation robustness is perfect by construction. This is fixture/wiring evidence (claim_class: wiring) only -- a production KD-readiness claim requires swapping a real teacher behind OperatorTeacherAdapter and re-running this exact harness. Bumps harness.distill to v4 in versions.json. Claude-Session: https://claude.ai/code/session_01HVU3Spui6zSHYvkmxi6iNL Co-authored-by: Claude <noreply@anthropic.com> * SLM-249 (LOT0-02): define CompilerReasoningTraceV1 target-trace contract (#909) Implements the LOT0-01 authorization's allowed_lot1_work scope: a typed, compiler-grounded reasoning-trace schema and deterministic extractor (reusing SemanticPlanV1 and the production codec, no new compiler/parser/evaluator), a lossless visible serialization, permutation-invariant/cycle-free/ truncation-explicit helpers, a bounded (n=16 fixture) K/c coverage probe, a fully specified but deliberately not-run oracle-ceiling experiment plan, and a defined-but-not-run causal_latent_use falsification-test spec extending causal_trace.py. Gate verdict: inconclusive -- the oracle campaign that would justify LOT1's model implementation requires GPU training and corpus work this issue does not authorize. Claude-Session: https://claude.ai/code/session_01625N4JruoBHHmrH2pXmRR4 Co-authored-by: Claude <noreply@anthropic.com> * Track AgentEvals grader metrics (#920) * Enforce harness-owned opaque template slots * Make strict template evaluation the default * Document longer opaque-slot baseline * Reject duplicate structural references * Close covered structural arrays * Record rejected all-path plan margin * Centralize canonical corpus defaults * Move slot conversion into harness boundary * Record harness-owned slot smoke * Keep training local and record typed collection result * Train surgical typed collection baseline * Record action group data rejections * Record lexer structural decode diagnosis * Record root arity warm start rejection * Enforce harness-owned opaque markers * Fix opaque marker ownership in data harnesses * Fix harness-owned marker and warm-start contracts * fix warm-start vocabulary ownership * fix deployed evidence bundle size * fix Vercel exclusion glob limit * fix Vercel corpus exclusions * fix Vercel upload exclusions * record recovered baseline evaluation * record hard-tail continuation result * record balanced replay result * record low replay result * add typed role training supplement * record invalid typed role scratch attempts * add focused typed role corpus * record focused role continuation failure * record focused role retention result * record E891 canvas cap results * reject untyped array forward references * prefer certified typed array items * activate planned typed array items * extend typed item margin to lexer * apply typed item margin after schema pruning * limit typed item margin to closed leaves * record typed item margin results * clarify gold-relative quality metrics * lock compact semantic metric distinction * test schema-aware component constraints * test schema-aware inline item planning * fix closed array component arity * tighten component-valued schema paths * test use opaque markers in compiler fixtures * reject conflicting typed binder reuse * bound typed forward references by slots * fix enforce role-safe training targets * fix enforce role-safe decoder strings * fix bound role-safe decoder nesting * fix audit role-safe outputs without style shifts * fix keep structural identities unique by role * docs record rejected inline typed items * docs record rejected lattice recovery * docs record no-op array close treatment * docs record rejected compiler array close * docs record rejected clean scratch checkpoint * docs record rejected symbol reservation * fix close direct training target leaks * docs confirm training boundary decode parity * docs record weighted scratch comparison * fix softly penalize repeated compiler binders * docs record rejected visible reference penalty * docs reject generic binder reuse penalty * fix withdraw harmful compiler reuse penalty * docs confirm compiler penalty withdrawal parity * fix reserve slots for typed binder obligations * docs reject incomplete typed slot reservation * fix reserve symbols for typed binder obligations * docs reject symbol slot reservation * fix withdraw typed slot reservation * docs confirm slot reservation withdrawal parity * docs reject binder arity scratch checkpoint * docs reject low weight binder arity arm * docs reject unique binder filtering * docs reject scoped binder ownership * docs reject arity lattice recovery * docs diagnose arity form fallback * docs reject arity slot margin * docs reject joint binder supervision * docs reject topology data supplement * docs reject generic topology exposure * docs reject binder component plan arm * perf scan binder component targets * docs reject full binder component arm * docs reject low binder component arm * fix isolate binder component gradients * docs reject detached binder component arm * test clarify role unsafe fixtures * docs reject joint binder plan arm * feat apply binder plan before declaration * test remove content-like sanitizer fixtures * docs reject predeclaration binder plan arm * docs close predeclaration binder scalar sweep * feat mask binder plans by typed use sites * docs reject typed binder candidate checkpoint * docs reject binder arity isolation * docs close binder arity scalar sweep * feat scope binder arity to bound declarations * docs record bound-only arity diagnostics * docs record dedicated root arity train * docs reject dedicated root arity checkpoint * docs isolate root arity decode ablation * docs record partial matched exposure control * docs complete matched exposure control * docs close matched exposure control * docs record partial v271 exposure train * docs complete v271 exposure train * docs record v271 exposure smoke pass * docs close v271 exposure sweep * feat generalize root reference identity * fix route lexer identity sampling * docs record partial v272 root identity train * docs complete v272 root identity train * docs record v272 root identity smoke * docs record v272 dual card timeout * docs: record invalid E1079 reproduction * fix: make AgentEvals named metrics authoritative * docs: record E1080 partial reproduction * docs: complete E1080 scratch record * Add document-only ProgramSpec campaign evidence * Track AgentEvals grader metrics * Fix Vercel exclusion policy * Restore structural identifier contract * SLM-413: implement atomic transaction composition, commit, and replay (#921) * SLM-413: implement atomic transaction composition, commit, and replay Wire the execution path SLM-412 deliberately deferred: compose_operator_transaction independently dry-runs each prepared action against the shared immutable base and folds their base-relative AST deltas via a shared 3-way merge primitive (extracted from merge.py into ast_merge.py so both modules reuse one algorithm) instead of re-executing operators sequentially against progressively stale reference tables. commit_operator_transaction runs full pack authority on the composed source once, builds one composite proof and fresh branch-local reference table, and any preparation/composition/ validation failure leaves the base state untouched. Adds a TRANSACTION_COMMIT conversation turn so a transaction commits as one CRDT event carrying every constituent application ID, and exact replay from base + recorded transaction. Also fixes a pre-existing gap in transactions.py's target lineage that made bulk/selector operators unpreparable into any transaction. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-413: rebuild ops-vocab registry for the new conversation.transaction_commit op CI's decode-invariant check (I13) caught that adding TRANSACTION_COMMIT to ConversationOperation drifted the committed shared encoder<->decoder ops vocabulary without rebuilding it. Rebuild via ops_vocab.write_registry() (19 -> 20 ops; conversation.transaction_commit inserted into the history family, shifting subsequent token_ids by one) and bump ops.vocab to v2. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Record seed-7 topology control * SLM-398: typed categorical embeddings over the sanitized operator view (DSH3-23) (#923) * SLM-398: typed categorical embeddings over the sanitized operator view (DSH3-23) Adds OperatorFeatureEncoder/OperatorFeatureVocabularyV1/CandidateScoringHead over the SLM-397 OperatorPolicyInputV1 boundary, with three matched arms: hash_scalar (the existing _stable_scalar control, preserved as-is), typed (learned per-field embeddings for ref_kind/value_type/compiler_facts/ operator_id/binding_phase/effect_kind/locality/cost/position), and typed_identity_bucket (typed plus a labeled row-position-only anti-generalization control). All three share one ragged OperatorFeatureBatchV1 and CandidateScoringHead, so matched parameters/optimizer/steps/seed hold structurally rather than by convention. Ships scripts/run_dsh3_23_operator_feature_encoder_fixture.py, which trains and evaluates all three arms on a small deterministic fixture and emits OperatorFeatureEncodingReportV1 evidence (docs/design/ dsh3-23-operator-feature-encoder.{md,json}). At fixture scale the run is honestly underpowered (both hash_scalar and typed hit the toy task's ceiling) but the adversarial permutation-robustness control is decisive: typed and hash_scalar are exactly invariant under a row-order/opaque-ID reshuffle, while typed_identity_bucket -- which can see row position -- is not, confirming the SLM-397 boundary blocks identity-based shortcut learning even when a model is deliberately given a spurious position-like feature to exploit. claim_class: wiring; no ship or capability claim is made. Registers model.operator_feature_encoder v1 in versions.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS * Fix flaky exact-float permutation-invariance assertion in feature-encoder test Comparing embedding tuples with Python == is sensitive to BLAS/hardware- dependent floating-point summation order (CI runner vs local dev), causing ULP-level mismatches on an otherwise-passing permutation-invariance check. Switch to a per-value pytest.approx comparison, matching the tolerance already used by the production module's own _permutation_robustness check. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-300 + SLM-250: self-context exposure-bias curriculum + LOT1-01 not_authorized (#895) * SLM-300: wire self-context exposure-bias curriculum (AP-015) Add the preregistered self-context/scheduled-corruption curriculum manifest, an exact policy_origin_mixture(rate, lagged_share) function (gold vs. current-policy vs. lagged-policy mass split), and a torch-free fixture runner/CLI following the SLM-120 corruption curriculum pattern. Proves the "mixture zero reproduces legacy behavior" acceptance criterion as an exact, unit-tested invariant. Actual multi-seed self-context training arms remain gated on a GPU host and the certified baseline checkpoint (SLM-103); this is wiring evidence only, no recovery or ship-gate claim is made. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KShriKrGosZr67yVPFgi78 * SLM-300: address CodeRabbit review on PR #895 - run_fixture_self_context_curriculum now calls validate_manifest and raises ValueError on an invalid manifest (missing 0.0 control, empty seeds), matching its own docstring and hardening the function as a trust boundary. - _arm_label is now lossless for arbitrary caller-supplied rates (e.g. 0.101 vs 0.104 no longer collide onto the same "SC10" label and run_id); default preregistered rates (0.10/0.25/0.50) render identically to before. - CLI: malformed --seeds/--self-context-rates CSV values now return a controlled exit code 2 instead of an uncaught ValueError traceback. - CLI: frontier mode's fixture fallback now returns exit code 2 instead of 0, so a scheduler checking only the exit code can't mistake it for a completed frontier run. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KShriKrGosZr67yVPFgi78 * fix: restore main CI after #920 (levers, tokenizers, vocab remap) Main #920 dropped DEFAULT_* / PROHIBITED lever constants, left selection importing DIFFICULTY_EASY_TAIL_FRACTION without defining it, expanded STRUCTURAL_ID_ATOMS without tokenizer version/layout updates, and removed _remap_vocab_weight while still calling it. Restore those and refresh the layout registry so data-build + verify_tokenizer_grammar_invariants pass. * fix(SLM-300): prepend ops.vocab no-bump after rebase onto main Keep ops.vocab history append-only vs main v2 (SLM-413) after the tokenizer layout registry refresh for #920 CI recovery. --------- Co-authored-by: Claude <noreply@anthropic.com> * Add SLM-268 fail-closed activation audit (#928) * SLM-302: reserve the collision-free AbstractPlanV1 codebook (AP-016) (#899) Define AbstractPlanV1, reserve default-off abstract-plan delimiters/slots in openui_tokens + dsl/choice tokenizers, fail closed on out-of-range slot counts, and document the contract. Tokenizer defaults stay byte-identical when abstract_plan_slots=0. * SLM-325: bridge CAP2 latent codecs to program-scale SemanticPlanV1 factors (#904) Adds deterministic SemanticPlanV1 program-factor tensorization (inventory, cardinality, topology, binder/reference graph, property roles/values, style/layout) and a CAP2-05 harness that runs the existing CAP2-02 codec families (uniform scalar, mixed-radix FSQ, binary LFQ, learned VQ, continuous) over it via their existing semantic_trace mode. Generalizes KaryBottleneck's no-bypass audit to any LatentCodec so decoder inputs are proven to contain only codec output, never a raw factor tensor. Claude-Session: https://claude.ai/code/session_01CL7wh4Xw51nQtJFR6hzBGD Co-authored-by: Claude <noreply@anthropic.com> * SLM-383 (DSH3-15): causal-attribution experiment for the hierarchical operator action head (#913) * SLM-383 (DSH3-15): run the causal-attribution experiment for the hierarchical operator action head Restores the wiring-only hierarchical operator action head from closed PR #907 (branch claude/inspiring-franklin-q77bwy, commit a6195e5) and adds the multi-seed causal-attribution experiment DSH3-15's own acceptance criteria require but that PR explicitly deferred: token baseline vs. weight-zero (frozen no-op capacity control) vs. enabled (trained) arms, over a fixture corpus whose gold operator depends only on a typed candidate-group-size feature (never opaque ids/display names), following the E803 (reserved_operator_baseline) harness pattern. Result: the enabled head strictly beats its own weight-zero capacity control (trainable, not a dead architecture) but ties exactly with the token baseline (both memorize the finite shape vocabulary to ceiling), so it does not causally improve beyond it. Per DSH3-15's own stop rule, the head stays default-off and REJECTED -- flipping cap2_disposition.py's HIERARCHICAL_HEAD verdict from UNRUN_CONDITIONAL to REJECTED with real evidence, and regenerating the DSH3-17 terminal disposition accordingly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N9wPE3V4hCMpcQ8bTA3bEB * fix(SLM-383): restore versions.json path ownership after rebase * fix(SLM-383): keep hierarchical_head off operators package init Eager re-export imported torch into ops_vocab via `from slm_training.dsl.operators import local`, breaking python-static verify_decode_invariants. Import the head from its submodule instead. --------- Co-authored-by: Claude <noreply@anthropic.com> * Optimize capacity-aware sampling * Add unblock-in-review Grok workflow (#940) Parallel Linear In Review drain: claim, worktree, babysit/fix CI, squash-merge, Done, self-heal. * SLM-328: run the program-factor latent size/width/codec rate-distortion sweep (#945) * SLM-325: bridge CAP2 latent codecs to program-scale SemanticPlanV1 factors Adds deterministic SemanticPlanV1 program-factor tensorization (inventory, cardinality, topology, binder/reference graph, property roles/values, style/layout) and a CAP2-05 harness that runs the existing CAP2-02 codec families (uniform scalar, mixed-radix FSQ, binary LFQ, learned VQ, continuous) over it via their existing semantic_trace mode. Generalizes KaryBottleneck's no-bypass audit to any LatentCodec so decoder inputs are proven to contain only codec output, never a raw factor tensor. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CL7wh4Xw51nQtJFR6hzBGD * SLM-328: run the program-factor latent size/width/codec rate-distortion sweep Adds a CAP2-06 harness that sweeps latent count x encoder width x codec family (uniform scalar, mixed-radix FSQ, binary LFQ, learned VQ, continuous) over the SLM-325 SemanticPlanV1 program-factor tensorizer, reconstructing the full factor vector through a single linear decoder and reporting per-factor-family MSE, serialized rate, and the smallest passing configuration per codec (3-seed confirmation). Reuses the existing codec families and audit_no_bypass unchanged. Found and fixed a real bug during development: select_retained_configs only checked the distortion threshold, so a cell whose encoder collapsed to a constant/dead code (a genuine failure mode at minimum capacity) could be wrongly promoted if it happened to reconstruct a low-variance factor well. Fixed by also requiring the no-bypass audit to pass; added regression tests that construct this exact scenario synthetically. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CL7wh4Xw51nQtJFR6hzBGD --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(model_build): unblock autotrain smoke train/eval paths (#948) Wire missing ModelBuildConfig fields used by train/eval CLIs, default max_wall_minutes to MAX_HARNESS_WALL_MINUTES, fail-close evaluate_model unconstrained fallback, and stop deriving semantic_role from opaque template markers. Align eval_gates fixtures to :slot_N markers. Record fixture smoke measured results; bump model.twotower v247 / harness.model_build.eval v60. * Close the tokenizer fallback and enforce cross-harness law parity (#935) * docs: audit agent-harness parity and implementation/intent gaps Reproduce and record two classes of defect against 42d76b2: A. The DSL native tokenizer vocabulary is environment-dependent. When src/apps/openui_bridge/node_modules is absent, the hybrid grammar backend falls through to Lark and _COMPONENT_NAMES admits grammar rule/terminal names (AST, NAME, STRING, ... and "Za", a fragment of [A-Za-z0-9_]), taking vocab_size 569 -> 605 with DSL_TOKENIZER_VERSION unchanged. The seam that does this is commented "fail-open fallback", contradicting the AGENTS.md fail-closed invariant, and the guard that would catch it only runs in the one CI job that installs the bridge -- with an assertion message that instructs the wrong fix. B. Only the decode invariants have a cross-surface parity check. Every other repository law (run cap, iron law, data-quality law, model card, version stamps, dashboard parity, campaign law) is missing from one or more of GEMINI.md, copilot-instructions.md and .cursor/rules. Grok is a recognized harness with no instruction surface, README overstates hook coverage (.github/hooks/changed-tests.json is an empty stub), MCP server sets diverge, and the documented skill-refresh commands produce a state scripts/repo_policy.py rejects. Includes a four-phase fix plan and the reproduction command for each finding. Documentation only; no harness or metric file touched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013s4yug4A2DCE3RykH7191Q * Close the tokenizer fallback and enforce cross-harness law parity Implements all four phases of docs/design/agent-harness-parity-audit.md. Phase 1 — the output vocabulary is no longer environment-dependent. dsl.openui_tokens.STRUCTURAL_TOKENS is now authoritative for the default DSL instead of being re-derived from whichever grammar backend is live. Routing it through the backend made vocab_size swing 569<->605 depending on whether src/apps/openui_bridge/node_modules was installed, with DSL_TOKENIZER_VERSION unchanged — silently incompatible checkpoints. The backend seam survives only for a non-default SLM_GRAMMAR_DSL, where it now fails closed. lark_backend.structural_tokens() extracts quoted literals rather than scraping capitalised words out of the grammar text, which had been admitting rule/terminal names and a char-class fragment ("Za") into a model vocabulary. Layout is unchanged at 569; it is now pinned by tests that need no Node, and the certificate's assertion text no longer invites writing an accidental layout into the registry. Phase 2 — scripts/verify_agent_surfaces.py owns a declarative obligation x surface matrix covering twelve repository laws plus hook parity. verify_decode_invariants delegates to it rather than keeping a second copy. Missing laws backfilled into CLAUDE.md, GEMINI.md, copilot-instructions.md, a new .cursor/rules/repo-laws.mdc, and the Grok workflow header; surfaces now cite the canonical I* ids, and I7 is a documented invariant rather than a phantom id. repo_policy checks skill mirrors in both directions. Phase 3 — .github/hooks/changed-tests.json was an empty stub; it and .codex/hooks.json now carry the same PostToolUse pair as Claude Code, and hook parity is itself certified. README no longer claims the agent hooks run the changed-file checker. Phase 4 — the skill-refresh block is deleted from AGENTS.md in favour of .agents/skills/README.md as single owner, with -a codex dropped and a normalisation loop so following it leaves repo_policy green. MCP divergence is documented; Codex's Serena block is committed. Bumps model.twotower v245->v246 and decode.invariants v2->v3. Also records A3, found while verifying Phase 1 and deliberately not fixed: run_slm157_flow_consistency_fixture.py mirrors into committed docs/design evidence under a bare `if args.mode == "fixture"`, ignoring an explicit --output-dir, so plain pytest rewrites the durable ledger with nondeterministic numbers. 