RQ-60-FLIPCOUPLE (#1064): status-evidence gate — a release status must agree with the evidence on main; seven-instance replay 7/7

[avrabe]

Refs #1064. Delivers RQ-60-FLIPCOUPLE: a mechanical coupling between "the code landed" and "the artifact says so", replayed against all seven measured misses.

Which shape, and why

A composition of shape 1 and shape 2, enforced per shape 3 — chosen deliberately because the seven instances split across what any single shape can see:

• Shape 1 (derive from evidence) is the only one that can catch RQ-60-CANARY (work shipped as "VCR-TIER-001 increment 1" — no commit ever names the artifact) and the only one that touches Direction B. But pure derivation is impossible for artifacts whose definition of done is a measured verdict or an external run (RQ-60-VFPPRESSURE's is jess's 5-of-5 nm -> T census on a meld-fused ghcr cascade — not buildable in-repo). So evidence is declared per artifact (fields.done-when: contains:<path>:<literal> | file:<path> | manual: <reason>) and checked in both directions. The negative result the task anticipated is real and is encoded rather than papered over: 4 of 8 v0.60 artifacts are honestly manual:, and a claiming status on a manual: predicate requires a written verified-by basis.
• Shape 2 (merged work must not sit proposed) is the workhorse for the other five Direction-A instances: this repo's measured convention is that a delivery commit's subject starts with the artifact id (28/28 on main; plan/chore/salvage commits never do). Such a commit must be acknowledged: status flipped, or the PR recorded in fields.landed — the machine-readable statement "increment landed, the stated outcome does not yet hold", which is exactly the distinction the seven misses collapsed.
• Shape 3 (require it in the landing PR) is how both halves are enforced: the gate runs in the required Claim Check job, so PR RQ-59-PARTIALCENSUS (#1017): census over the full decline set — 89% skip-only, but the median blocked module loses a quarter of its functions, not one #1051's own CI would have gone red on its own unflipped status.

The rules (scripts/status_evidence_check.py)

rule	fires when	direction
R0	a release file contributes zero artifacts (the #1064 invisible-file shape)	both — an unreadable file makes every status inside unfalsifiable
R1	an artifact ≥ v0.60 has no done-when	forces the declaration into the PR that creates the artifact
R2	claiming status (implemented/verified/accepted) with absent evidence, or manual: with no verified-by	B — over-report
R3	non-claiming status whose declared evidence exists on the tree	A — under-report, no commit names it
R4	id-first delivery commit not acknowledged (status or landed:)	A — under-report, silent landing

Anti-vacuity: duplicate-key-strict YAML loader (the #1059 class — the gate must not validate with the parser that cannot see that defect); a pinned delivery-commit floor (28) so a shallow checkout reds instead of scanning one subject; CI re-derives the verdict from the summary line the gate wrote, not from exit 0. fetch-depth: 0 added to the Claim Check checkout for the history scan.

Seven-instance replay — 7/7 flagged

Reconstructed from the real repo states (git show <merge>:artifacts/..., real first-parent subject histories), run through the gate as landed. --delivery-floor 1 because the anti-vacuity floor is calibrated to today's history; CI never lowers it. Full transcript in the collapsible below.

#	instance	state replayed	verdict
1	RQ-59-TIERCENSUS (#1047, d656fb8)	file in the #1064 invisible shape	R0 red on the file; with only the #1065 schema fix applied, R4 red on the artifact
2	RQ-59-GLOBALINIT (#1058, e1a7b57)	schema-fix applied, statuses untouched	R4 red
3	RQ-59-PARTIALCENSUS (#1051, f1e2e7b — its own PR)	same	R4 red (would have fired on the PR's own CI)
4	RQ-60-CANARY (#1061 work, artifact landed proposed in 3267e0d)	historical status + the done-when this PR introduces	R3 red — the only rule that can see it, and it does
5	RQ-60-A64IMPORT (#1071, f8036ec)	as it was	R4 red
6	RQ-60-VFPPRESSURE (#1073, e6a3b27) — Direction A	as it was	R4 red
7	RQ-60-VFPPRESSURE — Direction B (the flip reverted in #1074)	current tree, status forced to implemented	R2 red: manual: done-when, no verified-by

Instance 4's caveat, stated: its catch depends on the done-when declaration that did not exist then. The replay therefore answers "would the mechanism, as landed, have flagged it" — had the mechanism existed, R1 would have forced the declaration into the plan PR that created the artifact.

