FEAT-071 (REQ-021): scry's scope as DATA, from one source - #174
Merged
Conversation
The dashboard stated scope in hand-written prose, and `render_scope` ignored its AnalysisResult entirely (the parameter was `_r`), so it said the same thing about every module. An agent deciding whether to trust a verdict got paragraphs. THE DRIFT THIS REPLACES IS MEASURED, not hypothetical. The old not-proven list named only PROVENANCE limits -- WasmCert not imported, the memory-content model, not a qualified tool -- and NONE of the dominant practical ones. Measured on a real module: unmodeled-control-flow 15.6% of advisories and unsupported-op 5.9%, against a proven-safe rate of 0.6%. A reader would have formed a materially more optimistic picture than the numbers support. The enumerated list now names the if/else region havoc, the unsupported-op function scrub, and the disequality limit that makes a correct div-by-zero fix invisible (#165). SINGLE SOURCE: the page and the feed are both rendered from SCOPE_EVIDENCE and SCOPE_NOT_PROVEN, so a limitation cannot be stated on one and omitted from the other. The oracle requires every not-proven item in BOTH surfaces, and is mutation-checked: emitting empty strings in the FEED while the page still lists them (asserted a single matching line before applying) kills it with "not-proven item missing from the FEED". Red-first: "the feed must carry a scope manifest, not leave scope to the page", after the non-vacuity assertion on the constants had passed. Human legibility is NOT traded away: `hero_and_scope_copy_finalized` still passes unchanged, because each kind renders its human phrasing AND its machine tag. A manifest a human cannot read is a different failure from prose a machine cannot read, not a fix for it. Schema 5 -> 6. Three sibling tests pinned the version by EQUALITY and broke at once on a bump unrelated to the field each guarded; they now assert a LOWER BOUND parsed from the document, which still fails if a field ships without a bump. Mutation-checked: regressing the constant to 4 kills exactly those three. tests=0 clippy=0 fmt=0 rivet=0 claim-check=0 gate-coverage=0. Refs: FEAT-071 Claude-Session: https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
📐 rivet artifact deltaPR: #174 Base SHA: Validationhead — `rivet validate` resultbase — `rivet validate` result (for comparison)Artifact stats
full stats — headDiff (base → head)AADL model — headPosted by the |
avrabe
added a commit
that referenced
this pull request
Aug 27, 2026
#174 landed FEAT-071 with 13/13 green, so it belongs in this pass rather than a follow-up. Its oracle re-run on main just now: the scope manifest reaches the feed as data, and the anti-drift property (every not-proven item present in BOTH the page and the feed) holds. That property was mutation-checked when it landed -- emitting empty strings in the feed while the page kept them kills the test. Folded in here rather than opened separately because #176 had not started CI, so it costs nothing; had it been mid-run the trade would have gone the other way. rivet=0 claim-check=0 drift-gate=0 fmt=0. Claude-Session: https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Aug 27, 2026
#174 landed FEAT-071 with 13/13 green, so it belongs in this pass rather than a follow-up. Its oracle re-run on main just now: the scope manifest reaches the feed as data, and the anti-drift property (every not-proven item present in BOTH the page and the feed) holds. That property was mutation-checked when it landed -- emitting empty strings in the feed while the page kept them kills the test. Folded in here rather than opened separately because #176 had not started CI, so it costs nothing; had it been mid-run the trade would have gone the other way. rivet=0 claim-check=0 drift-gate=0 fmt=0. Claude-Session: https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Aug 27, 2026
…→4 (#176) * Promote FEAT-091 / FEAT-092 to accepted — v3.4.0 not-ready 7 -> 5 Both shipped and CI-verified; leaving them proposed understates the release the same way promoting them early would overstate it. FEAT-091 (#167, 13/13 green) -- commit traceability. Its gate's --self-test PASSES and the real check PASSES on main against HEAD~1..HEAD, and the job runs in CI as a REQUIRED check. FEAT-092 (#172, 13/13 green) -- one operator, one name. Its oracle re-run on main just now; the naming-only claim was measured, not argued (every advisory-code count identical on a real module, leaks 2,800 -> 71). NOT promoted, and the reason matters: FEAT-093 -- merged in #167 and green, but #175 is OPEN and adds ACs to it. Promoting now would produce an `accepted` artifact that immediately gains unmet criteria. It goes accepted after #175 lands, not before. FEAT-089 -- filed, not built; its AC#1 demands a test still red by design. FEAT-057 / FEAT-065 / REQ-021 -- unbuilt. FEAT-064 -- AC1 still falsified, so REQ-020 stays blocked. rivet=0 claim-check=0 drift-gate=0 fmt=0. Claude-Session: https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Also promote FEAT-071 — v3.3.0 not-ready 6 -> 5 #174 landed FEAT-071 with 13/13 green, so it belongs in this pass rather than a follow-up. Its oracle re-run on main just now: the scope manifest reaches the feed as data, and the anti-drift property (every not-proven item present in BOTH the page and the feed) holds. That property was mutation-checked when it landed -- emitting empty strings in the feed while the page kept them kills the test. Folded in here rather than opened separately because #176 had not started CI, so it costs nothing; had it been mid-run the trade would have gone the other way. rivet=0 claim-check=0 drift-gate=0 fmt=0. Claude-Session: https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Also promote FEAT-093 — its refinement landed, so its criteria are complete FEAT-093 was deliberately held back from the earlier promotion because #175 was OPEN and adding acceptance criteria to it; promoting then would have produced an `accepted` artifact that immediately acquired unmet criteria. #175 has now merged, so the criteria are complete AND met. Evidence re-run on main: the gate's 7-case --self-test passes, file mode passes, and live mode passes with `file agrees: True` -- the ruleset, the checked-in file and the CI jobs are all in agreement. Folded in here rather than opened separately because #176 still had not started CI. Same trade as FEAT-071 a moment ago, and the same reason. rivet=0 claim-check=0 drift-gate=0 fmt=0. Claude-Session: https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc Co-authored-by: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reopens #171, auto-closed when I deleted its base branch during the #170 merge.
Branch unchanged apart from a rebase onto main (it no longer needs stacking — #170's
12-entry
required-checks.txtis now on main). #171 has the discussion.The drift this replaces is measured
The dashboard stated scope in hand-written prose, and
render_scopeignored itsAnalysisResult(the parameter was_r) — it said the same thing about every module.Its "what scry does NOT prove" list named only provenance limits and none of the
dominant practical ones:
unmodeled-control-flow— anif/elsehavocs its regionunsupported-op— scrubs the whole functionAn agent reading it forms a materially more optimistic picture than the numbers support.
Single source, so page and feed can't drift
Both render from
SCOPE_EVIDENCE/SCOPE_NOT_PROVEN; the oracle requires everynot-proven item in both surfaces. Mutation-checked: emitting empty strings in the
feed while the page still lists them kills it with
not-proven item missing from the FEED.Red first:
the feed must carry a scope manifest, not leave scope to the page.Human legibility not traded away — the pre-existing
hero_and_scope_copy_finalizedgate passes unchanged, because each kind renders its human phrasing and machine tag.
Schema 5 → 6. Three sibling tests pinned the version by equality and broke at once on
an unrelated bump; they now assert a lower bound parsed from the document.
🤖 Generated with Claude Code
https://claude.ai/code/session_01KkNzkNYzPh7366DkNijeNc