Dashboard-vs-STATE CI gate + Phase B (CNO-law proptest, delete legacy tree, honest obliteration)#81
Merged
Conversation
…om STATE Structural defence against the estate's #1 recurring defect ("dashboards that lie": a human-facing status surface claiming more than the machine-readable STATE, e.g. the historical TOPOLOGY "100% Production Ready" vs STATE 60%/Grade-D). New Rust workspace crate `crates/dashboard-check` (Rust = the policy- preferred CLI language) parses `.machine_readable/6a2/STATE.a2ml` — a2ml is TOML, so it uses the `toml` crate, not a bespoke reader — extracts completion-percentage / crg-grade / last-updated (tolerating januskey's quoted "60"/"D" and other repos' bare integers), and asserts they match TOPOLOGY.md (`OVERALL: …%`, `Grade X`) and READINESS.md (`CRG Grade: X`), plus that the dashboard's `Last updated` is not older than STATE's. Exits non-zero with a precise diff on divergence. - 8 unit tests over pure extract/reconcile fns (quoted + bare parsing, each drift class, the aligned pass case, and a prose-shadowing regression where a note mentioning "OVERALL" must not shadow the real dashboard line). - Verified end-to-end: passes on this repo (reconciled); catches an injected 100%-vs-60% drift with the exact "completion mismatch" message. - Wired as `just check-dashboard` and CI workflow `Dashboard Check` (SPDX header, contents:read perms, SHA-pinned actions). - TOPOLOGY.md's "source of truth" note now records that agreement is machine-enforced. Prototyped in januskey; designed to be vendored estate-wide (every repo has the same STATE.a2ml + dashboard shape). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz
…ation Three januskey honesty/quality items. B5 — runnable reversibility evidence. Add a property test (crates/januskey-cli/tests/property_tests.rs) asserting the CNO round-trip law execute∘undo ≡ identity on the filesystem, across all supported operations (Delete/Modify/Move/Copy/Create) over random content: set up a temp working tree + content/metadata stores, snapshot it, execute then undo with a fresh executor, and assert the tree is byte-for-byte restored. This is the honest substitute for the "formal proofs pending" badge. Chown is excluded (undo unimplemented); we test the filesystem effect, not OperationType::inverse (deliberately non-involutive, Copy⁻¹=Delete). B2 — delete the legacy src/januskey/ monolith. It was a non-workspace, pre-extraction duplicate of crates/januskey-cli (ARCHITECTURE.md labelled it LEGACY). Removed it and repointed every reference (README, ARCHITECTURE, EXPLAINME, docs/wiki/*, idrisiser/*.tsig) to crates/januskey-cli; simplified the two contractile checks (Trustfile, Adjustfile) that scanned it — they already preferred crates/januskey-cli and the src/januskey branches were dead. src/abi/*.idr (the Idris ABI, outside src/januskey/) is untouched. B8 — stop overstating obliteration. The module doc-comment claimed content is "cryptographically unrecoverable"; overwrite-in-place cannot guarantee physical erasure on SSD/CoW/journaling media (the caveat already lived in .machine_readable/threat-model.a2ml). Mirror that honest wording into obliteration.rs and soften the README "data loss impossible by construction" to "resistant", with the obliteration exception called out. Verified: cargo build --workspace clean; cargo test -p januskey --lib 26 passed; property_tests 4 passed (incl. the new CNO-law case); no dangling src/januskey references remain; dashboard-check still green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz
hyperpolymath
marked this pull request as ready for review
July 17, 2026 05:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two threads of estate-honesty work in januskey. All changes build clean and are test-verified.
Thread 1 —
dashboard-check: make "dashboards that lie" a build failureNew Rust workspace crate
crates/dashboard-check(Rust = policy-preferred CLI language) that reads the machine-readable source of truth (.machine_readable/6a2/STATE.a2ml) and fails CI when a hand-maintained dashboard diverges from it — the structural fix for the estate's #1 recurring defect (the historicalTOPOLOGY.md"100% Production Ready" vsSTATE.a2ml60%/Grade-D).a2mlis TOML, so it parses with thetomlcrate (no bespoke reader). Extractscompletion-percentage/crg-grade/last-updated(tolerating januskey's quoted"60"/"D"and other repos' bare integers); asserts they matchTOPOLOGY.md(OVERALL: …%,Grade X) andREADINESS.md(CRG Grade: X), and that the dashboard isn't older than STATE.completion mismatchmessage.just check-dashboard+ CI job Dashboard Check (SPDX header,contents: read, SHA-pinned actions). Prototyped here; designed to be vendored estate-wide.Thread 3 — Phase B honesty/tests
execute∘undo ≡ identityon the filesystem, across all supported operations over random content (temp tree + stores, snapshot → execute → undo with a fresh executor → assert byte-for-byte restored). The honest substitute for the "formal proofs pending" badge. Chown excluded (undo unimplemented); tests the filesystem effect, not the deliberately non-involutiveOperationType::inverse.src/januskey/monolith (non-workspace, pre-extraction duplicate ofcrates/januskey-cli, labelled LEGACY). Every reference repointed (README, ARCHITECTURE, EXPLAINME, docs/wiki,idrisiser/*.tsig); the two contractile checks that scanned it simplified (they already preferredcrates/januskey-cli).src/abi/*.idr(Idris ABI) untouched. No dangling references remain.threat-model.a2ml). Mirrored that honest wording intoobliteration.rsand softened the README claim, with the obliteration exception called out.Verification
cargo build --workspace— clean.cargo test -p januskey --lib— 26 passed;--test property_tests— 4 passed (incl. the new CNO-law case);cargo test -p dashboard-check— 8 passed.dashboard-check --check .— green on this repo; clippy clean on the new crate.Context
Threads 1 & 3 of a three-thread follow-up (Lean mirror merged in #110; this is the januskey pair). Draft pending human review.
🤖 Generated with Claude Code
https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz
Generated by Claude Code