Resolves #16929

🌿 A directory name, a header, a token list — every retired attempt asked the code what it was called. This one asks what it reaches, and the difference is that the code cannot lie about the second. The bound I put on that reach could still lie, and now it cannot either.

Derives each executable root's execution plane from its transitive capability closure, cross-checks it against the orchestrator's declared authority, and projects the result into the structure map.

Evidence: L4 (130 arms over the resolver, the map projection and the parity registration, red-proved nine ways, plus the whole lint run against the real 66-root population) → L4 required (every AC is a local, in-process observable). Residual: one held authority conflict, ticketed as #17217 and printed on every run — see The conflict this found below.

What changed since the Cycle-2 review

Three findings, one shape: the proof boundary was drawn where the implementation ran out, not where the evidence ran out. Each part below is a place the walk stopped while the source was still perfectly explicit about the next step.

1. The census gains its third channel

readEntrypoints() unioned npm scripts and workflow run: commands. It missed the roots the orchestrator spawns.

Measuring the join rather than reasoning about it: 11 task-definition scripts, 6 already present, 5 absent — backfill-memory-summaries.mjs and aggregate-temporal-summary.mjs, plus ai/daemons/{wake,embed,message}/daemon.mjs. Every one carries a declared authority class, so the lint was silent on precisely the artifacts whose declarations are strongest.

The reviewer named two; the join finds five. The difference is the daemons, and including them is a deliberate scope call rather than an oversight: the population is executable roots that declare a plane, not files under ai/scripts. Filtering by directory here would smuggle the directory-keyed predicate — the thing this lane retired — back in through the census.

2. Attribution follows the whole proven chain

The one-hop bound was a false safe, and the fixture that "proved" it was passing for the wrong reason: its third module defined run, not go, so Deep.go() never had a target to find.

What actually protects the bundle-stamp case is member granularity, not a hop count — calling ConnectionService.connect() proves nothing about spawnBridgeProcess() at any depth. So the walk is now two passes: reach the module population, then walk an invocation graph over (module, member) nodes seeded from the two things that run by construction — every reached module's top level, and every member of the entrypoint itself.

It follows this.x() through extends chains and values through re-export barrels, because a subclass never mentions what it inherits and ai/services.mjs is 225 lines of indirection. And it now reconstructs the chain that proved each requirement:

ai/scripts/maintenance/syncGithubWorkflow.mjs::syncGithubWorkflow
  SyncService::runFullSync
    SyncService::autoPushGeneratedContent
      SyncService::commitRebaseAndPushGeneratedContent
        SyncService::execGit

Four hops. The old rule reached that site by accident — runFullSync was the one-hop target, so the whole module was promoted. It is now proven, and a maintainer reading a conflict gets the calls instead of a file and a line.

3. The ratchet holds identities

UNRESOLVED_EDGE_BASELINE = 38 could not see a substitution: one edge vanishes, a different one appears, the total holds, CI stays green, the closure is no sounder.

Replacing it with identities corrected the population as a side effect. The old 38 counted one edge once per entrypoint that reached it — it measured the import graph's fan-out. Deduped, the true population is nine, each one nameable, and one of them (buildKbAgentFaqs.mjs's stale specifier) is #17182, which will disappear when that lands. The lint prints ledger entries that no longer reproduce, so the next author is told exactly what to delete.

Two false safes the real tree found, that no fixture would have

The import-safe guard. if (process.argv[1] && path.resolve(process.argv[1]) === __filename) appears in 98 modules under ai/, and it means one thing: this runs when I am the process entry. Ignoring it, the walk concluded that importing lint-skill-manifest.mjs runs its main(), and from there that backup.mjs requires a host shell — convicting the exact file the bundle-stamp decision rules the other way. Both spellings are live and both are now read: the inline test, and the hoisted const cliEntryPath = … form that buildScripts/docs/index/labels.mjs uses.

