S0: adopt closed project-op plan vocabulary + dependency-graph executor (#293) #335

Merged
nsaspy merged 16 commits from issue-293 into main 2026-09-04 18:45:07 +00:00
Owner

Runtime invariant implemented

Recreated CI pull request for the unchanged S0 adoption head 56901058ec3034c231dbb2462a715420787605bf after the former PR record disappeared from Forgejo.

  • Adopts rage/288-spec-plan-graph-executor at pinned 71a10ae plus D6-11 plan-native dispatch (653fed1) into current main.
  • rlm_plan remains the only step executor; one rlm_async scheduler.
  • sync_remote/run/index/delete dispatch through native_handlers and are excluded from expert mapping; edit/create remain write-expert-owned.
  • Main's #57/#53 canonical durable effect and authority boundary is exercised through the expert/native handler contract path.
  • Design gate validates the merged module; pre-adoption BASE extraction and base_ref_resolvable are retired honestly.
  • Forgejo #293, design records, research scope, KB state, and roadmap are reconciled.

Local evidence at 92550f5: deterministic suite 1218/1218 (98 suites), benchmark 16/16, design gate 63/63, contract gate, CLI demo/trace, fresh-process effect restart fixture, research approval, diff check, and prolog-verify check all green. Evidence commit: 5690105.

Refs #293

## Runtime invariant implemented Recreated CI pull request for the unchanged S0 adoption head `56901058ec3034c231dbb2462a715420787605bf` after the former PR record disappeared from Forgejo. - Adopts `rage/288-spec-plan-graph-executor` at pinned `71a10ae` plus D6-11 plan-native dispatch (`653fed1`) into current main. - `rlm_plan` remains the only step executor; one `rlm_async` scheduler. - `sync_remote`/`run`/`index`/`delete` dispatch through `native_handlers` and are excluded from expert mapping; `edit`/`create` remain write-expert-owned. - Main's #57/#53 canonical durable effect and authority boundary is exercised through the expert/native handler contract path. - Design gate validates the merged module; pre-adoption BASE extraction and `base_ref_resolvable` are retired honestly. - Forgejo #293, design records, research scope, KB state, and roadmap are reconciled. Local evidence at `92550f5`: deterministic suite 1218/1218 (98 suites), benchmark 16/16, design gate 63/63, contract gate, CLI demo/trace, fresh-process effect restart fixture, research approval, diff check, and `prolog-verify check` all green. Evidence commit: `5690105`. Refs #293
Implements #288: rlm_plan_graph parses model-authored plan dependency
graphs (JSON or term form) over a closed 12-op project vocabulary,
validates structure/ids/dependencies/cycles/vocabulary/arg-shapes/
per-op tool(Op) capabilities/aggregate budget before execution, then
executes ready steps through rlm_plan as the only step interpreter with
host-supplied expert closures. Includes cancellation-as-token-rethrow,
blocked propagation, aggregate budget feed-forward, symbol_ref/
source_span resolver contract, async-first surface (one rlm_async
submission, same-Future await), docs, contract gate, and 24 PlUnit
tests plus deterministic corpus registration. No new external-effect
path: shipped handlers are pure host closures.
fix(plan-graph): final-review hardening for #288
Some checks failed
Tree-sitter FFI / Direct SWI-Prolog Tree-sitter FFI (push) Successful in 2m49s
CI / REAL OpenRouter integration (push) Has been skipped
Paid OpenRouter / Pinned paid OpenRouter integration (push) Has been skipped
Nix flake / Flake package and clean runtime load (push) Failing after 25s
CI / Deterministic unit and load checks (push) Successful in 2m25s
Clean SWI pack install / Install and load copied pack (push) Successful in 6m22s
71a10ae238
Deterministic fault classification (no choicepoint leakage), grounded
invalid_args sentinels, ghost/duplicate depends_on rejection, malformed
host caps -> structured fault, per-op exact JSON key sets, aggregate
funding across all feed-forward classes (unfundable -> aborted/budget),
parse-phase attribution, docs corrections, design deviations recorded,
two new tests (unfundable step, pre-cancelled token). 1021/1021 green.
feat(plan-graph): D6-11 plan-native deterministic mutations (#355)
Some checks failed
Nix flake / Flake package and clean runtime load (pull_request) Failing after 54s
CI / Deterministic unit and load checks (pull_request) Successful in 4m46s
Clean SWI pack install / Install and load copied pack (pull_request) Successful in 4m21s
Paid OpenRouter / Pinned paid OpenRouter integration (pull_request) Failing after 4m48s
Tree-sitter FFI / Direct SWI-Prolog Tree-sitter FFI (pull_request) Successful in 8m0s
CI / REAL OpenRouter integration (pull_request) Failing after 20m36s
653fed13ad
Implements the operator decision recorded as D6-11 in
docs/research/spec-plan-authority.md (main): the closed set
sync_remote/1, run/1, index/1, delete/1 executes at the plan layer
through the canonical boundary (schema -> capability -> authority ->
durable effect admission -> dispatch -> observe), exactly like a
tool/3 step — never ambient shell/git access in plan code. They are
excluded from expert mapping and from the expert registry;
edit/2 and create/2 remain write-expert-owned (§8.3).

