open/portfolio-optimiser
1
0
Fork 0
Code Issues Releases 4 Activity

fix(okf): close the inert ingest-stamp guard, then land okf 0.8.5 -- and read the block sources form all four bases actually write

Browse source 
P13 measured this lift and REFUSED it, because okf >=0.8.5 emits the ownership
stamp as the V1 flow mapping `generated: { by: process:okf-ingest, at: ... }`
where 0.3.2 emitted `true`, and `_carries_complete_ingest_stamp` read the new
form as NOT a stamp -- write_concept_file's forgery refusal would have shipped
DISARMED with the whole fail-closed suite green. That blocker is closed first,
red-first, and then the pin moves.

ROW 1, THE SECURITY HALF. `_claims_ingest_ownership` widens the predicate from
"reads as boolean True" to "claims ingest ownership", of which the boolean is
the pre-V1 spelling. The recogniser for the new half is `decode_flow_value` --
the module's ONE flow decoder, the same argument write_concept_file already
makes for `verified`: the writer refuses exactly what the reader can read. A
value the decoder REFUSES is therefore not an ownership claim and writes
through, which is what keeps this from collapsing into "any non-empty
generated". Two arms red before the fix; no YAML library introduced.

THE PIN. okf v0.3.2 -> v0.8.5, guard v0.3.4 -> v1.4.0 spelled `tag =`, not
`rev =`, and not the declared floor 1.2.0 -- both P13 premises hold and the
reason now lives next to the pin in pyproject.toml. The ":40" comment is
corrected: okf has ONE runtime dependency, the guard, and that is what binds
the two lines together. 27/27 imported names resolve across five modules.

THE GOLDENS, REGENERATED AS A DECISION. Seven concept files across four
examples/ingest-golden-* bundles, one line each. Two were regenerated by the
REAL materializer; the other five are derived (http/sql/mcp cannot materialize
outside the tests' stubs) and then MEASURED -- all four golden suites compare
byte for byte against what the stubs produce, and all four are green. The four
`generated == "true"` asserts now read ONE source, conftest.
expected_generated_stamp: four literals for one emitter fact are four places a
later release can leave half-corrected, which is exactly how the pre-V1 form
survived until P13 measured it. tests/test_okf.py keeps its literal on purpose
-- that one round-trips a CURATED half-stamp through our own writer.

THE BLOCK READER. Measured with the full denominator: all four delivered
knowledge bases write `sources` as a BLOCK sequence and none in flow form
(n100 446/446, n200 1133/1133, n500 270/270, r761 2756/2756 = 4605/4605), and
`evidence_for` reported `unreadable` on 4605 of 4605 -- the falsification layer
had no address for any document in any base. `okf.decode_block_mappings` is the
second CARRIER of one grammar, never a second grammar: colon-SPACE separator,
unquote_scalar, duplicate keys refused, SPEC 5.2's actor rule applied. okf's
consume.read_sources was READ for the form and not called; po calls no okf
reader, which is measured and deliberate. After: 4605 present / 4605 entries.
Reading is not a licence to WRITE -- the emitter is untouched and both writers
still refuse what decode_flow_value refuses.

THREE FINDINGS. (1) The first block reader INVENTED data on `- { k: v }` items
-- SPEC-canonical, and the shape tests/golden/block-form-provenance writes for
`verified` -- decoding it as `{'{ id': '...'}`. No arm caught it: the 5.2 actor
rule shielded the fixture by accident. Closed with a flow-decoder branch and
four new arms. (2) One of my own arms was VACUOUS, found by my own mutation M5:
it claimed to prove the colon-SPACE rule and stayed green under first-colon,
because the two rules agree on every delivered value. Renamed, labelled, and
the claim moved to the arm that actually witnesses it. (3) OPEN, and it needs
the operator: the commons-owned worked example declares its second concept
`unreadable`/`block-sequence`, which is now false for po. `shared/` is
pull-only, so closing it needs a commons amendment; the test asserts the
divergence instead of skipping it, keeping the discriminating half (the example
says two entries were seen and the reader returns exactly two).