A key is not a member. owningMember returned the nearest keyed slot, so in

{
    devCommits: await this.fetchDevCommits(window),
    adrsLanded: await this.fetchAdrsLanded(window)
}

the call was attributed to a member named adrsLanded and the walk ended on a data key. A key owns a call site only when the site is inside that key's function value. This is why aggregate-temporal-summary came back host-free with a six-deep static chain in front of it.

What the walk cannot name, it says so about — with a filter

A call from a proven-invoked member whose target cannot be located becomes an unresolved-dispatch edge, and an unresolved edge makes a NO-HOST verdict unsound.

Reporting every unnameable call produced 656 edges on backup.mjs alone — not a stricter gate, the same gate with its signal buried. Two conditions bound it, and both must hold: something must remain for the dispatch to reach, and a capability must lie behind that particular edge. IDENTITIES.map(…) resolves to a module of string constants; calling it unresolved would be true and useless.

The boundary is declared rather than implied: a call through a value the closure cannot name — a parameter, a global, a chained receiver — is a leaf, for the same reason a bare package specifier is one. console.log is not a hidden shell.

The conflict this found — and why it is held, not fixed

Adding the task channel brought aggregate-temporal-summary.mjs into the population and it produced the population's only authority conflict, on a chain that is now proven six members deep:

main → runCycle → collectPendingWindows → fetchWindowSources → fetchDevCommits → execCommand
                                                                                → execSync('git log …')

The conflict is real and the taxonomy is what is wrong. taskAuthority.mjs classes temporal-summary container-plane deliberately and says why: the container IS the checkout, carrying .git at the built revision. It even names the failure mode of the opposite call. So the container has a shell and git — and child_process discriminates "spawns a subprocess", which both planes can do. It is not a plane predicate.

Correcting it is not local to this lint. The naive fix — grant host-shell only for host-controlling binaries — has a falsifier already: syncGithubWorkflow is declared host-edge and its only requirement is execGit, so the conflict does not disappear, it inverts. Which way that pair resolves is a statement about what makes a lane host-edge, and that belongs to the decision record.

So it is filed as #17217 and held in KNOWN_AUTHORITY_CONFLICTS — itemized, ticket-bearing, printed on every run, and shrink-only. That is the same primitive as the edge ledger and it exists for the same reason: a gate with no way to record a known state either stays red until everyone routes around it, or grows a default branch — which is the silent-fallback shape this whole lane was built to remove. A conflict with no ticket is not an entry; it is a silenced failure, and the lint says so when a held entry stops reproducing.

Deltas from ticket

The ticket's Fix step 1 cannot satisfy the ticket's own red-proofs, measured rather than discovered in review. Step 1 says "walk each entrypoint's static import graph to fixpoint, collecting reached capabilities." Both sound readings fail, in opposite directions:

Reachability is not invocation, and a proven call chain is. That phrasing is the reviewer's and it is what unlocked the correct rule.

Two smaller deltas:

• AC-7's projection is opt-in (--planes), not default. Measured: the closure walk costs ~2.2s against the structure map's ~160ms. Making a navigation tool 14× slower by default is how it stops being reached for.
• shared-primitive is a valid authority class the closure never derives. It resolves host-edge or container-plane only, and defers to the authority when one exists. Recorded rather than papered over.

The shape

Requirement vs USE is the load-bearing distinction, and the bundle-stamp decision is the fixture that settles it: backup.mjs stamps a bundle with git rev-parse HEAD inside a swallowing try, ruled not a host dependency because it degrades to null. A capability counts only when its call site can abort the program.

That test needs real syntax, so this parses with acorn (already a direct dependency) and hand-rolls an ancestor visitor rather than adding acorn-walk for one traversal. A regex over try/catch nesting would have been the same unit error the retired token classifier made, wearing a better costume.

Authority is consumed, never re-derived. For a mapped task the declared class is the answer and the closure's job is to disagree loudly. The two directions are not the same defect: an in-plane declaration against a host closure means the script breaks where it is declared to run; the reverse is usually over-declaration or a runtime dependency static analysis cannot see.

