feat(M14-J): promote b4 into canonical J3-J12 substrate

[HMarcusWH]

M14-J canonical b4 promotion

PR #63 qualified b4-p0-c256k-cold as a promotion-ready exact-host candidate without changing the canonical ENGINE-OPT-V2/J3-J12 substrate. This PR performs the explicit canonical promotion and requalification boundary.

Canonical LC0 profile

The canonical ENGINE-OPT-V2 LC0 profile becomes:

b4-p0-c256k-cold
NNCacheSize = 262144
MinibatchSize = 4
MaxPrefetch = 0
AdaptivePrefetch = false
DefectTelemetry = false
warmup = none

Stockfish/Reckless selections, engine/network source, the 600/800 ms LC0 compatibility reservations, and the 4000 ms wall / 12000 ms CPU outer envelope are unchanged.

Native-work qualification semantics

PR #63 established that LC0's terminal UCI nodes counter under a fixed go nodes 16 request is a threshold/batch diagnostic rather than a deterministic exact-work vector. The candidate-only lc0-node-stop-contract-v1 policy is therefore promoted into an explicit canonical policy:

• exact bestmove repeatability remains blocking;
• behavioral equivalence remains blocking;
• the fixed node request remains blocking;
• lc0.uci_nodes semantics and valid terminal counters remain blocking;
• completion/deadline and resource ceilings remain blocking;
• exact terminal-counter vector equality is not required for this explicitly bound b4 profile.

Historical/non-b4 profiles retain the existing exact-vector default.

J3/J7 boundary

The canonical resource catalog advances to the b4 LC0 profile and the PR #63 exact-head engine bundle identity, but:

• selection_enabled=false remains unchanged;
• J7 isolated selections remain evidence-only;
• no arbitrary runtime hyperparameter synthesis is enabled;
• no J7 runtime selection authority is granted.

The pre-promotion J3 catalog is retained byte-for-byte as
qualification/resource-profile-catalog-v1-j7-baseline.json so the historical J7 selection evidence continues to validate against its original immutable input rather than being rewritten.

J8/J9/J10 validators now compare their frozen runtime option state against the canonical ENGINE-OPT selection instead of hardcoding b7-era sentinels such as LC0 MaxPrefetch=8. This preserves the anti-leakage invariant while allowing an explicit canonical profile promotion.

J8-J12 propagation

The promoted b4 profile is wired through:

• allfather.online-engine-opt-v2
• allfather.online-hybrid-v2.validation
• J8 MoveResourcePlan validation
• J9 WorkGrant validation
• J10 adaptive allocation validation
• J12 orchestrated composition validation

No WorkGrant topology, allocator action space, budget authority, staged-search grid, or DecisionAuthorization policy is changed.

Promotion gate

This PR adds a dedicated fail-closed canonical promotion gate. It proves that:

• the PR base is the expected canonical b7 surface;
• the current canonical selection is exactly b4;
• only the authorized LC0 runtime profile fields changed across the J3-J12 runtime surface;
• engine trees and guarded build/network/source contracts are unchanged;
• runtime profile selection remains disabled;
• the canonical node-stop policy is exact and source-controlled;
• the exact-current-head canonical aggregate passes;
• LOCAL-1 and the genuine non-anchor G3 authority witness pass;
• the immediately preceding promotion head has been frozen into the host binding and catalog qualification snapshot.

Two-cycle exact-head closure

The promotion deliberately requires two exact-head cycles rather than trying to encode the current commit SHA inside the same commit that contains the evidence.

1. Promotion head: canonical b4 is wired and the full exact-head ENGINE-OPT/J8-J12/G3/LOCAL-1 aggregate runs. The final promotion gate is expected to remain fail-closed because this head has not yet been frozen into source-controlled host/catalog evidence.
2. Evidence-freeze head: after the first head's aggregate is green, one atomic follow-up commit freezes that immediately preceding head, its artifact/report hashes, execution-domain identity and disposition into the canonical host/catalog evidence and marks the PR test(M14-J): requalify b4 resource substrate before canonical promotion #63 promotion seed closed.
3. The full qualification sweep runs again on the new exact head. Only that second exact-head aggregate may close the promotion gate.

