fix(okf): close the inert ingest-stamp guard, then land okf 0.8.5 -- and read the block sources form all four bases actually write
P13 measured this lift and REFUSED it, because okf >=0.8.5 emits the ownership
stamp as the V1 flow mapping `generated: { by: process:okf-ingest, at: ... }`
where 0.3.2 emitted `true`, and `_carries_complete_ingest_stamp` read the new
form as NOT a stamp -- write_concept_file's forgery refusal would have shipped
DISARMED with the whole fail-closed suite green. That blocker is closed first,
red-first, and then the pin moves.
ROW 1, THE SECURITY HALF. `_claims_ingest_ownership` widens the predicate from
"reads as boolean True" to "claims ingest ownership", of which the boolean is
the pre-V1 spelling. The recogniser for the new half is `decode_flow_value` --
the module's ONE flow decoder, the same argument write_concept_file already
makes for `verified`: the writer refuses exactly what the reader can read. A
value the decoder REFUSES is therefore not an ownership claim and writes
through, which is what keeps this from collapsing into "any non-empty
generated". Two arms red before the fix; no YAML library introduced.
THE PIN. okf v0.3.2 -> v0.8.5, guard v0.3.4 -> v1.4.0 spelled `tag =`, not
`rev =`, and not the declared floor 1.2.0 -- both P13 premises hold and the
reason now lives next to the pin in pyproject.toml. The ":40" comment is
corrected: okf has ONE runtime dependency, the guard, and that is what binds
the two lines together. 27/27 imported names resolve across five modules.
THE GOLDENS, REGENERATED AS A DECISION. Seven concept files across four
examples/ingest-golden-* bundles, one line each. Two were regenerated by the
REAL materializer; the other five are derived (http/sql/mcp cannot materialize
outside the tests' stubs) and then MEASURED -- all four golden suites compare
byte for byte against what the stubs produce, and all four are green. The four
`generated == "true"` asserts now read ONE source, conftest.
expected_generated_stamp: four literals for one emitter fact are four places a
later release can leave half-corrected, which is exactly how the pre-V1 form
survived until P13 measured it. tests/test_okf.py keeps its literal on purpose
-- that one round-trips a CURATED half-stamp through our own writer.
THE BLOCK READER. Measured with the full denominator: all four delivered
knowledge bases write `sources` as a BLOCK sequence and none in flow form
(n100 446/446, n200 1133/1133, n500 270/270, r761 2756/2756 = 4605/4605), and
`evidence_for` reported `unreadable` on 4605 of 4605 -- the falsification layer
had no address for any document in any base. `okf.decode_block_mappings` is the
second CARRIER of one grammar, never a second grammar: colon-SPACE separator,
unquote_scalar, duplicate keys refused, SPEC 5.2's actor rule applied. okf's
consume.read_sources was READ for the form and not called; po calls no okf
reader, which is measured and deliberate. After: 4605 present / 4605 entries.
Reading is not a licence to WRITE -- the emitter is untouched and both writers
still refuse what decode_flow_value refuses.
THREE FINDINGS. (1) The first block reader INVENTED data on `- { k: v }` items
-- SPEC-canonical, and the shape tests/golden/block-form-provenance writes for
`verified` -- decoding it as `{'{ id': '...'}`. No arm caught it: the 5.2 actor
rule shielded the fixture by accident. Closed with a flow-decoder branch and
four new arms. (2) One of my own arms was VACUOUS, found by my own mutation M5:
it claimed to prove the colon-SPACE rule and stayed green under first-colon,
because the two rules agree on every delivered value. Renamed, labelled, and
the claim moved to the arm that actually witnesses it. (3) OPEN, and it needs
the operator: the commons-owned worked example declares its second concept
`unreadable`/`block-sequence`, which is now false for po. `shared/` is
pull-only, so closing it needs a commons amendment; the test asserts the
divergence instead of skipping it, keeping the discriminating half (the example
says two entries were seen and the reader returns exactly two).