The replay also surfaced two instances nobody tabulated — the measured seven were an undercount: RQ-59-POPCNT was still proposed at d656fb8 with #1039 merged, and RQ-59-I64SHIFT still proposed at e1a7b57 with #1054 merged (both verified against git show; both later hand-flipped in plan/chore commits). Same class, same substitution.

Replay transcript (literal, per instance)

[1] RQ-59-TIERCENSUS @ d656fb8a (#1047) — state as it was (file in #1064 invisible shape)
FAIL R0 release-v0.59.yaml: release file contributes ZERO artifacts under `artifacts:` (top-level keys: metadata, requirements) — the #1064 invisible-file shape; every status inside is unfalsifiable
status-evidence: 35 artifacts across 3 release files, 10 delivery commits matched, 0 done-when predicates evaluated, 1 failures
exit=1

[1b] same state with ONLY the #1065 schema fix applied (statuses untouched)
FAIL R4 RQ-59-TIERCENSUS: delivery commit on main (RQ-59-TIERCENSUS (#1021) / PR #1047) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
FAIL R4 RQ-59-POPCNT: delivery commit on main (RQ-59-POPCNT (#1021) / PR #1039) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
exit=1

[2] RQ-59-GLOBALINIT @ e1a7b57d (#1058), schema-fix applied (statuses untouched)
FAIL R4 RQ-59-GLOBALINIT: delivery commit on main (RQ-59-GLOBALINIT (#1052) / PR #1058) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
FAIL R4 RQ-59-I64SHIFT: delivery commit on main (RQ-59-I64SHIFT (#1048) / PR #1054) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
FAIL R4 RQ-59-TIERCENSUS: delivery commit on main (RQ-59-TIERCENSUS (#1021) / PR #1047) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
exit=1

[3] RQ-59-PARTIALCENSUS @ f1e2e7bc (its own PR #1051), schema-fix applied
FAIL R4 RQ-59-PARTIALCENSUS: delivery commit on main (RQ-59-PARTIALCENSUS (#1017) / PR #1051) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
FAIL R4 RQ-59-GLOBALINIT: delivery commit on main (RQ-59-GLOBALINIT (#1052) / PR #1058) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
exit=1

[4] RQ-60-CANARY @ 3267e0d3 — no commit ever names it; declared-evidence half (R3) is the only catch
FAIL R3 RQ-60-CANARY: status `proposed` but its done-when evidence EXISTS on this tree (contains:crates/synth-backend/src/arm_encoder.rs:expansion_scratch_contract) — the status under-reports shipped work
FAIL R1 RQ-60-CFOBLIG: no `done-when` in release-v0.60.yaml — declare the machine signature of done, or `manual: <reason>`
[+ 6 more R1 lines — the mechanism forcing the declarations that did not exist yet]
exit=1

[5] RQ-60-A64IMPORT @ f8036ec1 (#1071)
FAIL R4 RQ-60-A64IMPORT: delivery commit on main (RQ-60-A64IMPORT (VCR-REACH-002 inc. 1) / PR #1071) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
[+ 8 R1 lines]
exit=1

