test(research): certify the V45 closed native endpoint cone

research/rank7-v45-native-cone-seed78/INDEPENDENT-ORACLE.md

@@ -0,0 +1,143 @@
+# Independent abstract SSA dependency oracle
+
+Prepared with substantial OpenAI Codex assistance; Apache-2.0.
+This module implements only an abstract dependency-closure oracle. Native
+kernels, source construction and predecessor package credit remain with
+their original authors and packages.
+
+## Implementation independence
+
+The SSA implementation and its normative controls were prepared by a separate
+AI-assisted implementation without reading or importing the primary cone or
+source-binding code. Preparation without execution was not counted as a
+passing validation receipt. Actual execution evidence appears below and in
+`VALIDATION.json` and both `RESULT-*.json` files.
+
+The oracle independently constructs a forward versioned graph, then follows
+its predecessor edges backwards. The primary implementation uses reverse
+demand over the same abstract records. Agreement checks those two closure
+algorithms. It does not independently prove that the event-to-record semantics
+correctly model the actual word, native program, chart transitions or resource
+obligations. Those require the separately checked decoder and semantic controls.
+
+## Interface
+
+```python
+dependency_cone(records, initial_slots, final_slots=())
+```
+
+Each ordered record is exactly:
+
+```python
+{
+    'index': 42,
+    'outputs': {'value:L:249': ['value:L:249', 'value:L:17']},
+    'roots': ['lifetime:Z:249'],
+}
+```
+
+This is a schema illustration, not a valid standalone fixture: every read/root
+must be explicitly initialized or written by an earlier event. Indices must be
+strictly increasing nonnegative integers; booleans are rejected. State slots are
+nonempty `channel:name` strings. The oracle treats channels opaquely; the semantic decoder supplies
+the value/chart/lifetime interpretation. Outputs are a dictionary of state slot
+to a list of input state slots. Dependencies resolve to **pre-event** versions
+for every output before any output is installed. Roots resolve **after** all
+simultaneous writes in that record. Final roots resolve after the last record.
+
+Outputs may introduce fresh state slots, but inputs may not read a new slot
+from the same event. An output with no predecessors creates a constant node
+that still retains its producing event. This handles allocation and clear
+without inventing arbitrary initial private/center inputs. Slots persist after
+being introduced; lifetime activation/deactivation must be represented in
+explicit lifetime values and checked by the semantic decoder.
+
+`initial_slots` and `final_slots` accept lists, tuples, sets, or frozensets.
+Initial order is normalized to sorted unique names for deterministic node IDs.
+Dependency/root repetitions are normalized to one graph edge/reference: the
+oracle does not perform XOR or coefficient cancellation. Records and their
+nested collections are never mutated.
+
+Returned fields:
+
+- `event_indices`: sorted events producing any backward-reachable value,
+  including constant-producing events with empty predecessor lists.
+- `boundary_inputs`: sorted initialized slots reached by the roots.
+- `versions`: every node's integer ID, state slot, per-slot version number,
+  producing event index (or `None` for explicit initial input), and predecessor
+  node IDs. Initial nodes start at version zero. A newly introduced slot also
+  starts at version zero; a rewrite advances its per-slot version.
+- `events`: every input event, including zero-output events, with its output
+  and post-event root node IDs.
+- `event_roots`: event index to resolved post-event root node IDs.
+- `root_versions` and `reachable_versions`: sorted node IDs.
+- `initial_versions` and `final_versions`: state-slot to selected node ID maps.
+
+An event with zero outputs has no producer edge of its own. Merely listing a
+root in that event requests the current value; it does not make the event itself
+causal. A guard/free whose own execution must be certified should produce an
+explicit obligation/lifetime value, dependent on its pre-event value, chart,
+and lifetime, then root that output. This is the explicit private-free obligation model.
+
+## Bounds and failure behavior
+
+The module rejects more than 100,000 records, more than 4,096 total state slots,
+or an individual slot collection larger than 4,096. It rejects malformed record
+shapes, unknown pre-event reads, unknown post-event/final roots, and invalid
+indices. Exceptions use explicit `ValueError`, surviving Python optimization.