NINE EXISTING ARMS REWRITTEN, NONE WEAKENED. All nine pinned "the block form is
unreadable" -- the behaviour this order changes. Each keeps its claim on a
specimen that is still unreadable for a reason of its own (5.2: an entry naming
no actor), or pins the REVERSED direction where the old arm stood so the change
cannot be silent. Two got STRONGER: multi-verified.md was authored for "a reader
keeping the last entry reports machine-confirmed for a concept a human signed",
and that could not be tested while the form was unreadable. Three node ids were
renamed; nothing was removed in substance.
Suite 1582 -> 1606 passed / 5 skipped. Both demo goldens byte-unchanged
(ea8c534... / ede3e2f..., shasum -a 1 of the CONTENT, never the git blob id).
ruff check / ruff format / mypy green. shared/ untouched.
Six mutations, all red against the WHOLE suite, each with its own signature:
row 1 detached (2) / block reader detached (17) / flow-item branch detached (7)
/ a stray indented line folds into an INVENTED entry (4) / separator becomes the
first colon (1 -- and that is finding 2) / the stamp expectation reverts to
"true" (4).
Order: 20260912T195112Z-995611104-from-.claude
Record: docs/2026-09-12-p13b-okf-bump.md
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
parent
afdd9e0692
commit
fed69790ac
25 changed files with 964 additions and 89 deletions
|
|
@ -60,11 +60,18 @@ def test_block_form_bundle_renders_the_captured_bytes() -> None:
|
|||
)
|
||||
assert [f.name for f in bundle.files] == ["index.md", "attested.md", "multi-verified.md"]
|
||||
|
||||
# (2) The decoder REFUSES the same document's `sources`, on the very same fixture. A refusal
|
||||
# that reached navigation would be a coupling a correct design never creates.
|
||||
# (2) The decoder READS the same document's block `sources`, on the very same fixture — the
|
||||
# direction REVERSED by P13b, and the fixture's own body is what asked for it ("a reader that
|
||||
# only understands the flow shorthand loses the provenance of this concept entirely"). The
|
||||
# coexistence claim is unchanged and is now the stronger one: a decoder that reads this
|
||||
# document did not make navigation any less tolerant of it, and did not move a byte of (3).
|
||||
sources = okf.read_provenance(Path(bundle_dir) / "attested.md", "sources")
|
||||
assert isinstance(sources, okf.UnreadableProvenance)
|
||||
assert sources.reason == "block-sequence"
|
||||
assert sources == (
|
||||
{
|
||||
"resource": "https://example.invalid/fixture-cost-baseline",
|
||||
"id": "fixture-cost-baseline",
|
||||
},
|
||||
)
|
||||
|
||||
# (3) And the bytes have not moved. This clause is the one a no-op cannot fake: tolerant
|
||||
# navigation was ALREADY today's behaviour, so clauses (1) and (2) alone are green on a tree
|
||||
|
|
@ -79,6 +86,22 @@ def test_block_form_bundle_renders_the_captured_bytes() -> None:
|
|||
_ENERGI_BUNDLE = Path(__file__).resolve().parents[1] / "shared" / "examples" / "bygg-energi-mikro"
|
||||
|
||||
|
||||
def _unreadable_document(tmp_path: Path, entries: int = 1) -> Path:
|
||||
"""A document whose ``verified`` is a block sequence the decoder REFUSES, with a chosen count.
|
||||
|
||||
P13b widened the reader to the block sequence of mappings (measured: 4605 of 4605 concepts in
|
||||
the four delivered bases write it, and po reported every one of them unreadable). The arms below
|
||||
need a specimen that is still unreadable for a reason of its own, or they would be asserting
|
||||
against a state the reader no longer produces. This one refuses on SPEC §5.2 — an entry naming
|
||||
no ``by`` actor — which keeps the reason token ``block-sequence`` and lets the count be chosen,
|
||||
so the triple those arms assert on is unchanged rather than relabelled.
|
||||
"""
|
||||
path = tmp_path / f"unreadable-{entries}.md"
|
||||
items = "".join(f" - at: 2026-01-0{n + 1}T00:00:00Z\n" for n in range(entries))
|
||||
path.write_text(f"---\ntype: concept\nverified:\n{items}---\n\nInnhold.\n", encoding="utf-8")
|
||||
return path
|
||||
|
||||
|
||||
def _present_document(tmp_path: Path) -> Path:
|
||||
"""A REAL flow-form document, produced by our own writer — never a mock.