54 of 76 run_*.py share the shape, so the semantics are the experiment owners' call. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013s4yug4A2DCE3RykH7191Q * Pin the tokenizer vocab cap to the layout registry, not a magic number test_vocab_is_fixed_and_typed asserted `vocab_size <= 512`. Main #920 folded STRUCTURAL_ID_ATOMS into the fixed literal set (505 -> 569) and left the cap behind, so this test had been red on main -- with and without the Node bridge -- while CI stayed green, because check_changed --changed-tests-only runs only changed test files and this one had not changed. Assert against the checked-in tokenizer_layout_registry.json instead, so the bound cannot go stale silently again. Same root cause as A1: the vocabulary moved and its guards did not. Recorded as A2b in docs/design/agent-harness-parity-audit.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013s4yug4A2DCE3RykH7191Q --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-332: add hard-valid latent geometry objectives (#956) * SLM-332 add hard-valid latent geometry objective * SLM-332 retain opaque binding contrast edges * SLM-332 normalize AgentV evidence paths * SLM-332 record local geometry diagnostic * SLM-332 refresh rebased geometry evidence * SLM-393: freeze the CAP2 operator-policy rebase addendum (#900) Inventories every CAP2 operator-policy symbol against production/fixture/ untested status with file:line anchors, empirically confirms the LocalFlatHead optimizer-visibility gap DSH3-21 fixes, and builds a dependency-readiness map for DSH3-19 through DSH3-33 from Linear blockedBy edges so future sessions know which increments are unblocked. Design-only; no runtime behavior change. Claude-Session: https://claude.ai/code/session_019c9boLgpJYyjdupKCn8317 Co-authored-by: Claude <noreply@anthropic.com> * docs(autotrain): multi-iteration smoke loop measured results (#961) * docs(autotrain): record multi-iteration smoke loop measured results Persist fixture/scratch autotrain loop ledger (iter2–5) under docs/design with honest non-ship labeling; train/eval ran via canonical slm CLI under MAX_HARNESS_WALL_MINUTES. * docs(autotrain): add iter6 measured results * docs(autotrain): include iter6 in loop ledger * Fix effect-derived merge conflicts (#965) * docs(autotrain): extend smoke loop ledger through iter16 (#966) Record fixture/scratch measured results for autotrain loop iterations 7–16 and refresh the aggregate ledger. Not a ship claim. * docs(autotrain): extend smoke loop ledger through iter25 (#968) Fixture/scratch measured results for iterations 17–25 plus refreshed aggregate ledger. Not a ship claim. * docs(autotrain): extend smoke loop ledger through iter40 (#970) * feat(operators): rebuild post-merge references (#969) * SLM-304: implement codebook-only abstract trace decoding (AP-017) (#947) Default-off prompt/abstract/answer decode phases on CausalLMOpenUIPlugin: abstract phase hard-masks logits to the AbstractPlanV1 codebook plus <endabstract>, forces the end at m_max with recorded forced termination, rejects malformed/nested delimiters as hard errors, and carries independent abstract/answer sampling params and seeds plus per-phase token counts and per-token logprobs. Legacy outputs/logits are byte-identical when off. * docs(autotrain): extend smoke loop ledger through iter50 (#971) * SLM-307 (AP-019): block-structured bottleneck attention and masked SFT loss (#951) Add slm_training.models.block_attention: a segment-aware additive attention mask that reproduces the Abstract-CoT bottleneck (arXiv:2604.22709) -- target tokens may never attend privileged-plan positions directly, even though a plain causal mask exposes them, while abstract tokens still read the plan. Loss is restricted to abstract+target positions, and packed batches get per-example isolation via an optional example_ids tensor. Wire it into a new, opt-in CausalLMOpenUIPlugin.forward_with_segments method; the existing forward() full-sequence path is untouched (default-off, legacy behavior unchanged). The bypass canary (test_block_attention.py and the plugin-level mirror) deliberately omits the abstract span, since abstract-mediated plan->target information flow is the intended mechanism, not the bypass this masks: only a fixture with no abstract intermediary isolates the direct edge that must go from leaking (plain causal) to blocked (bottleneck mask). Claude-Session: https://claude.ai/code/session_011uJCkG9ALyro7QvXcCYt14 Co-authored-by: Claude <noreply@anthropic.com> * SLM-315 (AP-023): add a lightweight discrete abstract-plan head to TwoTower (#952) * SLM-315 (AP-023): add a default-off AbstractPlanHead over context-tower states Add slm_training.models.abstract_plan_head.AbstractPlanHead: predicts a short AbstractPlanV1 (AP-016) codebook-index sequence from TwoTowerModel's pooled context-tower state, with disabled | teacher_forced | sampled | oracle | random | shuffled modes. Wired as a new opt-in TwoTowerModel.abstract_plan_trace(...) method only -- training_loss()/ forward() are unmodified, so no plan signal reaches the decoder unless a caller explicitly invokes it (AP-027 will own actually connecting a plan signal into the decoder). abstract_plan_mode="disabled" (the default) builds no head at all -- zero parameters, RNG/optimizer-group/compatibility_fingerprint bit-exact with the prior baseline, mirroring every other optional aux head already in twotower.py (binder_arity_head, component_plan_head, etc.) via the existing isolated_aux_init helper. Bump model.twotower to v249 in versions.json (new watched files abstract_plan_head.py + its test; behavior changes only under a non-default mode). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uJCkG9ALyro7QvXcCYt14 * Address CodeRabbit review on #952: validate abstract_plan_mode, target_plan_ids, generator device - TwoTowerConfig.__post_init__ now rejects any abstract_plan_mode not in AbstractPlanMode's value set (mirrors the sibling recursive_*_mode validation pattern). Previously a typo silently took the "enabled" branch in __init__, undermining the disabled-by-default bit-exact guarantee documented in abstract-plan-head-v1.md. - AbstractPlanHead.forward validates caller-supplied target_plan_ids shape (batch, plan.rounds) and bounds ([0, plan.slot_count)) before use, and rejects a generator whose device doesn't match the context tensor's device with a clear ValueError instead of a confusing deep torch RuntimeError. - Register the integration test and design doc in model.twotower's watched paths (versions.json) so future edits to them are tracked too; bump v249 -> v250 for this follow-up. - New regression tests live in tests/test_models/test_abstract_plan_head.py (not the existing, partially-flaky test_twotower.py) to keep this diff's local pre-commit hook run isolated from unrelated pre-existing failures in that large shared file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uJCkG9ALyro7QvXcCYt14 * Fix SLM-315 review regressions --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-309 + SLM-316 (AP-020, AP-024): on-policy self-distillation collector and abstract-plan denoiser connector (#976) * SLM-309 (AP-020): on-policy abstract self-distillation collector Close the warm-up train-inference gap by sampling prompt-only AP-017 abstract traces on-policy and verifying each candidate independently (the generating policy is never the sole semantic judge) before it is eligible for [prompt; abstract; verified target] training. - collect_on_policy_traces: deterministic (ordered + shard_index/ num_shards), resumable (prompt fingerprint scoped to policy+decode config), duplicate-free (answer fingerprint catches the same output recurring for a different prompt), and auditable on rejection (rejected samples are still appended with a reject_reason). Writes through the existing TraceStore in the meta/labels/final shape select.py already filters, so no new selection plumbing is needed. - training_example_from_capture / segment_ids_for_capture: adapt a collected trace into AP-019's forward_with_segments call-site (masked SFT loss over abstract+target only), reusing the existing owner instead of a new trainer. - SelfDistillCollectConfig(enabled=False) is a pure no-op, so the bottleneck-only control stays reproducible whether or not this collector runs. Bumps harness.distill to v5 in versions.json and adds a design doc noting this is wiring only -- no training run was executed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM * fix(distill): break circular import from eager self_distill_collect load harnesses.distill.__init__ imported self_distill_collect eagerly, which imports models.abstract_decode. abstract_decode imports models.causal_trace, which imports harnesses.distill.trace_store -- triggering this package's __init__ a second time mid-initialization, before self_distill_collect (and therefore abstract_decode) had finished defining its names. Any fresh-process import of models.abstract_decode or models.causal_trace hit this ImportError. Load self_distill_collect's names lazily via __getattr__ instead (the same pattern already used for the torch-heavy sft.py trainer), so the cycle never re-enters the package init. Adds a subprocess-based regression test, since a same-process pytest run can't reliably reproduce the cycle once the modules are already cached. Bumps harness.distill to v6 in versions.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM * SLM-316 (AP-024): abstract-plan denoiser connector Condition MaskGIT denoising on the AP-023 (SLM-315) discrete abstract plan via one gated-additive connector, matching the repo's existing conditioning idiom (DenoiserTower._runtime_symbol_features, TwoTowerModel._component_inventory_bias/_component_plan_bias): a post-hoc additive bias on already-computed vocabulary logits, applied once inside DenoiserTower.project -- every MaskGIT round already calls project, so no round-loop scheduling change is needed and the singleton/exact-forced-token bypass paths (which never call project) are structurally untouched. - abstract_plan_connector.py: PlanConnectorArm (disabled/learned/ oracle/detached/empty/random/shuffled) resolving through one resolve_plan_vector code path; AbstractPlanConnector owns a small codebook-local embedding table (the plan's absolute reserved vocabulary ids are reserved in the causal-LM tokenizer's namespace, not necessarily valid rows in an arbitrary TwoTower vocabulary) plus a zero-initialized gated projection to vocab logits; PlanConnectorTrace records gate norm and a correlational (not causal) per-call argmax choice-change count. - blocks.py: set_plan_connector/set_plan_vector/ pop_plan_connector_traces on DenoiserTower; project() applies the bias only for batch-shaped (3D) logits, leaving per-row compiler/ tree-scorer slices untouched. - twotower.py: abstract_plan_connector_arm config field (default-off, requires abstract_plan_mode enabled, rejects shared_recursive denoiser_arch since SharedRecursiveDenoiserTower doesn't implement the hook yet); TwoTowerModel.abstract_plan_connector is a property reading denoiser._plan_connector (single registration point, so named_parameters()/optimizer_parameter_groups don't silently drop it under identity-based dedup); new generate_with_plan_connector(...) delegates to the existing unmodified generate() so every arm shares scheduling/seed. Bumps model.twotower to v252; adds a no-bump note to harness.experiments.slm211_untied_output_head (blocks.py is shared, one-owner-per-path) explaining the change is unrelated to output-head tying. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM * Address CodeRabbit review on PR #976 - blocks.py: fix a real bug where DenoiserTower.project's reshape-and- recurse branch (for runtime_symbol_features on a per-row compiler/LTR slice) produced a 3D recursive call that the AP-024 plan-bias hook then misapplied to, even though that call is a per-row score, not a genuine MaskGIT round. Added an internal _apply_plan_bias switch and a regression test combining runtime_symbol_features with an attached plan connector. - twotower.py: reject abstract_plan_connector_arm != "disabled" with denoiser_backend="hf" too -- HFDenoiserTower is a standalone nn.Module with its own project() and no plan-connector hook at all, unlike StackedMatchedStateDenoiserTower, which subclasses DenoiserTower without overriding project() and so is correctly left unrejected. - self_distill_collect.py: a duplicate-answer candidate and a generate()/verifier exception now both persist an auditable row instead of being silently dropped or aborting the whole run. An error row omits prompt_fingerprint (unlike a duplicate/rejection) so the prompt is retried, not permanently resume-skipped, since the failure is presumed transient infrastructure trouble. Adds CollectionSummary.errored. - distill/__init__.py: add SOURCE_FAMILY and GenerateAbstractTrace to the lazy re-export set -- both are in self_distill_collect.py's own __all__ but were missing here, so importing them from the package raised AttributeError. - Design docs and versions.json updated to match (model.twotower v253, harness.distill v7, harness.experiments.slm211_untied_output_head no-bump). Not applied: CodeRabbit's suggestion to also list blocks.py under model.twotower's paths in versions.json -- it's already exclusively owned by harness.experiments.slm211_untied_output_head, and verify_version_stamps.py enforces one owner per path (confirmed by re-running the check with that change staged). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM --------- Co-authored-by: Claude <noreply@anthropic.com> * docs(autotrain): extend smoke loop ledger through iter65 (#975) * Add resumable Abstract-CoT warmup orchestration * docs(autotrain): extend smoke loop ledger through iter95 (#981) * feat: add abstract plan functional evidence (#983) * fix: tighten abstract plan functional evidence * docs(autotrain): extend smoke loop ledger through iter120 (#986) * feat: run bounded abstract plan interventions * feat: run bounded abstract plan interventions * fix: preserve constrained raw plan diagnostics * fix: canonicalize locked plan evaluation slots * fix: derive locked plan strata structurally * fix: fail closed on incomplete abstract plan matrix * docs(autotrain): extend smoke loop ledger through iter145 (#989) * docs(autotrain): extend smoke loop ledger through iter175 (#992) * docs: record abstract plan matrix disposition * fix: retain deterministic plan bypass evidence * fix: bound each abstract plan decode independently * fix: allow bounded long abstract plan decodes * docs: record abstract plan matrix disposition * docs(autotrain): extend smoke loop ledger through iter205 (#994) * docs(autotrain): extend smoke loop ledger through iter210 (#996) Fixture-or-scratch smoke autotrain measured results for iters 206–210. Not a ship claim. * SLM-399: operator-policy rows from collapse hard negatives Adds OperatorPolicyRowV1/OperatorPolicyHardNegativeV1 over the SLM-397 sanitized OperatorPolicyInputV1 boundary: one leak-free supervision row per collapsed conversation step, built by re-enumerating live legal-set membership fresh at each step's actual trace state (never copying the collapse's own recorded membership), then locating the accepted application by ID in that fresh set and re-projecting any adjacent-swap CONFLICT/ DIFFERENT_RESULT hard negative collapse_conversation_trace already computed onto this step's fresh action rows. A step whose recorded application isn't live in the fresh re-enumeration is rejected (RowRejectionKind. ACCEPTED_ACTION_NOT_LIVE), never forced in. Ships OperatorPolicyCorpusQualityReportV1 + build_operator_policy_corpus for accepted/rejected/hard-negative-outcome aggregation. Two hand-built fixture conversation traces exercise both hard-negative outcomes: two unconditional- overwrite operators produce a genuine DIFFERENT_RESULT swap (both orders execute, disagree on the final state), and a precondition-chained pair produces a genuine CONFLICT swap (the reordered execution fails outright). Building the rejection adversarial test surfaced a real registry-identity property worth documenting: an operator's application_id is sensitive to the whole registry's composition (via proof.compiler_result_digest), not just to that one operator's ow…
Tyler-R-Kendrick
added a commit
that referenced
this pull request
Jul 27, 2026
…05) (#908) * SLM-363: deterministic SemanticFrameV1 from canonical AST + structured schema (DSH2-02) Add SemanticFrameV1, CAP1SchemaV1, and derive_semantic_frame: entities, roles, relations, order, cardinality, closed-value alternatives, effects, and a required/optional/forbidden/unspecified fact partition, every fact carrying exact AST-path + schema-field provenance. Fail-closed throughout via UnsupportedSemanticFactError; no free-form/LLM-guessed fallback. Adds frame equivalence/conflict checks, an inverse frame-to-constraint path for candidate/ambiguity evaluation, and a proven one-fact counterfactual mutator. SLM-343 (the schema this issue references) has no merged code, so CAP1SchemaV1 derives from already-merged DslPack prop_order/backend slots instead of inventing a parallel schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-364: provenance-complete NL paraphrase provider + cache contract (DSH2-03) Add ParaphraseRequestV1/ResponseV1, a content-addressed cache key over exactly the reproducibility-determining fields (provider/model/prompt+ system digests/sampling/seed), a ParaphraseProvider protocol with a fully implemented deterministic offline provider plus a network-disabled API-key-shaped stub, and a quarantine-before-promotion store so a malformed/echoed/secret-leaking/rate-limited response can never reach a QuestionArtifactV1. build_prompt_payload sends only a schema+frame projection, excluding SemanticFrameV1.canonical_source (the literal DSL target text) and any label/split metadata. Stacked on the SLM-363 SemanticFrameV1 work this branch builds on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) - frame_paraphrases.py: four plan-declared styles (concise, descriptive, imperative, compositional) rendered from frame facts only — never from answer AST text; DSH2-03 provenance records per row; declared FrameLeakDetectorV1 rejects DSL production forms, marker surfaces, answer digests, and provenance fields; required-fact coverage and forbidden-fact absence enforced per row. - Offline deterministic fixture provider (DSH2-03 protocol); diversity metrics per frame/style/provider; exact + near-dup + repeated-template + cross-family dedup with rejected rows counted; accepted prompts linked to one canonical answer + equivalence set by fingerprint; grounding-floor stop rule drops leaking styles with a reason. - 29 new tests; slm365 component v1. * SLM-366: one-fact semantic counterfactuals + hard grounding contrasts (DSH2-06) - semantic_counterfactuals.py: typed one-fact mutations across six declared dimensions (role, order, cardinality, closed value, required child, relation) using only schema/grammar-licensed alternatives; one_fact_proof requires the declared dimension's diff non-empty and all others empty, distinct canonical fingerprints, both targets parse+validate+canonicalize, and inverse round-trip; two differing dimensions reject. - Prompts via the SLM-365 offline provider with matched style + length ratio control; marker surfaces permuted so surfaces are not a cue (prompts + proof byte-identical under permutation); embedding-close and inventory-matched topology negatives; constant/frequency baseline exactly 0.5; 11 coded rejections — uncontrolled pairs never counted. - Split family: counterfactual inherits source root family with a parent link; cross-family drift and cross-split reuse