+There are no assertions, dependencies, imports, threads, subprocesses, filesystem
+writes, environment changes, or CLI execution hooks in the module. The limits
+bound domain shape, not a claim that the largest possible graph fits available
+memory: actual execution must budget output/edge counts and authenticate the records
+before building this graph. The graph preserves every written version rather than
+discarding versions whose consumers have not yet appeared.
+
+## Normative fixtures proposed before execution
+
+These were proposed before primary-code access. The separate worker later
+implemented `graph_controls.py`; it was executed during the
+source-bound audits. Eight positive examples, the missing-edge control and
+fifteen oracle input guards are recorded in both `RESULT-*.json` files.
+
+1. **ADD dependency:** initialize `value:t` and `value:s`; event0 writes
+   `value:t <- [value:t,value:s]`. The target root reaches event0 and both inputs;
+   an unchanged source root reaches only the source boundary, not event0.
+2. **Simultaneous swap:** event0 writes `value:a <- [value:b]` and
+   `value:b <- [value:a]`. Root the new a: it reaches the old b only. Installation
+   order cannot introduce a self-edge or replace the old a read of new b.
+3. **COPY overwrite:** event0 modifies target; event1 writes target from source
+   only. The target root reaches event1/source; event0 and old target are excluded.
+4. **CLEAR/alloc constant:** write a fresh private slot from `[]`; root it. The
+   allocating event remains selected with no boundary inputs. A prior target
+   writer is killed by clear. No fictitious dirty private input is introduced.
+5. **Post-event root:** rewrite a slot and root it in the same event. Reach the
+   new version and its producer, not the overwritten version alone.
+6. **Private free obligation:** free writes a new lifetime from pre-free value,
+   chart and lifetime, then roots it. Earlier value/chart/lifetime producers must
+   remain covered even if the private value is not a final output slot.
+7. **Unary chart chain:** chart rewrites and a scalar value node referencing
+   that chart must retain the complete earlier chart dependencies. Dropping a
+   decoder-supplied chart edge must visibly change closure on the fixture.
+8. **Unknown slot guards:** a read of an uninitialized private, a same-event read
+   of a fresh output, and an unknown final root all reject. A previously written
+   fresh private can be read subsequently.
+9. **Noncontiguous event labels:** indices2/9/31 are accepted in chronological
+   order; duplicates, decreasing labels and boolean labels reject.
+10. **Root without outputs:** a zero-output record with a root keeps that value's
+    real earlier producer; it does not manufacture the empty event as a writer.
+
+## Exact scope
+
+A passing comparison supports abstract closure. Actual source decoder coverage is supported separately
+by source reconstruction and its semantic controls. It does not establish phase/native identities, chart commutative
+diagrams, free private-zero return, backing ownership, precision, paid storage,
+full-supplier admission, or any κ. Those remain separately checked evidence
+obligations. Preserve this distinction in any final package and receipts.
+
+## Execution evidence
+
+Both frozen-provider certificates now record agreement with the reverse-demand
+closure on both actual programs, with the normative controls passing. The
+full result also includes separate source binding and exact native identities;
+those are separate evidence, not independent capabilities of this abstract
+oracle. Preparation without execution was not counted as validation.

research/rank7-v45-native-cone-seed78/README.md

@@ -0,0 +1,157 @@
+# Source-bound native dependency cone for one PR2979 endpoint
+
+This finite audit verifies the source-bound closed dependency cone for
+helper249/private953 in both frozen PR2979 providers and both orientations.
+All7,658 reached native classes pass exact512-column checks including global
+phase. No new supplier, physical invoice or kappa is claimed.
+
+The audit follows PR3008's released peer-dependency handoff for PR2979's
+helper249/private953. It fixes the original construction at
+`be191346391661f4d35fc0d1508d0a6029572576`, with scientific base
+`d8e0f83f00191df62174b641e9fff055c357f641`, priority revision6. It covers both
+final providers and their separately emitted forward/inverse-transpose programs.