|
||||
|
||||
|
|
@ -122,28 +145,62 @@ def test_a_document_without_the_key_is_absent_and_carries_no_tier() -> None:
|
|||
assert evidence.items_seen == 0
|
||||
|
||||
|
||||
def test_a_block_form_document_is_unreadable_and_says_WHY() -> None:
|
||||
def test_an_undecodable_document_is_unreadable_and_says_WHY(tmp_path: Path) -> None:
|
||||
"""The third state, and the arm asserts the REASON, not merely the state.
|
||||
|
||||
A collapsed ``unreadable`` → ``absent`` is a verdict on missing evidence presented as evidence
|
||||
of absence. Asserting only ``state != "present"`` would stay green against exactly that
|
||||
collapse, so the reason token is what this arm pins.
|
||||
|
||||
The specimen moved off the committed fixture when P13b made the block sequence READABLE. What
|
||||
the arm claims is unchanged — the third state still exists and still carries its reason — and
|
||||
the specimen now refuses on a rule of its own (SPEC §5.2, an entry naming no actor) rather than
|
||||
on the carrier having no reader.
|
||||
"""
|
||||
evidence = okf.evidence_for(_GOLDEN_DIR / "bundle" / "attested.md")
|
||||
evidence = okf.evidence_for(_unreadable_document(tmp_path))
|
||||
assert evidence.state == "unreadable"
|
||||
assert evidence.reason == "block-sequence"
|
||||
assert evidence.items_seen == 1
|
||||
|
||||
|
||||
def test_a_two_entry_block_document_yields_NO_tier() -> None:
|
||||
"""A tier here would be the measured second-entry-wins defect surfacing.
|
||||
def test_the_committed_block_form_fixture_is_now_READ(tmp_path: Path) -> None:
|
||||
"""The direction P13b reversed, pinned where the old arm stood so the change cannot be silent.
|
||||
|
||||
``multi-verified.md`` carries a human sign-off FIRST and a process entry SECOND. A reader that
|
||||
limped past the block form and kept the last entry it saw would report ``machine-confirmed``
|
||||
for a concept a human signed — downgrading the tier with nothing failing. The honest answer to
|
||||
an unreadable value is no tier at all.
|
||||
``attested.md`` was the repo's specimen for "the reader cannot read this". It is the SPEC §5.1
|
||||
block form, which all four delivered knowledge bases write on 4605 of 4605 concepts, and it now
|
||||
yields its single verification entry with the actor intact."""
|
||||
evidence = okf.evidence_for(_GOLDEN_DIR / "bundle" / "attested.md")
|
||||
assert evidence.state == "present"
|
||||
assert evidence.reason is None
|
||||
assert evidence.items_seen == 1
|
||||
assert evidence.entries[0]["by"] == "process:fixture-check"
|
||||
assert evidence.tier == "machine-confirmed"
|
||||
|
||||
|
||||
def test_a_two_entry_block_document_keeps_the_human_sign_off() -> None:
|
||||
"""The defect this fixture was AUTHORED for, finally checkable rather than merely avoided.
|
||||
|
||||
``multi-verified.md`` carries a human sign-off FIRST and a process entry SECOND. Until P13b the
|
||||
block form came back unreadable, so "no tier at all" was the honest answer — and the
|
||||
second-entry-wins defect the fixture's body describes could not be tested for, only sidestepped.
|
||||
Now that the form is read, the claim is the real one: both entries survive IN ORDER and the tier
|
||||
is the human one. A reader keeping the last entry it saw would report ``machine-confirmed`` for
|
||||
a concept a human signed, with nothing failing.
|
||||
"""
|
||||
evidence = okf.evidence_for(_GOLDEN_DIR / "bundle" / "multi-verified.md")
|
||||
assert evidence.state == "present"
|
||||
assert evidence.items_seen == 2
|
||||
assert [entry["by"] for entry in evidence.entries] == [
|
||||
"human:fixture-reviewer",
|
||||
"process:fixture-nightly",
|
||||
]
|
||||
assert evidence.tier == "human-reviewed"
|
||||
|
||||
|
||||
def test_an_unreadable_document_yields_NO_tier(tmp_path: Path) -> None:
|
||||
"""The half of the arm above that P13b did NOT change: the honest answer to a value that could
|
||||
not be read is no tier at all, never a tier derived from what the reader limped past."""
