Skip to content

feat(index): add authenticated semantic execution facts #633

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mohanagy merged 5 commits into from
Jul 31, 2026
Merged

feat(index): add authenticated semantic execution facts #633

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9fe3c24
feat(index): add authenticated execution semantics
mohanagy Jul 31, 2026
c977de0
fix(index): enforce execution proof exactness
mohanagy Jul 31, 2026
f4ae644
fix(index): isolate deferred execution owners
mohanagy Jul 31, 2026
bff482c
fix: harden semantic execution evidence
mohanagy Jul 31, 2026
c9d2c6f
docs: complete semantic verification cohort
mohanagy Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
230 changes: 211 additions & 19 deletions docs/core-reset/removal-manifest.yml
View file
Open in desktop

Large diffs are not rendered by default.

34 changes: 26 additions & 8 deletions docs/core-reset/scorecard.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **RFC:** [#577](https://github.com/mohanagy/madar/issues/577)
> **Milestone:** [`v0.40.0 — Core Reset`](https://github.com/mohanagy/madar/milestone/7)
> **Status:** accepted; the product vertical slice through Evaluation Tooling Isolation and retrieval regressions #618, #622, and #625 passed; `0.40.0-beta.3` remains immutable published history; `0.40.0-beta.4` release preparation is authorized against protected `next`; Capability Validation remains cancelled; npm `latest`, stable release, MCP Registry publication, and `main` remain unauthorized
> **Status:** accepted; the product vertical slice through Evaluation Tooling Isolation and retrieval regressions #618, #622, and #625 passed; `0.40.0-beta.4` is published from exact protected-`next` commit `9043320cfa08370e5cdd3911bfb9283005aa9912`; semantic execution index #632 is active, #630 and #631 are pending in dependency order; npm `latest` remains `0.32.0`; another beta, stable release, MCP Registry publication, and `main` remain unauthorized

This is the phase-gate evidence ledger. An issue or PR link is not evidence by itself; each gate needs a reproducible test, receipt, measurement, or external-user record.

Expand Down Expand Up @@ -43,11 +43,14 @@ The schema-validated, share-safe receipt was recorded at tooling checkout `250a6
| Retrieval regression #618 | **Passed** | Restore grounded natural-flow retrieval in one call or at most one bounded recovery without repository-specific rules, graph/index changes, dependencies, or fallback engines | [#618](https://github.com/mohanagy/madar/issues/618) completed through [PR #620](https://github.com/mohanagy/madar/pull/620), merged at `eaa1a8781eda28dad5395d6da378a2cc40bf81fe`; all six exact-head CI jobs, two independent no-blocker reviews, and zero review threads passed |
| Retrieval regression #622 | **Passed** | Stabilize equivalent end-to-end report-flow prompts and expose honest asynchronous handoff targets within the unchanged retrieval and package ceilings | [#622](https://github.com/mohanagy/madar/issues/622) completed through [PR #623](https://github.com/mohanagy/madar/pull/623), merged at `6416dbc02cefb3bd79157cf440e420b30dda8cf0`; [six-job CI](https://github.com/mohanagy/madar/actions/runs/30452883659), two exact-head no-blocker reviews, CodeRabbit PASS, and zero unresolved threads |
| Retrieval regression #625 | **Passed** | Replace phrase-gated recovery with a generic bounded, graph-coherent evidence skeleton/forest without exceeding the inherited package ceilings | [#625](https://github.com/mohanagy/madar/issues/625) completed through [PR #626](https://github.com/mohanagy/madar/pull/626), merged at `b6562b715133304bd46e537b6f39008bc1e02095`; [six-job CI](https://github.com/mohanagy/madar/actions/runs/30533140531), independent exact-head review, CodeRabbit PASS, and zero unresolved threads |
| Semantic execution index #632 | **In progress** | Authenticated ordered body facts, exact async channels and receiver/type-proven persistence pass every source, graph, indexing, latency, package, CI, review and zero-thread gate | [#632](https://github.com/mohanagy/madar/issues/632); protected base `9043320cfa08370e5cdd3911bfb9283005aa9912`; three PR heads were stopped and not merged; the new local correction is qualified, while exact-head CI/review/merge remain pending |
| Obligation-driven retrieval #630 | **Pending** | Return a complete authenticated workflow dossier or exact missing obligations within unchanged budgets | [#630](https://github.com/mohanagy/madar/issues/630); blocked on #632 |
| No-fallback qualification #631 | **Pending** | Installed exact-head package matches or beats the strongest frozen baseline and requires zero repository-tool fallback | [#631](https://github.com/mohanagy/madar/issues/631); blocked on #632 and #630 |
| External validation | **Deferred** | Activation, retention, and paid-intent evidence remains required for later stable claims, not this beta | No external-validation claim in `0.40.0-beta.4` |
| Beta release | **Ready** | Publish only the exact protected-`next` beta.4 candidate under npm `next` plus a matching exact-commit GitHub prerelease | [#627](https://github.com/mohanagy/madar/issues/627); candidate package 102 / 159,937 / 639,875 against fixed 102 / 165,000 / 640,000 ceilings; npm `latest` remains `0.32.0` |
| Beta release | **Published** | Preserve exact beta.4 npm/GitHub release history; any later beta requires separate authorization after #632, #630 and #631 gates | [#627](https://github.com/mohanagy/madar/issues/627); exact commit `9043320cfa08370e5cdd3911bfb9283005aa9912`; package 102 / 159,937 / 639,875; npm `next` is `0.40.0-beta.4`, npm `latest` is `0.32.0` |
| Stable release | Not started | Every separately retained stable gate passed; old core absent; migration docs ready | Pending; the beta does not satisfy this gate |

