RFC-025: execution-path corridor shape and prize function (#527 P1)

[ritikpal1122]

Refs #527, phase P1. Draft for discussion, not yet proposed for sign-off.

P1 asked for problem formulation, prize function, determinism rules, the knapsack ordering contract, and a benchmark plan. This delivers those, and reaches a conclusion the issue did not anticipate: GW may not be worth building, and the RFC is structured so the benchmark can say so.

The finding that reframes it

The issue treats the missing Goemans-Williamson solver as the gap. Measuring says the node-selection rule is:

d(source, v)  <=  (1 + lambda) * d(source, sink)

The sink appears once, as a scalar radius. Nothing asks whether v is between source and sink. It is a ball around the source, not a corridor, and no algorithm computing the route changes that.

Evidence, 36 regenerated pairs on this repo's graph, after #648:

lambda	recall	mean nodes	path share
0.0	100%	37.1	0.172
0.5	100%	42.0	0.150
1.0	100%	43.3	0.146

lambda = 0 still returns 37 nodes for a 3-to-5 node route. That floor is the ball.

D2, the load-bearing decision

Prize must be sink-conditioned. With d_t from a reverse Dijkstra seeded at the sink:

detour(v) = d_s(v) + d_t(v) - d(source, sink)

Zero exactly on an optimal route; large for a node near the source but pointing away from the sink; infinite for one with no path to the sink at all. The ball admits all three alike.

This matters most for GW. If prize is a global centrality score, the obvious choice being PPR, then fn:get at in-degree 178 scores high, and that is the hub already dragging its low-degree neighbourhood into every result. GW on a centrality prize could make the observed failure worse, not better. The prize function, not the algorithm, decides whether S16 succeeds.

D3, and why there are three arms

detour yields a corridor needing no primal-dual solver: one extra Dijkstra on the reversed subgraph, same O((n+m) log n), n <= 2000.

So the acceptance criteria compare C1 (shipped), C2 (detour corridor), C3 (GW), and gate 3 requires C3 to beat C2, not C1. Beating the thing being replaced is not the bar; beating the cheap alternative is. If C2 clears, S16 closes by re-affirming the heuristic on evidence, which P2's gate already permits.

Two corrections to the issue

1. P2 says "k8s bench data already exist under bench/". For this tool it does not: every k8s set there is a get_context query set and none contains a (source, sink) pair. Only bench/queries-execpath-travsr.json exists. A k8s arm needs pairs generated first.
2. The bench: get_execution_path ground-truth harness + baseline (#527 P2) #533 pairs go stale. They score 36.1% recall against a current index; regenerated pairs score 100% on unmodified code. P2 is not reproducible until that is owned.

What it deliberately does not do

Settle the functional form of the prize under C3 (dies with C3 if C2 wins), or change the lambda default (an ADR-007 decision, now measurable).

It also records the hub cascade as needing an owner under every outcome including closure, since re-affirming the heuristic leaves that failure in place rather than fixing it.

Contracts preserved

pcst_path's signature, the MCP tool contract, RBAC filtering inside expand_local_subgraph, the SEC P0 "not found == access denied" equivalence, the BFS fallback triggers, and the route-first ordering pinned by #317. D5 spells out how GW would have to satisfy that last one, since it returns a tree rather than a route.

[Abhishek5517]

Review — RFC-025 (#527 P1)

Verdict: strong accept for P1 sign-off as a Draft. Doc-only (+271, one file). Every load-bearing code and contract claim reproduces against current master. The reframing is correct and, more importantly, honest: it argues its way out of the work it was scoped to justify, on evidence. Recommend it proceed to Principal Architect + Tech Lead sign-off with the minor tightenings below folded in first.