Executor changes (prolog/rlm_plan_graph.pl):
- plan_native_op/1 exported closed set + native_op_tool/1 mapping.
- Host deterministic adapter closures move to a separate trusted
  native_handlers([native_handler(Op, Handler)]) option; the executor
  performs no effects itself and gains no ambient authority.
- Preflight fail-closed: native steps require a native handler
  (unknown_native_handler), expert entries for plan-native ops are
  rejected (expert_mapping_excluded), and native entries for
  non-native ops are rejected (not_plan_native).
- Desugared form unchanged:
  plan([tool(Op, literal(Args), Bind), final(var(Bind))]) executed
  through the rlm_plan validate/execute ABIs.
- Per-op capability enforcement is untouched: an ungranted
  tool(Op) still fails closed at validation before any dispatch.

Tests (TDD, red first): plan-native single-op and full-set runs with
no expert registry, missing-handler preflight fault, expert-mapping
exclusion fault, non-native native-table rejection, capability
fail-closed unchanged. Existing expert-routed fixtures converted:
index/sync_remote move to the native table; read/search/validate/
delegate/expert paths unchanged.

SWI 10.0.2 compat fix required by the gate: decode_args/4 re-tags
unknown-op JSON args via dict_pairs(Args, _, Pairs) — this SWI
decodes JSON objects with a tag that does not unify with
plan_graph_args, so the invalid_args sentinel silently failed and
the two vocabulary-rejection tests failed. Fault contract unchanged.

Docs: plan-graph-runtime.md D6-11 dispatch section; design record
amendment appended (rage/288-spec-plan-graph-executor.org); contract
gate pins the plan_native_op/1 export.

Gate: check_runtime, load_all, run_tests 1027/1027 (86 suites),
benchmark deterministic 16/16, CLI demo, git diff --check,
research-approval, contract gate ALL DEFINED.
Adopt the closed project-op plan vocabulary and plan dependency-graph
executor (#293): prolog/rlm_plan_graph.pl, docs/plan-graph-runtime.md,
design record, contract gate, PlUnit suite. Resolves drift conflicts in
docs/typed-plans.md and test/load_all.pl (keep spec_strategy + add
plan_graph to the static load surface).
S0 adoption slice for the closed project-op plan vocabulary and plan
dependency-graph executor (Forgejo #293 / lost-rob0t/prolog-rlm#288).

Runtime invariant implemented:
- rlm_plan_graph.pl (71a10ae + 653fed1) is merged: rlm_plan remains the
  only step executor, one rlm_async scheduler, plan-native dispatch is
  the D6-11 closed set (sync_remote/run/index/delete) through
  native_handlers, excluded from expert mapping (expert_mapping_excluded);
  edit/create stay write-expert-owned.
- The handler contract path inherits main's #57/#53 durable effect
  boundary and authority semantics through the canonical rlm_tool
  registry: test/rlm_plan_native_ops_test.pl drives BOTH the plan layer
  and the executor's native_handlers path through tool_invoke and proves
  the durable observed attempt with content-derived fingerprint, replay
  without a second external dispatch, capability fail-closed before any
  dispatch, and observation ops never entering the effect store. The
  executor gains no effect path and no ambient authority.

Design gate (#356/#293 reconciliation):
- The extract-unmerged-BASE flow (git cat-file of the pinned 71a10ae
  object) is replaced by loading the merged prolog/rlm_plan_graph.pl
  from the checkout; base_ref_resolvable is retired and honestly
  repointed as plan_graph_merged_module_loaded (pinned id stays as
  adoption provenance).
- New plan_native_checks group (4 checks) validates the module's own
  exported plan_native_op/1 against the closed vocabulary, capability
  fail-closed/exact admission, and the canonical desugared tool/3 step.
- source:rage288: evidence refs repointed to the merged checkout path.

Docs + KB reconciliation:
- spec-plan-authority.md: D6-11 recorded verbatim in §6.3, D6-8 amended,
  §6.2 notes adoption and the retired pin, §14 updated (63 checks,
  14 groups).
- RLM-RESEARCH-353 scope boundary: plan-native ops are never projected
  as direct-mode expert tools.
- plan-graph-executor-design.md: adoption-reconciliation banner for the
  D6-11 deviations re-checked against merged code.
- plan-graph-runtime.md: canonical-boundary obligation + behavioral
  evidence for the native handler path.
- roadmap: D6-11 noted in the substrate paragraph.
- research KB: s00 recorded done with gate/source evidence, D6-11
  fold-in recorded as a validated decision.

Gate: check_runtime, load_all, run_tests 1218/1218 (98 suites incl.
rlm_plan_native_ops), benchmark deterministic 16/16, CLI demo,
design gate ALL CHECKS PASSED, plan_graph contract ALL REQUIREMENTS
DEFINED, research-approval PASS, git diff --check clean.

Refs #293 #355 #356
chore(verify): record #293 adoption gate evidence at head 92550f5
Some checks failed
Tree-sitter FFI / Direct SWI-Prolog Tree-sitter FFI (pull_request) Failing after 29s
CI / Deterministic unit and load checks (pull_request) Failing after 1m38s
CI / REAL OpenRouter integration (pull_request) Has been skipped
Clean SWI pack install / Install and load copied pack (pull_request) Has been cancelled
Paid OpenRouter / Pinned paid OpenRouter integration (pull_request) Has been cancelled
Nix flake / Flake package and clean runtime load (pull_request) Has been cancelled
56901058ec
Machine-recorded observations (prolog-verify observe) for check_runtime,
load_all, run_tests (1218/1218), benchmark deterministic, CLI demo,
design gate, plan_graph contract check, focused plan-graph and
plan-native suites, the fresh-process effect restart fixture, git diff
--check, and research-approval — all exit(0) at 92550f5. Derived
invariants pin the D6-11 closed set, expert-mapping exclusion, single
rlm_async scheduler, and no executor effect path. prolog-verify check
passes at that head.
chore(verify): record CI whitespace fix evidence
Some checks failed
Tree-sitter FFI / Direct SWI-Prolog Tree-sitter FFI (pull_request) Failing after 16s
CI / Deterministic unit and load checks (pull_request) Successful in 1m33s
CI / REAL OpenRouter integration (pull_request) Has been skipped
Nix flake / Flake package and clean runtime load (pull_request) Failing after 5m29s
Clean SWI pack install / Install and load copied pack (pull_request) Successful in 30s
Paid OpenRouter / Pinned paid OpenRouter integration (pull_request) Failing after 37s
d2cc7a9987
- .prolog state resolved to the incoming #293 task evidence (repo convention)
- roadmap text-streaming paragraph and deterministic corpus additions from
  #350 kept; no semantic overlap with the S0 adoption slice
chore(verify): record PR 335 merge reconcile evidence at a0272a3
Some checks failed
CI / REAL OpenRouter integration (pull_request) Has been skipped
Tree-sitter FFI / Direct SWI-Prolog Tree-sitter FFI (pull_request) Failing after 51s
Paid OpenRouter / Pinned paid OpenRouter integration (pull_request) Failing after 1m10s
Clean SWI pack install / Install and load copied pack (pull_request) Successful in 1m24s
CI / Deterministic unit and load checks (pull_request) Successful in 2m28s
Nix flake / Flake package and clean runtime load (pull_request) Failing after 5m33s
d211e682a7
nsaspy merged commit af9911ae30 into main 2026-09-04 18:45:07 +00:00
Sign in to join this conversation.
No description provided.