Issues `#622` and `#625` are complete on `next`. Evaluation Tooling Isolation completed through #606 and PR #608 at 43 production files / 11,956 LOC; #618 completed at 43 production files / 12,008 LOC with `+69/-17/net +52`; #622 completed at 43 production files / 12,147 LOC with `+164/-25/net +139`; and #625 completed at 43 production files / 12,454 LOC with `+1,409/-1,102/net +307` against its protected base. The beta.3 release is immutable published history at exact protected-`next` commit `ece7d0d02643ecec08bd91aa904a4514aa845f42`. Capability Validation issues #610, #612, #614, #615, and #616 are closed not planned: no campaign ran, no Native/Graphify/Madar result exists, provider requests remain zero, and paid spend remains USD 0. Their `Deferred` project disposition means “not a beta gate and not passed.” Issue #625 itself authorized no publication; the separately authorized beta.4 release is tracked by #627.
Issues `#622` and `#625` are complete on `next`. Evaluation Tooling Isolation completed through #606 and PR #608 at 43 production files / 11,956 LOC; #618 completed at 43 production files / 12,008 LOC with `+69/-17/net +52`; #622 completed at 43 production files / 12,147 LOC with `+164/-25/net +139`; and #625 completed at 43 production files / 12,454 LOC with `+1,409/-1,102/net +307` against its protected base. Beta.4 is immutable published history at exact protected-`next` commit `9043320cfa08370e5cdd3911bfb9283005aa9912`. Capability Validation issues #610, #612, #614, #615, and #616 are closed not planned: no campaign ran, provider requests remain zero, and paid spend remains USD 0. The new work is dependency ordered: #632 active, then #630 pending, then #631 pending.

### Directed multigraph phase evidence (passed)

Expand Down Expand Up @@ -187,12 +190,27 @@ The following contract facts are historical. Issues #610 and #612, together with
- Local focused retrieval tests pass 107/107, the exact five-file candidate gate passes 128/128, and the complete V8 coverage suite passes 76 files / 684 tests with 83.74% statement, 75.41% branch, 91.00% function, and 87.56% line coverage.
- Final reviewed head `3d194b62aba3324e93bcf01c77cf508edea70a6f` and tree `15565d356d947b2b195e7e0ec4871094b60b8493` passed all six [exact-head CI jobs](https://github.com/mohanagy/madar/actions/runs/30533140531), [independent review](https://github.com/mohanagy/madar/pull/626#pullrequestreview-4817647772), CodeRabbit, and zero unresolved threads. Protected squash merge `b6562b715133304bd46e537b6f39008bc1e02095` preserved that exact reviewed tree. [Issue completion](https://github.com/mohanagy/madar/issues/625#issuecomment-5129571164) and [PR completion](https://github.com/mohanagy/madar/pull/626#issuecomment-5129571401) receipts close the phase.

### Beta.4 release (ready)
### Beta.4 release (published)

- Release preparation starts from exact protected `next` commit `b6562b715133304bd46e537b6f39008bc1e02095` and tree `15565d356d947b2b195e7e0ec4871094b60b8493`.
- Scope is release-only: governance completion, version/package metadata, changelog and release documentation, SBOM/Registry manifest alignment, release-workflow pins, and matching tests. No production source, dependency, graph/index schema, CLI/MCP surface, or retrieval budget changes.
- The exact npm 12.0.1 candidate is 102 files / 159,937 packed / 639,875 unpacked bytes with shasum `c5250a0d308b3d6df374851154ddb393a678a992`, integrity `sha512-772P+n4Cx55nqC+CAx8A1aTJ2rY4yk1hUH45lAlxNMMw4YRj8hhswgDiCwczS5hx1S3a+Z+KUv2jma/zWjQZ6w==`, and tarball SHA-256 `8bd8d501b8cd3546e16a5a1ddac1f7649434e685517e1171fbd5897515e76e6b`.
- The release PR targets protected `next`. Merge requires the exact head to pass all six CI jobs, independent no-blocker review, honest CodeRabbit disposition, and zero unresolved threads. Only the exact merged `next` tip may be tagged `v0.40.0-beta.4` and published as npm `next` plus a matching GitHub prerelease. npm `latest`, stable release, MCP Registry publication, comparative claims, and `main` remain out of scope.
- `@lubab/madar@0.40.0-beta.4` is published under npm `next` from exact protected-`next` commit `9043320cfa08370e5cdd3911bfb9283005aa9912` and tree `f51d6e75e3b806dec6caf9ff0be43fc2ab5713fc`; tag `v0.40.0-beta.4` and the matching [GitHub prerelease](https://github.com/mohanagy/madar/releases/tag/v0.40.0-beta.4) target that commit.
- The published npm 12.0.1 artifact is 102 files / 159,937 packed / 639,875 unpacked bytes with shasum `c5250a0d308b3d6df374851154ddb393a678a992`, integrity `sha512-772P+n4Cx55nqC+CAx8A1aTJ2rY4yk1hUH45lAlxNMMw4YRj8hhswgDiCwczS5hx1S3a+Z+KUv2jma/zWjQZ6w==`, and tarball SHA-256 `8bd8d501b8cd3546e16a5a1ddac1f7649434e685517e1171fbd5897515e76e6b`.
- npm `latest` remains `0.32.0`. Another beta, stable release, MCP Registry publication, new comparative claims, and `main` remain out of scope without separate authority.

