David/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PROPOSAL] PENDING-121 — the jurist-gated half of REVIEWED-101

Browse Source 
Filed so the item is visible as awaiting a ruling: condition 1 lives inside
PENDING-117, which is closed, and closed items do not surface at wake.

Carries the three census findings that changed the proposal from the one
REVIEWED-101 anticipated — the five-not-four enumeration, 0 fingerprints
across 327 regions, and the live 53-day false attestation on Mauss.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A35wiD55yRHj5U1ECZAX4t
This commit is contained in:
David F Glidden
2026-08-08 17:20:59 +02:00
co-authored by Claude Opus 5
parent 02c6875def
commit e31ad027b3
1 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PENDING.md
+27
View File
@@ -1734,3 +1734,30 @@ This is harmless today only because voice ⟺ source: measured, **max distinct v
**Awaiting:** Steward authorization.
---
## PENDING-121 — `engine_source_binding`: prose → declared surfaces, and the fingerprint that is specified but never recorded (REVIEWED-101 condition 1)
**Date:** 2026-08-08
**Tag:** [PROPOSAL] — **jurist design-gate**, ratified convention-data lane
**Related:** REVIEWED-101 condition 1 (mandates this) · PENDING-117 §A/§C · hash-locality principle (RATIFIED 2026-07-10, PENDING-47) · studium-engine R0 contract §3/§5.
**Package:** `~/_Dev/chamber-library/docs/engine-source-binding-surfaces-JURIST-PACKAGE-2026-08-08.md` — self-contained; the jurist needs no repository access.
**Summary.** `graduation-spec.yaml` carries `engine_source_binding` as a **prose string**. A checker cannot consume it, so it must either hardcode the surfaces — the second home the hash-locality principle forbids — or the spec gains a structured `surfaces:` list. Condition 1 of REVIEWED-101 requires the latter before (a) may be built.
**What the grounding pass changed, and it is the substance.** Three findings, all censused 2026-08-08:
1. **The "fourth surface" framing in REVIEWED-101 §C is not quite right, and the truth is worse.** The runbook's `reanchor:` block **already** enumerates the reading index chamber-side, bound outward by `source_sha256`. So the index is not unhashed. The gap is one level in: **every** hash on this path is whole-file (manifest · sidecar · ledger · index→text), and **not one attests that a division's line range still holds the content it was anchored to.** An index can declare the correct `source_sha256` while any number of its anchors point at wrong lines. The honest enumeration is **five**, splitting the index's *outward whole-file* binding from its *per-region* one — they fail differently, and collapsing them lets the populated one launder the empty one.
2. **The mechanism already exists and is specified.** R0 §3 defines `binding.content_sha256` per region with three states, and says in terms that *"every index that exists today is `unverified` … because none records a fingerprint."* Measured today: **0 fingerprints across 327 regions** (271 verified, all by name-landing; 56 unverified; 0 stale).
3. **⚠ A live false attestation in the governed record.** `mauss-essai-sur-le-don`'s index declares `ecac11b9…`; the manifest declares `2889709555f2…` and states `reading_index_status: VERIFIED-BOUND`. **Stale since 2026-06-16 — 53 days.** The anchors themselves are fine (hand-checked, per R0 §3) — which is what makes it the *useful* case: three signals disagree, and the only true one was produced by a human and is recorded nowhere a checker can reach. **Consumer census: `engine_source_binding` has 0 code consumers; `reading_index_status` has 0.**
**The design question the package puts to the jurist.** R0's `emit` promotes a baseline computed from *today's* anchors into a dated `content_sha256`. Emit Alexander now and its five known-stale `front_matter` anchors — which R0 §3.1 names stale and §5 declines to correct — acquire a fingerprint of the **wrong content**, and every future check passes. **The staleness would be ratified by the very instrument built to detect it.** So the proposal carries a promotion rule: a fingerprint may be recorded only against a positive, attributed re-verification; emission alone yields a *baseline*, never a *binding*.
**Gate questions (full text + leans in the package):** Q1 may a zero-evidence surface be enumerated, and under what marking (lean: yes, `unverified-by-construction`, and it may never contribute to a green — adding it otherwise makes the aggregate *more* reassuring and no better informed) · Q2 does `reading_index_status` survive (lean: demote to non-authoritative, do not retire while population is 0; ⚠ it is an *engine* field and the engine is D-1, so a chamber spec ruling its fate may exceed standing) · Q3 spec vs runbook authority for one enumeration (lean: spec enumerates, runbook cites) · Q4 refinement of the principle's third instance or a fourth (lean: refinement — same referent, same home, finer granularity; if the jurist reads it as a fourth, the ratified *"THREE instances"* sentence needs amending in the same pass).
**⚠ What this does not establish.** The amendment makes the gap **nameable**, not closed: population stays 0 until a re-verification pass runs, and this package neither performs nor schedules one. It does not re-anchor Mauss or Alexander. It does not touch the interpretive layer (2026-06-29 ruling). And it decides nothing about where any checker lives — that is PENDING-119, steward-lane.
**Files affected:** `_curation/graduation-spec.yaml` (`engine_source_binding` → `why:` + `surfaces:`); the constitution for the one normative requirement (MINOR, supersession + bounded-diff); `_curation/conversion-runbook.yaml` re-pointed, not rewritten, if Q3 lands as leaned.
**Awaiting:** Jurist design-gate, then steward authorization.
---