quarantined. - 44 new tests; slm366 component v1. * SLM-367: freeze two-pack generic CAP1 eval + schema-sensitivity suite (DSH2-07) - mini_pack.py + mini_flow.lark: complete test-only DslPack (lark authority, canonicalizer, static validator, CAP1SchemaV1 contract, SemanticFrameV1 provider, marker policy, fragment support); completeness_report + fail-closed require_complete_for_generic_claim; no OpenUI imports (AST-audited). - Cap1TwoPackSuiteV1: 41 rows, 2 packs x 2 base cases x 10 strata + excluded ambiguity row (original/empty/contradictory/reordered/ irrelevant schema, marker permutations, paraphrases, counterfactuals, ambiguity classes with accepted-set-or-exclusion recording, CAP0 identity retention); disjoint root families; sha256 rows + tamper-evident manifest + suite cards with full provenance; create-once freeze; fail-closed integrity. - score_schema_sensitivity (relevant must change, irrelevant invariant within tolerance); adjudicate_suite (canonical equivalence, required/forbidden facts, prompt invariance, determinacy calibration, CAP0 retention); gates with retention mandatory. - 35 new tests; slm367 component v1. * SLM-368: matched CAP1 grounding experiment — CERT_CAP1 rejected (DSH2-08) - Preregistered sha-locked block first: four arms (NL_NO_SCHEMA, SCHEMA_UNFILTERED, SCHEMA_FILTERED_SINGLE, SCHEMA_FILTERED_MULTI) differing only in declared data levers with family-stratified matched exposure; identical tiny tree-edit training, seeds {0,1}; two-pack train roots split-disjoint from the frozen SLM-367 suite. - Full evaluation on the frozen two-pack suite: schema replays (original/empty/contradictory/reordered/irrelevant causal probe), counterfactuals, marker permutations, ambiguity/determinacy, mandatory CAP0 retention; symbol-only audit; paired Wilson + exact McNemar; sharded within the cap; AgentV diagnostic. - Outcome: CERT_CAP1 rejected — underpowered (paired n=32 < 64) plus prediction_identical, ignores_schema, fails_hard_contrasts, cap0_regression at fixture scale; NL CAP2 stays closed. Certificate machinery proven both ways (issue on synthetic win; all six stop codes). Suite clean, zero contamination, exposure exactly matched. - 20 new tests; slm368 component v1. * SLM-379: schema-grounded NL descriptions of operator applications (DSH3-11) - OperatorFrameV1: deterministic fail-closed derivation from operator declaration + typed args + before-state + ActionEffectV1; required edit facts (every effect delta), forbidden facts only under exact compiler coverage (no overclaim under bounded/approximate), state-reference facts through typed descriptor tables; per-fact provenance, equivalence, conflict checks, fingerprint. - operator_nl_turns.py: admission under the exact OperatorLegalSetV1 + accepted set with coded rejections (missing_legal_membership, not_in_accepted_set, ambiguous_state_reference, compatible_with_non_equivalent, accepted_set_not_named, leak); symbol-only targets across three views; offline provider reusing the DSH2-03 contract unchanged. - Measured disambiguation report: unambiguous and accepted-set-named families admit at 1.0; non-equivalent and shared-descriptor families record the honest symbolic_cap2_only stop-rule disposition (overall 0.5). Contract-level machinery, not an NL-CAP2 ship claim. - 18 new tests; slm379 component v1. * SLM-390: quarantined runtime trace-to-eval candidate lifecycle (DSH4-05) - TraceEvalCandidateV1 + QUARANTINED -> REVIEWED -> FROZEN -> CONFIRMATION_USED lifecycle with validated explicit transitions (no automatic promotion); PROMOTED_TO_TRAINING as a separate transition creating a new DerivationActivityV1 + dataset version under a fresh train-split family, asserting the frozen manifest is byte-identical. - ingest_trace: redaction of paths/hosts/secret-shaped strings with canary support, fail-closed on secrets in structural fields; environment pinning + clustering by failure signature; stop rules (deidentification_failed, environment_not_reproducible, not_independently_verifiable) keep candidates quarantined. - mark_reviewed requires explicit reviewer + full checklist incl. separate agent/verifier trajectory review; freeze_candidate enforces deterministic env replay, held positive/negative verifier validation (no trivial/self-certifying verifiers), train/eval root-family dedup + disjointness, exposed-answer and shortcut checks; one-touch confirmation ledger; create-once tamper-evident manifest. - 20 new tests; slm390 component v1. * SLM-409: define exact SelectorRefV1 contracts and finite selector domains * SLM-409: define exact SelectorRefV1 contracts and finite selector domains Extend the existing typed-reference/ReferenceTableV1 machinery with a RefKind.SELECTOR that commits to a finite, pack-authorized, permutation-safe target set (component-type, single-schema-role, single-symbol-ref, and declared-role-descendant kinds) instead of a free-form query language. Selectors resolve only from current pack-authorized state and fail closed on stale state, cross branch/request use, wrong kind, changed membership, or fanout overflow. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-409: fix selector round-trip stability and re-attach idempotence Address CodeRabbit review on PR #910: - normalize SelectorDescriptorV1.compiler_facts (dedupe + sort) at construction so from_dict(to_dict(x)) == x for unsorted/duplicate facts - dedupe descriptors by fingerprint in attach_selectors so re-attaching an identical selector is idempotent instead of raising ref.duplicate - add regression coverage for both plus selector.cardinality_mismatch, selector.type_incompatible, and entry-ref stability across attach Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Satisfy the decode goals rather than only documenting them (#886) * Satisfy the decode goals rather than only documenting them The merged invariants work made the goals enforceable. Three of them were still only *stated*: a proven singleton could still cost a forward, speculative ranking was unreachable, and the shared ops vocabulary did not exist. This closes all three and reserves the vocabulary. I2 — a horizon-limited domain is not a contradiction. For the DSL-native codec `exact_forced_token_id` consulted only the pack completion domain, which needs budget to enumerate a terminal witness and returns coverage="none" when remaining_tokens is small (measured: none at <=4, complete at 8). It threw away a DFA proof that had already decided the position. It now falls through to that proof, while a *complete* domain naming several candidates still refuses. The whitespace veto is skipped for the native codec, because the native completion domain already excludes insignificant whitespace — applying it only in the fallback made one position disagree with itself depending on remaining budget. This turns `test_repair_exact_token_skips_forward_and_records_authority`, red on main since before the invariants doc existed, green. I3 — speculative ranking is reachable. Ships the committed table built train-split-only from the immutable certified corpus (openui_verified_v1: 1682 records, 89,415 native tokens, order 3, 523 contexts, templatized so it keys on symbols and never on free-form strings). `speculative_rank="ngram"` with no table named resolves to it. `--check` fails when artifact and builder disagree. It ranks real branch points confidently: `Stack(` at margin 1.0 after `root = ` (27 candidates), `<BIND_1>` at margin 1.59 after `root = Stack([` (25) — both decided from the symbol table with no forward. I4 — the scheduler gets a real checkpoint. `common_forced_run` proves the one thing available before position t is decided: if every legal candidate leads into the same length of forced lexemes, those positions are determined whatever the model picks. Bounded at 8 candidates, 4 lexemes, 4 rows; any budget exceeded claims nothing and leaves device-window sizing in place. Replaces the `forced_run_lengths=None` placeholder. I13 — the reserved ops vocabulary now exists. `dsl/ops_vocab.py` holds 19 ops across ast/graph/set/topology/history, in a new `ops` token-id namespace placed above every codec range so no stored embedding row moves. Two properties make it more than another list: it is derived from the live operator registries, so an op cannot be in the vocabulary without an implementation or implemented without appearing in it; and `shared_token_ids()` is the only mapping, so "shared encoder<->decoder" is the same function called twice rather than a convention two towers are asked to honor. Grammar layering is asserted, NL is absent by construction, and the fingerprint is pinned and CI-gated. The open rung is the encoder-conditioned campaign — e803 tested decoder targets only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ * Fix a decode-contract assertion my merged PR broke `test_prompt_inventory_is_visible_to_decode_and_persisted` asserts exact equality on the persisted `decode_contract` metadata. #881 added three keys to it — `grammar_constrained`, `diagnostic_control`, `certifiable` — so a diagnostic-control sample can never later be mistaken for a certified serving generation. The keys are intentional; the assertion was not updated. Verified by bisect: passes at d45d43f (pre-881), fails on main. CI missed it because `check_changed` did not select `test_bad_outputs.py` for #881's diff. Not fixed here, for the record: `test_annotations.py::test_sample_api_generates` asserts a 200 from `/api/sample`, but the committed playground demo checkpoint is output-contract v0 and the serving path deliberately refuses pre-v2 checkpoints ("checkpoint output contract v0 is incompatible with required symbol_only/v2"), exactly as MODEL_CARD describes. It fails at d45d43f too. Resolving it means either a v2 demo checkpoint or a decision to change what the endpoint promises — a product call, not a drive-by. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ * Keep the I2 tests out of the slow legacy fast-path suite CI run 30148188085 was cancelled: the `python` job hit the repository's three-minute cap. Cause was mine — appending the two I2 tests to `tests/test_dsl/test_grammar_fastpath.py` made `check_changed` select that whole file, and its ~40 node-bridge cases alone exceed the budget. #881 never hit this because a three-dot diff excludes main's own edits to the file, so it was never selected there. Moves them to `tests/test_dsl/test_exact_forced_horizon.py` (43s, well inside the cap) and restores `test_grammar_fastpath.py` byte-identical to main so it drops out of selection. Same coverage, same assertions — only the file they live in changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-410: implement atomic bulk set-property operator over SelectorRefV1 Add openui.map_set_property(selector, role, value) as the first consumer of the DSH5-01 SelectorRefV1 contract: applies one schema-valid property update to every exact selected node atomically (all-or-nothing, no partial commits), emits one ActionEffectV1 with exact per-target deltas and CompilerCoverage.EXACT, and rebuilds a fresh post-commit reference table. Adds OpenUILocalOperatorContextV1.resolve_selector to consume the existing reference-table selector resolution, and a diagnostic-only primitive-lowering oracle to prove equivalence against repeated SET_PROPERTY actions. Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap Co-authored-by: Claude <noreply@anthropic.com> * perf: slim Vercel function bundle from ~10.4 GB to 16.6 MB (#915) The deployed FastAPI function failed to build: local run artifacts (outputs/ ~10 GB, .venv, node_modules) were uploaded because the function-level excludeFiles glob is ineffective, and the wheel packaged resources/static (~100 MB) including 69 MB of training records.jsonl, contaminated further by a stale build/ directory. - .vercelignore: exclude build/run artifacts (/outputs, /.venv, /node_modules, /build, /session, /_uv, /tests, caches), published training records.jsonl, sourcemaps, oversized historical docs/design JSON, and the fixture checkpoint (dead weight without a runtime) - web/requirements-vercel.txt: slim deploy-only deps without numpy/onnxruntime (~109 MB); wired via installCommand since Vercel prefers uv.lock over requirements files - web/vercel.py: lazy ONNX import; web/service.py: model-less deploys raise honest GenerationExhausted so /api/sample hands off to the browser path (verified live: 200 + fallback_required, never a 500) - pyproject.toml: tool.uv package=false (entrypoint imports from the uploaded source tree; installed copy was pure duplication) and wheel exclude-package-data for records/governance/maps - vite configs: sourcemap=false; committed static 24 MB -> 6.1 MB - bundle policy test locks the new exclusions Verified: preview deploy succeeds; lambda 73 MB -> 16.6 MB; /api/health and /api/sample exercised via vercel curl. * Add SLM-298 local factorial harness (#898) * SLM-412: define OperatorTransactionV1 base-state and conflict contracts * SLM-412: define OperatorTransactionV1 base-state and conflict contracts Add PreparedOperatorActionV1, OperatorReadWriteSetV1, and OperatorTransactionV1 schema/safety contracts: several actions prepared against one shared base state get semantic read/write footprints derived from their exact effects (never operator names), a dependency/conflict graph, and one canonical, permutation-invariant transaction identity keyed by semantic action ID. Reuses merge.py's effect-target extraction and commutativity gate rather than duplicating conflict logic. Schema/validation only — no commit/execution path is wired, per the issue's own agent contract. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-412: normalize OperatorTransactionProofV1.checks for round-trip stability An independent adversarial review found the same bug shape CodeRabbit caught on SLM-409: to_dict() force-sorted and deduped `checks`, but __post_init__ never normalized the field, so from_dict(to_dict(x)) == x could fail for input built with unsorted/duplicate checks -- including the exact literal order build_operator_transaction constructs the proof with in production. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Add deterministic autotrain Grok workflow (#917) Encode the autotrain skill as a host-owned Rhai workflow under .grok/workflows with exact slm command plans, parallel data legs, durable state, and OpenWiki/contracts prompts. Allow .grok in repository policy and pin a feature-flag null-coercion regression. * SLM-267 + SLM-296: bounded wiring-evidence slices (ProgramSpec sampling, teacher admission) (#893) * SLM-267: bounded uniform-vs-coverage-targeted ProgramSpec sampling wiring evidence VSD2-02 asks for 10k/100k/1M-record ProgramSpec corpora comparing uniform against coverage-targeted sampling. The existing coverage-guided generator (SLM-5) samples from a fixed, exhaustible candidate grid, so those rungs are out of reach without a materially different generator. This scopes the issue to what the generator actually supports: a genuine uniform-random control arm (ProgramGenerator.generate_uniform, new), a deterministic (global_seed, shard_id, worker_id) sharding primitive, and an honest, reproducible measurement of the generator's own coverage-targeted-vs-uniform budget efficiency and state-space saturation point. - generate.py: refactor generate_one into _materialize + add generate_uniform (uniform-random candidate selection, no coverage bias) as a genuine control arm distinct from the existing greedy CoverageTracker.score() selection. - New harness (slm267_programspec_coverage_scaling.py) + CLI (generate_programspec_corpus.py) run both policies to a bounded budget, dedup by canonical-root fingerprint (in-memory), and report exhaustion point, unique roots, and programs-to-full-coverage per arm. - Fixture campaign (80 programs/shard x2 shards): coverage-targeted reaches full coverable-cell coverage in 19 programs vs uniform's 34-35; both exhaust the 3-component grid at 36 accepted (28 unique roots, 8 duplicate canonical roots via serialization collapse). - Disposition: inconclusive (wiring only) -- does not validate VSD-H7a/b/c, which require corpora/training several orders of magnitude larger than this fixture budget. Documented as explicit follow-up. Closes SLM-267. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg * SLM-296: bounded verifier-filtered teacher-admission wiring evidence AP-013 asks for >=500 accepted records from a capable separate-family teacher, filtered through G0-G10 + independent judgment + human audit, then a matched-budget fine-tune with grammar-on/off evaluation. This sandbox has no network access to a real teacher and no GPU -- SLM-266 already measured that even a local CPU teacher run is infeasible here (>=11 days extrapolated for 10k requests). Scoped down to a bounded wiring slice that exercises the two real safety mechanisms the acceptance criteria test: - generate.py's compiler-inverted ProgramSpec generator stands in as a deterministic offline candidate proposer (explicitly not a teacher), tagged source="teacher" (a verifier-stack weak source) so admitted rows structurally cap at Bronze tier regardless of gate passes -- "teacher self-judgment alone cannot assign Gold/Silver" is enforced by the real verify_record() tier rule, not asserted narratively. - check_family_independence() + a same-family "shadow judge" control: wiring independent_judge_passed=False for a same-family judge causes the real G11 gate to quarantine 10/10 sampled candidates; a different-family judge would pass. Locked-holdout decontamination excludes any candidate whose canonical root (SLM-171 diversity fingerprint) collides with a disjoint-seed holdout before counting yield (23/27 excluded in the fixture run, reflecting the generator's shared finite candidate grid already documented in SLM-267). Disposition: yield_limitation_no_real_teacher_available (wiring only) -- the >=500-record scale and grammar-on/off fine-tune comparison remain unaddressed in this sandbox and are documented as explicit follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg * Refresh SLM-267 evidence after rebase --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-397: freeze a sanitized typed OperatorActionViewV1 model boundary (DSH3-22) (#918) Adds OperatorPolicyInputV1/OperatorActionViewV1/ReferenceModelViewV1 as the only allowed model input for DSH3 M6/M7 learned operator policies: an immutable, row-indexed snapshot over a verified-fresh ReferenceTableV1 + OperatorLegalSetV1 pair. Row-local joins (parent_row, candidate_rows) replace every raw opaque/semantic identity; recursive forbidden-field validation guards the boundary structurally. build_operator_policy_input fails closed on a stale reference table or a mismatched operator registry. Covers the ticket's verification matrix and adversarial controls: index parent/position resolution, partial-coverage explicitness for unbounded repeated slots, opaque-ID/candidate-order permutation equivalence, and allocation-seed-only changes (which vary every downstream application/proof hash) leaving the sanitized view byte-identical. Registers model.operator_policy_view v1 in versions.json. Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS Co-authored-by: Claude <noreply@anthropic.com> * SLM-396: make LocalFlatHead optimizer-visible and checkpoint-stable (#897) Per-action embeddings were a plain dict, invisible to model.parameters() and thus never trained. Replace with a registered nn.ParameterDict, add explicit materialize()/checkpoint contracts that fail closed on registry/shape mismatch, and canonicalize action keys so opaque request/reference ids can't fragment the parameter table. LocalFlatHead stays a documented O(distinct-actions) diagnostic head, not a fake generalization claim. model.quantization bumped v5->v6. Claude-Session: https://claude.ai/code/session_01GbtSeD33wb4okHTpYrs4vJ Co-authored-by: Claude <noreply@anthropic.com> * SLM-386: export operator decision-state traces from existing legal-set contracts (#903) DSH4-01: reuse the DSH3-06 OperatorLegalSetV1 legal-action enumeration and the SPV2-03 TeacherTraceManifest provenance envelope to export certified operator decision-state traces instead of building a duplicate distillation data stack. Adds operator_decision_state.py (capture, accepted-trajectory replay, and a fail-closed export_for_teacher_query stop-rule gate), a fixture runner, tests, and a docs/design evidence pair. Bumps harness.distill to v3. Claude-Session: https://claude.ai/code/session_01HVU3Spui6zSHYvkmxi6iNL Co-authored-by: Claude <noreply@anthropic.com> * SLM-387: one-teacher ceiling over exact operator legal sets (DSH4-02) (#922) Implements the full teacher-vs-baseline comparison harness required before any operator legal-set distillation work: a synthetic, explicitly non-real stand-in teacher adapter (SyntheticDescriptorTeacherV1) behind the same interface a real LLM teacher would use; frequency, deterministic compiler-order, current-scorer, and descriptor-similarity baselines plus an oracle upper bound; accepted-set mass/MRR/NDCG/calibration/selective-risk/ verifier-regret-correlation metrics; a candidate-order/opaque-id/ description-length/prompt-template perturbation-robustness harness; paired bootstrap significance; and a stop-rule gate. Run honestly against the synthetic teacher on deterministic fixture data (scripts/run_dsh4_02_operator_teacher_ceiling_fixture.py), the harness reports DEFER (do not distill): the synthetic teacher does not significantly beat any required baseline on paired MRR and its scores negatively correlate with verifier-backed outcomes, though perturbation robustness is perfect by construction. This is fixture/wiring evidence (claim_class: wiring) only -- a production KD-readiness claim requires swapping a real teacher behind OperatorTeacherAdapter and re-running this exact harness. Bumps harness.distill to v4 in versions.json. Claude-Session: https://claude.ai/code/session_01HVU3Spui6zSHYvkmxi6iNL Co-authored-by: Claude <noreply@anthropic.com> * SLM-249 (LOT0-02): define CompilerReasoningTraceV1 target-trace contract (#909) Implements the LOT0-01 authorization's allowed_lot1_work scope: a typed, compiler-grounded reasoning-trace schema and deterministic extractor (reusing SemanticPlanV1 and the production codec, no new compiler/parser/evaluator), a lossless visible serialization, permutation-invariant/cycle-free/ truncation-explicit helpers, a bounded (n=16 fixture) K/c coverage probe, a fully specified but deliberately not-run oracle-ceiling experiment plan, and a defined-but-not-run causal_latent_use falsification-test spec extending causal_trace.py. Gate verdict: inconclusive -- the oracle campaign that would justify LOT1's model implementation requires GPU training and corpus work this issue does not authorize. Claude-Session: https://claude.ai/code/session_01625N4JruoBHHmrH2pXmRR4 Co-authored-by: Claude <noreply@anthropic.com> * Track AgentEvals grader metrics (#920) * Enforce harness-owned opaque template slots * Make strict template evaluation the default * Document longer opaque-slot baseline * Reject duplicate structural references * Close covered structural arrays * Record rejected all-path plan margin * Centralize canonical corpus defaults * Move slot conversion into harness boundary * Record harness-owned slot smoke * Keep training local and record typed collection result * Train surgical typed collection baseline * Record action group data rejections * Record lexer structural decode diagnosis * Record root arity warm start rejection * Enforce harness-owned opaque markers * Fix opaque marker ownership in data harnesses * Fix harness-owned marker and warm-start contracts * fix warm-start vocabulary ownership * fix deployed evidence bundle size * fix Vercel exclusion glob limit * fix Vercel corpus exclusions * fix Vercel upload exclusions * record recovered baseline evaluation * record hard-tail continuation result * record balanced replay result * record low replay result * add typed role training supplement * record invalid typed role scratch attempts * add focused typed role corpus * record focused role continuation failure * record focused role retention result * record E891 canvas cap results * reject untyped array forward references * prefer certified typed array items * activate planned typed array items * extend typed item margin to lexer * apply typed item margin after schema pruning * limit typed item margin to closed leaves * record typed item margin results * clarify gold-relative quality metrics * lock compact semantic metric distinction * test schema-aware component constraints * test schema-aware inline item planning * fix closed array component arity * tighten component-valued schema paths * test use opaque markers in compiler fixtures * reject conflicting typed binder reuse * bound typed forward references by slots * fix enforce role-safe training targets * fix enforce role-safe decoder strings * fix bound role-safe decoder nesting * fix audit role-safe outputs without style shifts * fix keep structural identities unique by role * docs record rejected inline typed items * docs record rejected lattice recovery * docs record no-op array close treatment * docs record rejected compiler array close * docs record rejected clean scratch checkpoint * docs record rejected symbol reservation * fix close direct training target leaks * docs confirm training boundary decode parity * docs record weighted scratch comparison * fix softly penalize repeated compiler binders * docs record rejected visible reference penalty * docs reject generic binder reuse penalty * fix withdraw harmful compiler reuse penalty * docs confirm compiler penalty withdrawal parity * fix reserve slots for typed binder obligations * docs reject incomplete typed slot reservation * fix reserve symbols for typed binder obligations * docs reject symbol slot reservation * fix withdraw typed slot reservation * docs confirm slot reservation withdrawal parity * docs reject binder arity scratch checkpoint * docs reject low weight binder arity arm * docs reject unique binder filtering * docs reject scoped binder ownership * docs reject arity lattice recovery * docs diagnose arity form fallback * docs reject arity slot margin * docs reject joint binder supervision * docs reject topology data supplement * docs reject generic topology exposure * docs reject binder component plan arm * perf scan binder component targets * docs reject full binder component arm * docs reject low binder component arm * fix isolate binder component gradients * docs reject detached binder component arm * test clarify role unsafe fixtures * docs reject joint binder plan arm * feat apply binder plan before declaration * test remove content-like sanitizer fixtures * docs reject predeclaration binder plan arm * docs close predeclaration binder scalar sweep * feat mask binder plans by typed use sites * docs reject typed binder candidate checkpoint * docs reject binder arity isolation * docs close binder arity scalar sweep * feat scope binder arity to bound declarations * docs record bound-only arity diagnostics * docs record dedicated root arity train * docs reject dedicated root arity checkpoint * docs isolate root arity decode ablation * docs record partial matched exposure control * docs complete matched exposure control * docs close matched exposure control * docs record partial v271 exposure train * docs complete v271 exposure train * docs record v271 exposure smoke pass * docs close v271 exposure sweep * feat generalize root reference identity * fix route lexer identity sampling * docs record partial v272 root identity train * docs complete v272 root identity train * docs record v272 root identity smoke * docs record v272 dual card timeout * docs: record invalid E1079 reproduction * fix: make AgentEvals named metrics authoritative * docs: record E1080 partial reproduction * docs: complete E1080 scratch record * Add document-only ProgramSpec campaign evidence * Track AgentEvals grader metrics * Fix Vercel exclusion policy * Restore structural identifier contract * SLM-413: implement atomic transaction composition, commit, and replay (#921) * SLM-413: implement atomic transaction composition, commit, and replay Wire the execution path SLM-412 deliberately deferred: compose_operator_transaction independently dry-runs each prepared action against the shared immutable base and folds their base-relative AST deltas via a shared 3-way merge primitive (extracted from merge.py into ast_merge.py so both modules reuse one algorithm) instead of re-executing operators sequentially against progressively stale reference tables. commit_operator_transaction runs full pack authority on the composed source once, builds one composite proof and fresh branch-local reference table, and any preparation/composition/ validation failure leaves the base state untouched. Adds a TRANSACTION_COMMIT conversation turn so a transaction commits as one CRDT event carrying every constituent application ID, and exact replay from base + recorded transaction. Also fixes a pre-existing gap in transactions.py's target lineage that made bulk/selector operators unpreparable into any transaction. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-413: rebuild ops-vocab registry for the new conversation.transaction_commit op CI's decode-invariant check (I13) caught that adding TRANSACTION_COMMIT to ConversationOperation drifted the committed shared encoder<->decoder ops vocabulary without rebuilding it. Rebuild via ops_vocab.write_registry() (19 -> 20 ops; conversation.transaction_commit inserted into the history family, shifting subsequent token_ids by one) and bump ops.vocab to v2. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Record seed-7 topology control * SLM-398: typed categorical embeddings over the sanitized operator view (DSH3-23) (#923) * SLM-398: typed categorical embeddings over the sanitized operator view (DSH3-23) Adds OperatorFeatureEncoder/OperatorFeatureVocabularyV1/CandidateScoringHead over the SLM-397 OperatorPolicyInputV1 boundary, with three matched arms: hash_scalar (the existing _stable_scalar control, preserved as-is), typed (learned per-field embeddings for ref_kind/value_type/compiler_facts/ operator_id/binding_phase/effect_kind/locality/cost/position), and typed_identity_bucket (typed plus a labeled row-position-only anti-generalization control). All three share one ragged OperatorFeatureBatchV1 and CandidateScoringHead, so matched parameters/optimizer/steps/seed hold structurally rather than by convention. Ships scripts/run_dsh3_23_operator_feature_encoder_fixture.py, which trains and evaluates all three arms on a small deterministic fixture and emits OperatorFeatureEncodingReportV1 evidence (docs/design/ dsh3-23-operator-feature-encoder.{md,json}). At fixture scale the run is honestly underpowered (both hash_scalar and typed hit the toy task's ceiling) but the adversarial permutation-robustness control is decisive: typed and hash_scalar are exactly invariant under a row-order/opaque-ID reshuffle, while typed_identity_bucket -- which can see row position -- is not, confirming the SLM-397 boundary blocks identity-based shortcut learning even when a model is deliberately given a spurious position-like feature to exploit. claim_class: wiring; no ship or capability claim is made. Registers model.operator_feature_encoder v1 in versions.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS * Fix flaky exact-float permutation-invariance assertion in feature-encoder test Comparing embedding tuples with Python == is sensitive to BLAS/hardware- dependent floating-point summation order (CI runner vs local dev), causing ULP-level mismatches on an otherwise-passing permutation-invariance check. Switch to a per-value pytest.approx comparison, matching the tolerance already used by the production module's own _permutation_robustness check. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-300 + SLM-250: self-context exposure-bias curriculum + LOT1-01 not_authorized (#895) * SLM-300: wire self-context exposure-bias curriculum (AP-015) Add the preregistered self-context/scheduled-corruption curriculum manifest, an exact policy_origin_mixture(rate, lagged_share) function (gold vs. current-policy vs. lagged-policy mass split), and a torch-free fixture runner/CLI following the SLM-120 corruption curriculum pattern. Proves the "mixture zero reproduces legacy behavior" acceptance criterion as an exact, unit-tested invariant. Actual multi-seed self-context training arms remain gated on a GPU host and the certified baseline checkpoint (SLM-103); this is wiring evidence only, no recovery or ship-gate claim is made. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KShriKrGosZr67yVPFgi78 * SLM-300: address CodeRabbit review on PR #895 - run_fixture_self_context_curriculum now calls validate_manifest and raises ValueError on an invalid manifest (missing 0.0 control, empty seeds), matching its own docstring and hardening the function as a trust boundary. - _arm_label is now lossless for arbitrary caller-supplied rates (e.g. 0.101 vs 0.104 no longer collide onto the same "SC10" label and run_id); default preregistered rates (0.10/0.25/0.50) render identically to before. - CLI: malformed --seeds/--self-context-rates CSV values now return a controlled exit code 2 instead of an uncaught ValueError traceback. - CLI: frontier mode's fixture fallback now returns exit code 2 instead of 0, so a scheduler checking only the exit code can't mistake it for a completed frontier run. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KShriKrGosZr67yVPFgi78 * fix: restore main CI after #920 (levers, tokenizers, vocab remap) Main #920 dropped DEFAULT_* / PROHIBITED lever constants, left selection importing DIFFICULTY_EASY_TAIL_FRACTION without defining it, expanded STRUCTURAL_ID_ATOMS without tokenizer version/layout updates, and removed _remap_vocab_weight while still calling it. Restore those and refresh the layout registry so data-build + verify_tokenizer_grammar_invariants pass. * fix(SLM-300): prepend ops.vocab no-bump after rebase onto main Keep ops.vocab history append-only vs main v2 (SLM-413) after the tokenizer layout registry refresh for #920 CI recovery. --------- Co-authored-by: Claude <noreply@anthropic.com> * Add SLM-268 fail-closed activation audit (#928) * SLM-302: reserve the collision-free AbstractPlanV1 codebook (AP-016) (#899) Define AbstractPlanV1, reserve default-off abstract-plan delimiters/slots in openui_tokens + dsl/choice tokenizers, fail closed on out-of-range slot counts, and document the contract. Tokenizer defaults stay byte-identical when abstract_plan_slots=0. * SLM-325: bridge CAP2 latent codecs to program-scale SemanticPlanV1 factors (#904) Adds deterministic SemanticPlanV1 program-factor tensorization (inventory, cardinality, topology, binder/reference graph, property roles/values, style/layout) and a CAP2-05 harness that runs the existing CAP2-02 codec families (uniform scalar, mixed-radix FSQ, binary LFQ, learned VQ, continuous) over it via their existing semantic_trace mode. Generalizes KaryBottleneck's no-bypass audit to any LatentCodec so decoder inputs are proven to contain only codec output, never a raw factor tensor. Claude-Session: https://claude.ai/code/session_01CL7wh4Xw51nQtJFR6hzBGD Co-authored-by: Claude <noreply@anthropic.com> * SLM-383 (DSH3-15): causal-attribution experiment for the hierarchical operator action head (#913) * SLM-383 (DSH3-15): run the causal-attribution experiment for the hierarchical operator action head Restores the wiring-only hierarchical operator action head from closed PR #907 (branch claude/inspiring-franklin-q77bwy, commit a6195e5) and adds the multi-seed causal-attribution experiment DSH3-15's own acceptance criteria require but that PR explicitly deferred: token baseline vs. weight-zero (frozen no-op capacity control) vs. enabled (trained) arms, over a fixture corpus whose gold operator depends only on a typed candidate-group-size feature (never opaque ids/display names), following the E803 (reserved_operator_baseline) harness pattern. Result: the enabled head strictly beats its own weight-zero capacity control (trainable, not a dead architecture) but ties exactly with the token baseline (both memorize the finite shape vocabulary to ceiling), so it does not causally improve beyond it. Per DSH3-15's own stop rule, the head stays default-off and REJECTED -- flipping cap2_disposition.py's HIERARCHICAL_HEAD verdict from UNRUN_CONDITIONAL to REJECTED with real evidence, and regenerating the DSH3-17 terminal disposition accordingly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N9wPE3V4hCMpcQ8bTA3bEB * fix(SLM-383): restore versions.json path ownership after rebase * fix(SLM-383): keep hierarchical_head off operators package init Eager re-export imported torch into ops_vocab via `from slm_training.dsl.operators import local`, breaking python-static verify_decode_invariants. Import the head from its submodule instead. --------- Co-authored-by: Claude <noreply@anthropic.com> * Optimize capacity-aware sampling * Add unblock-in-review Grok workflow (#940) Parallel Linear In Review drain: claim, worktree, babysit/fix CI, squash-merge, Done, self-heal. * SLM-328: run the program-factor latent size/width/codec rate-distortion sweep (#945) * SLM-325: bridge CAP2 latent codecs to program-scale SemanticPlanV1 factors Adds deterministic SemanticPlanV1 program-factor tensorization (inventory, cardinality, topology, binder/reference graph, property roles/values, style/layout) and a CAP2-05 harness that runs the existing CAP2-02 codec families (uniform scalar, mixed-radix FSQ, binary LFQ, learned VQ, continuous) over it via their existing semantic_trace mode. Generalizes KaryBottleneck's no-bypass audit to any LatentCodec so decoder inputs are proven to contain only codec output, never a raw factor tensor. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CL7wh4Xw51nQtJFR6hzBGD * SLM-328: run the program-factor latent size/width/codec rate-distortion sweep Adds a CAP2-06 harness that sweeps latent count x encoder width x codec family (uniform scalar, mixed-radix FSQ, binary LFQ, learned VQ, continuous) over the SLM-325 SemanticPlanV1 program-factor tensorizer, reconstructing the full factor vector through a single linear decoder and reporting per-factor-family MSE, serialized rate, and the smallest passing configuration per codec (3-seed confirmation). Reuses the existing codec families and audit_no_bypass unchanged. Found and fixed a real bug during development: select_retained_configs only checked the distortion threshold, so a cell whose encoder collapsed to a constant/dead code (a genuine failure mode at minimum capacity) could be wrongly promoted if it happened to reconstruct a low-variance factor well. Fixed by also requiring the no-bypass audit to pass; added regression tests that construct this exact scenario synthetically. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CL7wh4Xw51nQtJFR6hzBGD --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(model_build): unblock autotrain smoke train/eval paths (#948) Wire missing ModelBuildConfig fields used by train/eval CLIs, default max_wall_minutes to MAX_HARNESS_WALL_MINUTES, fail-close evaluate_model unconstrained fallback, and stop deriving semantic_role from opaque template markers. Align eval_gates fixtures to :slot_N markers. Record fixture smoke measured results; bump model.twotower v247 / harness.model_build.eval v60. * Close the tokenizer fallback and enforce cross-harness law parity (#935) * docs: audit agent-harness parity and implementation/intent gaps Reproduce and record two classes of defect against 42d76b2: A. The DSL native tokenizer vocabulary is environment-dependent. When src/apps/openui_bridge/node_modules is absent, the hybrid grammar backend falls through to Lark and _COMPONENT_NAMES admits grammar rule/terminal names (AST, NAME, STRING, ... and "Za", a fragment of [A-Za-z0-9_]), taking vocab_size 569 -> 605 with DSL_TOKENIZER_VERSION unchanged. The seam that does this is commented "fail-open fallback", contradicting the AGENTS.md fail-closed invariant, and the guard that would catch it only runs in the one CI job that installs the bridge -- with an assertion message that instructs the wrong fix. B. Only the decode invariants have a cross-surface parity check. Every other repository law (run cap, iron law, data-quality law, model card, version stamps, dashboard parity, campaign law) is missing from one or more of GEMINI.md, copilot-instructions.md and .cursor/rules. Grok is a recognized harness with no instruction surface, README overstates hook coverage (.github/hooks/changed-tests.json is an empty stub), MCP server sets diverge, and the documented skill-refresh commands produce a state scripts/repo_policy.py rejects. Includes a four-phase fix plan and the reproduction command for each finding. Documentation only; no harness or metric file touched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013s4yug4A2DCE3RykH7191Q * Close the tokenizer fallback and enforce cross-harness law parity Implements all four phases of docs/design/agent-harness-parity-audit.md. Phase 1 — the output vocabulary is no longer environment-dependent. dsl.openui_tokens.STRUCTURAL_TOKENS is now authoritative for the default DSL instead of being re-derived from whichever grammar backend is live. Routing it through the backend made vocab_size swing 569<->605 depending on whether src/apps/openui_bridge/node_modules was installed, with DSL_TOKENIZER_VERSION unchanged — silently incompatible checkpoints. The backend seam survives only for a non-default SLM_GRAMMAR_DSL, where it now fails closed. lark_backend.structural_tokens() extracts quoted literals rather than scraping capitalised words out of the grammar text, which had been admitting rule/terminal names and a char-class fragment ("Za") into a model vocabulary. Layout is unchanged at 569; it is now pinned by tests that need no Node, and the certificate's assertion text no longer invites writing an accidental layout into the registry. Phase 2 — scripts/verify_agent_surfaces.py owns a declarative obligation x surface matrix covering twelve repository laws plus hook parity. verify_decode_invariants delegates to it rather than keeping a second copy. Missing laws backfilled into CLAUDE.md, GEMINI.md, copilot-instructions.md, a new .cursor/rules/repo-laws.mdc, and the Grok workflow header; surfaces now cite the canonical I* ids, and I7 is a documented invariant rather than a phantom id. repo_policy checks skill mirrors in both directions. Phase 3 — .github/hooks/changed-tests.json was an empty stub; it and .codex/hooks.json now carry the same PostToolUse pair as Claude Code, and hook parity is itself certified. README no longer claims the agent hooks run the changed-file checker. Phase 4 — the skill-refresh block is deleted from AGENTS.md in favour of .agents/skills/README.md as single owner, with -a codex dropped and a normalisation loop so following it leaves repo_policy green. MCP divergence is documented; Codex's Serena block is committed. Bumps model.twotower v245->v246 and decode.invariants v2->v3. Also records A3, found while verifying Phase 1 and deliberately not fixed: run_slm157_flow_consistency_fixture.py mirrors into committed docs/design evidence under a bare `if args.mode == "fixture"`, ignoring an explicit --output-dir, so plain pytest rewrites the durable ledger with nondeterministic numbers. 