### Semantic execution index #632 (in progress)

- Protected base and target are exact `next` commit `9043320cfa08370e5cdd3911bfb9283005aa9912`, tree `f51d6e75e3b806dec6caf9ff0be43fc2ab5713fc`, and protected branch `next`; the issue is [#632](https://github.com/mohanagy/madar/issues/632).
- The exact allowed production paths are `src/adapters/filesystem/graph-artifact.ts`, `src/adapters/mcp/server.ts`, `src/adapters/typescript/execution.ts`, `src/adapters/typescript/index.ts`, `src/application/retrieve-context.ts`, `src/domain/index/build-state.ts`, `src/domain/index/model.ts`, `src/domain/query/index-status.ts`, and `src/domain/query/rank.ts`.
- Delivery is blocked above four new production files, 3,500 net new production lines, 1.5x the beta.4 GoValidate graph size, 1.25x the beta.4 same-machine indexing median, or warm retrieval p95 greater than or equal to 500 ms. Package ceilings remain 102 files / 165,000 packed / 640,000 unpacked bytes.
- The package whitelist may remove only `examples/why-madar.md` and `CHANGELOG.md`; the repository files remain present, and version, scripts, dependencies, package lock, publication and public surface cannot change.
- #632 owns authenticated ordered body facts, exact queue/job/event channels, bounded two-hop wrapper substitution, concurrency groups, and receiver/type-proven persistence. Retrieval-result v2, obligation planning, response dossier generation, comparator claims, provider activity, npm publication, GitHub Release, Registry metadata, tags, and `main` are outside this phase.
- First PR head `9fe3c2448958c6b8cead2452758077fef093cf4e` passed all six hosted jobs but was independently blocked on twelve semantic-proof classes; corrective heads `c977de03ecba7958d03966df728abed9f1b36ff7` and `f4ae64402d89ccf639bf698687b3767678ab708c` were also stopped. None was merged. The new local correction retains their fixes and closes the nine f4ae false-proof classes plus computed-key alias confidentiality and dense persistence-ordinal integrity with dedicated regressions. It measures 44 production files / 15,934 LOC at `+3,667/-187/net +3,480`; 102 package files / 145,254 packed / 638,736 unpacked bytes; and a 60,267,088-byte real GoValidate graph, ratio `1.2291718874663748`, containing 12,313 nodes / 32,717 edges / six exact queue channels / 42 typed channel edges. The 51-to-42 change removes only nine duplicate outer-callsite projections through `dispatchWave` and `checkAndDispatchNext`; every unique producer, channel, consumer, and call link remains. Five indexing trials have 13.17-second median, ratio `0.5943140794223827`; 100 warm retrieval samples have 156.7398119999998 ms median / 177.5851354499996 ms p95 / 183.07708300000013 ms maximum. Repeated graph SHA-256 is `77270a6f0330a3ce85fbc42b90e7a3e99f8bf37776f6e65f5da8aad1bad3caaf`; beta.4 v1 retrieval remains byte-identical at 15,294 bytes and SHA-256 `87b4ef75473834708b20f1d2580b31470a710d797d7bdf55eee1d0876827a173`.
- These are local corrective-candidate measurements, not a final receipt. Corrected-head commit/tree, all-six CI, independent no-blocker review, CodeRabbit completion, zero unresolved threads, merge commit, and publication remain open until those exact gates pass.

### Successors #630 and #631 (pending)

- [#630](https://github.com/mohanagy/madar/issues/630) is blocked on #632 and owns explicit obligations, bounded recovery, strict answerability and the `madar.retrieve` v2 dossier.
- [#631](https://github.com/mohanagy/madar/issues/631) is blocked on #632 and #630 and owns installed-package parity plus the no-fallback comparison against `0.32.0`, `0.40.0-beta.4`, one pinned Graphify commit and a no-tool control.
- Neither pending issue authorizes provider traffic or spend, npm publication, GitHub Release, Registry metadata, tags, stable/`latest`, or `main`; any real campaign or beta publication requires separate owner authorization.

## Graph gates

Expand Down
Loading
Loading