From e31ad027b3b97fd9dfb4cf248a9427ecaa264b54 Mon Sep 17 00:00:00 2001 From: David F Glidden Date: Sat, 8 Aug 2026 17:20:59 +0200 Subject: [PATCH] =?UTF-8?q?[PROPOSAL]=20PENDING-121=20=E2=80=94=20the=20ju?= =?UTF-8?q?rist-gated=20half=20of=20REVIEWED-101?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Filed so the item is visible as awaiting a ruling: condition 1 lives inside PENDING-117, which is closed, and closed items do not surface at wake. Carries the three census findings that changed the proposal from the one REVIEWED-101 anticipated — the five-not-four enumeration, 0 fingerprints across 327 regions, and the live 53-day false attestation on Mauss. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01A35wiD55yRHj5U1ECZAX4t --- PENDING.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/PENDING.md b/PENDING.md index 3a6ed03..7ab319e 100644 --- a/PENDING.md +++ b/PENDING.md @@ -1734,3 +1734,30 @@ This is harmless today only because voice ⟺ source: measured, **max distinct v **Awaiting:** Steward authorization. --- + +## PENDING-121 — `engine_source_binding`: prose → declared surfaces, and the fingerprint that is specified but never recorded (REVIEWED-101 condition 1) + +**Date:** 2026-08-08 +**Tag:** [PROPOSAL] — **jurist design-gate**, ratified convention-data lane +**Related:** REVIEWED-101 condition 1 (mandates this) · PENDING-117 §A/§C · hash-locality principle (RATIFIED 2026-07-10, PENDING-47) · studium-engine R0 contract §3/§5. +**Package:** `~/_Dev/chamber-library/docs/engine-source-binding-surfaces-JURIST-PACKAGE-2026-08-08.md` — self-contained; the jurist needs no repository access. + +**Summary.** `graduation-spec.yaml` carries `engine_source_binding` as a **prose string**. A checker cannot consume it, so it must either hardcode the surfaces — the second home the hash-locality principle forbids — or the spec gains a structured `surfaces:` list. Condition 1 of REVIEWED-101 requires the latter before (a) may be built. + +**What the grounding pass changed, and it is the substance.** Three findings, all censused 2026-08-08: + +1. **The "fourth surface" framing in REVIEWED-101 §C is not quite right, and the truth is worse.** The runbook's `reanchor:` block **already** enumerates the reading index chamber-side, bound outward by `source_sha256`. So the index is not unhashed. The gap is one level in: **every** hash on this path is whole-file (manifest · sidecar · ledger · index→text), and **not one attests that a division's line range still holds the content it was anchored to.** An index can declare the correct `source_sha256` while any number of its anchors point at wrong lines. The honest enumeration is **five**, splitting the index's *outward whole-file* binding from its *per-region* one — they fail differently, and collapsing them lets the populated one launder the empty one. +2. **The mechanism already exists and is specified.** R0 §3 defines `binding.content_sha256` per region with three states, and says in terms that *"every index that exists today is `unverified` … because none records a fingerprint."* Measured today: **0 fingerprints across 327 regions** (271 verified, all by name-landing; 56 unverified; 0 stale). +3. **⚠ A live false attestation in the governed record.** `mauss-essai-sur-le-don`'s index declares `ecac11b9…`; the manifest declares `2889709555f2…` and states `reading_index_status: VERIFIED-BOUND`. **Stale since 2026-06-16 — 53 days.** The anchors themselves are fine (hand-checked, per R0 §3) — which is what makes it the *useful* case: three signals disagree, and the only true one was produced by a human and is recorded nowhere a checker can reach. **Consumer census: `engine_source_binding` has 0 code consumers; `reading_index_status` has 0.** + +**The design question the package puts to the jurist.** R0's `emit` promotes a baseline computed from *today's* anchors into a dated `content_sha256`. Emit Alexander now and its five known-stale `front_matter` anchors — which R0 §3.1 names stale and §5 declines to correct — acquire a fingerprint of the **wrong content**, and every future check passes. **The staleness would be ratified by the very instrument built to detect it.** So the proposal carries a promotion rule: a fingerprint may be recorded only against a positive, attributed re-verification; emission alone yields a *baseline*, never a *binding*. + +**Gate questions (full text + leans in the package):** Q1 may a zero-evidence surface be enumerated, and under what marking (lean: yes, `unverified-by-construction`, and it may never contribute to a green — adding it otherwise makes the aggregate *more* reassuring and no better informed) · Q2 does `reading_index_status` survive (lean: demote to non-authoritative, do not retire while population is 0; ⚠ it is an *engine* field and the engine is D-1, so a chamber spec ruling its fate may exceed standing) · Q3 spec vs runbook authority for one enumeration (lean: spec enumerates, runbook cites) · Q4 refinement of the principle's third instance or a fourth (lean: refinement — same referent, same home, finer granularity; if the jurist reads it as a fourth, the ratified *"THREE instances"* sentence needs amending in the same pass). + +**⚠ What this does not establish.** The amendment makes the gap **nameable**, not closed: population stays 0 until a re-verification pass runs, and this package neither performs nor schedules one. It does not re-anchor Mauss or Alexander. It does not touch the interpretive layer (2026-06-29 ruling). And it decides nothing about where any checker lives — that is PENDING-119, steward-lane. + +**Files affected:** `_curation/graduation-spec.yaml` (`engine_source_binding` → `why:` + `surfaces:`); the constitution for the one normative requirement (MINOR, supersession + bounded-diff); `_curation/conversion-runbook.yaml` re-pointed, not rewritten, if Q3 lands as leaned. + +**Awaiting:** Jurist design-gate, then steward authorization. + +---