54 of 76 run_*.py share the shape, so the semantics are the experiment owners' call. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013s4yug4A2DCE3RykH7191Q * Pin the tokenizer vocab cap to the layout registry, not a magic number test_vocab_is_fixed_and_typed asserted `vocab_size <= 512`. Main #920 folded STRUCTURAL_ID_ATOMS into the fixed literal set (505 -> 569) and left the cap behind, so this test had been red on main -- with and without the Node bridge -- while CI stayed green, because check_changed --changed-tests-only runs only changed test files and this one had not changed. Assert against the checked-in tokenizer_layout_registry.json instead, so the bound cannot go stale silently again. Same root cause as A1: the vocabulary moved and its guards did not. Recorded as A2b in docs/design/agent-harness-parity-audit.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013s4yug4A2DCE3RykH7191Q --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-332: add hard-valid latent geometry objectives (#956) * SLM-332 add hard-valid latent geometry objective * SLM-332 retain opaque binding contrast edges * SLM-332 normalize AgentV evidence paths * SLM-332 record local geometry diagnostic * SLM-332 refresh rebased geometry evidence * SLM-393: freeze the CAP2 operator-policy rebase addendum (#900) Inventories every CAP2 operator-policy symbol against production/fixture/ untested status with file:line anchors, empirically confirms the LocalFlatHead optimizer-visibility gap DSH3-21 fixes, and builds a dependency-readiness map for DSH3-19 through DSH3-33 from Linear blockedBy edges so future sessions know which increments are unblocked. Design-only; no runtime behavior change. Claude-Session: https://claude.ai/code/session_019c9boLgpJYyjdupKCn8317 Co-authored-by: Claude <noreply@anthropic.com> * docs(autotrain): multi-iteration smoke loop measured results (#961) * docs(autotrain): record multi-iteration smoke loop measured results Persist fixture/scratch autotrain loop ledger (iter2–5) under docs/design with honest non-ship labeling; train/eval ran via canonical slm CLI under MAX_HARNESS_WALL_MINUTES. * docs(autotrain): add iter6 measured results * docs(autotrain): include iter6 in loop ledger * Fix effect-derived merge conflicts (#965) * docs(autotrain): extend smoke loop ledger through iter16 (#966) Record fixture/scratch measured results for autotrain loop iterations 7–16 and refresh the aggregate ledger. Not a ship claim. * docs(autotrain): extend smoke loop ledger through iter25 (#968) Fixture/scratch measured results for iterations 17–25 plus refreshed aggregate ledger. Not a ship claim. * docs(autotrain): extend smoke loop ledger through iter40 (#970) * feat(operators): rebuild post-merge references (#969) * SLM-304: implement codebook-only abstract trace decoding (AP-017) (#947) Default-off prompt/abstract/answer decode phases on CausalLMOpenUIPlugin: abstract phase hard-masks logits to the AbstractPlanV1 codebook plus <endabstract>, forces the end at m_max with recorded forced termination, rejects malformed/nested delimiters as hard errors, and carries independent abstract/answer sampling params and seeds plus per-phase token counts and per-token logprobs. Legacy outputs/logits are byte-identical when off. * docs(autotrain): extend smoke loop ledger through iter50 (#971) * SLM-307 (AP-019): block-structured bottleneck attention and masked SFT loss (#951) Add slm_training.models.block_attention: a segment-aware additive attention mask that reproduces the Abstract-CoT bottleneck (arXiv:2604.22709) -- target tokens may never attend privileged-plan positions directly, even though a plain causal mask exposes them, while abstract tokens still read the plan. Loss is restricted to abstract+target positions, and packed batches get per-example isolation via an optional example_ids tensor. Wire it into a new, opt-in CausalLMOpenUIPlugin.forward_with_segments method; the existing forward() full-sequence path is untouched (default-off, legacy behavior unchanged). The bypass canary (test_block_attention.py and the plugin-level mirror) deliberately omits the abstract span, since abstract-mediated plan->target information flow is the intended mechanism, not the bypass this masks: only a fixture with no abstract intermediary isolates the direct edge that must go from leaking (plain causal) to blocked (bottleneck mask). Claude-Session: https://claude.ai/code/session_011uJCkG9ALyro7QvXcCYt14 Co-authored-by: Claude <noreply@anthropic.com> * SLM-315 (AP-023): add a lightweight discrete abstract-plan head to TwoTower (#952) * SLM-315 (AP-023): add a default-off AbstractPlanHead over context-tower states Add slm_training.models.abstract_plan_head.AbstractPlanHead: predicts a short AbstractPlanV1 (AP-016) codebook-index sequence from TwoTowerModel's pooled context-tower state, with disabled | teacher_forced | sampled | oracle | random | shuffled modes. Wired as a new opt-in TwoTowerModel.abstract_plan_trace(...) method only -- training_loss()/ forward() are unmodified, so no plan signal reaches the decoder unless a caller explicitly invokes it (AP-027 will own actually connecting a plan signal into the decoder). abstract_plan_mode="disabled" (the default) builds no head at all -- zero parameters, RNG/optimizer-group/compatibility_fingerprint bit-exact with the prior baseline, mirroring every other optional aux head already in twotower.py (binder_arity_head, component_plan_head, etc.) via the existing isolated_aux_init helper. Bump model.twotower to v249 in versions.json (new watched files abstract_plan_head.py + its test; behavior changes only under a non-default mode). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uJCkG9ALyro7QvXcCYt14 * Address CodeRabbit review on #952: validate abstract_plan_mode, target_plan_ids, generator device - TwoTowerConfig.__post_init__ now rejects any abstract_plan_mode not in AbstractPlanMode's value set (mirrors the sibling recursive_*_mode validation pattern). Previously a typo silently took the "enabled" branch in __init__, undermining the disabled-by-default bit-exact guarantee documented in abstract-plan-head-v1.md. - AbstractPlanHead.forward validates caller-supplied target_plan_ids shape (batch, plan.rounds) and bounds ([0, plan.slot_count)) before use, and rejects a generator whose device doesn't match the context tensor's device with a clear ValueError instead of a confusing deep torch RuntimeError. - Register the integration test and design doc in model.twotower's watched paths (versions.json) so future edits to them are tracked too; bump v249 -> v250 for this follow-up. - New regression tests live in tests/test_models/test_abstract_plan_head.py (not the existing, partially-flaky test_twotower.py) to keep this diff's local pre-commit hook run isolated from unrelated pre-existing failures in that large shared file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uJCkG9ALyro7QvXcCYt14 * Fix SLM-315 review regressions --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-309 + SLM-316 (AP-020, AP-024): on-policy self-distillation collector and abstract-plan denoiser connector (#976) * SLM-309 (AP-020): on-policy abstract self-distillation collector Close the warm-up train-inference gap by sampling prompt-only AP-017 abstract traces on-policy and verifying each candidate independently (the generating policy is never the sole semantic judge) before it is eligible for [prompt; abstract; verified target] training. - collect_on_policy_traces: deterministic (ordered + shard_index/ num_shards), resumable (prompt fingerprint scoped to policy+decode config), duplicate-free (answer fingerprint catches the same output recurring for a different prompt), and auditable on rejection (rejected samples are still appended with a reject_reason). Writes through the existing TraceStore in the meta/labels/final shape select.py already filters, so no new selection plumbing is needed. - training_example_from_capture / segment_ids_for_capture: adapt a collected trace into AP-019's forward_with_segments call-site (masked SFT loss over abstract+target only), reusing the existing owner instead of a new trainer. - SelfDistillCollectConfig(enabled=False) is a pure no-op, so the bottleneck-only control stays reproducible whether or not this collector runs. Bumps harness.distill to v5 in versions.json and adds a design doc noting this is wiring only -- no training run was executed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM * fix(distill): break circular import from eager self_distill_collect load harnesses.distill.__init__ imported self_distill_collect eagerly, which imports models.abstract_decode. abstract_decode imports models.causal_trace, which imports harnesses.distill.trace_store -- triggering this package's __init__ a second time mid-initialization, before self_distill_collect (and therefore abstract_decode) had finished defining its names. Any fresh-process import of models.abstract_decode or models.causal_trace hit this ImportError. Load self_distill_collect's names lazily via __getattr__ instead (the same pattern already used for the torch-heavy sft.py trainer), so the cycle never re-enters the package init. Adds a subprocess-based regression test, since a same-process pytest run can't reliably reproduce the cycle once the modules are already cached. Bumps harness.distill to v6 in versions.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM * SLM-316 (AP-024): abstract-plan denoiser connector Condition MaskGIT denoising on the AP-023 (SLM-315) discrete abstract plan via one gated-additive connector, matching the repo's existing conditioning idiom (DenoiserTower._runtime_symbol_features, TwoTowerModel._component_inventory_bias/_component_plan_bias): a post-hoc additive bias on already-computed vocabulary logits, applied once inside DenoiserTower.project -- every MaskGIT round already calls project, so no round-loop scheduling change is needed and the singleton/exact-forced-token bypass paths (which never call project) are structurally untouched. - abstract_plan_connector.py: PlanConnectorArm (disabled/learned/ oracle/detached/empty/random/shuffled) resolving through one resolve_plan_vector code path; AbstractPlanConnector owns a small codebook-local embedding table (the plan's absolute reserved vocabulary ids are reserved in the causal-LM tokenizer's namespace, not necessarily valid rows in an arbitrary TwoTower vocabulary) plus a zero-initialized gated projection to vocab logits; PlanConnectorTrace records gate norm and a correlational (not causal) per-call argmax choice-change count. - blocks.py: set_plan_connector/set_plan_vector/ pop_plan_connector_traces on DenoiserTower; project() applies the bias only for batch-shaped (3D) logits, leaving per-row compiler/ tree-scorer slices untouched. - twotower.py: abstract_plan_connector_arm config field (default-off, requires abstract_plan_mode enabled, rejects shared_recursive denoiser_arch since SharedRecursiveDenoiserTower doesn't implement the hook yet); TwoTowerModel.abstract_plan_connector is a property reading denoiser._plan_connector (single registration point, so named_parameters()/optimizer_parameter_groups don't silently drop it under identity-based dedup); new generate_with_plan_connector(...) delegates to the existing unmodified generate() so every arm shares scheduling/seed. Bumps model.twotower to v252; adds a no-bump note to harness.experiments.slm211_untied_output_head (blocks.py is shared, one-owner-per-path) explaining the change is unrelated to output-head tying. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM * Address CodeRabbit review on PR #976 - blocks.py: fix a real bug where DenoiserTower.project's reshape-and- recurse branch (for runtime_symbol_features on a per-row compiler/LTR slice) produced a 3D recursive call that the AP-024 plan-bias hook then misapplied to, even though that call is a per-row score, not a genuine MaskGIT round. Added an internal _apply_plan_bias switch and a regression test combining runtime_symbol_features with an attached plan connector. - twotower.py: reject abstract_plan_connector_arm != "disabled" with denoiser_backend="hf" too -- HFDenoiserTower is a standalone nn.Module with its own project() and no plan-connector hook at all, unlike StackedMatchedStateDenoiserTower, which subclasses DenoiserTower without overriding project() and so is correctly left unrejected. - self_distill_collect.py: a duplicate-answer candidate and a generate()/verifier exception now both persist an auditable row instead of being silently dropped or aborting the whole run. An error row omits prompt_fingerprint (unlike a duplicate/rejection) so the prompt is retried, not permanently resume-skipped, since the failure is presumed transient infrastructure trouble. Adds CollectionSummary.errored. - distill/__init__.py: add SOURCE_FAMILY and GenerateAbstractTrace to the lazy re-export set -- both are in self_distill_collect.py's own __all__ but were missing here, so importing them from the package raised AttributeError. - Design docs and versions.json updated to match (model.twotower v253, harness.distill v7, harness.experiments.slm211_untied_output_head no-bump). Not applied: CodeRabbit's suggestion to also list blocks.py under model.twotower's paths in versions.json -- it's already exclusively owned by harness.experiments.slm211_untied_output_head, and verify_version_stamps.py enforces one owner per path (confirmed by re-running the check with that change staged). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GoutW9nzZhxguVbmVY9rcM --------- Co-authored-by: Claude <noreply@anthropic.com> * docs(autotrain): extend smoke loop ledger through iter65 (#975) * Add resumable Abstract-CoT warmup orchestration * docs(autotrain): extend smoke loop ledger through iter95 (#981) * feat: add abstract plan functional evidence (#983) * fix: tighten abstract plan functional evidence * docs(autotrain): extend smoke loop ledger through iter120 (#986) * feat: run bounded abstract plan interventions * feat: run bounded abstract plan interventions * fix: preserve constrained raw plan diagnostics * fix: canonicalize locked plan evaluation slots * fix: derive locked plan strata structurally * fix: fail closed on incomplete abstract plan matrix * docs(autotrain): extend smoke loop ledger through iter145 (#989) * docs(autotrain): extend smoke loop ledger through iter175 (#992) * docs: record abstract plan matrix disposition * fix: retain deterministic plan bypass evidence * fix: bound each abstract plan decode independently * fix: allow bounded long abstract plan decodes * docs: record abstract plan matrix disposition * docs(autotrain): extend smoke loop ledger through iter205 (#994) * docs(autotrain): extend smoke loop ledger through iter210 (#996) Fixture-or-scratch smoke autotrain measured results for iters 206–210. Not a ship claim. * SLM-399: operator-policy rows from collapse hard negatives Adds OperatorPolicyRowV1/OperatorPolicyHardNegativeV1 over the SLM-397 sanitized OperatorPolicyInputV1 boundary: one leak-free supervision row per collapsed conversation step, built by re-enumerating live legal-set me…
Tyler-R-Kendrick
added a commit
that referenced
this pull request
Jul 27, 2026
…fix on main (#1031) * docs(autotrain): flag historically-unverifiable ledger rows, verify fix wf_smoke_v2 -- the fixture 295 of this ledger's measured-results docs claim to have trained against -- has exactly one commit in its entire history: ae4b446 (#1015, just merged), which republished it with genuinely canonical markers as part of fixing the assert_canonical_template_markers crash three prior sessions had already hit and failed to land a fix for (orphaned PRs #1006, #1020). No prior commit ever published wf_smoke_v2 (or wf_smoke_v1), so no historical row referencing it can be trusted, regardless of iteration number or wall-clock plausibility. Adds an integrity notice to the ledger with the concrete evidence (git log --follow on the fixture path, the from_records crash reproduced against pre-fix main, the missing outputs/autotrain-workflow/ harness code, the iter341 doc/PR#1020 direct contradiction) instead of extending the ledger with more rows on top of it. Independently re-verifies the now-merged fix with a fresh run against main HEAD ae4b446 exactly as merged (no local patch): slm sft train --train-dir wf_smoke_v2 --model twotower --steps 8, real train_summary.json, last_loss=32.61, record_count=101. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019or2DYTz3Tm6QFT5EPimot * SLM-423 (VAR0-02): re-scope reachability from a scalar to a per-variant matrix (#1061) Add an optional variant: VariantContractV1 parameter to analyze_reachability()/analyze_record(), defaulting to tree_edit_variant() (bit-for-bit identical to omitting it -- this module's BFS engine has only ever analyzed that one variant). Passing any other registered variant raises ReachabilityNotMeasuredError rather than silently running the tree-edit engine against a different alphabet. Add scripts/run_var0_02_reachability_matrix.py, publishing docs/design/var0-02-reachability-matrix-20260726.