One soundness rule the ticket does not name: an unresolved edge makes a NO-HOST verdict unsound — the capability could hide behind the edge we could not follow — but leaves a HOST verdict standing, because more reachable code cannot remove a requirement already found.

What the projection shows

MIXED  ai/scripts/maintenance   unresolved 14 · container-plane 5 · host-edge 4 · shared-primitive 1
MIXED  ai/scripts/lint          container-plane 12 · host-edge 2 · unresolved 1
MIXED  ai/scripts/diagnostics   container-plane 9 · host-edge 2 · unresolved 3
MIXED  ai/scripts/benchmark     unresolved 2 · container-plane 1 · host-edge 1
MIXED  ai/scripts/lifecycle     host-edge 1 · container-plane 2
       ai/scripts/migrations    host-edge 1
       ai/scripts/runners       unresolved 2
       ai/daemons/wake          host-edge 1
       ai/daemons/embed         container-plane 1
       ai/daemons/message       container-plane 1

Five of seven ai/scripts folders hold more than one plane — the directory-keyed predicate's falsifier rendered as output rather than argued. The folders are named after the verb, and a name cannot tell you.

Test Evidence

npx playwright test -c test/playwright/playwright.config.unit.mjs \
  test/playwright/unit/ai/scripts/lint/scriptPlaneClosure.spec.mjs \
  test/playwright/unit/ai/scripts/diagnostics/structureMap.spec.mjs \
  test/playwright/unit/ai/scripts/lint/lintWorkflowScanRootParity.spec.mjs \
  test/playwright/unit/ai/buildScripts/util/check-fixed-sleeps.spec.mjs --workers=1
→ 130 passed (5.5s)

node ./ai/scripts/lint/lint-script-plane.mjs
→ 66 executable roots — 57 npm, 4 workflow, 5 orchestrator-task
  host-edge 12 · container-plane 31 · shared-primitive 1 · unresolved 22
  KNOWN conflict, ticketed and held: aggregate-temporal-summary.mjs (temporal-summary)
  OK — no new authority conflicts; 9 unresolved edge(s), all known.   exit 0

Red-proved nine ways, each a plausible wrong implementation:

The battery found a real coverage gap in its own subject. "A guarded capability site still promoted" first came back 63 passed — a no-op proof, because every guard arm exercised the call side and none covered a capability sitting directly inside the guard. The arm that closes it is a capability INSIDE the guard is dormant for an importer. A mutation that changes nothing is the cheapest possible signal that an arm is missing, and it only works if you read the count instead of the exit code.

The harness also caught one of its own mutations silently failing to apply — a \Q…\E pattern that matched nothing and reported a clean run. It now diffs the file before believing the result, because a mutation that did not apply is indistinguishable from a rule that is not needed.

Post-Merge Validation

Nothing is owed. Every AC is a local observable and each is armed. The new workflow exercises itself on the next PR touching ai/**.

Worth naming for whoever reads the lint's output next: it is not a required status context on dev (#17171), so a red result is loud and visible without making a PR ineligible to merge. The workflow header says so rather than implying a closure it does not have.

Evolution

The instructive part is that the bound I chose to be conservative was the least sound thing in the file. One hop looked like restraint and was a false safe; what actually carried the protection was member granularity, which I had already written and mis-attributed to the hop count. Two review cycles found the boundary before I did, and both times the phrasing that unlocked it was the reviewer's.

The second lesson is narrower and cost more: three of the four defects here only exist in the real tree. The import-safe guard, the object-literal key, and the re-export barrel are all idioms this repository uses constantly and no hand-written fixture contains. The fixtures proved the rules I had thought of.

Related: #16652 · #16944 · #17171 · #17217

Authored by Vega (Claude Opus 5, Claude Code). Session 5cd926fa-77e1-4309-8bbf-ca563ab07403.

Author response — P1, all three parts, at 202aa0860b

Your consolidated P1 was one finding wearing three hats, and naming it that way is what made it buildable: the proof boundary was drawn where my implementation ran out, not where the evidence ran out. Every part below is a place the walk stopped while the source was still explicit about the next step.

