架构审阅整改批:边界面加固(C2 纪元谓词/C5 评估 rc/C3 门契约单源/C6 tools 分层,伞 #191)

CHANGELOG.md

@@ -6,6 +6,15 @@
 
 ### 新增 Added
 
+  - **Assessment-track rc machine-checking + month-round leg separation (issue #193, umbrella #191 arch-review C5)**: `scripts/fusion_replay_gate.py` grows `gate_rc` aggregation — 0 = all legs PASS with sufficient corpus, 1 = any true FAIL (C2 strict/loose mismatch stays a hard gate), 2 = insufficient corpus (empty-corpus vacuous PASS no longer masquerades as green); `main()` returns it instead of unconditionally `0` (the dead gate is alive again; reviewer-D P1-1). `scripts/monthly_eval.sh` separates per-leg rc: all eight legs (LEG_ORDER: model/all/dsem/audit/temporal/readout/anchors/agg-share) capture rc explicitly and never abort siblings — the F4 anchors special case is honestly generalized to a whole-round contract; final exit = first non-zero in leg order; `check_family -maxdepth 1` closes the old find-recursion hole where a same-shape artifact in a subdirectory could substitute for the family verdict; leg-status artifacts (`leg-status-*.json`) dual-write (in-flight snapshot with readout=null + final) and feed the monthly report's leg-status section (missing = section omitted, never fabricated). STANDARD.md D-1 gate hook 47→48.
+  - **评估轨 rc 机检化+月轮全腿分离(issue #193,伞 #191 审审整改 C5)**:`scripts/fusion_replay_gate.py` 新增 `gate_rc` 聚合——0=全腿 PASS 且语料充分,1=任一真 FAIL(C2 strict/loose 失配仍硬门),2=语料不足(空语料的空真 PASS 不再冒充绿);`main()` 返回真实 rc(死门复活,评审D P1-1)。`scripts/monthly_eval.sh` 全腿 rc 分离:八腿(LEG_ORDER)显式捕获不互断——F4 anchors 特例诚实推广为全轮契约;最终退出码=腿序首非零;`check_family -maxdepth 1` 补 find 递归旧洞(子目录同形状件不再能顶替族 verdict 件);腿级状态件(leg-status-*.json)双写(在飞快照+定稿件)入月报腿况节(缺省不出节,不虚构)。STANDARD.md D-1 挂点 47→48。
+  - **Gate-contract single source + dual cross-language sentinels (issue #194, umbrella #191 arch-review C3)**: `GATE_SEQUENCE`/`GATE_COUNT`/`GATE_NAMES` derive from the gates.mjs registry itself (7 hardcoded `records.length !== 10` sites zeroed; adding/removing/reordering a gate trips the registry-order↔execution-order bijection invariant test); the 19-anchor JS mirror is unified into `ops/agent/anchor-mirror.mjs` (single definition, `anchorRow` constructor throws on unknown/missing keys — the #189 stub-missing-conflict precedent); two new §14 sentinels: SHAPE (anchor row key-set cross-language check) and FOLD (fold-family full-value-domain check: python `_error_family` golden constants AST-extracted vs JS `foldErrorFamily` — previously only net_timeout→timeout was covered). Acceptance replayed by the merger: tampering with gate list / one fold value / one anchor / one row key each trips the sentinels red while the JS-internal tests still look green (the canned-self-consistency blind spot the sentinels exist to catch).
