update
This commit is contained in:
@@ -9,6 +9,43 @@ content, templates, or cosmetic runes — the value is in the tests that refuse
|
||||
to let the universe collapse into a single score, resource, effect axis,
|
||||
executor, rune, hidden formula, or decorative domain.
|
||||
|
||||
## Compliance model
|
||||
|
||||
No gate may pass from configuration, naming, shared implementation, smoke-scale
|
||||
runs, regenerated expectations, proxy metrics, a default profile, or a
|
||||
locally-runnable binary. A gate passes only from persisted, independently
|
||||
reproducible, full-scale adversarial evidence enforced at merge. Every
|
||||
acceptance obligation has all four of: a **measured artifact**, a **provenance
|
||||
chain** to the run that produced it, a **merge-blocking enforcement point**, and
|
||||
a **failure condition if the artifact or provenance is absent**.
|
||||
|
||||
- The merge-blocking enforcement point is `.github/workflows/merge-gates.yml`,
|
||||
whose `merge-gates` job runs `MAGICKA_PROFILE=merge` (full gates) and must be a
|
||||
**required status check** on the protected branch / merge queue. It is not a
|
||||
local binary, and the fast profile is advisory only — it can never stand in for
|
||||
acceptance.
|
||||
- `compliance_report.json` enumerates every obligation, its artifact, its floor,
|
||||
the actual measured value, and whether the artifact is present. A missing
|
||||
required report fails acceptance.
|
||||
- The merge floors (50k worlds, 250k programs, 1,000,000 executions, 10
|
||||
perturbations/exec, 100% reference/runtime comparison over base **and**
|
||||
perturbations, 500 mutants, 10,000 replay cases) cannot be lowered by
|
||||
environment overrides: a lowering override is recorded as a provenance failure
|
||||
and the floor is kept.
|
||||
|
||||
Every gate is built to be *able to fail*, and a negative-control test proves it does:
|
||||
|
||||
| Gate | How it is made unbypassable | Negative control proving it can fail |
|
||||
|------|-----------------------------|--------------------------------------|
|
||||
| runtime_equivalence | Compares two **independent implementations** (the reference engine vs. `runtime_under_test::native`, which never calls the reference engine) | `buggy_runtime_is_rejected` — a runtime with one dropped causal edge is caught |
|
||||
| compression_resistance | Attacks operate on the **real serialized trace** (causal influence, info-flow, access, temporal, deltas), not a hash proxy; info loss is genuine unexplained variance | `single_factor_corpus_is_rejected` — a rank-1 universe is rejected |
|
||||
| mutation_survivor | Each mutant must fail the **named gate** it targets, not merely differ from the reference | `reference_passes_every_named_gate` + `no_mutant_survives_its_named_gate` |
|
||||
| replay | Expectations are **loaded from a committed file**, not regenerated in the same run | `corrupted_expectation_is_detected` |
|
||||
| domain_participation | Decorative/redundant domains are flagged directly | `decorative_domain_is_rejected` |
|
||||
| merge scale floor | Env overrides may only **raise** merge counts; a lowering attempt is recorded and the floor kept; executions actually performed are counted | `merge_floor_cannot_be_lowered_by_override`, `merge_profile_at_smoke_scale_is_rejected` |
|
||||
| 100% comparison | Reference vs. runtime-under-test compared for **every** execution — base and all perturbations, never base only | `runtime_equivalence` gate fails unless `equiv_total == base + perturbations` |
|
||||
| provenance | A Merkle root over per-execution records, plus independent engine identities, binds reported numbers to executed work | `merkle_root_binds_to_leaves` |
|
||||
|
||||
## Workspace layout
|
||||
