Conversation
…W5 ) Wave 5 is 146 work items across twelve parallel groups, against Wave 4's 32. At that size a shared-file collision that Wave 4 absorbed in a follow-up round would collide across several groups at once, so the scope and shared-file decisions are settled here rather than argued at review. Three specification corrections. The canonical crate names are the ones that exist: d2b-session, d2b-resource-client and d2b-zone-routing are workspace members with source, while d2b-bus-session, d2b-client, d2b-bus-client and d2b-zone-router are absent everywhere. The zone bundle DTO takes the crate root, matching the sibling generation_bundle that Wave 4 shipped, because a bundle is an emitted artifact rather than a resource and v3/ holds the resource object model. Three unmet obligations. The canonical RSS fixture registers its watches only after its last write, so it never executes the clone-per-watcher path and cannot be cited as evidence that the fan-out correction works. Latency targets stay recorded rather than met while no pinned runner exists. The standing debt that names the production store chain is carried in explicitly so no reviewer has to reconstruct it. Two specification gaps carried forward unchanged: the derivation output layout that zone-control-015 needs, and the security-key backing set. Two inferences flagged for confirmation: per-round prep against the binding panel's one-snapshot requirement, and landing redb with its consuming slice on the Wave 3 precedent for rtnetlink and nftnl.
Keep host path authority out of the Zone runtime contract by carrying only validated broker-resolved identifiers. Require the ownership, filesystem, lock, marker, replacement, durability, and publication posture needed for fail-closed store open and replacement.
…W5 ) The store-004 slice was originally told to guard the whole-process RSS measurement by checking pgrep -a cargo and waiting if the machine was busy. That guard was wrong three ways, and the wave nearly took its keystone evidence from it. It watches the wrong processes: cargo forks rustc, and the memory is in the children. When this was caught the host was running five rustc processes totalling about 4.7 GB, a nix build at 8.8 GB resident, and a nix eval at 3.0 GB. None are named cargo, so the check read as near-idle. The wait belongs to nobody. The load came from unrelated worktrees running multi-hour gates, which a slice agent has no authority to wait on. Most importantly the bias runs toward a false pass. Under memory pressure the kernel reclaims, so a maximum-RSS high-water mark reads lower. A loaded measurement is biased toward passing the 24,576 KiB gate that unblocks the entire wave critical path. The slice may take a provisional reading for its own feedback. The measurement of record is taken by the integrator on a quiet machine with the precondition and machine state recorded beside the number.
The Zone resource store needs one bounded, fully durable engine before the watch and runtime layers can consume it. Preserve D106 by keeping redb API-neutral and binding the concrete bridge through a store-instance mutation port in d2b-resource-api. Correct replay and live fan-out so old envelopes are never decoded and matching watchers share immutable batches.
Operator decision: coding lanes move from gpt-5.6-sol to gpt-5.6-luna at reasoning effort xhigh. The panel binding is untouched and stays on github-copilot/gemini-3.1-pro-preview at effort high, so a lane still cannot both author a change and attest to it. The switch is safe against panel-attest because ensure_panel_binding is an allowlist rather than a denylist: it admits only the exact panel provider, model and effort, so it rejects gpt-5.6-luna records for the same reason it rejected gpt-5.6-sol. No coding-model constant exists in the delivery tooling. One guard did depend on the old name. The manifest assertion in policy_adr046_work_items existed, by its own comment, to catch a manifest that reintroduces the coding model as a panel binding, but it tested for the literal gpt-5.6-sol. Moving the coding model would have left it passing while the regression it guards became undetectable, so it now pins the whole gpt-5.6 family. That is strictly stronger, stays correct across future rebindings, and collides with no Gemini panel model. Verified by planting a new-coding-model spelling in a generated artifact and confirming the assertion fails, then restoring. Three prose sites that named the coding model are updated so the specification does not assert a stale fact.
Evaluate the per-Zone storage artifact instead of treating source text as rendered evidence. Enumerate workspace metadata so direct redb use cannot spread beyond the backend while retaining the exact proof pin.
Preserve store-owned envelope layers and deletion state while making\nidempotent replay independent of minted identities. Quarantine ambiguous\nwriter failures, bind reads and cursors to their transaction lifetime, and\nleave watch policy to its owning coordinator.\n\nSeal the backend to API-owned verified mutation evidence and require explicit\npublication evidence before initializing an empty database.
Reject resource types whose active validator is not represented by a trusted\ncompiled contract. This keeps dynamic schemas fail-closed until their signed\ncontract decoder is available.
Reject production store instantiations whose mutation type is not the API-owned\nverified evidence. This closes the remaining safe-Rust trait fabrication path.
# Conflicts: # AGENTS.md
Add a test-only exec-status helper that duplicates the handed status fd with CLOEXEC before exec and closes the parent writer before waiting. The receipt race now scans /proc only after EOF confirms target exec, preserving the CMSG_CLOEXEC invariant.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
make test-rust-api-surface— passmake test-rust— passD2B_ENABLE_FIXTURE_BUILD=1 make test-fixture-contracts— passmake test-policy— passmake test-drift— passmake test-proofs— passmake test-runtime-ledger— passmake test-nix-unit— passmake test-flake— passmake check-tier0— passmake check-inventory— passmake test-lint— passmake test-changelog— passmake test-performance-budgets— skipped by its documented advisory manifest policy; not used as evidenceReview
Merge
v3; do not merge until the binding panel is unanimous and required checks are green