+  - **门契约单源+跨语言双哨(issue #194,伞 #191 审审整改 C3)**:`GATE_SEQUENCE`/`GATE_COUNT`/`GATE_NAMES` 全部从 gates.mjs 注册表本体派生(7 处 `records.length !== 10` 硬编码清零;加门/删门/改序即触发注册键序↔执行序双射不变式红);19 锚 JS 镜像合一到 `ops/agent/anchor-mirror.mjs`(唯一定义点,`anchorRow` 构造器多写/漏写键即 throw,#189 桩漏 conflict 判例);§14 新增双哨:SHAPE(锚行键集跨语言对拍)+FOLD(折叠族全值域对拍:python `_error_family` 金常量 AST 抽取 vs JS `foldErrorFamily`,旧盖面仅 net_timeout→timeout 一例)。merger 篡改重放:改门清单/折叠族一值/锚一员/行键一枚→哨齐红而 JS 内部测试仍绿(哨存在的意义=罐内自洽假绿面)。
+  - **tools.mjs layering, behavior-preserving (issue #195, umbrella #191 arch-review C6)**: the 1345-line monolith splits into a 132-line facade (ToolHost host + registration orchestration + semanticGate + prototype mixin mount) plus six single-purpose faces `tools/{shared,envelope,registry,precedents,measurement,discovery}.mjs`; all existing imports keep working through the facade re-export; behavior conservation pinned three ways — the 29-name public export set equals the bde7f061 frozen monolith name-for-name, constants byte-equal (GH_WRITE_SUBCOMMANDS/FROZEN_DAYS/RSS_FRESH_DAYS/RG_TIMEOUT_MS), and a line-multiset audit showing zero unplanned logic-line changes. Exit-safety single sources (PREDICATES/GH_WRITE_SUBCOMMANDS/DENY_*) live exactly once each in registry.mjs; STANDARD.md anchors P1/P6/D-3/D-6 repointed to the face files; contract SRCS and selftest.sh node --check extended to the six faces.
+  - **tools.mjs 分层,行为守恒(issue #195,伞 #191 审审整改 C6)**:1345 行单体拆为 132 行门面(ToolHost 宿主+注册编排+semanticGate+prototype mixin 挂载)+六面 `tools/{shared,envelope,registry,precedents,measurement,discovery}.mjs`;既有 import 面经门面 re-export 全不断;行为守恒三重钉死——公开导出面 29 名与 bde7f061 冻结单体逐名相等、常量字节等(GH_WRITE_SUBCOMMANDS/FROZEN_DAYS/RSS_FRESH_DAYS/RG_TIMEOUT_MS)、行多重集审计零计划外逻辑行变更。出口安全单源(PREDICATES/GH_WRITE_SUBCOMMANDS/DENY_*)全仓各恰一处(registry.mjs);STANDARD.md 四锚(P1/P6/D-3/D-6)改指面文件;contract SRCS+selftest.sh node --check 扩六面。
+- **物化谓词根修:harvest 版本戳腿(issue #192,伞 #191 架审整改 C2;ADR 0009;收口 #188 部署注记的「harvest 代码演进不触发重物化」架构缺口)**:`needs_convert` 从 mtime 单腿(代理「内容+代码版本」,代码演进不动 csv mtime → 新纪元永不建 → 静默休眠,2026-10-10 / 2026-10-25 两起生产事故同形)升三腿——ptr 缺失 ∨ `.rev` 版本戳 ≠ 当前 `HARVEST_REV`(代码代腿;`_sources/_lmdb.py` 单调递增常量,任何 harvest 语义改动必须 bump,判例注记在常量旁)∨ ptr mtime < raw mtime(数据腿,增量跳写语义保住);`rebuild_lmdb` staged 段在 ptr 前盖 `.rev` 章(ptr-LAST 无裸奔不变式不动);`_needs_rebuild_of` 比较对象从 `_mmdb_path` 换 `_lmdb_base` 族(`_mmdb_path` 留作 scheduler 观测契约);存量族 `.rev` 缺失=不匹配 → 首跑一次全量重建自愈;门①位等价=代码未变连续 rebuild 零副作用逐字节同(sidecar 字节/纪元清单/逐文件 sha256+mtime_ns);门②消融 3 真实源(myip_ms 1563/56、ziyadnz 123106/0、cps 32715/0)touch 旧仪式 vs `HARVEST_REV` 前进(进程内模拟代码演进)——计数相等+排除/告警日志 multiset 相等(ziyadnz 46 行)+csv mtime 全程不动 → touch 不再必要;rev 前进后收敛无循环;GLOSSARY「物化谓词」「harvest 版本戳」同批铸词;**部署注记**:首跑触发存量族全量迁移重建(票面口径 41 源;开发机 data 面 50/59 raw 在场,以生产面为准)——计数不变已机检钉死,属预期自愈非故障;#188 部署注记的显式 `POST /api/sources/infra_services/update` 仪式随本修失效(版本戳腿自动触发),infra_services 无条件重物化机制保留、职责转为投影一致性自愈(ADR 0009)