|
||||
Built in the mandatory order from the spec:
|
||||
@@ -19,17 +56,18 @@ Built in the mandatory order from the spec:
|
||||
| – | `rune_ir` | Rune token / program model (no stream is ever rejected) |
|
||||
| 2 | `trace_model` | Execution trace + all graphs, behavior fingerprint, replay record, fault log, trace metrics |
|
||||
| 3 | `generators` | Worlds, programs, executors, contracts, perturbations; rejects flat cases |
|
||||
| 4 | `collapse_analysis` | The 11 compression attacks + collapse gates |
|
||||
| 5 | `semantic_mutation` | Structurally generated mutant runtimes; proves every one is killed |
|
||||
| 6 | `replay_corpus` | Permanent, bit-exact replay cases |
|
||||
| 4 | `collapse_analysis` | The 11 compression attacks over real trace structure + collapse gates |
|
||||
| 5 | `semantic_mutation` | Structurally generated mutant runtimes; proves every one fails its named gate |
|
||||
| 6 | `replay_corpus` | Permanent, bit-exact replay cases persisted to `corpus/replay_corpus.tsv` |
|
||||
| 7 | `reference_runtime` | The executable spec engine (`Runtime` trait, `resolve`) |
|
||||
| 8 | `runtime_under_test` | Config-driven engine, proven equivalent to the reference |
|
||||
| – | `ci_reports` | Orchestrator + `ci` binary; emits the 8 required reports |
|
||||
| 8 | `runtime_under_test` | An **independent** interpreter (`native`) proven equivalent to the reference |
|
||||
| – | `ci_reports` | Orchestrator + `ci` binary; emits 8 gate reports + a provenance report |
|
||||
|
||||
The optimized runtime may not begin before steps 1–7 pass CI; until then the
|
||||
runtime under test is the reference engine driven through the same config
|
||||
surface, which is equivalent by construction. Mutation swaps in a *mutated*
|
||||
config to prove the suite detects any divergence.
|
||||
The runtime under test does not call the reference engine. It re-derives the
|
||||
canonical behavior from the spec in a different code organization, so 100%
|
||||
agreement is *evidence* the spec is implemented correctly rather than a
|
||||
tautology. (`native_matches_reference_bit_for_bit` checks this over a 2000-seed
|
||||
sweep.)
|
||||
|
||||
## The engine in one paragraph
|
||||
|
||||
@@ -40,51 +78,57 @@ domains, mixes them through a nonlinear avalanche keyed by per-domain
|
||||
constants, the world coupling, and the executor's salt, then writes back —
|
||||
recording causal/read/write/information-flow/temporal edges as it goes.
|
||||
Scheduled effects and coupling diffusion propagate changes 3 turns into the
|
||||
future. Because every output bit depends on all inputs, the universe is
|
||||
high-rank, incompressible, future-sensitive, and executor-divergent — exactly
|
||||
the properties the gates demand.
|
||||
future.
|
||||
|
||||
## Running CI
|
||||
|
||||
```bash
|
||||
cargo test # unit tests for every crate
|
||||
cargo run --release -p ci_reports --bin ci # full gate run (fast scale)
|
||||
cargo test # unit tests + negative controls
|
||||
MAGICKA_PROFILE=fast cargo run --release -p ci_reports --bin ci # advisory PR slice
|
||||
MAGICKA_PROFILE=merge cargo run --release -p ci_reports --bin ci # acceptance (full gates)
|
||||
```
|
||||
|
||||
Reports are written to `ci_out/` (8 JSON files + `ci_summary.md`). The binary
|
||||
exits non-zero if any gate fails.
|
||||
Reports are written to the output dir (8 gate reports + `provenance_report.json`
|
||||
+ `compliance_report.json` + `ci_summary.md`). The binary exits non-zero if any
|
||||
gate fails or any required artifact is absent.
|
||||
|
||||
### Scales
|
||||
### Profiles
|
||||
|
||||
`MAGICKA_SCALE` selects the corpus size; individual counts can be overridden.
|
||||
`MAGICKA_PROFILE` (or `MAGICKA_SCALE`) selects the run profile.