{json,md}: rows = the three VAR0-01 registered variants, columns = the 6 SLM-299 suites. tree_edit_diffusion is measured via the existing analyzer; repl_operators is not_measured_deferred (enumeration primitives -- legal_set.py, registry.py's OperatorLibraryV1.apply/OperatorStateV1.from_source -- already exist and compose in harnesses/train_data/operator_corpus.py, but a standalone BFS engine is out of this issue's measurement-only scope); twotower_prompt_ast is not_applicable (denoises directly, no discrete edit-action space to search). The two reasons are deliberately distinct so neither is mistaken for the other. Amend decode-invariants.md I12 to attribute its reachable_fraction=0.0 citation to the tree_edit_diffusion variant and alphabet fingerprint instead of a bare program-wide number, and I14's guard gains one sentence: a variant-scoped measurement may not be cited as a program-scoped status. Backfill (append-only, historical entries untouched) the X22 evidence annotations in iter-slm305-edit-language-20260724.md and iter-x22-d3-kapur-tree-edit-20260717.md with the same attribution. No action alphabet, checkpoint, or decode path changed; measurement and attribution only. Claude-Session: https://claude.ai/code/session_01J6VwSXamUKpZzrCtVaHJmV Co-authored-by: Claude <noreply@anthropic.com> * feat(harness): charge model size as a cost so scaling can't buy a capability win (#888) Quality rises with capacity on its own, so a bigger model could clear gates and win promotions without the change under test doing anything. Size was recorded everywhere and charged nowhere. Root cause: ScalingObservation carried trainable_params, but CostKey was {flops,time,nfe} and efficiency_gain re-implemented the cost switch in parallel, so params fell through both. Promotion's only efficiency bar was EG_time, and wall time is not a size budget -- a wider model can hold its latency and still buy its loss. - scaling_fit: add "params" cost key; make observation_cost the single accessor - efficiency_gain: reuse it, deleting the duplicate switch that dropped params - promotion_engine: EG_params criterion via check_parameter_efficiency (growth without a measured size-normalized gain fails closed; shrinking always passes), select_smallest_sufficient, and numeric ladder-point ordering - run_scaling_ladder: fit/score params, and stop promoting via min(best_weighted_nll) across a width-spanning ladder, which promoted the widest rung by construction - levers: CAPACITY_SCALING_LEVERS registry + size-matched-arm guards, mirroring CONSTRAINT_WEAKENING_LEVERS - verify_decode_invariants: certify the registry so it can't be silently emptied - goal law: AGENTS.md VI / decode-invariants I16-I19, CLAUDE.md, GEMINI.md, and the honest-ship-eval / running-experiment-matrices / improve-openui-harnesses skills check_rank_stability sorted point ids lexically ("d96" > "d64" > "d192"), so the one place intending size-awareness compared the wrong two rungs. Two pre-existing size rewards are documented as open goals under I19 rather than changed here, since re-baselining champions is a research decision: the V3+ champion recipes in run_quality_matrix splice d_model=192, and ladder.scratch_ladder_default sets the token budget proportional to d_model^2. Claude-Session: https://claude.ai/code/session_01GgeURy7HtWotVNB3rCzf4w Co-authored-by: Claude <noreply@anthropic.com> * docs(autotrain): extend smoke loop ledger through iter970 (#1098) Fixture smoke SFT+eval measured-results for iters 948–970 (941–947 already landed). Honesty: fixture_or_scratch only. Not ship. * docs(autotrain): extend smoke loop ledger through iter977 (#1099) * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) (#891) * SLM-363: deterministic SemanticFrameV1 from canonical AST + structured schema (DSH2-02) Add SemanticFrameV1, CAP1SchemaV1, and derive_semantic_frame: entities, roles, relations, order, cardinality, closed-value alternatives, effects, and a required/optional/forbidden/unspecified fact partition, every fact carrying exact AST-path + schema-field provenance. Fail-closed throughout via UnsupportedSemanticFactError; no free-form/LLM-guessed fallback. Adds frame equivalence/conflict checks, an inverse frame-to-constraint path for candidate/ambiguity evaluation, and a proven one-fact counterfactual mutator. SLM-343 (the schema this issue references) has no merged code, so CAP1SchemaV1 derives from already-merged DslPack prop_order/backend slots instead of inventing a parallel schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-364: provenance-complete NL paraphrase provider + cache contract (DSH2-03) Add ParaphraseRequestV1/ResponseV1, a content-addressed cache key over exactly the reproducibility-determining fields (provider/model/prompt+ system digests/sampling/seed), a ParaphraseProvider protocol with a fully implemented deterministic offline provider plus a network-disabled API-key-shaped stub, and a quarantine-before-promotion store so a malformed/echoed/secret-leaking/rate-limited response can never reach a QuestionArtifactV1. build_prompt_payload sends only a schema+frame projection, excluding SemanticFrameV1.canonical_source (the literal DSL target text) and any label/split metadata. Stacked on the SLM-363 SemanticFrameV1 work this branch builds on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) - frame_paraphrases.py: four plan-declared styles (concise, descriptive, imperative, compositional) rendered from frame facts only — never from answer AST text; DSH2-03 provenance records per row; declared FrameLeakDetectorV1 rejects DSL production forms, marker surfaces, answer digests, and provenance fields; required-fact coverage and forbidden-fact absence enforced per row. - Offline deterministic fixture provider (DSH2-03 protocol); diversity metrics per frame/style/provider; exact + near-dup + repeated-template + cross-family dedup with rejected rows counted; accepted prompts linked to one canonical answer + equivalence set by fingerprint; grounding-floor stop rule drops leaking styles with a reason. - 29 new tests; slm365 component v1. --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-366: one-fact semantic counterfactuals + hard grounding contrasts (DSH2-06) (#896) * SLM-363: deterministic SemanticFrameV1 from canonical AST + structured schema (DSH2-02) Add SemanticFrameV1, CAP1SchemaV1, and derive_semantic_frame: entities, roles, relations, order, cardinality, closed-value alternatives, effects, and a required/optional/forbidden/unspecified fact partition, every fact carrying exact AST-path + schema-field provenance. Fail-closed throughout via UnsupportedSemanticFactError; no free-form/LLM-guessed fallback. Adds frame equivalence/conflict checks, an inverse frame-to-constraint path for candidate/ambiguity evaluation, and a proven one-fact counterfactual mutator. SLM-343 (the schema this issue references) has no merged code, so CAP1SchemaV1 derives from already-merged DslPack prop_order/backend slots instead of inventing a parallel schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-364: provenance-complete NL paraphrase provider + cache contract (DSH2-03) Add ParaphraseRequestV1/ResponseV1, a content-addressed cache key over exactly the reproducibility-determining fields (provider/model/prompt+ system digests/sampling/seed), a ParaphraseProvider protocol with a fully implemented deterministic offline provider plus a network-disabled API-key-shaped stub, and a quarantine-before-promotion store so a malformed/echoed/secret-leaking/rate-limited response can never reach a QuestionArtifactV1. build_prompt_payload sends only a schema+frame projection, excluding SemanticFrameV1.canonical_source (the literal DSL target text) and any label/split metadata. Stacked on the SLM-363 SemanticFrameV1 work this branch builds on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) - frame_paraphrases.py: four plan-declared styles (concise, descriptive, imperative, compositional) rendered from frame facts only — never from answer AST text; DSH2-03 provenance records per row; declared FrameLeakDetectorV1 rejects DSL production forms, marker surfaces, answer digests, and provenance fields; required-fact coverage and forbidden-fact absence enforced per row. - Offline deterministic fixture provider (DSH2-03 protocol); diversity metrics per frame/style/provider; exact + near-dup + repeated-template + cross-family dedup with rejected rows counted; accepted prompts linked to one canonical answer + equivalence set by fingerprint; grounding-floor stop rule drops leaking styles with a reason. - 29 new tests; slm365 component v1. * SLM-366: one-fact semantic counterfactuals + hard grounding contrasts (DSH2-06) - semantic_counterfactuals.py: typed one-fact mutations across six declared dimensions (role, order, cardinality, closed value, required child, relation) using only schema/grammar-licensed alternatives; one_fact_proof requires the declared dimension's diff non-empty and all others empty, distinct canonical fingerprints, both targets parse+validate+canonicalize, and inverse round-trip; two differing dimensions reject. - Prompts via the SLM-365 offline provider with matched style + length ratio control; marker surfaces permuted so surfaces are not a cue (prompts + proof byte-identical under permutation); embedding-close and inventory-matched topology negatives; constant/frequency baseline exactly 0.5; 11 coded rejections — uncontrolled pairs never counted. - Split family: counterfactual inherits source root family with a parent link; cross-family drift and cross-split reuse quarantined. - 44 new tests; slm366 component v1. --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-367: freeze two-pack generic CAP1 eval + schema-sensitivity suite (DSH2-07) (#901) * SLM-363: deterministic SemanticFrameV1 from canonical AST + structured schema (DSH2-02) Add SemanticFrameV1, CAP1SchemaV1, and derive_semantic_frame: entities, roles, relations, order, cardinality, closed-value alternatives, effects, and a required/optional/forbidden/unspecified fact partition, every fact carrying exact AST-path + schema-field provenance. Fail-closed throughout via UnsupportedSemanticFactError; no free-form/LLM-guessed fallback. Adds frame equivalence/conflict checks, an inverse frame-to-constraint path for candidate/ambiguity evaluation, and a proven one-fact counterfactual mutator. SLM-343 (the schema this issue references) has no merged code, so CAP1SchemaV1 derives from already-merged DslPack prop_order/backend slots instead of inventing a parallel schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-364: provenance-complete NL paraphrase provider + cache contract (DSH2-03) Add ParaphraseRequestV1/ResponseV1, a content-addressed cache key over exactly the reproducibility-determining fields (provider/model/prompt+ system digests/sampling/seed), a ParaphraseProvider protocol with a fully implemented deterministic offline provider plus a network-disabled API-key-shaped stub, and a quarantine-before-promotion store so a malformed/echoed/secret-leaking/rate-limited response can never reach a QuestionArtifactV1. build_prompt_payload sends only a schema+frame projection, excluding SemanticFrameV1.canonical_source (the literal DSL target text) and any label/split metadata. Stacked on the SLM-363 SemanticFrameV1 work this branch builds on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) - frame_paraphrases.py: four plan-declared styles (concise, descriptive, imperative, compositional) rendered from frame facts only — never from answer AST text; DSH2-03 provenance records per row; declared FrameLeakDetectorV1 rejects DSL production forms, marker surfaces, answer digests, and provenance fields; required-fact coverage and forbidden-fact absence enforced per row. - Offline deterministic fixture provider (DSH2-03 protocol); diversity metrics per frame/style/provider; exact + near-dup + repeated-template + cross-family dedup with rejected rows counted; accepted prompts linked to one canonical answer + equivalence set by fingerprint; grounding-floor stop rule drops leaking styles with a reason. - 29 new tests; slm365 component v1. * SLM-366: one-fact semantic counterfactuals + hard grounding contrasts (DSH2-06) - semantic_counterfactuals.py: typed one-fact mutations across six declared dimensions (role, order, cardinality, closed value, required child, relation) using only schema/grammar-licensed alternatives; one_fact_proof requires the declared dimension's diff non-empty and all others empty, distinct canonical fingerprints, both targets parse+validate+canonicalize, and inverse round-trip; two differing dimensions reject. - Prompts via the SLM-365 offline provider with matched style + length ratio control; marker surfaces permuted so surfaces are not a cue (prompts + proof byte-identical under permutation); embedding-close and inventory-matched topology negatives; constant/frequency baseline exactly 0.5; 11 coded rejections — uncontrolled pairs never counted. - Split family: counterfactual inherits source root family with a parent link; cross-family drift and cross-split reuse quarantined. - 44 new tests; slm366 component v1. * SLM-367: freeze two-pack generic CAP1 eval + schema-sensitivity suite (DSH2-07) - mini_pack.py + mini_flow.lark: complete test-only DslPack (lark authority, canonicalizer, static validator, CAP1SchemaV1 contract, SemanticFrameV1 provider, marker policy, fragment support); completeness_report + fail-closed require_complete_for_generic_claim; no OpenUI imports (AST-audited). - Cap1TwoPackSuiteV1: 41 rows, 2 packs x 2 base cases x 10 strata + excluded ambiguity row (original/empty/contradictory/reordered/ irrelevant schema, marker permutations, paraphrases, counterfactuals, ambiguity classes with accepted-set-or-exclusion recording, CAP0 identity retention); disjoint root families; sha256 rows + tamper-evident manifest + suite cards with full provenance; create-once freeze; fail-closed integrity. - score_schema_sensitivity (relevant must change, irrelevant invariant within tolerance); adjudicate_suite (canonical equivalence, required/forbidden facts, prompt invariance, determinacy calibration, CAP0 retention); gates with retention mandatory. - 35 new tests; slm367 component v1. --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-368: matched CAP1 grounding experiment — CERT_CAP1 rejected (DSH2-08) (#902) * SLM-363: deterministic SemanticFrameV1 from canonical AST + structured schema (DSH2-02) Add SemanticFrameV1, CAP1SchemaV1, and derive_semantic_frame: entities, roles, relations, order, cardinality, closed-value alternatives, effects, and a required/optional/forbidden/unspecified fact partition, every fact carrying exact AST-path + schema-field provenance. Fail-closed throughout via UnsupportedSemanticFactError; no free-form/LLM-guessed fallback. Adds frame equivalence/conflict checks, an inverse frame-to-constraint path for candidate/ambiguity evaluation, and a proven one-fact counterfactual mutator. SLM-343 (the schema this issue references) has no merged code, so CAP1SchemaV1 derives from already-merged DslPack prop_order/backend slots instead of inventing a parallel schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-364: provenance-complete NL paraphrase provider + cache contract (DSH2-03) Add ParaphraseRequestV1/ResponseV1, a content-addressed cache key over exactly the reproducibility-determining fields (provider/model/prompt+ system digests/sampling/seed), a ParaphraseProvider protocol with a fully implemented deterministic offline provider plus a network-disabled API-key-shaped stub, and a quarantine-before-promotion store so a malformed/echoed/secret-leaking/rate-limited response can never reach a QuestionArtifactV1. build_prompt_payload sends only a schema+frame projection, excluding SemanticFrameV1.canonical_source (the literal DSL target text) and any label/split metadata. Stacked on the SLM-363 SemanticFrameV1 work this branch builds on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) - frame_paraphrases.py: four plan-declared styles (concise, descriptive, imperative, compositional) rendered from frame facts only — never from answer AST text; DSH2-03 provenance records per row; declared FrameLeakDetectorV1 rejects DSL production forms, marker surfaces, answer digests, and provenance fields; required-fact coverage and forbidden-fact absence enforced per row. - Offline deterministic fixture provider (DSH2-03 protocol); diversity metrics per frame/style/provider; exact + near-dup + repeated-template + cross-family dedup with rejected rows counted; accepted prompts linked to one canonical answer + equivalence set by fingerprint; grounding-floor stop rule drops leaking styles with a reason. - 29 new tests; slm365 component v1. * SLM-366: one-fact semantic counterfactuals + hard grounding contrasts (DSH2-06) - semantic_counterfactuals.py: typed one-fact mutations across six declared dimensions (role, order, cardinality, closed value, required child, relation) using only schema/grammar-licensed alternatives; one_fact_proof requires the declared dimension's diff non-empty and all others empty, distinct canonical fingerprints, both targets parse+validate+canonicalize, and inverse round-trip; two differing dimensions reject. - Prompts via the SLM-365 offline provider with matched style + length ratio control; marker surfaces permuted so surfaces are not a cue (prompts + proof byte-identical under permutation); embedding-close and inventory-matched topology negatives; constant/frequency baseline exactly 0.5; 11 coded rejections — uncontrolled pairs never counted. - Split family: counterfactual inherits source root family with a parent link; cross-family drift and cross-split reuse quarantined. - 44 new tests; slm366 component v1. * SLM-367: freeze two-pack generic CAP1 eval + schema-sensitivity suite (DSH2-07) - mini_pack.py + mini_flow.lark: complete test-only DslPack (lark authority, canonicalizer, static validator, CAP1SchemaV1 contract, SemanticFrameV1 provider, marker policy, fragment support); completeness_report + fail-closed require_complete_for_generic_claim; no OpenUI imports (AST-audited). - Cap1TwoPackSuiteV1: 41 rows, 2 packs x 2 base cases x 10 strata + excluded ambiguity row (original/empty/contradictory/reordered/ irrelevant schema, marker permutations, paraphrases, counterfactuals, ambiguity classes with accepted-set-or-exclusion recording, CAP0 identity retention); disjoint root families; sha256 rows + tamper-evident manifest + suite cards with full provenance; create-once freeze; fail-closed integrity. - score_schema_sensitivity (relevant must change, irrelevant invariant within tolerance); adjudicate_suite (canonical equivalence, required/forbidden facts, prompt invariance, determinacy calibration, CAP0 retention); gates with retention mandatory. - 35 new tests; slm367 component v1. * SLM-368: matched CAP1 grounding experiment — CERT_CAP1 rejected (DSH2-08) - Preregistered sha-locked block first: four arms (NL_NO_SCHEMA, SCHEMA_UNFILTERED, SCHEMA_FILTERED_SINGLE, SCHEMA_FILTERED_MULTI) differing only in declared data levers with family-stratified matched exposure; identical tiny tree-edit training, seeds {0,1}; two-pack train roots split-disjoint from the frozen SLM-367 suite. - Full evaluation on the frozen two-pack suite: schema replays (original/empty/contradictory/reordered/irrelevant causal probe), counterfactuals, marker permutations, ambiguity/determinacy, mandatory CAP0 retention; symbol-only audit; paired Wilson + exact McNemar; sharded within the cap; AgentV diagnostic. - Outcome: CERT_CAP1 rejected — underpowered (paired n=32 < 64) plus prediction_identical, ignores_schema, fails_hard_contrasts, cap0_regression at fixture scale; NL CAP2 stays closed. Certificate machinery proven both ways (issue on synthetic win; all six stop codes). Suite clean, zero contamination, exposure exactly matched. - 20 new tests; slm368 component v1. --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-413: check provenance.source_artifact_digest in transaction staleness guard (#924) Follow-up to PR #921, landed after it merged: CodeRabbit review found that commit_operator_transaction's STALE_TRANSACTION_BASE guard checked provenance.request_id/pack_id against transaction.provenance but never source_artifact_digest, so inconsistent provenance metadata could be embedded verbatim into the committed OperatorTransactionCommitV1 record. append_operator_transaction_turn in conversation.py already made this exact check; the executor now matches it. Also: fixes a stale ast_merge.py docstring cross-reference to a nonexistent _compose_prepared_outputs (renamed to compose_operator_transaction during review), extracts the duplicated authority-resolution block in replay_conversation_trace into one _resolve_turn_authority helper, and adds a tiny-domain size assert plus a direct selector-lineage assertion to the transaction-executor test suite. One reviewer finding was investigated and rejected: comparing final_state.state_digest/ast_digest directly against transaction.expected_final_state_digest/expected_final_ast_digest is a category error -- per docs/design/dsh5-04-operator-transactions.md ("Expected final digests are commitments, not executed hashes"), those fields are deterministic commitments over (base digest, composite-effect fingerprint, action IDs), not literal AST-content hashes, and their authenticity is already fully verified by the existing TRANSACTION_TAMPERED replay check (which recomputes decision_id, transitively binding them). Confirmed empirically: applying the suggested literal comparison broke a previously-passing test. Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap Co-authored-by: Claude <noreply@anthropic.com> * Remove duplicate on-policy self-distillation module superseded by #976 (#1091) Two independent autonomous sessions implemented SLM-309 (AP-020, on-policy abstract self-distillation) concurrently: this session's PR #974 (harnesses/distill/abstract_self_distill.py, merged first) and a separate session's PR #976 (harnesses/distill/self_distill_collect.py, merged shortly after). #976's module is the one actually wired into harnesses/distill/__init__.py and reuses the existing TraceStore shape that select.py already filters; abstract_self_distill.py was left completely unreferenced by anything else -- confirmed via a repo-wide grep, the only remaining references were its own test file and design doc. Remove the orphaned module, its test, and its design doc. Confirmed the 48 pre-existing test failures in tests/test_harnesses/distill/ (missing Node.js openui_bridge dependency in this sandbox, unrelated to either self-distillation module) are identical before and after this removal -- no regression. Also fix scripts/check_changed.py: select_tests/select_changed_tests could select an already-deleted test file as a pytest target (hit by this exact deletion-only diff), crashing the local pre-commit hook with "file or directory not found" instead of falling back to the still-valid suite mapping from the deletion's source-file prefix. Both now filter to existing files only. Claude-Session: https://claude.ai/code/session_011uJCkG9ALyro7QvXcCYt14 Co-authored-by: Claude <noreply@anthropic.com> * fix(quality-matrix): fail-closed Experiment defaults + V7 E76 attempt writeup (#957) - Experiment.allow_unconstrained_fallback defaulted to True, violating decode invariant I6 (fail-closed serving); ModelBuildConfig hard-rejects the unconstrained default, so every V9/V10 lattice-search row and the E0 baseline raised before training could start. Flip the default to False; no row explicitly relied on the old default. - Experiment was also missing grammar_fastpath, grammar_sample_decode, and grammar_uniform_at_unforced (present on ModelBuildConfig, spread in via the shared STRICT_COMPILER_TREE_POLICY dict but never declared as fields), causing the same TypeError. Add all three. - test_verify_decode_invariants.py's sandbox fixture only monkeypatched verify_decode_invariants.ROOT; check_agent_surfaces() imports scripts.verify_agent_surfaces directly, which reads off its own module-level ROOT, so test_orphaned_agent_surface_fails was silently checking the real repo instead of the sandbox and could never catch the regression it exists to catch. Patch both ROOTs and add the .grok/workflows/autotrain.rhai fixture file the obligation already requires. - Document the E76 (qx_e76_cache_reuse, V7 cache-reuse arm) attempt: wired but never listed in quality-experiment-matrix.md or results.json. Training completed (40 steps, final_loss_eval.weighted_nll=8.87) but both attempts were killed by MAX_RUN_MINUTES=3 during the ship-gate eval stage, so no E76 quality numbers are reported — a killed run is not evidence. Claude-Session: https://claude.ai/code/session_01PhEhKyFBL6NiA6ga4RdCus Co-authored-by: Claude <noreply@anthropic.com> * SLM-379: schema-grounded NL descriptions of operator applications (DSH3-11) (#906) * SLM-363: deterministic SemanticFrameV1 from canonical AST + structured schema (DSH2-02) Add SemanticFrameV1, CAP1SchemaV1, and derive_semantic_frame: entities, roles, relations, order, cardinality, closed-value alternatives, effects, and a required/optional/forbidden/unspecified fact partition, every fact carrying exact AST-path + schema-field provenance. Fail-closed throughout via UnsupportedSemanticFactError; no free-form/LLM-guessed fallback. Adds frame equivalence/conflict checks, an inverse frame-to-constraint path for candidate/ambiguity evaluation, and a proven one-fact counterfactual mutator. SLM-343 (the schema this issue references) has no merged code, so CAP1SchemaV1 derives from already-merged DslPack prop_order/backend slots instead of inventing a parallel schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-364: provenance-complete NL paraphrase provider + cache contract (DSH2-03) Add ParaphraseRequestV1/ResponseV1, a content-addressed cache key over exactly the reproducibility-determining fields (provider/model/prompt+ system digests/sampling/seed), a ParaphraseProvider protocol with a fully implemented deterministic offline provider plus a network-disabled API-key-shaped stub, and a quarantine-before-promotion store so a malformed/echoed/secret-leaking/rate-limited response can never reach a QuestionArtifactV1. build_prompt_payload sends only a schema+frame projection, excluding SemanticFrameV1.canonical_source (the literal DSL target text) and any label/split metadata. Stacked on the SLM-363 SemanticFrameV1 work this branch builds on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qi7efrNWDh1ya5DJauBCDH * SLM-365: diverse prompt-only paraphrases from semantic frames (DSH2-04) - frame_paraphrases.py: four plan-declared styles (concise, descriptive, imperative, compositional) rendered from frame facts only — never from answer AST text; DSH2-03 provenance records per row; declared FrameLeakDetectorV1 rejects DSL production forms, marker surfaces, answer digests, and provenance fields; required-fact coverage and forbidden-fact absence enforced per row. - Offline deterministic fixture provider (DSH2-03 protocol); diversity metrics per frame/style/provider; exact + near-dup + repeated-template + cross-family dedup with rejected rows counted; accepted prompts linked to one canonical answer + equivalence set by fingerprint; grounding-floor stop rule drops leaking styles with a reason. - 29 new tests; slm365 component v1. * SLM-366: one-fact semantic counterfactuals + hard grounding contrasts (DSH2-06) - semantic_counterfactuals.py: typed one-fact mutations across six declared dimensions (role, order, cardinality, closed value, required child, relation) using only schema/grammar-licensed alternatives; one_fact_proof requires the declared dimension's diff non-empty and all others empty, distinct canonical fingerprints, both targets parse+validate+canonicalize, and inverse round-trip; two differing dimensions reject. - Prompts via the SLM-365 offline provider with matched style + length ratio control; marker surfaces permuted so surfaces are not a cue (prompts + proof byte-identical under permutation); embedding-close and inventory-matched topology negatives; constant/frequency baseline exactly 0.5; 11 coded rejections — uncontrolled pairs never counted. - Split family: counterfactual inherits source root family with a parent link; cross-family drift and cross-split reuse quarantined. - 44 new tests; slm366 component v1. * SLM-367: freeze two-pack generic CAP1 eval + schema-sensitivity suite (DSH2-07) - mini_pack.py + mini_flow.lark: complete test-only DslPack (lark authority, canonicalizer, static validator, CAP1SchemaV1 contract, SemanticFrameV1 provider, marker policy, fragment support); completeness_report + fail-closed require_complete_for_generic_claim; no OpenUI imports (AST-audited). - Cap1TwoPackSuiteV1: 41 rows, 2 packs x 2 base cases x 10 strata + excluded ambiguity row (original/empty/contradictory/reordered/ irrelevant schema, marker permutations, paraphrases, counterfactuals, ambiguity classes with accepted-set-or-exclusion recording, CAP0 identity retention); disjoint root families; sha256 rows + tamper-evident manifest + suite cards with full provenance; create-once freeze; fail-closed integrity. - score_schema_sensitivity (relevant must change, irrelevant invariant within tolerance); adjudicate_suite (canonical equivalence, required/forbidden facts, prompt invariance, determinacy calibration, CAP0 retention); gates with retention mandatory. - 35 new tests; slm367 component v1. * SLM-368: matched CAP1 grounding experiment — CERT_CAP1 rejected (DSH2-08) - Preregistered sha-locked block first: four arms (NL_NO_SCHEMA, SCHEMA_UNFILTERED, SCHEMA_FILTERED_SINGLE, SCHEMA_FILTERED_MULTI) differing only in declared data levers with family-stratified matched exposure; identical tiny tree-edit training, seeds {0,1}; two-pack train roots split-disjoint from the frozen SLM-367 suite. - Full evaluation on the frozen two-pack suite: schema replays (original/empty/contradictory/reordered/irrelevant causal probe), counterfactuals, marker permutations, ambiguity/determinacy, mandatory CAP0 retention; symbol-only audit; paired Wilson + exact McNemar; sharded within the cap; AgentV diagnostic. - Outcome: CERT_CAP1 rejected — underpowered (paired n=32 < 64) plus prediction_identical, ignores_schema, fails_hard_contrasts, cap0_regression at fixture scale; NL CAP2 stays closed. Certificate machinery proven both ways (issue on synthetic win; all six stop codes). Suite clean, zero contamination, exposure exactly matched. - 20 new tests; slm368 component v1. * SLM-379: schema-grounded NL descriptions of operator applications (DSH3-11) - OperatorFrameV1: deterministic fail-closed derivation from operator declaration + typed args + before-state + ActionEffectV1; required edit facts (every effect delta), forbidden facts only under exact compiler coverage (no overclaim under bounded/approximate), state-reference facts through typed descriptor tables; per-fact provenance, equivalence, conflict checks, fingerprint. - operator_nl_turns.py: admission under the exact OperatorLegalSetV1 + accepted set with coded rejections (missing_legal_membership, not_in_accepted_set, ambiguous_state_reference, compatible_with_non_equivalent, accepted_set_not_named, leak); symbol-only targets across three views; offline provider reusing the DSH2-03 contract unchanged. - Measured disambiguation report: unambiguous and accepted-set-named families admit at 1.0; non-equivalent and shared-descriptor families record the honest symbolic_cap2_only stop-rule disposition (overall 0.5). Contract-level machinery, not an NL-CAP2 ship claim. - 18 new tests; slm379 component v1. * SLM-409: define exact SelectorRefV1 contracts and finite selector domains * SLM-409: define exact SelectorRefV1 contracts and finite selector domains Extend the existing typed-reference/ReferenceTableV1 machinery with a RefKind.SELECTOR that commits to a finite, pack-authorized, permutation-safe target set (component-type, single-schema-role, single-symbol-ref, and declared-role-descendant kinds) instead of a free-form query language. Selectors resolve only from current pack-authorized state and fail closed on stale state, cross branch/request use, wrong kind, changed membership, or fanout overflow. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-409: fix selector round-trip stability and re-attach idempotence Address CodeRabbit review on PR #910: - normalize SelectorDescriptorV1.compiler_facts (dedupe + sort) at construction so from_dict(to_dict(x)) == x for unsorted/duplicate facts - dedupe descriptors by fingerprint in attach_selectors so re-attaching an identical selector is idempotent instead of raising ref.duplicate - add regression coverage for both plus selector.cardinality_mismatch, selector.type_incompatible, and entry-ref stability across attach Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Satisfy the decode goals rather than only documenting them (#886) * Satisfy the decode goals rather than only documenting them The merged invariants work made the goals enforceable. Three of them were still only *stated*: a proven singleton could still cost a forward, speculative ranking was unreachable, and the shared ops vocabulary did not exist. This closes all three and reserves the vocabulary. I2 — a horizon-limited domain is not a contradiction. For the DSL-native codec `exact_forced_token_id` consulted only the pack completion domain, which needs budget to enumerate a terminal witness and returns coverage="none" when remaining_tokens is small (measured: none at <=4, complete at 8). It threw away a DFA proof that had already decided the position. It now falls through to that proof, while a *complete* domain naming several candidates still refuses. The whitespace veto is skipped for the native codec, because the native completion domain already excludes insignificant whitespace — applying it only in the fallback made one position disagree with itself depending on remaining budget. This turns `test_repair_exact_token_skips_forward_and_records_authority`, red on main since before the invariants doc existed, green. I3 — speculative ranking is reachable. Ships the committed table built train-split-only from the immutable certified corpus (openui_verified_v1: 1682 records, 89,415 native tokens, order 3, 523 contexts, templatized so it keys on symbols and never on free-form strings). `speculative_rank="ngram"` with no table named resolves to it. `--check` fails when artifact and builder disagree. It ranks real branch points confidently: `Stack(` at margin 1.0 after `root = ` (27 candidates), `<BIND_1>` at margin 1.59 after `root = Stack([` (25) — both decided from the symbol table with no forward. I4 — the scheduler gets a real checkpoint. `common_forced_run` proves the one thing available before position t is decided: if every legal candidate leads into the same length of forced lexemes, those positions are determined whatever the model picks. Bounded at 8 candidates, 4 lexemes, 4 rows; any budget exceeded claims nothing and leaves device-window sizing in place. Replaces the `forced_run_lengths=None` placeholder. I13 — the reserved ops vocabulary now exists. `dsl/ops_vocab.py` holds 19 ops across ast/graph/set/topology/history, in a new `ops` token-id namespace placed above every codec range so no stored embedding row moves. Two properties make it more than another list: it is derived from the live operator registries, so an op cannot be in the vocabulary without an implementation or implemented without appearing in it; and `shared_token_ids()` is the only mapping, so "shared encoder<->decoder" is the same function called twice rather than a convention two towers are asked to honor. Grammar layering is asserted, NL is absent by construction, and the fingerprint is pinned and CI-gated. The open rung is the encoder-conditioned campaign — e803 tested decoder targets only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ * Fix a decode-contract assertion my merged PR broke `test_prompt_inventory_is_visible_to_decode_and_persisted` asserts exact equality on the persisted `decode_contract` metadata. #881 added three keys to it — `grammar_constrained`, `diagnostic_control`, `certifiable` — so a diagnostic-control sample can never later be mistaken for a certified serving generation. The keys are intentional; the assertion was not updated. Verified by bisect: passes at d45d43f (pre-881), fails on main. CI missed it because `check_changed` did not select `test_bad_outputs.py` for #881's diff. Not fixed here, for the record: `test_annotations.py::test_sample_api_generates` asserts a 200 from `/api/sample`, but the committed playground demo checkpoint is output-contract v0 and the serving path deliberately refuses pre-v2 checkpoints ("checkpoint output contract v0 is incompatible with required symbol_only/v2"), exactly as MODEL_CARD describes. It fails at d45d43f too. Resolving it means either a v2 demo checkpoint or a decision to change what the endpoint promises — a product call, not a drive-by. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ * Keep the I2 tests out of the slow legacy fast-path suite CI run 30148188085 was cancelled: the `python` job hit the repository's three-minute cap. Cause was mine — appending the two I2 tests to `tests/test_dsl/test_grammar_fastpath.py` made `check_changed` select that whole file, and its ~40 node-bridge cases alone exceed the budget. #881 never hit this because a three-dot diff excludes main's own edits to the file, so it was never selected there. Moves them to `tests/test_dsl/test_exact_forced_horizon.py` (43s, well inside the cap) and restores `test_grammar_fastpath.py` byte-identical to main so it drops out of selection. Same coverage, same assertions — only the file they live in changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AQbo4x8APVeZT12QwvyDUJ --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-410: implement atomic bulk set-property operator over SelectorRefV1 Add openui.map_set_property(selector, role, value) as the first consumer of the DSH5-01 SelectorRefV1 contract: applies one schema-valid property update to every exact selected node atomically (all-or-nothing, no partial commits), emits one ActionEffectV1 with exact per-target deltas and CompilerCoverage.EXACT, and rebuilds a fresh post-commit reference table. Adds OpenUILocalOperatorContextV1.resolve_selector to consume the existing reference-table selector resolution, and a diagnostic-only primitive-lowering oracle to prove equivalence against repeated SET_PROPERTY actions. Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap Co-authored-by: Claude <noreply@anthropic.com> * perf: slim Vercel function bundle from ~10.4 GB to 16.6 MB (#915) The deployed FastAPI function failed to build: local run artifacts (outputs/ ~10 GB, .venv, node_modules) were uploaded because the function-level excludeFiles glob is ineffective, and the wheel packaged resources/static (~100 MB) including 69 MB of training records.jsonl, contaminated further by a stale build/ directory. - .vercelignore: exclude build/run artifacts (/outputs, /.venv, /node_modules, /build, /session, /_uv, /tests, caches), published training records.jsonl, sourcemaps, oversized historical docs/design JSON, and the fixture checkpoint (dead weight without a runtime) - web/requirements-vercel.txt: slim deploy-only deps without numpy/onnxruntime (~109 MB); wired via installCommand since Vercel prefers uv.lock over requirements files - web/vercel.py: lazy ONNX import; web/service.py: model-less deploys raise honest GenerationExhausted so /api/sample hands off to the browser path (verified live: 200 + fallback_required, never a 500) - pyproject.toml: tool.uv package=false (entrypoint imports from the uploaded source tree; installed copy was pure duplication) and wheel exclude-package-data for records/governance/maps - vite configs: sourcemap=false; committed static 24 MB -> 6.1 MB - bundle policy test locks the new exclusions Verified: preview deploy succeeds; lambda 73 MB -> 16.6 MB; /api/health and /api/sample exercised via vercel curl. * Add SLM-298 local factorial harness (#898) * SLM-412: define OperatorTransactionV1 base-state and conflict contracts * SLM-412: define OperatorTransactionV1 base-state and conflict contracts Add PreparedOperatorActionV1, OperatorReadWriteSetV1, and OperatorTransactionV1 schema/safety contracts: several actions prepared against one shared base state get semantic read/write footprints derived from their exact effects (never operator names), a dependency/conflict graph, and one canonical, permutation-invariant transaction identity keyed by semantic action ID. Reuses merge.py's effect-target extraction and commutativity gate rather than duplicating conflict logic. Schema/validation only — no commit/execution path is wired, per the issue's own agent contract. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-412: normalize OperatorTransactionProofV1.checks for round-trip stability An independent adversarial review found the same bug shape CodeRabbit caught on SLM-409: to_dict() force-sorted and deduped `checks`, but __post_init__ never normalized the field, so from_dict(to_dict(x)) == x could fail for input built with unsorted/duplicate checks -- including the exact literal order build_operator_transaction constructs the proof with in production. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Add deterministic autotrain Grok workflow (#917) Encode the autotrain skill as a host-owned Rhai workflow under .grok/workflows with exact slm command plans, parallel data legs, durable state, and OpenWiki/contracts prompts. Allow .grok in repository policy and pin a feature-flag null-coercion regression. * SLM-267 + SLM-296: bounded wiring-evidence slices (ProgramSpec sampling, teacher admission) (#893) * SLM-267: bounded uniform-vs-coverage-targeted ProgramSpec sampling wiring evidence VSD2-02 asks for 10k/100k/1M-record ProgramSpec corpora comparing uniform against coverage-targeted sampling. The existing coverage-guided generator (SLM-5) samples from a fixed, exhaustible candidate grid, so those rungs are out of reach without a materially different generator. This scopes the issue to what the generator actually supports: a genuine uniform-random control arm (ProgramGenerator.generate_uniform, new), a deterministic (global_seed, shard_id, worker_id) sharding primitive, and an honest, reproducible measurement of the generator's own coverage-targeted-vs-uniform budget efficiency and state-space saturation point. - generate.py: refactor generate_one into _materialize + add generate_uniform (uniform-random candidate selection, no coverage bias) as a genuine control arm distinct from the existing greedy CoverageTracker.score() selection. - New harness (slm267_programspec_coverage_scaling.py) + CLI (generate_programspec_corpus.py) run both policies to a bounded budget, dedup by canonical-root fingerprint (in-memory), and report exhaustion point, unique roots, and programs-to-full-coverage per arm. - Fixture campaign (80 programs/shard x2 shards): coverage-targeted reaches full coverable-cell coverage in 19 programs vs uniform's 34-35; both exhaust the 3-component grid at 36 accepted (28 unique roots, 8 duplicate canonical roots via serialization collapse). - Disposition: inconclusive (wiring only) -- does not validate VSD-H7a/b/c, which require corpora/training several orders of magnitude larger than this fixture budget. Documented as explicit follow-up. Closes SLM-267. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg * SLM-296: bounded verifier-filtered teacher-admission wiring evidence AP-013 asks for >=500 accepted records from a capable separate-family teacher, filtered through G0-G10 + independent judgment + human audit, then a matched-budget fine-tune with grammar-on/off evaluation. This sandbox has no network access to a real teacher and no GPU -- SLM-266 already measured that even a local CPU teacher run is infeasible here (>=11 days extrapolated for 10k requests). Scoped down to a bounded wiring slice that exercises the two real safety mechanisms the acceptance criteria test: - generate.py's compiler-inverted ProgramSpec generator stands in as a deterministic offline candidate proposer (explicitly not a teacher), tagged source="teacher" (a verifier-stack weak source) so admitted rows structurally cap at Bronze tier regardless of gate passes -- "teacher self-judgment alone cannot assign Gold/Silver" is enforced by the real verify_record() tier rule, not asserted narratively. - check_family_independence() + a same-family "shadow judge" control: wiring independent_judge_passed=False for a same-family judge causes the real G11 gate to quarantine 10/10 sampled candidates; a different-family judge would pass. Locked-holdout decontamination excludes any candidate whose canonical root (SLM-171 diversity fingerprint) collides with a disjoint-seed holdout before counting yield (23/27 excluded in the fixture run, reflecting the generator's shared finite candidate grid already documented in SLM-267). Disposition: yield_limitation_no_real_teacher_available (wiring only) -- the >=500-record scale and grammar-on/off fine-tune comparison remain unaddressed in this sandbox and are documented as explicit follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MAH7ibENsNM41tPTnVJkbg * Refresh SLM-267 evidence after rebase --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-397: freeze a sanitized typed OperatorActionViewV1 model boundary (DSH3-22) (#918) Adds OperatorPolicyInputV1/OperatorActionViewV1/ReferenceModelViewV1 as the only allowed model input for DSH3 M6/M7 learned operator policies: an immutable, row-indexed snapshot over a verified-fresh ReferenceTableV1 + OperatorLegalSetV1 pair. Row-local joins (parent_row, candidate_rows) replace every raw opaque/semantic identity; recursive forbidden-field validation guards the boundary structurally. build_operator_policy_input fails closed on a stale reference table or a mismatched operator registry. Covers the ticket's verification matrix and adversarial controls: index parent/position resolution, partial-coverage explicitness for unbounded repeated slots, opaque-ID/candidate-order permutation equivalence, and allocation-seed-only changes (which vary every downstream application/proof hash) leaving the sanitized view byte-identical. Registers model.operator_policy_view v1 in versions.json. Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS Co-authored-by: Claude <noreply@anthropic.com> * SLM-396: make LocalFlatHead optimizer-visible and checkpoint-stable (#897) Per-action embeddings were a plain dict, invisible to model.parameters() and thus never trained. Replace with a registered nn.ParameterDict, add explicit materialize()/checkpoint contracts that fail closed on registry/shape mismatch, and canonicalize action keys so opaque request/reference ids can't fragment the parameter table. LocalFlatHead stays a documented O(distinct-actions) diagnostic head, not a fake generalization claim. model.quantization bumped v5->v6. Claude-Session: https://claude.ai/code/session_01GbtSeD33wb4okHTpYrs4vJ Co-authored-by: Claude <noreply@anthropic.com> * SLM-386: export operator decision-state traces from existing legal-set contracts (#903) DSH4-01: reuse the DSH3-06 OperatorLegalSetV1 legal-action enumeration and the SPV2-03 TeacherTraceManifest provenance envelope to export certified operator decision-state traces instead of building a duplicate distillation data stack. Adds operator_decision_state.py (capture, accepted-trajectory replay, and a fail-closed export_for_teacher_query stop-rule gate), a fixture runner, tests, and a docs/design evidence pair. Bumps harness.distill to v3. Claude-Session: https://claude.ai/code/session_01HVU3Spui6zSHYvkmxi6iNL Co-authored-by: Claude <noreply@anthropic.com> * SLM-387: one-teacher ceiling over exact operator legal sets (DSH4-02) (#922) Implements the full teacher-vs-baseline comparison harness required before any operator legal-set distillation work: a synthetic, explicitly non-real stand-in teacher adapter (SyntheticDescriptorTeacherV1) behind the same interface a real LLM teacher would use; frequency, deterministic compiler-order, current-scorer, and descriptor-similarity baselines plus an oracle upper bound; accepted-set mass/MRR/NDCG/calibration/selective-risk/ verifier-regret-correlation metrics; a candidate-order/opaque-id/ description-length/prompt-template perturbation-robustness harness; paired bootstrap significance; and a stop-rule gate. Run honestly against the synthetic teacher on deterministic fixture data (scripts/run_dsh4_02_operator_teacher_ceiling_fixture.py), the harness reports DEFER (do not distill): the synthetic teacher does not significantly beat any required baseline on paired MRR and its scores negatively correlate with verifier-backed outcomes, though perturbation robustness is perfect by construction. This is fixture/wiring evidence (claim_class: wiring) only -- a production KD-readiness claim requires swapping a real teacher behind OperatorTeacherAdapter and re-running this exact harness. Bumps harness.distill to v4 in versions.json. Claude-Session: https://claude.ai/code/session_01HVU3Spui6zSHYvkmxi6iNL Co-authored-by: Claude <noreply@anthropic.com> * SLM-249 (LOT0-02): define CompilerReasoningTraceV1 target-trace contract (#909) Implements the LOT0-01 authorization's allowed_lot1_work scope: a typed, compiler-grounded reasoning-trace schema and deterministic extractor (reusing SemanticPlanV1 and the production codec, no new compiler/parser/evaluator), a lossless visible serialization, permutation-invariant/cycle-free/ truncation-explicit helpers, a bounded (n=16 fixture) K/c coverage probe, a fully specified but deliberately not-run oracle-ceiling experiment plan, and a defined-but-not-run causal_latent_use falsification-test spec extending causal_trace.py. Gate verdict: inconclusive -- the oracle campaign that would justify LOT1's model implementation requires GPU training and corpus work this issue does not authorize. Claude-Session: https://claude.ai/code/session_01625N4JruoBHHmrH2pXmRR4 Co-authored-by: Claude <noreply@anthropic.com> * Track AgentEvals grader metrics (#920) * Enforce harness-owned opaque template slots * Make strict template evaluation the default * Document longer opaque-slot baseline * Reject duplicate structural references * Close covered structural arrays * Record rejected all-path plan margin * Centralize canonical corpus defaults * Move slot conversion into harness boundary * Record harness-owned slot smoke * Keep training local and record typed collection result * Train surgical typed collection baseline * Record action group data rejections * Record lexer structural decode diagnosis * Record root arity warm start rejection * Enforce harness-owned opaque markers * Fix opaque marker ownership in data harnesses * Fix harness-owned marker and warm-start contracts * fix warm-start vocabulary ownership * fix deployed evidence bundle size * fix Vercel exclusion glob limit * fix Vercel corpus exclusions * fix Vercel upload exclusions * record recovered baseline evaluation * record hard-tail continuation result * record balanced replay result * record low replay result * add typed role training supplement * record invalid typed role scratch attempts * add focused typed role corpus * record focused role continuation failure * record focused role retention result * record E891 canvas cap results * reject untyped array forward references * prefer certified typed array items * activate planned typed array items * extend typed item margin to lexer * apply typed item margin after schema pruning * limit typed item margin to closed leaves * record typed item margin results * clarify gold-relative quality metrics * lock compact semantic metric distinction * test schema-aware component constraints * test schema-aware inline item planning * fix closed array component arity * tighten component-valued schema paths * test use opaque markers in compiler fixtures * reject conflicting typed binder reuse * bound typed forward references by slots * fix enforce role-safe training targets * fix enforce role-safe decoder strings * fix bound role-safe decoder nesting * fix audit role-safe outputs without style shifts * fix keep structural identities unique by role * docs record rejected inline typed items * docs record rejected lattice recovery * docs record no-op array close treatment * docs record rejected compiler array close * docs record rejected clean scratch checkpoint * docs record rejected symbol reservation * fix close direct training target leaks * docs confirm training boundary decode parity * docs record weighted scratch comparison * fix softly penalize repeated compiler binders * docs record rejected visible reference penalty * docs reject generic binder reuse penalty * fix withdraw harmful compiler reuse penalty * docs confirm compiler penalty withdrawal parity * fix reserve slots for typed binder obligations * docs reject incomplete typed slot reservation * fix reserve symbols for typed binder obligations * docs reject symbol slot reservation * fix withdraw typed slot reservation * docs confirm slot reservation withdrawal parity * docs reject binder arity scratch checkpoint * docs reject low weight binder arity arm * docs reject unique binder filtering * docs reject scoped binder ownership * docs reject arity lattice recovery * docs diagnose arity form fallback * docs reject arity slot margin * docs reject joint binder supervision * docs reject topology data supplement * docs reject generic topology exposure * docs reject binder component plan arm * perf scan binder component targets * docs reject full binder component arm * docs reject low binder component arm * fix isolate binder component gradients * docs reject detached binder component arm * test clarify role unsafe fixtures * docs reject joint binder plan arm * feat apply binder plan before declaration * test remove content-like sanitizer fixtures * docs reject predeclaration binder plan arm * docs close predeclaration binder scalar sweep * feat mask binder plans by typed use sites * docs reject typed binder candidate checkpoint * docs reject binder arity isolation * docs close binder arity scalar sweep * feat scope binder arity to bound declarations * docs record bound-only arity diagnostics * docs record dedicated root arity train * docs reject dedicated root arity checkpoint * docs isolate root arity decode ablation * docs record partial matched exposure control * docs complete matched exposure control * docs close matched exposure control * docs record partial v271 exposure train * docs complete v271 exposure train * docs record v271 exposure smoke pass * docs close v271 exposure sweep * feat generalize root reference identity * fix route lexer identity sampling * docs record partial v272 root identity train * docs complete v272 root identity train * docs record v272 root identity smoke * docs record v272 dual card timeout * docs: record invalid E1079 reproduction * fix: make AgentEvals named metrics authoritative * docs: record E1080 partial reproduction * docs: complete E1080 scratch record * Add document-only ProgramSpec campaign evidence * Track AgentEvals grader metrics * Fix Vercel exclusion policy * Restore structural identifier contract * SLM-413: implement atomic transaction composition, commit, and replay (#921) * SLM-413: implement atomic transaction composition, commit, and replay Wire the execution path SLM-412 deliberately deferred: compose_operator_transaction independently dry-runs each prepared action against the shared immutable base and folds their base-relative AST deltas via a shared 3-way merge primitive (extracted from merge.py into ast_merge.py so both modules reuse one algorithm) instead of re-executing operators sequentially against progressively stale reference tables. commit_operator_transaction runs full pack authority on the composed source once, builds one composite proof and fresh branch-local reference table, and any preparation/composition/ validation failure leaves the base state untouched. Adds a TRANSACTION_COMMIT conversation turn so a transaction commits as one CRDT event carrying every constituent application ID, and exact replay from base + recorded transaction. Also fixes a pre-existing gap in transactions.py's target lineage that made bulk/selector operators unpreparable into any transaction. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap * SLM-413: rebuild ops-vocab registry for the new conversation.transaction_commit op CI's decode-invariant check (I13) caught that adding TRANSACTION_COMMIT to ConversationOperation drifted the committed shared encoder<->decoder ops vocabulary without rebuilding it. Rebuild via ops_vocab.write_registry() (19 -> 20 ops; conversation.transaction_commit inserted into the history family, shifting subsequent token_ids by one) and bump ops.vocab to v2. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8n55RpmVTcbuwT6Q42Eap --------- Co-authored-by: Claude <noreply@anthropic.com> * Record seed-7 topology control * SLM-398: typed categorical embeddings over the sanitized operator view (DSH3-23) (#923) * SLM-398: typed categorical embeddings over the sanitized operator view (DSH3-23) Adds OperatorFeatureEncoder/OperatorFeatureVocabularyV1/CandidateScoringHead over the SLM-397 OperatorPolicyInputV1 boundary, with three matched arms: hash_scalar (the existing _stable_scalar control, preserved as-is), typed (learned per-field embeddings for ref_kind/value_type/compiler_facts/ operator_id/binding_phase/effect_kind/locality/cost/position), and typed_identity_bucket (typed plus a labeled row-position-only anti-generalization control). All three share one ragged OperatorFeatureBatchV1 and CandidateScoringHead, so matched parameters/optimizer/steps/seed hold structurally rather than by convention. Ships scripts/run_dsh3_23_operator_feature_encoder_fixture.py, which trains and evaluates all three arms on a small deterministic fixture and emits OperatorFeatureEncodingReportV1 evidence (docs/design/ dsh3-23-operator-feature-encoder.{md,json}). At fixture scale the run is honestly underpowered (both hash_scalar and typed hit the toy task's ceiling) but the adversarial permutation-robustness control is decisive: typed and hash_scalar are exactly invariant under a row-order/opaque-ID reshuffle, while typed_identity_bucket -- which can see row position -- is not, confirming the SLM-397 boundary blocks identity-based shortcut learning even when a model is deliberately given a spurious position-like feature to exploit. claim_class: wiring; no ship or capability claim is made. Registers model.operator_feature_encoder v1 in versions.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS * Fix flaky exact-float permutation-invariance assertion in feature-encoder test Comparing embedding tuples with Python == is sensitive to BLAS/hardware- dependent floating-point summation order (CI runner vs local dev), causing ULP-level mismatches on an otherwise-passing permutation-invariance check. Switch to a per-value pytest.approx comparison, matching the tolerance already used by the production module's own _permutation_robustness check. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PYLGwD5toj2CQ1wRRb5vJS --------- Co-authored-by: Claude <noreply@anthropic.com> * SLM-300 + SLM-250: self-context exposure-bias curriculum + LOT1-01 not_authorized (#895) * SLM-300: wire self-context exposure-bias curriculum (AP-015) Add the preregistered self-context/scheduled-corruption curriculum manifest, an exact policy_origin_mixture(rate, lagged_share) function (gold vs. current-policy vs. lagged-policy mass split), and a torch-free fixture runner/CLI following the SLM-120 corruption curriculum pattern. Proves the "mixture zero reproduces legacy behavior" acceptance criterion as an exact, unit-tested invariant. Actual multi-seed self-context training arms remain gated on a GPU host and the certified baseline checkpoint (SLM-103); this is wiring evidence only, no recovery or ship-gate claim is made. Co-Authored-By: Claude Sonnet 5 <nore…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is on the session's designated branch (
claude/inspiring-franklin-hns9t1) and now carries two bounded, honest wiring-evidence slices completed in the same autonomous session, each closing a separate Linear issue.SLM-267 / VSD2-02: uniform-vs-coverage-targeted ProgramSpec sampling
SLM-267 asks for 10k/100k/1M-record ProgramSpec corpora comparing uniform-valid against coverage-targeted sampling, plus a training experiment at that scale. The repository's existing coverage-guided generator (SLM-5) samples from a fixed, exhaustible candidate grid, not an open-ended program space — those rungs are unreachable without a materially different generator, and no GPU training runs in this issue. Scoped down to what the generator actually supports:
generate.py: refactorgenerate_oneinto_materialize(candidate)+ newgenerate_uniform(rng)— a genuine uniform-random control arm, distinct from the existing greedyCoverageTracker.score()-driven selection.slm267_programspec_coverage_scaling.py+ CLIscripts/generate_programspec_corpus.py: runs both policies to a bounded budget, dedups by canonical-root fingerprint, reports exhaustion point and programs-to-full-coverage. Addsshard_seed(global_seed, shard_id, worker_id), the deterministic sharding primitive VSD2-02 requires.coverage_targetedreaches full coverable-cell coverage in 19 programs vsuniform's 34–35; both exhaust the 3-component grid at 36 accepted (28 unique roots, 8 duplicates via serialization collapse). Fully deterministic/reproducible.inconclusive(wiring only) — does not validate VSD-H7a/b/c, which require corpora/training orders of magnitude larger than this fixture budget.Linear: closes SLM-267.
SLM-296 / AP-013: verifier-filtered teacher-admission wiring evidence
SLM-296 asks for ≥500 accepted records from a capable separate-family teacher, filtered through G0-G10 + independent judgment + human audit, then a matched-budget fine-tune with grammar-on/off evaluation. This sandbox has no network access to a real teacher and no GPU — SLM-266 already measured that even a local CPU teacher run is infeasible here (≥11 days extrapolated for 10k requests). Scoped down to exercise the two real safety mechanisms the acceptance criteria test:
source="teacher"(a verifier-stack weak source) so admitted rows structurally cap at Bronze tier regardless of gate passes — "teacher self-judgment alone cannot assign Gold/Silver" is enforced by the realverify_record()tier rule, not asserted narratively.check_family_independence()+ a same-family "shadow judge" control: wiringindependent_judge_passed=Falsefor a same-family judge causes the real G11 gate to quarantine 10/10 sampled candidates; a different-family judge would pass.yield_limitation_no_real_teacher_available(wiring only) — the ≥500-record scale and grammar-on/off fine-tune comparison remain unaddressed in this sandbox, documented as explicit follow-up.Linear: closes SLM-296.
Test plan
python -m pytest tests/test_harnesses/experiments/test_slm267_programspec_coverage_scaling.py tests/test_scripts/test_generate_programspec_corpus.py tests/test_harnesses/experiments/test_slm296_verified_teacher_admission.py tests/test_scripts/test_run_verified_teacher_admission.py tests/test_data/test_progspec_generate.py tests/test_data/test_progspec.py tests/test_data/test_semantic_contrast.py -q— all passed (includes pre-existing progspec/semantic-contrast suites, confirming thegenerate.pyrefactor is behavior-preserving)python -m ruff checkon all changed/new Python files — cleanpython -m scripts.repo_policy— okpython -m scripts.verify_version_stamps --check— ok (harness.experimentsbumped v104→v106; two new components registered)git diff --check— cleanpython,python-static,data-build) green on the first commit;Vercelfailure is pre-existing across other open PRs (confirmed unrelated to this diff, e.g. also failing on SLM-317: do-no-harm AR→repair hybrid + advancement screen #852) and untouched by this change