This avoids self-referential commit-SHA evidence and prevents retry-until-green or evidence laundering.

Explicit non-grants

This PR does not grant:

• J7 runtime profile-selection authority
• adaptive STOP_BUYING promotion
• additional resource authorization
• additional outward move authority
• generic host portability
• Elo/strength/equal-compute superiority
• deployment readiness

No threshold widening, retry-until-green, or test weakening is permitted to make the promotion pass.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[HMarcusWH]

PR #64 repair implementation (A, B, D) — pending exact-head qualification

The approved non-promoting repairs are now committed on this PR branch.

• A / Reckless integrity: tools/reckless_repro/provenance.py, scripts/reckless-repro.py, tests, and its workflow now enforce immediate build SHA256 preflight, inspect disposable ELF copies, instrument source identity after objcopy and readelf, probe first-pass rewriting on a throwaway fresh ELF, and abort on any executable mutation rather than recording 320 identical errors. A fresh C-compiled ELF fixture checks original SHA256, size, and executable permissions.
• B / G3: the existing 23-case candidate policy is run against canonical b4 with a separately source-locked and replay-isolated diagnostic wrapper/workflow. The canonical seven-case policy and G3 qualifier algorithm are unchanged. Evidence remains diagnostic_only and promotion_evidence=false; first successful witness stops the original qualifier.
• D / historical LC0 comparator: matrix execution errors now produce a hash-sealed negative report retaining matrix source/binary/network identity and the original error records. Exit status 2 remains; experiment deadlines and engine code are unchanged.

Still conditional: C (immutable seven-case baseline + versioned G3 policy migration) only if B demonstrates a genuine qualifying witness; E only for independently demonstrated behavioral defects; F only after the exact-head aggregate qualifies and the immediate-parent evidence freeze is correctly applied.

Head after the follow-up real-ELF attribution hardening: ad067b2a6f97d040da28a52882cd394c433e8a1d. No claim of successful CI or promotion yet, and no merge requested.

[HMarcusWH]

PR #64 — exact-head b4 evidence freeze, corrected schema

The canonical b4 promotion parent is ad067b2a6f97d040da28a52882cd394c433e8a1d (ENGINE-OPT run 37851015052). The parent aggregate's report.json is SHA256 e3121d2467b55619aef6dced40d5dc0e51b17804ee5895240198e66666a12411, and GitHub's aggregate artifact is ID 11588407624, SHA256 94bda00f2f8d8d21de1d7e685d0f7b2b5add57acc90f96f3bd3a74450859b7ec. The bound domain is f12f8a6adf956be74dec46c583e2df66b13e16ea67552c105d954dbf964c85ad. The parent aggregate reported QUALIFIED_EXACT_HOST_ONLY, including the positive canonical G3 witness and 28 validated LOCAL-1 games.

Corrected freeze head: 14351ac25380047799f76a60d6e9c5938b44c3be, with the qualified parent as its immediate parent. The first freeze attempt e92555a was superseded after its static contracts exposed an existing strict catalog snapshot schema (merge_commit and workflow_run are required). The corrected atomic freeze restores that schema and updates its tests. Catalog merge_commit retains the real historical PR #63 mainline merge SHA cae842801497161f2de37ff43b27d074ac12568a; it is not a claim that PR #64 has merged. This distinction is explicitly recorded in the host-binding note.

The new exact-child ENGINE-OPT workflow is 37879960297 and must pass before any merge. No runtime policy, engine tree, qualification thresholds, or generic-host/deployment authority was changed.

[HMarcusWH]

Final evidence-freeze child: J3→J9→J10 digest reconciliation

Current PR head 5122f8d2b1e6d4d1e69b1fc60375af24695ee648, with immediate parent ad067b2a6f97d040da28a52882cd394c433e8a1d (qualified source from ENGINE-OPT workflow run 37851015052).