+The selected maintainer result remains separate.
+
+## Statement and method
+
+The verified finite statement concerns a **conditional macro execution**:
+helper249's normalized endpoint is its own original input, and allocated
+private953 is zero immediately before free. After the helper's actual residual
+wrappers, its physical local factor is F7, or inverse F7 in the other
+orientation. It is not a physical identity on that helper's entire array.
+
+1. `source.py` independently reconstructs every source event, including initial
+   corrections, both center constructions, private cleanup, source matrices,
+   exact rational operations, canonical ordered charts and wrapper positions.
+   Complete source equality is checked before pruning. This prevents an
+   omitted writer from silently disappearing from an emitted-only graph.
+2. `cone.py` uses a backwards demand scan on separate value, chart and lifetime
+   slots. `oracle.py` independently builds forward SSA and graph reachability.
+   The two closures must agree. CLEAR/COPY and simultaneous writes have explicit
+   normative controls; agreement on corrupted shared records is not accepted as
+   evidence that their decoder is correct.
+3. Both the full emitted program and its restricted cone are pulled back with
+   exact rational covectors over a free noncommutative warp alphabet. The roots
+   are the helper after its post wrapper and the private immediately before
+   free. This is conservative syntactic closure, not a minimal algebraic slice.
+4. Every reached climb, center transition, warp, ordinary adapter and residual
+   wrapper is mapped to the actual serialized native class. `native.py` compares
+   the expected caller chart product with its decoded recipe using the credited
+   separate Gaussian-integer kernel on all512 columns, including global phase.
+   The inverse-transpose native operation is conjugated in chronological order.
+
+The source census reaches8902/22748 events forward and12357/22748 in the
+inverse-transpose program for each provider. These include2819 and2601 native
+events, respectively, grouped into2039 and1790 native classes. The two
+`RESULT-*.json` files retain each exact identity and every event association.
+Counts are per provider; shared identities are still checked in each run.
+
+Common-chart incidence is checked independently, including exact warp matrices,
+nested center paths and the FULL cleanup boundary. Nonidentity target exit
+adapters cannot be reused in cleanup as canonical FULL data. Native residual
+recipes are selected from exact entrance/terminal pairs. Cache identity uses
+the entire candidate/reference circuits, serialized record and orientation;
+local numeric frame IDs alone are never a global verification key.
+
+## Reproduce
+
+The research environment is CPython3.12.14 with existing NumPy2.3.5. Native
+comparisons use the standard-library exact kernel; the unchanged retained
+producer uses NumPy. No dependency is downloaded by the verifier.
+
+From the repository root, each provider is a separate bounded command:
+
+```sh
+python3.12 -I -O -Werror -B research/rank7-v45-native-cone-seed78/verify.py --provider base
+python3.12 -I -O -Werror -B research/rank7-v45-native-cone-seed78/verify.py --provider extra
+```
+
+Default execution authenticates the source closure, reconstructs artifacts in
+a fresh temporary directory, binds retained recipe/program receipts, runs the
+behavioral controls, and checks every reached native class. `--emit` prints a
+fresh deterministic certificate. `--artifacts DIR` reuses artifacts while
+still checking all source bindings and native identities; it does not claim a
+fresh producer execution. `--progress` writes bounded progress to stderr.
+Normal verification writes no repository files and requires no network or Git.
+
+The registered hook is `python3.12 -B scripts/research_package.py --package
+research/rank7-v45-native-cone-seed78`. It authenticates the13-row source
+manifest and runs both cold commands, with600 seconds per provider. The two
+frozen result files were first produced using freshly generated supplied
+artifacts. The registered cold replay then passed both default providers in
+599.18 seconds total, reproducing those exact deterministic certificates.
+`VALIDATION.json` records modes, source/code pins, receipts and remaining checks.