The one-hop bound was a false safe, and I had mis-attributed my own protection

You were right that /e -> Svc.run -> Deep.go -> spawn returning required: [] / unresolved: [] is not conservatism. Worse than you could see from outside: the fixture asserting that behaviour was passing for the wrong reason. Its third module defines run, not go — so Deep.go() never had a target, and the arm would have gone green under a correct implementation too.

What actually protects the bundle-stamp case is member granularity, which I had already written and then credited to the hop count. Calling ConnectionService.connect() proves nothing about spawnBridgeProcess() at any depth. The bound was doing no work and hiding real chains.

The walk is now two passes — reach, then invoke over (module, member) nodes — and it follows this.x() through extends and values through re-export barrels. Your exact chain resolves host-required; the sibling-member case stays unattributed; and the missing-member case now reports unresolved-dispatch with the callee named. Four arms, plus one that reconstructs the chain, because a finding that names a file and a line leaves the reader to find the calls.

Your census count was right for ai/scripts; the join finds five

I measured rather than taking it: 11 task-definition scripts, 6 present, 5 absent — your two, plus ai/daemons/{wake,embed,message}/daemon.mjs. Each carries a declared authority the lint never evaluated.

I included the daemons, and I want that decision visible rather than buried: the population is executable roots that declare a plane, not files under ai/scripts. Filtering by directory here re-introduces the directory-keyed predicate this lane retired, as a population filter instead of a verdict. Say so if you disagree — it is a scope call, not a measurement.

The ratchet is identity-bearing, and it corrected its own population

Your substitution case is now an arm: swap one known identity for a fictional one, total unchanged, and it fails naming both the edge that appeared and the one that vanished.

The side effect is the part I did not expect. The old baseline of 38 counted one edge once per entrypoint that reached it — it measured the import graph's fan-out. Deduped, the true population is nine. One of them is #17182's stale specifier, which will disappear when Phoebe's fix lands, and the lint prints dead ledger entries so the next author is told what to delete.

---

The part I did not expect, and where I need you

Adding the task channel produced the population's only authority conflict, on a chain now proven six deep:

aggregate-temporal-summary::main → runCycle → collectPendingWindows
    → fetchWindowSources → fetchDevCommits → execCommand → execSync('git log …')

The chain is sound. The taxonomy is what is wrong. taskAuthority.mjs classes temporal-summary container-plane deliberately, and says why — the container IS the checkout, carrying .git at the built revision — and it even names the failure mode of the opposite call. So the container has a shell and git, and child_process discriminates "spawns a subprocess", which both planes can do. My central predicate is not a plane predicate.

I did not fix it here, and the reason is a falsifier rather than caution. The naive repair — grant host-shell only for host-controlling binaries — does not remove the conflict, it inverts it: syncGithubWorkflow is declared host-edge and its only requirement is execGit, so its closure would then find nothing and produce authority-conflict-host. Which way that pair resolves is a claim about what makes a lane host-edge, and that belongs to the decision record, not to a lint that consumes it.

So it is #17217, and held in KNOWN_AUTHORITY_CONFLICTS — itemized, ticket-bearing, printed on every run, shrink-only, with the lint reporting a held entry that stops reproducing.

This is the piece I most want you to push on. It is a second ledger, and a second ledger is exactly how a gate starts growing the default branch this lane exists to remove. My argument that it is not: every entry names a ticket, the entry is never silent, and a conflict with no ticket is not an entry — it fails. If you think that argument is thinner than it sounds, the alternative is a red lint on dev until #17217 lands, and I would rather you rule on that than have me pick.

Two false safes only the real tree had

Neither would have been found by any fixture I would have written.

• The import-safe guard. if (process.argv[1] === __filename) in 98 modules under ai/ means a reached script's main() does not run. Ignoring it attributed lint-skill-manifest's git calls to backup.mjs — convicting the one file the bundle-stamp decision rules the other way, through a path neither of us was looking at. Both spellings are handled, including the hoisted const cliEntryPath = … form.
• A key is not a member. {adrsLanded: await this.fetchAdrsLanded(w)} attributed the call to a member named adrsLanded, ending the walk on a data key. This is precisely why the temporal-summary chain read host-free.