+  - **Materialization-predicate root fix: the harvest version-stamp leg (issue #192, umbrella #191 arch-review C2; ADR 0009; closes the "harvest-code evolution never re-materializes" architecture gap left in #188's deploy note)**: `needs_convert` goes from the single mtime leg (which proxied "content + code version" — code evolution leaves the csv mtime unmoved, so a new epoch is never built and projections go dormant; the 2026-10-10 and 2026-10-25 production incidents share this shape) to three legs — ptr missing ∨ `.rev` stamp ≠ current `HARVEST_REV` (the code-generation leg; a monotonically increasing constant in `_sources/_lmdb.py` that any harvest-semantics change must bump, with the incident precedents annotated at the constant) ∨ ptr mtime < raw mtime (the data leg; incremental skip-write semantics preserved); `rebuild_lmdb` stamps `.rev` in the staged section before the ptr swap (the ptr-LAST no-naked-commit invariant untouched); `_needs_rebuild_of` compares against the `_lmdb_base` family instead of `_mmdb_path` (`_mmdb_path` stays as the scheduler's observability contract); legacy families without `.rev` read as mismatch → one-time full self-heal rebuild on first run; gate ① bit-equivalence = with code unchanged, consecutive rebuilds have zero side effects, byte-identical (sidecar bytes / epoch listing / per-file sha256 + mtime_ns); gate ② ablation across 3 real sources (myip_ms 1563/56, ziyadnz 123106/0, cps 32715/0): the old touch ceremony vs advancing `HARVEST_REV` (in-process code-evolution simulation) — equal counts + equal exclusion/alert-log multisets (ziyadnz 46 rows) + csv mtime untouched throughout → touch no longer necessary; convergence after a rev advance loops no further; GLOSSARY coins "物化谓词" (materialization predicate) and "harvest 版本戳" (harvest version stamp) in the same batch; **deploy note**: the first run triggers a one-time full migration rebuild of all existing families (ticket estimate 41 sources; the dev-machine data face shows 50/59 raws present — production's face is authoritative) — counts unchanged is machine-pinned, this is expected self-healing, not a fault; #188's deploy-note ceremony of an explicit `POST /api/sources/infra_services/update` is superseded (the version-stamp leg triggers automatically), while infra_services' unconditional re-materialization mechanism stays, its duty shifting to projection-consistency healing (ADR 0009)
+
 - **benign② 良性断言源接入(issue #188,spec #180 首批租户 Q5 承接;ADR 0008 决策4 定向整改)**:infra_services 升格为首个良性断言源——harvest 同 payload 双面(service 资产槽照旧 + classification_type=服务角色(dns/ntp)+verdict="benign" 进分类面;弃权拼写 "" 期作废);_registry.lookup 分组注入:良性断言 type-agnostic 注入每个指控组同场(任意指控类型×良性断言 = verdict_conflict=True 真对立出海,如 223.5.5.5 = tweetfeed 指控×infra_services 良性断言;固定 ctype 方案否决:blacklist 型指控会漏接);宁少算不变式测试钉死:良性证人不投票(组 conf/顶层重融合逐位不变)、不压制指控 verdict(precedence 恒指控胜)、不产 STIX Indicator;无指控组时以自身 ctype 成纯良性面(verdict=benign conf≈r,区别于①无证据弃权 benign/0);_classification 注册 dns/ntp 断言域标签+i18n 双语;三锚点(2026-09-06 PR #61 终审建议4 挂账)同批收口:①STIX verdict_conflict=True 往返断言 ②回放 check_directional 合法成因清单加 benign-abstention ③_types/_api_models/api.ts 三处「今天恒 False,占位」注释改口径;conflict 留痕人裁链:anchor_sweep 工件逐锚 conflict 投影(留痕不持门,锚仍 finding——宁少算不自动压制)+G_ANCHOR_SWEEP 门 conflict 布尔形状校验+finding 出口 issue 模板对立行标记;GLOSSARY「benign(两层,勿混)」②随实做改口径(占位句作废,铸词同批律);新增 tests/lookup/test_benign_assertion.py(6 例:真对立/多指控组各自对峙/conf 位等价/纯良性 v4+v6/无 Indicator)+锚巡检 conflict 形状固化例;**部署注记(评审A P1)**:本批 `_DATA` 字节不变→csv mtime 不动→`needs_convert` 恒 False,存量 epoch 不含良性断言=部署后静默休眠(2026-10-10 事故同形状:那次靠 docker rm csv+restart 外科治愈);部署时须显式触发重建——`POST /api/sources/infra_services/update`,良性面才物化出海;另「harvest 代码演进不触发重物化」为架构缺口,已留票缓议;**回放闸门判例(评审C)**:C3 同面双跑 ρ 第五位/直方图 ±10/3.28M 桶移=now 基准时间衰减抖动非回归(`_merge.py asof_to_now`),硬门=C2 strict 失配 0