NINE EXISTING ARMS REWRITTEN, NONE WEAKENED. All nine pinned "the block form is
unreadable" -- the behaviour this order changes. Each keeps its claim on a
specimen that is still unreadable for a reason of its own (5.2: an entry naming
no actor), or pins the REVERSED direction where the old arm stood so the change
cannot be silent. Two got STRONGER: multi-verified.md was authored for "a reader
keeping the last entry reports machine-confirmed for a concept a human signed",
and that could not be tested while the form was unreadable. Three node ids were
renamed; nothing was removed in substance.

Suite 1582 -> 1606 passed / 5 skipped. Both demo goldens byte-unchanged
(ea8c534... / ede3e2f..., shasum -a 1 of the CONTENT, never the git blob id).
ruff check / ruff format / mypy green. shared/ untouched.

Six mutations, all red against the WHOLE suite, each with its own signature:
row 1 detached (2) / block reader detached (17) / flow-item branch detached (7)
/ a stray indented line folds into an INVENTED entry (4) / separator becomes the
first colon (1 -- and that is finding 2) / the stamp expectation reverts to
"true" (4).

Order: 20260912T195112Z-995611104-from-.claude
Record: docs/2026-09-12-p13b-okf-bump.md

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-12 23:02:38 +02:00
commit fed69790ac
25 changed files with 964 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

