Add proof-carrying child result acceptance boundary #255

Merged

lost-rob0t merged 1 commit from rage/56-result-acceptance into main

2026-08-27 02:35:39 +00:00

lost-rob0t commented

2026-08-26 17:55:37 +00:00

(Migrated from github.com)

Advances #56.

RAGE slice

Starts from exact canonical main 267697bef10a3fffff7c093e1435ece770e7444b. No competing #56 transaction or downstream product implementation was found. This reuses merged #92's rlm_evidence / Spec/Verify substrate rather than introducing another verifier stack.

Current exact candidate head: 60bb1effb46abedf7ac23cc544ac6ba63c1a5f08.

TDD first

Commit a8beb5048e14a661d16610d4c30b66738d457312 defines the result-acceptance contract before production implementation. The test-only head was not opened as a PR, so CI was not intentionally left red.

The deterministic matrix covers valid completed acceptance, non-completed rejection, missing/undeclared claim evidence, stale/missing artifact refs, model-claim proof laundering, child-proposed verifier laundering, distinct verifier failure/error/timeout states, monotonic policy narrowing, duplicate claim IDs and nonground result rejection. Negative behavior is asserted as expected structured rejection while the suite remains green.

Design / realization

rlm_result_accept adds result_normalize/2, result_acceptance_policy_normalize/2, result_acceptance_policy_narrow/3, and result_accept/4.

Child completion and parent acceptance remain distinct. The result envelope is closed typed data. Artifact refs retain typed ground identity and are resolved through canonical rlm_artifact; current artifact provenance is checked by canonical rlm_evidence policy. Host-required verifier outcomes come only from a separate trusted acceptance context. The child envelope's verification field is inert proposal metadata and cannot satisfy or waive a host-required verifier.

Policy narrowing reuses evidence_policy_narrow/3, only tightens boolean evidence requirements, and unions required verifier sets. The module is statically loaded by test/load_all.pl; its tests are in the authoritative deterministic corpus; public/security semantics are in docs/result-acceptance.md.

Adversarial review

The first realization was rejected before promotion after review found three real bugs: non-completed children could still be accepted, claim-local refs could bypass result-level declaration/resolution, and duplicate identities could fail nondeterministically. Tests were hardened before the production fixes.

A second interface review rejected generic closed-data retagging for artifact refs because that would erase reusable typed identity. Artifact refs now have a separate ground typed boundary while arbitrary child payloads remain canonical closed data.

Security invariants: completion != acceptance; model/child data never becomes a verifier callable; child-proposed verification cannot satisfy host verification; evidence/verifier policy narrows only; missing/stale/untrusted evidence remains explicit rejection; verifier failure/error/timeout never becomes success; no authority/effect/capability path or private reasoning storage is introduced.

Exact-head verification

Exact head 60bb1effb46abedf7ac23cc544ac6ba63c1a5f08, tested as synthetic merge 66b83c7a3d4fec829cded86ffc68d2fa134984fc into unchanged main, is green for:

canonical deterministic PlUnit: 79 suites / 899 discovered / 899 planned / 899 completed / 899 passed / 0 failed / 0 timeout / 0 blocked / 0 fixme;
deterministic benchmark/conformance: 16/16 pass;
deterministic deep-recursion experiment: 15/15 pass;
credential-free CLI/trace smoke;
graph and artifact fresh-process restart checks;
whitespace checks;
credential-backed REAL OpenRouter core, structured repair, benchmark, depth 0/1/2 and CLI smoke;
pinned Paid OpenRouter;
Nix flake;
clean SWI pack install;
Tree-sitter FFI.

No submitted reviews, PR conversation comments, or unresolved review threads exist. GitHub reports the PR mergeable.

Scope / decision

Engineering decision: GO for this bounded first #56 slice. #56 remains open for separate acceptance trace events and deeper canonical supervised-child integration/correlation.

Merge remains subject to the repository's stronger explicit merge-on-green authorization requirement.

Advances #56. ## RAGE slice Starts from exact canonical `main` `267697bef10a3fffff7c093e1435ece770e7444b`. No competing #56 transaction or downstream product implementation was found. This reuses merged #92's `rlm_evidence` / Spec/Verify substrate rather than introducing another verifier stack. Current exact candidate head: `60bb1effb46abedf7ac23cc544ac6ba63c1a5f08`. ## TDD first Commit `a8beb5048e14a661d16610d4c30b66738d457312` defines the result-acceptance contract before production implementation. The test-only head was not opened as a PR, so CI was not intentionally left red. The deterministic matrix covers valid completed acceptance, non-completed rejection, missing/undeclared claim evidence, stale/missing artifact refs, model-claim proof laundering, child-proposed verifier laundering, distinct verifier failure/error/timeout states, monotonic policy narrowing, duplicate claim IDs and nonground result rejection. Negative behavior is asserted as expected structured rejection while the suite remains green. ## Design / realization `rlm_result_accept` adds `result_normalize/2`, `result_acceptance_policy_normalize/2`, `result_acceptance_policy_narrow/3`, and `result_accept/4`. Child completion and parent acceptance remain distinct. The result envelope is closed typed data. Artifact refs retain typed ground identity and are resolved through canonical `rlm_artifact`; current artifact provenance is checked by canonical `rlm_evidence` policy. Host-required verifier outcomes come only from a separate trusted acceptance context. The child envelope's `verification` field is inert proposal metadata and cannot satisfy or waive a host-required verifier. Policy narrowing reuses `evidence_policy_narrow/3`, only tightens boolean evidence requirements, and unions required verifier sets. The module is statically loaded by `test/load_all.pl`; its tests are in the authoritative deterministic corpus; public/security semantics are in `docs/result-acceptance.md`. ## Adversarial review The first realization was rejected before promotion after review found three real bugs: non-completed children could still be accepted, claim-local refs could bypass result-level declaration/resolution, and duplicate identities could fail nondeterministically. Tests were hardened before the production fixes. A second interface review rejected generic closed-data retagging for artifact refs because that would erase reusable typed identity. Artifact refs now have a separate ground typed boundary while arbitrary child payloads remain canonical closed data. Security invariants: completion != acceptance; model/child data never becomes a verifier callable; child-proposed verification cannot satisfy host verification; evidence/verifier policy narrows only; missing/stale/untrusted evidence remains explicit rejection; verifier failure/error/timeout never becomes success; no authority/effect/capability path or private reasoning storage is introduced. ## Exact-head verification Exact head `60bb1effb46abedf7ac23cc544ac6ba63c1a5f08`, tested as synthetic merge `66b83c7a3d4fec829cded86ffc68d2fa134984fc` into unchanged `main`, is green for: - canonical deterministic PlUnit: **79 suites / 899 discovered / 899 planned / 899 completed / 899 passed / 0 failed / 0 timeout / 0 blocked / 0 fixme**; - deterministic benchmark/conformance: 16/16 pass; - deterministic deep-recursion experiment: 15/15 pass; - credential-free CLI/trace smoke; - graph and artifact fresh-process restart checks; - whitespace checks; - credential-backed REAL OpenRouter core, structured repair, benchmark, depth 0/1/2 and CLI smoke; - pinned Paid OpenRouter; - Nix flake; - clean SWI pack install; - Tree-sitter FFI. No submitted reviews, PR conversation comments, or unresolved review threads exist. GitHub reports the PR mergeable. ## Scope / decision Engineering decision: **GO for this bounded first #56 slice**. #56 remains open for separate acceptance trace events and deeper canonical supervised-child integration/correlation. Merge remains subject to the repository's stronger explicit merge-on-green authorization requirement.