+Each retained producer has a300-second timeout. An initial120-second phase
+generation failed at its saved cap and was preserved; a new separately
+allocated run produced both exact retained recipe files. This was a runtime
+calibration failure, not a negative mathematical result.
+
+## Coverage, controls and limits
+
+PR3006 checked the chosen source endpoint covectors and seven native recipes;
+PR3008 bound73 directly touching events. This package changes the coverage to
+the complete actual peer-event dependency closure and joins that emitted
+normalized endpoint with its native chart realizations. It does not import
+either predecessor's checker. The frozen compiler and separate native kernel
+are reused with attribution; neither is a new implementation here.
+
+Controls include a peer warp crossing an ADD while direct-event projection and
+clocks stay unchanged, a substituted source G matrix, post-exit non-FULL
+cleanup, a private write after free, actual peer native phase/character faults,
+and an explicit Gaussian basis witness. The same-rank center containment
+control is a **derived center-only fixture**, using an actual center/cut and
+positive/negative target lines; it is not an observed defect in the word.
+Eight handwritten graph examples, one missing-edge control and fifteen oracle
+input guards complement the actual-program checks.
+
+The implication inherits physical rational scalar, COPY/CLEAR and known-zero
+allocation contracts. A peer private buffer can affect the chosen endpoint
+before its own free; its later zero-return is not automatically a dependency
+of these two roots. **This audit does not prove every peer private reusable.**
+It also leaves physical backing/ownership, the changed final packing invoice,
+storage/precision/tape, the complete supplier/outer release and all-size/compiler
+assumptions open. No cost or exponent follows from these local identities.
+
+The current selected record/source manifest was read for context, without a
+fresh selected1579-file binding/cold replay. Lean, Docker and hosted CI are
+separate and unclaimed. This is finite Python evidence with an explicit
+conditional composition argument, not a proof-kernel multiplication theorem.
+
+## Open next questions
+
+1. Seed and check all peer-private free obligations needed for ownership and
+   ancillary reuse. Start with the actual Z allocations in these closures;
+   do not infer their final zeros from private953 alone.
+2. Join the independently checked local execution to PR2987's actual final fill
+   and the complete physical storage/precision bill. The local native ranks
+   alone do not price those interfaces or admit PR2979's claimed exponent.
+
+## Credit and engineering constraints
+
+ToikY, with substantial OpenAI Codex assistance in research, code, internal
+independent implementation/review and writing. No independent human review is
+claimed. Apache-2.0. All existing frozen sources/notices remain unchanged.
+
+Credit Marius-Paul Dumitrean for PR2979; Nick Petalas for PR2993/3006/3008 and
+the released scope; Jeremy Kothe, Mason Hale and Jeremy Diviney for the retained
+frame/native/extraction chain; Tekalign and icekylinx for native tooling;
+Sagar Thakrar for the separate exact kernel; Ross Richardson for packing and
+invoice audits; and Cinna Davis, Yiyang Lu, DreamingOfClouds, Douglas Colkitt and
+the source packages' original geometry/owner/compiler lineage. See the exact
+source manifest and retained PR2226 notice.
+
+Build the Lever motivates the rerunnable closed-cone checker. Prove It Works
+requires source completeness, actual recipes and semantic mutants. Test
+Behavior, Not Implementation requires normative graph answers, not agreement
+alone. Unslop keeps the result and inherited obligations separate.
+
+New functions remain below60 physical lines. Input files/decoded artifacts are
+bounded at16MiB, except decompression of the exact hash-pinned source word;
+source sections at10000 gates, event streams at100000 entries,
+frames at4096 and the native domain at9 axes/512 columns. Explicit exceptions
+remain active under `-O`. Rule3 deviation: managed Python/NumPy allocations are
+bounded for this fixed research domain, not a resident untrusted-input service.
+Rules8/9 deviation: named authenticated source modules and bounded retained
+producer subprocesses execute in fresh tool directories; their candidate
+outputs are independently decoded. Broader input/service domains need a new
+capacity and execution audit.