|
||||
|
||||
| Scale | executions | replay | mutants | notes |
|
||||
|-------|-----------|--------|---------|-------|
|
||||
| `tiny` | 120 | 120 | 520 | smoke (~80 ms) |
|
||||
| `fast` (default) | 600 | 600 | 520 | every gate, ~0.3 s |
|
||||
| `full` | 1,000,000 | 10,000 | 600 | merge-blocking spec gates |
|
||||
| Profile | executions | replay | mutants | role |
|
||||
|---------|-----------|--------|---------|------|
|
||||
| `fast` (default) | 600 | 10,000 (committed) | 520 | **advisory only — never acceptance** |
|
||||
| `tiny` | 120 | 10,000 | 520 | smoke |
|
||||
| `merge` (`MAGICKA_SCALE=full`) | 1,000,000 | 10,000 | 600 | **acceptance — hard floors** |
|
||||
|
||||
The fast/tiny profiles print `ADVISORY … NOT a merge-blocking acceptance run`
|
||||
and are labelled non-acceptance in `compliance_report.json`. Acceptance comes
|
||||
only from the merge profile, run by the merge-gates workflow. The merge floors
|
||||
cannot be lowered by environment overrides (a lowering override is recorded as a
|
||||
provenance failure and the floor kept).
|
||||
|
||||
### Merge-blocking enforcement (required check)
|
||||
|
||||
`.github/workflows/merge-gates.yml` defines the enforcement point. Configure
|
||||
branch protection / the merge queue to **require** the `merge-gates` job. That
|
||||
job runs the full merge profile, verifies the committed corpus has ≥10,000
|
||||
cases, and fails if any required artifact is missing. The full run executes
|
||||
~1M base executions × (1 base + 10 perturbations) with 100% reference/runtime
|
||||
comparison; it completes in minutes on a CI runner.
|
||||
|
||||
### Replay corpus
|
||||
|
||||
The replay corpus is committed at
|
||||
`crates/replay_corpus/corpus/replay_corpus.tsv` (10,000 cases). Replay loads
|
||||
those expectations and re-executes the reference, so any engine change that
|
||||
alters a hash makes the committed file and the fresh run disagree and CI fails.
|
||||
Regenerate it only as a deliberate, reviewed migration:
|
||||
|
||||
```bash
|
||||
MAGICKA_SCALE=full cargo run --release -p ci_reports --bin ci
|
||||
# or override individual counts:
|
||||
MAGICKA_EXECUTIONS=20000 MAGICKA_REPLAY=10000 cargo run --release -p ci_reports --bin ci
|
||||
cargo run --release -p replay_corpus --bin freeze -- 10000
|
||||
```
|
||||
|
||||
The gate *thresholds* are identical across scales — only the corpus size
|
||||
changes. Fast CI runs a representative slice; merge-blocking CI runs `full`.
|
||||
|
||||
## Gates enforced (all must pass)
|
||||
|
||||
- **runtime_equivalence** — 100% of executions: `canonical(reference) == canonical(runtime_under_test)` over delta, trace, faults, replay hash, and 3-turn future hash.
|
||||
- **causal_rank / trace** — median causal edges ≥ 24, 95% causal rank ≥ 6, median touched domains ≥ 4, 95% ≥ 3, fingerprint collision rate < 5%, largest cluster < 2%.
|
||||
- **domain_participation** — each domain appears in ≥ 35% of traces, influences ≥ 20%, is mutated in ≥ 20%; removing any domain loses ≥ 10% behavioral diversity; merging any pair loses ≥ 8%; no read-only or write-only domain.
|
||||
- **metamorphic_response** — ≥ 90% of perturbations alter the trace, ≥ 75% the delta, ≥ 50% the 3-turn future; ≤ 5% unexplained neutral.
|
||||
- **compression_resistance** — best 1/2/4-factor models predict < 40/55/70%; no single domain > 30%, no pair > 55%; every compressed model loses ≥ 35% information. All 11 attack families are run.
|
||||
- **mutation_survivor** — ≥ 500 structurally generated mutants, 0 survivors.
|
||||
- **contract** — every admitted case satisfies its semantic contract (min causal rank, domain participation, future sensitivity, context divergence, max compressibility); contract-violating cases are rejected at admission.
|
||||
- **replay** — 100% deterministic, 0 hash drift.
|
||||
- **coverage** — generated/contract rejection accounting; no admitted case fails the generated gates.
|
||||
|
||||
## Determinism
|
||||
|
||||
Everything is seed-derived and integer-only (SplitMix64 RNG, FNV-1a content
|
||||
|
||||
Reference in New Issue
Block a user