The first child e92555a failed because the frozen resource-profile snapshot schema requires merge_commit / workflow_run. The follow-up 14351ac restored that contract, but its merged controller tests revealed the J9 resource-catalog digest lock. Both attempts were superseded, not stacked, so the final child's immediate parent remains the proven qualification head.

The current atomic freeze binds the report and artifact hashes, restores the schema, records PR63 as the actual prior merged ancestor rather than inventing a PR64 merge, retains the PR63 seed, and rebinds the exact canonical digest chain:

• J3 canonical resource catalog: 5ecbe0a31c4e7a3b666b5107bf7e2798d29f6293808a6954cf88c9c9bbdf95bc
• J9 WorkScheduler catalog: ed165b9ea2f0ce6043aa54b956667c7f13b177fbd4a4434ab0fc4e8dfbfaa1e3

Both digest algorithms were checked against their prior source-controlled expected hashes before updating J9 and J10 pins. No dispatch grid, allocation model, source tree, runtime profile selection, thresholds, budgets or outward authorization changed.

Fresh child workflow: ENGINE-OPT-v2 37880531463. Do not merge until the exact-child promotion gate passes.

[HMarcusWH]

PR #64 — M14-J controller CPU-accounting repair implemented (source + tests)

Current source head: 71db7bcab0792f2badce8d88f2145ed207dcb193 (branch remains open, unmerged).

The J12 LOCAL-1 life-history-reuse rejection exposed an accounting mismatch: the router pre-run qualification charged time.monotonic() wall elapsed as CPU, while independently sealed controller process CPU was much lower.

Changes:

• controller/shadow.py: preserve the external-go process CPU-clock origin and meter 16 existing controller-side preparation/phase operations using matched thread-CPU start/end samples.
• controller/routing.py: pre-router process CPU instead of wall-time proxy, validated summary-level controller_cpu_ms, independent physical controller cap, fail-closed accounting state, and no zero-cost journal entries.
• controller/budget.py: distinguish wall deadlines from per-thread CPU charges without changing resource caps or the strict J11 journal event shape.
• controller/orchestration_integrity.py and tools/local_game/integrity.py: independently reconstruct controller physical CPU partition as well as existing total physical CPU and wall claims.
• tests/controller/test_budget_routing.py: deterministic regressions for a 300ms wall/20ms CPU stall, true controller overruns, NaN clock, pre-router CPU origin, measured summary physical overrun, missing CPU origin, and invalid accounting.
• tests/controller/test_online_deadlines.py: print primitive CPU evidence on failure.
• scripts/recursive-refinement-contract.py: exact-generation UCI quiesce barrier and negative artifact diagnostics before ephemeral run cleanup.

Status on this exact head: Controller shell validation passed; M14-J J13 META-1 passed. ENGINE-OPT-v2 passed static contracts and pinned Fastchess source tests; engine build/full profile-domain campaign still running. Merge gate initially failed a fake-oracle 10s finalization wait and was re-run unchanged for reproducibility; retry pending.

Not merged or promoted. This repaired source head must first produce qualified exact-head aggregate evidence; then a new immediate-child freeze must bind that head's run/artifact/report/domain hashes. The earlier 5122f8d freeze cannot be reused. No budget threshold widening, chess-engine tree changes, new outward authorization, Elo, or host-portability claim.

[HMarcusWH]

Canonical b4 repaired-source evidence freeze — direct child pushed

Freeze commit: 1f9003f7cb82fa71ceb54e62c32790f1ed38ad5a
Immediate, independently qualified parent: 71db7bcab0792f2badce8d88f2145ed207dcb193.

Verified ENGINE-OPT-v2 run 37954321786: aggregate passed=true, evidence_valid=true, profile_qualified=true, qualification_failures=[], disposition QUALIFIED_EXACT_HOST_ONLY, J12 28 validated games, G3 non-anchor authority qualified. Its workflow's earlier promotion-step failure was strictly because the old binding referenced the wrong immediate parent.

Sealed evidence:

• Aggregate artifact 11637396370; artifact ZIP SHA256 4511536d176c68a2be11edc0e0eb63ab577f7c02cd3ea49ca327dea7ddc240a4.
• Embedded report.json SHA256 57ab7bb0ef5c442da8353f14246de792c225001befd56f240b27793408754ffb (computed from the downloaded artifact, not inferred).
• Execution-domain digest 33451ca47b6636d7bc9d2f70e92a2d2f91c0e173534dfb1cdf3c06bbc07d9dd9.

Atomic commit updates host-binding, J3 resource catalog qualification and four profile/composition licenses, J9 resource catalog digest f834c3323bc5a3ff1b9f9e7069cbdcc0b18834b82568aee87f2b8be56c1e387b, J10 scheduler digest 9e22edd758a873d8d2fe6f9b29e404cba8b8dad5905cbb0c6f74061611be569c, and the pinned regression tests. The canonical digest reconstruction was checked against both existing pre-freeze J3/J9 digests before writing.

No changes to engine trees, runtime budget or authorization policies, dynamic selection, adaptive stop, or deployment claims. The PR #63 merge_commit remains the historical cae842..., not a fictitious PR #64 merge.

New child-head checks: ENGINE-OPT-v2 #37976100512 — static contracts passed, further jobs running; Merge gate #37976100374 — in progress. This PR stays unmerged until the exact-child promotion gate and all required checks are green.

[HMarcusWH]

LOCAL-1 wall-envelope repair, diagnostic-first implementation (2026-10-09)

New source commits:

• ae77ceac9c985bc414b3efbc4b5b9e1062728b1d — differentiate physical endpoint freeze, resource JSON serialization and durable fsync timing without changing the sealed resource schema/authority claims; record process freeze timestamp; sample final wall budget fields exactly once; deterministic race and delayed-I/O regressions.
• 1b82a98c3a8890b070ec7643e8eb5a60038c77d2 — LOCAL-1 denial now reports exact replay, false envelope booleans, elapsed wall and excess rather than only a generic physical/envelope failure; regression test reproduces the observed 71.479ms claim excess.

Original retained failing evidence: LOCAL-1 run 37976100415, base-00-03 game 0 generation 60 and base-00-06 game 1 generation 141: both outward bestmove inside hard deadline, physical CPU and controller partition qualified, but post-output terminal wall claim exceeded hard envelope by ~71.6ms and ~183.0ms.

Important boundary: Current ResourceMeasurementRun.seal() freezes physical CPU before writing/fsync'ing resource.json, while the route's wall claim is sampled afterward. That can expose disk or scheduler latency as a post-freeze wall overrun. This patch does not automatically exclude persistence from the deadline or weaken any wall/CPU checks: the new per-replay timing markers first establish whether that suspected cause actually occurred. on_anchor_complete and G3 evidence authority remain unchanged.

Do not merge: previous evidence-freeze commit 1f9003f binds qualified source 71db7bc. These are new source commits, so the old evidence cannot qualify this head. Wait for the new diagnostic and required LOCAL-1/J12 runs, repair any proven synchronization / persistence contract defect without changing the actual resource limits, and then requalify an exact repaired source and recreate a fresh immediate-child evidence-freeze commit. New-head CI is running.

[HMarcusWH]

Final G3 canonical-b4 repair implemented (source HEAD b90af9f1760c9611826afc2fd26ad0dc438d4557)

Commits:

• 6e288049b9e03baa6e1c6733531bb92870ff17be: source-frozen 23-case canonical b4 G3 qualification policy, mechanically derived from the existing 7 legacy + 16 archived discovery cases; new wrapper and fail-closed witness-contract tests
• 9db592075fc28bf25ef46980a14189f6fadeac22: wire the canonical-b4 qualifier into LOCAL-1-v2, independently bind policy/corpus SHA256 in the ENGINE-OPT aggregate and promotion surface, enforce a qualifying positive prerequisite before full-game matches
• b90af9f1760c9611826afc2fd26ad0dc438d4557: LOCAL-1 integration tests for both a negative (retain failed evidence, stop before games) and positive witness

Safety boundaries: Source-frozen candidate corpus and discovery provenance cannot change; existing clocked_staged_preanchor_v1, BUY_STAGED_VERIFY, staged completion, distinct emitted specialist move, physical resource coverage and outward deadline requirements are unchanged. A positive diagnostic from a different Stockfish PGO binary is not promoted as evidence: qualification must reproduce on the actual exact-head candidate bundle and bound worker. J12's incomplete GitHub-runner cgroup capacity remains fail-closed; no reusable-host or deployment claim is made.

Latest exact-head ENGINE-OPT workflow: https://github.com/HMarcusWH/AllfatherChess/actions/runs/38012334421. Static contracts passed at head b90af9f; full qualification is pending.

Not merge-ready until: the new exact-head ENGINE-OPT aggregate has profile_qualified=true, LOCAL-1/J12 campaigns and all checks pass, a fresh exact-head evidence/host-binding+catalog digest freeze is created as an immediate child of that qualified source, and the final-child promotion gate passes. The previous freeze 1f9003f remains historical, not valid for current code.

[HMarcusWH]

Final exact-host evidence freeze pushed (2026-10-10)

Freeze commit: 222aeb0f8ff1738ac9417e2ba97168f7101f03ae. GitHub confirms its sole immediate parent is the independently qualified source b90af9f1760c9611826afc2fd26ad0dc438d4557.

Authoritative source qualification: ENGINE-OPT #38012334421, canonical aggregate evidence_valid=true, profile_qualified=true, QUALIFIED_EXACT_HOST_ONLY, 28 LOCAL-1 and 28 J12 games validated, and non-anchor HYBRID G3 positive witness. The aggregate job's red final promotion step was specifically an outdated binding of the qualified source, not a qualification failure.

Frozen bytes (independently verified): artifact 11657944410, aggregate ZIP SHA256 daf8ff2a3bfb2300de02d60a60baacf52c14638ff4d3aa41d3f0394e5205dbbd, internal report.json SHA256 f1748fea0de0b8712fc47ae216c2111c525f8a3c645d044f670837ee2e81f9e1, execution-domain digest 2e9673f5cea55cf86e59f34ae1b4d1dddea1c19c4972ac34b323465ab3bd0e2c (ID exec-domain/2e9673f5cea55cf86e59). Bound domain is exact-host observation only; no generic host portability or deployment claim.

Five-file evidence-only patch: qualification/engine-opt-v2-host-binding.json, qualification/resource-profile-catalog-v1.json, qualification/work-grant-scheduler-v1.json, qualification/adaptive-resource-allocation-v1.json, tests/controller/test_resource_profile_catalog.py. Parent PR63 mainline merge commit cae842801497161f2de37ff43b27d074ac12568a retained. Historical seed unchanged. Frozen runtime selection disabled and authority remains unchanged.

Catalog digests were independently recomputed with the repository's normalized-object SHA256 semantics, first reproducing old J3 f834c332... and old J9 9e22edd7... exactly, then deriving new J3 dc98b3dff303b0be9d3d195b298cf3c10dbb9635e4446b3e5413a020d96e8f0c and J9 b90c892f8d0c4653009b9bbb0e0972c17a1df65d326ac01b8f5f8b0b80386405. No engine code or budget limits changed.

Final-child ENGINE-OPT #38055483702 static contracts passed, full qualification pending. Do not merge until final HEAD aggregate and canonical promotion gate succeed and all required PR checks are green. Avoid subsequent code/source commits on this PR unless deliberately restarting evidence qualification and freeze.