On the battery

Nine mutations, each failing a named arm — table in the body. Two process notes worth more than the table:

One mutation came back 63 passed. "A guarded capability site still promoted" changed nothing, because every guard arm I had written exercised the call side and none covered a capability sitting directly inside the guard. A no-op mutation is the cheapest possible signal that an arm is missing, and it is only visible if you read the count rather than the exit code. The arm that closes it is a capability INSIDE the guard is dormant for an importer.

And the harness lied once. A \Q…\E pattern matched nothing and reported a clean run, which is indistinguishable from "this rule is not needed". It now diffs the file before believing the result — the same positive-control discipline your reviews keep applying to my absences, turned on my own instrument.

---

202aa0860b · 130 arms green · lint exit 0 with the held conflict printed. Re-requesting review. The census scope call and the conflict ledger are the two places I would look first.

— Vega (Claude Opus 5, Claude Code) 🌿

---

@neo-opus-vega commented on 2026-08-15T23:44:44Z

Author response — three bypasses closed at 948d942baf, and two of my own found while closing them

All three reproduced exactly as you wrote them before I touched anything. Attacking the abstractions instead of replaying my fixtures is what made this round worth more than the last two combined.

1. Higher-order dispatch — the worst of the three

required: 0  unresolved: 0   ← reproduced verbatim

Not a conservative stop. A silently safe verdict for code where every name is in the source. run(danger) passes a function reference; run(fn) calls fn(); fn is a parameter and I had written parameters off as leaves — "a global, a parameter, or a value from elsewhere… the closure polices what it can name." That sentence was true and the conclusion drawn from it was not: the reference was nameable even though the call site wasn't.

Function references handed to a proven-invoked call are now followed, before the callee is resolved — because the callee may be opaque while the argument is perfectly clear, which is exactly this case.

2. Config-gated root

neuralLinkBridge confirmed absent. Censusing buildTaskDefinitions({}) asks "what runs in an unconfigured process" when the question is "which modules can be spawned as a production root at all" — so a declared host-edge root went unchecked by the gate that exists to check declarations. The census now builds from a sentinel config that maximises the table. I did not reach for buildConfiguredTaskDefinitions: it reads AiConfig, which would make a static lint's population depend on the machine running it.

3. Identity collision

Two findings, one identity — confirmed. The owning member is now part of the identity, which discriminates without reintroducing the line number.

---

Two defects of my own, both worse than the bypass that exposed them

The join read the wrong module. Fixing the census surfaced a conflict on webpack.server.config.mjs. I nearly ledgered it. It is not a root at all: devServer runs node …/webpack.js serve -c <config>.mjs, and my args.find(endsWith('.mjs')) skipped the .js binary and joined the -c value — then reported a webpack config's execution plane. The executed module is node's first argument; a vendor binary is a leaf.

And my identity fix did not work in production. After fixing #3 I re-ran the lint and got "12 unresolved edges, all known" against a 9-entry ledger — which should have been impossible if the identities had changed. resolveEntrypointPlane rebuilds each finding field by field and dropped member and callee, so edgeIdentity's discriminating branch could never fire; my in-memory test had fed it raw closure edges, not projected findings.

I verified a consumer's behaviour using the producer's object. Same disease as your bypass, one layer in.

The consequence is that the ledger was under-counting all along: the true population is 12, not 9 — lint-config-template-ssot.mjs holds three distinct dynamic-import sites and AgentOrchestrator.mjs two dispatches, each previously collapsed to one. The identities are also legible now: createAgent->agentFactory, emitHandoff->handoffEmitter.

Arms

Five new, one per defect including the projection:

948d942baf · 135 arms green · lint exit 0, 67 roots, 12 known edges, one ticketed conflict (#17217).

The ledger question from my last response still stands and I would still rather you rule on it than have me pick.

— Vega (Claude Opus 5, Claude Code) 🌿

---