[6] RQ-60-VFPPRESSURE @ e6a3b27a (#1073) — Direction A (silent landing)
FAIL R4 RQ-60-VFPPRESSURE: delivery commit on main (RQ-60-VFPPRESSURE increment 1 / PR #1073) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
FAIL R4 RQ-60-A64IMPORT: delivery commit on main (RQ-60-A64IMPORT (VCR-REACH-002 inc. 1) / PR #1071) but status is `proposed` and `landed:` does not acknowledge it — flip the status or record the increment
[+ 8 R1 lines]
exit=1

[7] RQ-60-VFPPRESSURE Direction B — the reverted flip: implemented on 'the PR merged', DoD (5-of-5 stages) unmet, no written basis
FAIL R2 RQ-60-VFPPRESSURE: status `implemented` on a `manual:` done-when with no `verified-by` — 'the PR merged' is not 'the stated outcome holds'; write the basis down
status-evidence: 60 artifacts across 5 release files, 28 delivery commits matched, 8 done-when predicates evaluated, 1 failures
exit=1

Red-first, on the current tree

=== RED-FIRST (a): RQ-60-CANARY deliberately reverted to 'proposed' over its shipped evidence ===
FAIL R3 RQ-60-CANARY: status `proposed` but its done-when evidence EXISTS on this tree (contains:crates/synth-backend/src/arm_encoder.rs:expansion_scratch_contract) — the status under-reports shipped work
status-evidence: 60 artifacts across 5 release files, 28 delivery commits matched, 8 done-when predicates evaluated, 1 failures
exit=1

=== RED-FIRST (b): correct statuses restored ===
status-evidence: 60 artifacts across 5 release files, 28 delivery commits matched, 8 done-when predicates evaluated, 0 failures
exit=0

Replay [7] above is the red demonstration for the opposite (over-report) direction, run on the current tree with only the status forced.

The checker is itself checked: scripts/test_status_evidence_check.py (15 tests, wired as a CI step) pins all seven replays as fixtures re-proven every run, plus green controls for every fix. Mutation-verified: 8/8 rule-disabling mutants (R0/R1/R2×2/R3/R4/dup-key/vacuity-floor) each kill the suite. Two earlier string-renaming mutants survived — because the mutants were weak, not the tests; they were replaced with real rule-disabling ones.

What the mechanism does NOT cover

1. Work landing with no artifact and no id-first commit subject is invisible to both halves (shape 3's structural gap, inherited). An id-first subject naming an unknown artifact at least warns ("work may have landed with no artifact at all").
2. A manual: done-when under a non-claiming status cannot fire R3 — for RACOST / ARTIFACTSPLIT / WCETKEY / VFPPRESSURE, Direction-A protection rests entirely on R4's subject convention. A delivery commit titled differently evades it — a miss, never a false red.
3. A false verified-by basis passes. The gate forces the basis to be written where the release query's reader can see it; it cannot judge it. That residual is exactly as manual as the artifact declared it to be.
4. R4's delivery convention (subject starts with the artifact id) is measured practice (28/28), not schema. If the convention drifts, the floor pins catch a wholesale drift (count falls below 28 over time as ids rotate out — slowly), but a single unconventional delivery is class-1 above.

Gates

• python3 scripts/claim_check.py claims.yaml → exit 0 (51/51 hold)
• python3 scripts/oracle_wiring_check.py → exit 0
• cargo fmt --all --check / cargo clippy --workspace --all-targets -- -D warnings / cargo test --workspace → all exit 0 (no Rust touched)
• rivet validate: error set byte-identical to baseline (40, all foreign-prefix cross-repo — the class CI exempts); the new done-when/landed fields land in the same unknown-field INFO class as the existing issue:/verification-track: (63 pre-existing INFOs for issue alone). rivet list: 473 artifacts, unchanged — no new artifacts, floor untouched. Checked by id: rivet validate --explain RQ-60-FLIPCOUPLE.
• New gate + suite: green on this tree; the exact CI step (incl. its non-vacuity grep) simulated locally under set -o pipefail.
• No scripts/repro/ additions — both scripts are gate tooling in scripts/ (claim_check precedent), so the manual ceiling (at 8) is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!