   - **benign② benign-assertion source onboarding (issue #188, carrying spec #180 first-batch tenant Q5; ADR 0008 decision 4's targeted remediation)**: infra_services is upgraded into the first benign-assertion source — harvest yields one payload on two faces (the service asset slot unchanged, plus classification_type=service role (dns/ntp) + verdict="benign" entering the classification face; the old abstention spelling "" is retired); _registry.lookup group injection: benign assertions inject type-agnostically into every accusing group in the same scene (any accusation type × benign assertion = verdict_conflict=True true opposition going live, e.g. 223.5.5.5 = tweetfeed accusation × infra_services benign assertion; the fixed-ctype design was rejected: blacklist-type accusations would miss); 宁少算 (err on under-counting) invariants pinned by tests: the benign witness never votes (group conf / top-level re-fusion bit-identical), never suppresses an accusation verdict (precedence always favors the accusation), never yields a STIX Indicator; with no accusing group the assertion forms a pure-benign face on its own ctype (verdict=benign conf≈r, distinct from ① no-evidence abstention benign/0); _classification registers the dns/ntp assertion-domain labels + bilingual i18n; the three anchor points (2026-09-06 PR #61 final-review recommendation 4 carryover) close in the same batch: ① STIX verdict_conflict=True roundtrip assertion ② replay check_directional legal-cause list gains benign-abstention ③ the three "constant False today, placeholder" comments in _types/_api_models/api.ts re-worded; conflict mark-for-human-adjudication chain: anchor_sweep artifacts carry a per-anchor conflict projection (recorded, never gating — the anchor stays a finding, 宁少算 means no auto-suppression) + G_ANCHOR_SWEEP gate boolean shape check for conflict + the finding-exit issue template marks opposition rows; GLOSSARY "benign (two layers, never conflate)" ② re-worded to match the landed reality (the placeholder sentence retired, coinage-in-same-batch rule); adds tests/lookup/test_benign_assertion.py (6 cases: true opposition / per-group confrontation across multiple accusing groups / conf bit-equivalence / pure-benign v4+v6 / no Indicator) plus the anchor-sweep conflict-shape pinning case; **deploy note (review A P1)**: this batch's `_DATA` is byte-unchanged → csv mtime unmoved → `needs_convert` stays False, so the existing epoch carries no benign assertion and the feature lies dormant after deploy (same shape as the 2026-10-10 incident, then cured surgically via docker rm csv+restart); at deploy time explicitly trigger the rebuild — `POST /api/sources/infra_services/update` — before the benign face materializes; "harvest-code evolution without `_DATA` drift never re-materializes" is an architecture gap deferred to a follow-up ticket; **replay-gate judgment (review C)**: C3 same-face double-run drift (ρ at the 5th decimal / histogram ±10 / 3.28M bucket moves) is now-anchor time-decay jitter, not a regression (`_merge.py asof_to_now`); the hard gate is C2 strict with 0 mismatches