Verified against the code

RFC claim	Status	Evidence
Filter is a ball: d(source,v) <= (1+λ)·d(source,sink), source-distance only	Confirmed	pcst.rs:215-222: threshold = total_cost * (1.0 + λ), filter is c <= threshold where c comes from a single dijkstra(graph, src_idx, None, …) at pcst.rs:184. No sink term in the predicate.
At λ=0 the floor is the full disc, not the route	Confirmed structurally	λ=0 gives threshold = total_cost, admitting every node with d_s(v) <= d(source,sink). Proven from code; the "37 nodes" magnitude is a P2 measurement (MCP-only tool, needs the daemon), not reproduced here.
cost = 1.0/ppr_weight, MAX_LOCAL_NODES=2000, EXPAND_DEPTH=5, A* route extraction	Confirmed	pcst.rs:100, 113, 116, 191
Only one Dijkstra today (from source); the reverse pass for d_t is genuinely new	Confirmed	pcst.rs:184 single call
RBAC lives in expand_local_subgraph	Confirmed	filter.allow(...) at pcst.rs:296,317,335,358,376, applied on both forward and reverse BFS frontiers already
pcst_path signature / MCP boundary preserved	Confirmed	pcst.rs:127, unchanged
Named tests exist: pcst_respects_rbac_filter, pcst_is_deterministic_on_tied_cost_topology	Confirmed	pcst.rs:693, 747
#317 route-first regression pinned	Confirmed	pcst.rs:658, 683
ADR-007 exists and is the λ-selection ADR	Confirmed	docs/adrs/ADR-007-pcst-lambda-selection.md
Corpus correction: only queries-execpath-travsr.json is an execpath pair set; all k8s sets are get_context	Confirmed	The one k8s file matching "sink" (probe-cascade-k8s.mjs) uses "sink" as prose in a get_context probe; gen-execpath-pairs.mjs exists as cited

The central thesis holds and the corrections to the issue text are accurate.

Architectural judgment

• Algorithms First is respected, and this RFC actively defends it. detour(v) = d_s(v) + d_t(v) - d(source,sink) is a pure graph-distance quantity: no ML, no embedding, no centrality-via-model. It rejects the degree-penalised prize and semantic edge weighting temptations. This is the right resolution of the PCST approximation-quality problem: tighten the shape, don't reach for a heuristic scorer.
• The D2 insight is the strongest part. Sink-conditioning is what the filter always should have had; d_t=∞ pruning falls out for free, and the hub cascade is disarmed at the root rather than special-cased. Framing GW's benefit as contingent on D2, which C2 also gets, correctly moves the gate to "C3 must beat C2," not C1.
• Invariants intact: token budget as hard constraint (pcst.rs:231), write/read separation, incremental correctness, MCP-only. None touched. C2 returning fewer nodes is fine under the token invariant.

Fix before sign-off (minor, none blocking)

1. Rollout has no phase for C2's production landing. Gate (2) says "C2 ships," but the Rollout section only defines P3 for GW ("P3 happens only under gate (3)"). If C2 wins, it is a real production change to pcst.rs with no named phase. Add a P3-equivalent for the C2-wins branch, same pcst_path boundary and same test-extension requirements.
2. Node-count reduction should be a gate metric, not just a reported one. The whole complaint is ~10x too many nodes, yet gate (2) tests only path share and query-independence. Mean-nodes-returned is reported but not gated. Make the node-count reduction an explicit, quantified acceptance threshold, otherwise an arm could improve path share while barely denting the padding.
3. Float determinism of detour <= λ·d. detour is a three-term float sum, so on-route nodes will not land at exactly 0.0 and summation order can jitter the boundary. Route nodes are emitted separately (A*, route-first) so this only affects context, but the D4 determinism contract should call for an epsilon on the threshold comparison and a determinism test that exercises near-zero detour ties, not just the (detour, NodeId) sort.
4. Gates are qualitative. "Clears C1 on path share" by how much? For a benchmark whose job is to decide whether to build GW, put numeric thresholds in P2's harness spec, or state explicitly that P2 sets them.

Nits

• Summary says "roughly ten times more nodes"; the table implies ~7-12x depending on whether the route is 3 or 5 nodes. Pick one reference route size so Summary and table agree.
• Unresolved Q2 (#533 pairs stale, 36.1% recall) correctly flags an owner is needed regardless of outcome. Agreed: that is a live harness-reproducibility bug independent of #527 and should not be closed with it.