58
tests/test_okf_version_guard.py
View file

@ -12,14 +12,16 @@ A grep on ``pyproject.toml`` alone would be blind to an environment that drifted
stale ``.venv``, a shadowing tool install), and a version assert alone would be blind to a lock that
drifted from the declared pin. This guard is both halves.
**Why the pins are still 0.3.2 / 0.3.4 after P13 measured 0.8.5 / 1.4.0.** The lift was built and
run in a worktree on 2026-09-12 and it is NOT green: okf 0.8.5 emits the V1 provenance stamp
``generated: { by: process:okf-ingest, at: <ingested_at> }`` where 0.3.2 emitted ``generated: true``.
Eight tests go red on that ONE line, and — the finding that decides it — ``okf.
_carries_complete_ingest_stamp`` returns ``False`` for the new form while the whole suite stays
green on that seam, so the ``write_concept_file`` forgery refusal would land DISARMED. The refusal
messages below name that, because a pin whose reason lives only in prose is a pin the next session
lifts without re-measuring. Full numbers: ``docs/2026-09-12-p13-okf-pin-r761.md``.
**What the pinned pair costs, and why it is named in the refusal.** P13 measured the lift and
REFUSED it; P13b closed the blocker and landed it. okf >=0.8.5 emits the V1 provenance stamp
``generated: { by: process:okf-ingest, at: <ingested_at> }`` where 0.3.2 emitted ``generated: true``,
and ``okf._carries_complete_ingest_stamp`` read the new form as NOT a stamp — the
``write_concept_file`` forgery refusal went inert on exactly the output it guards against, with the
whole fail-closed suite green. ``_claims_ingest_ownership`` now recognises BOTH spellings. Any
further lift must re-measure that predicate against what the new release actually writes, because
nothing in the suite would go red if a third spelling appeared. The refusal messages below name it,
because a pin whose reason lives only in prose is a pin the next session lifts without
re-measuring. Full numbers: ``docs/2026-09-12-p13-okf-pin-r761.md`` and ``…-p13b-okf-bump.md``.
"""
from __future__ import annotations
@ -35,17 +37,17 @@ _GUARD_DIST = "llm-ingestion-guard"
#: The measured-green pins. ONE place each; the ``pyproject`` asserts DERIVE their expected strings
#: from these (the kø-(p) rule) — two literals for one fact drift, and a drifted pin is a guard that
#: stops guarding without a local diff.
_OKF_PINNED = "0.3.2"
_GUARD_PINNED = "0.3.4"
_OKF_PINNED = "0.8.5"
_GUARD_PINNED = "1.4.0"
_OKF_LIFT_COST = (
"P13 measured the lift to 0.8.5 in a worktree: 27/27 imported names still resolve, both demo "
"goldens stay byte-identical and ruff/mypy pass, but the emitted stamp moves from "
"'generated: true' to the V1 flow mapping 'generated: { by: ..., at: ... }'. Eight tests go "
"red on that one line (four examples/ingest-golden-* byte goldens over seven concept files, "
"plus four 'generated == \"true\"' asserts), and okf._carries_complete_ingest_stamp reads the "
"new form as NOT a stamp — so write_concept_file's forgery refusal would ship disarmed with "
"the suite green. Close that first; see docs/2026-09-12-p13-okf-pin-r761.md."
"Before lifting, re-measure what this release EMITS as the §7 ownership stamp and check "
"okf._claims_ingest_ownership still recognises it. 0.3.2 wrote 'generated: true'; 0.8.5 writes "
"the V1 flow mapping 'generated: { by: process:okf-ingest, at: ... }', and the detector that "
"knew only the boolean left write_concept_file's forgery refusal INERT with the whole "
"fail-closed suite green (P13 § 2c'). A third spelling would do the same. Then expect the four "
"examples/ingest-golden-* byte goldens (seven concept files) and conftest."
"expected_generated_stamp to move with it. See docs/2026-09-12-p13b-okf-bump.md."
)
_GUARD_LIFT_COST = (
@ -54,7 +56,8 @@ _GUARD_LIFT_COST = (
"ingest._ACCEPTED_DISPOSITION reads 'warn' as the lowest tier a clean concept scores — "
"re-measure it before lifting. Note also that okf >=0.8.5 pins this library itself via "
"[tool.uv.sources] tag = 'v1.4.0', so a consumer cannot choose a lower 1.x, and must spell its "
"own pin with tag= rather than rev= or uv refuses the resolution as conflicting URLs."
"own pin with tag= rather than rev= or uv refuses the resolution as conflicting URLs — which "
"is why pyproject.toml spells this one tag= and the okf one rev=."
)
@ -89,19 +92,19 @@ def test_installed_guard_version_is_the_pinned_one() -> None:
def test_okf_guard_trips_on_the_measured_lift_and_on_its_neighbours() -> None:
"""``0.8.5`` is the release P13 actually measured; ``0.4.0`` is where the guard first became a
hard runtime dependency of okf; ``0.8.4`` and ``0.9.0`` bracket the measured one, so a
neighbouring tag cannot slip in under a range this pin does not have."""
for other in ("0.4.0", "0.7.0", "0.8.4", "0.8.5", "0.9.0", "1.0.0"):
"""``0.3.2`` is the pin P13b lifted FROM, so a revert cannot pass silently; ``0.4.0`` is where
the guard first became a hard runtime dependency of okf; ``0.8.4``/``0.8.6`` bracket the pinned
one, so a neighbouring tag cannot slip in under a range this pin does not have."""
for other in ("0.3.2", "0.4.0", "0.7.0", "0.8.4", "0.8.6", "0.9.0", "1.0.0"):
with pytest.raises(ValueError, match="write_concept_file"):
assert_pinned_okf_version(other)
def test_guard_version_guard_trips_on_the_lift_okf_would_force() -> None:
"""``1.4.0`` is the tag okf 0.8.5 forces (it pins this library itself); ``1.2.0`` is the lowest
1.x satisfying okf's declared ``>=1.2,<2.0`` and is NOT choosable for that reason; ``2.0.0`` is
where the surface freeze ends."""
for other in ("0.3.3", "1.2.0", "1.4.0", "2.0.0"):
"""``0.3.4`` is the pin P13b lifted FROM; ``1.2.0`` is the lowest 1.x satisfying okf's declared
``>=1.2,<2.0`` and is NOT choosable, because okf pins this library itself at ``v1.4.0``;
``2.0.0`` is where the surface freeze ends."""
for other in ("0.3.4", "1.2.0", "1.3.0", "2.0.0"):
with pytest.raises(ValueError, match="calibration"):
assert_pinned_guard_version(other)
@ -111,4 +114,5 @@ def test_pyproject_pins_both_tags() -> None:
cannot drift apart."""
pyproject = (Path(__file__).resolve().parents[1] / "pyproject.toml").read_text(encoding="utf-8")
assert f'llm-ingestion-okf.git", rev = "v{_OKF_PINNED}" }}' in pyproject
assert f'llm-ingestion-pipeline-security.git", rev = "v{_GUARD_PINNED}" }}' in pyproject
# `tag =`, not `rev =`: measured, not stylistic. See _GUARD_LIFT_COST.
assert f'llm-ingestion-pipeline-security.git", tag = "v{_GUARD_PINNED}" }}' in pyproject