|
||||
evidence = okf.evidence_for(_unreadable_document(tmp_path, entries=2))
|
||||
assert evidence.state == "unreadable"
|
||||
assert evidence.tier is None
|
||||
assert evidence.items_seen == 2
|
||||
|
|
@ -154,10 +211,13 @@ def test_evidence_notice_is_None_when_there_is_nothing_to_say(tmp_path: Path) ->
|
|||
assert okf.evidence_notice(okf.evidence_for(_present_document(tmp_path))) is None
|
||||
|
||||
|
||||
def test_evidence_notice_prints_the_reason_TOKEN_itself() -> None:
|
||||
def test_evidence_notice_prints_the_reason_TOKEN_itself(tmp_path: Path) -> None:
|
||||
"""No second display vocabulary. A prose translation here would be free to drift from
|
||||
``ProvenanceReason``, and the drifted copy is the one the operator would read."""
|
||||
notice = okf.evidence_notice(okf.evidence_for(_GOLDEN_DIR / "bundle" / "attested.md"))
|
||||
``ProvenanceReason``, and the drifted copy is the one the operator would read.
|
||||
|
||||
The specimen moved from the committed fixture to ``_unreadable_document`` because P13b made the
|
||||
fixture READABLE; the token and the count asserted are unchanged."""
|
||||
notice = okf.evidence_notice(okf.evidence_for(_unreadable_document(tmp_path)))
|
||||
assert notice is not None
|
||||
assert "block-sequence" in notice
|
||||
assert "items_seen=1" in notice
|
||||
|
|
@ -166,9 +226,12 @@ def test_evidence_notice_prints_the_reason_TOKEN_itself() -> None:
|
|||
# --- Amendment A: the K5 threshold ------------------------------------------------------------
|
||||
|
||||
|
||||
def test_admits_falsification_refuses_a_state_that_is_not_present() -> None:
|
||||
"""AMENDMENT A, first conjunct — a verdict may not rest on evidence that was never read."""
|
||||
assert not okf.admits_falsification(okf.evidence_for(_GOLDEN_DIR / "bundle" / "attested.md"))
|
||||
def test_admits_falsification_refuses_a_state_that_is_not_present(tmp_path: Path) -> None:
|
||||
"""AMENDMENT A, first conjunct — a verdict may not rest on evidence that was never read.
|
||||
|
||||
Both non-present states are exercised: unreadable (the specimen, since P13b made the committed
|
||||
fixture readable) and absent (``index.md``, which declares no ``verified`` at all)."""
|
||||
assert not okf.admits_falsification(okf.evidence_for(_unreadable_document(tmp_path)))
|
||||
assert not okf.admits_falsification(okf.evidence_for(_GOLDEN_DIR / "bundle" / "index.md"))
|
||||
|
||||
|
||||
|
|
@ -193,14 +256,14 @@ def test_admits_falsification_ADMITS_the_positive_case(tmp_path: Path) -> None:
|
|||
assert okf.admits_falsification(okf.evidence_for(_present_document(tmp_path)))
|
||||
|
||||
|
||||
def test_a_discounted_concept_reports_the_TRIPLE_not_merely_the_refusal() -> None:
|
||||
def test_a_discounted_concept_reports_the_TRIPLE_not_merely_the_refusal(tmp_path: Path) -> None:
|
||||
"""AMENDMENT A — "why it was discounted" is the operative fact.
|
||||
|
||||
A dropped concept and a discounted one are different facts, and only the second is honest about
|
||||
what was read. Asserting that admission was denied says nothing about which of them happened;
|
||||
the triple ``(state, reason, items_seen)`` is what makes the difference legible.
|
||||
"""
|
||||
evidence = okf.evidence_for(_GOLDEN_DIR / "bundle" / "multi-verified.md")
|
||||
evidence = okf.evidence_for(_unreadable_document(tmp_path, entries=2))
|
||||
assert not okf.admits_falsification(evidence)
|
||||
assert (evidence.state, evidence.reason, evidence.items_seen) == (
|
||||
"unreadable",
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue