[cunninghamcard-bit]

Unit 1.9 (PHASES, Q0 per RFC-0038a §12 :419). Base exp/restart @ 8455db9. Head b3c1961 (f3f80c1 + must-fix: unregistered bypass closed).

What

• scripts/quality/budget_lib.py — strict schema (rejects unknown keys, duplicate keys/IDs, floats, negatives/bools, unconstrained *), measurer (raw/packed/unpacked; rejects path traversal, duplicate members, symlinks), comparator.
  • hard_cap :45 — H = min(C, ceil(B*1.10)), done in integers as (B*11+9)//10. No floats.
  • passes :52 — actual <= H. compare :342 uses the stored H. A stored H that differs from the formula, or B > C, is rejected when the file is loaded (RFC-0038a §3.2 :75).
  • Failure categories: BUDGET_EXCEEDED, BUDGET_UNREGISTERED, ARTIFACT_MISSING, BUDGET_INVALID.
• CLIs from RFC §9.1: measure-artifacts.py, check-budgets.py (with --report-only for the Q0 transitional mode, §12 :428), and check-inventory.py.
• quality/artifacts.json has 61 artifact IDs with the §4 product caps C. quality/size-budgets.json is empty: nothing has been measured yet, and B/H registration belongs to S2.
• ci.yml contract-tests gets a step (ci.yml:407) that runs check-inventory.py and the unit tests.

Negative tests (scripts/quality/tests/test_q0.py)

• :69 test_actual_equal_H_passes: B=1000, C=1e9, H=1100, actual=1100 passes
• :76 test_actual_H_plus_one_blocked: actual=1101 gives BUDGET_EXCEEDED, delta=1
• :85 test_rounded_ceiling_boundary: B=1001 gives H=1102; 1102 passes and 1103 is blocked
• :90 test_C_below_ceil_B_times_1_10_blocks: B=1000, C=1050 < 1100, so H=1050; 1050 passes, and 1051 and 1100 are blocked
• :101 tampered stored H is rejected; :106 B > C cannot register; :110 no budget gives BUDGET_UNREGISTERED; :115 no measurement gives ARTIFACT_MISSING; :121 an inventory unregistered entry never fails
• Unregistered bypass (UnregisteredBypass): :154 the allowlist is exactly the 3; :161 the repo's unregistered set equals the allowlist; :166 a non-allowlisted unregistered entry is rejected; :170 every mapped repo artifact, if flipped to unregistered, is rejected; :183 an allowlisted entry that has a budget is rejected (by the loader and by compare); :194 the exact mutation: a mapped artifact flipped to unregistered, budget kept, actual 10^12 bytes, fails in the loader, in compare, and in the CLI with and without --report-only; :217 --report-only exits 1 on BUDGET_UNREGISTERED; :227 --report-only lets an over-budget artifact through, while normal mode exits 1
• Schema/measurer: :134 :138 :142 :149 :163 :171 :187. Inventory: :213 every mapped artifact resolves to a real job and matrix value; :216 every release.yml job that uploads or publishes is covered; :224 a bad job name is reported

Artifact → workflow mapping (release.yml)

58 mapped, 3 unregistered.

• go-build :260: staticlib ×4 (linux-gnu, x86_64/aarch64 darwin, windows-gnu)
• ffi-build :308: cdylib ×3 (.so, .dylib, .dll)
• flutter-ffi-mobile :419: iOS device and sim binaries, the xcframework directory, the xcframework Info.plist, Android .so ×3, and the Android 3-ABI total
• console-build :352: aimux-cli ×3, aimux-replay ×3, aimux-web ×3 (embed-frontend)
• node-build :114: .node ×6
• node-publish :177: 6 platform npm tgz (published via napi prepublish) and the main @arcships/aimux tgz
• python-release :234: wheel ×3. The platform tag must come from the wheel metadata (§4.2).
• rust-publish :46: .crate ×5
• jvm-publish :463: for both java and kotlin, the main/sources/javadoc JARs, POM, Gradle module metadata, and PGP signature
• flutter-publish :509: pub archive (packed and unpacked)

Unregistered (listed here, not failed; completing them is 1.9b)

budget_lib.UNREGISTERED_ALLOWLIST (:37) is a fixed list in code with exactly these 3 IDs, so a config-only PR can't use unregistered to skip the gate (RFC-0038a arcships#208 @ 11511b3: §1 :17, §12 :428):

• marking any other artifact unregistered is a load error (:157)
• an unregistered artifact that still has a budget is a load error (:197). compare also reports it as BUDGET_INVALID even if validation was skipped (:388-389)
• --report-only still exits 1 on BUDGET_UNREGISTERED and BUDGET_INVALID (exit_code :417, NEVER_REPORT_ONLY :30; §9.4 :377). Only BUDGET_EXCEEDED and ARTIFACT_MISSING get through in report-only mode.
• aimux-java/checksum/jvm/default/release: Gradle maven-publish makes the md5/sha1 files implicitly during upload. No workflow step produces a file that can be staged and measured.
• aimux-kotlin/checksum/jvm/default/release: same reason.
• aimux-ffi/c-header/any/default/release: aimux-ffi/aimux-ffi.h is only uploaded by ci.yml ffi-build as a CI artifact. No release.yml job publishes it.

Checks (/workspace/fullcheck.sh at b3c1961)

• fmt 0, clippy 0, cargo test 2871 passed / 0 failed / 7 ignored, gen_ts_types up to date, boundaries 0, node build 0
• node: 87 passed, 1 failed (decision › missing or null usage counts…). The same test also fails on exp/restart and in every earlier run log; this PR doesn't touch it.
• python3 -m unittest discover -s scripts/quality/tests: 29 tests OK. All 8 new tests fail against f3f80c1. check-inventory.py exits 0.