[K1] Domain and immutable intent

kilo commented

2026-09-22 16:49:34 +00:00

Member

Goal

Implement pure deterministic ProgramSpec, finite WorkUnit DAG, immutable Attempt inputs, legal commands, readiness, authority envelopes, budgets/policies, and spec amendments.

Why

Program truth and legal transitions must be proven without infrastructure or providers.

Scope

In scope

Typed immutable domain values; DAG/readiness validation; lifecycle commands; expected-revision checks; amendment semantics; pure tests for valid/invalid graphs, missing inputs, cycles, stale revisions, illegal transitions, authority limits, and immutable effective inputs.

Out of scope

SQLite, external operations, runtime/workspace implementations, live adapters, CLI, verification execution, workflow language, REST/MCP/A2A, and migrations.

Acceptance Criteria

A two-node dependent DAG can be constructed, activated, queried for readiness, and advanced only by legal commands.
Cycles, missing references/inputs, stale revisions, illegal transitions, and budget/authority violations produce deterministic domain errors.
Attempts have distinct immutable effective inputs; amendments create new revisions without rewriting prior decisions.
Pure tests require no filesystem, database, network, model, or adapter.
Core preserves adapters -> ports -> core and has no set_state/force_status bypass.

Constraints

Owner approval is explicit; model text, comments, issues, and worker output cannot grant authority.
Preserve vocabulary/invariants in docs/architecture/target.md, ADR 0005, and ADR 0006.

Links

Parent: issue #3 #3
Direct prerequisite: none; this is the first implementation issue.
Direct dependent: issue #5 #5
Architecture: docs/architecture/target.md, docs/adr/0005-authority-and-acceptance.md, docs/adr/0006-context-and-outcomes.md

Domain Contract

K1 is a pure present-fact domain model, not a future-path planner. A finite,
structurally valid Program may have no currently executable autonomous action.
Neither Program validity nor command admission requires hypothetical Attempts,
satisfactions, amendments or a path to a terminal state.

ProgramSpec must pin immutable objective, nonempty Program acceptance criteria,
explicit pinned policy references, WorkUnit graph, approved initial input
name/reference bindings, admission budget and delegated authority envelope.
Each WorkUnit must pin a nonblank obligation/intended outcome, acceptance
criteria and/or an explicit acceptance-policy reference, dependencies, required
logical inputs and declared outputs. Policy references contain identity,
version and digest. All owner-intent values participate in the full spec digest.

Aggregate revision, ProgramSpec revision and full historical spec digest are
distinct from semantic applicability. Define each WorkUnit intent fingerprint
from Program identity/objective/criteria/policies, the complete definitions of
that WorkUnit and its transitive predecessors, and approved initial bindings
consumed by that closure. Exclude revision/parent metadata, unrelated WorkUnits,
admission budgets and delegated authority from acceptance applicability.

Each required logical input must resolve uniquely to an approved initial
binding or a declared direct predecessor output. AttemptSpec pins the exact
resolved references and their approval provenance. Reject missing, extra,
foreign, arbitrary or non-applicable bindings. References remain opaque:
K1 does not verify their contents.

Satisfaction is an immutable trusted fact separate from Attempt lifecycle.
It records historical spec identity, WorkUnit intent fingerprint, trusted
issuer, authoritative record order, a source Attempt and declared output
bindings. The source Attempt must already be FINISHED and match the recorded
subject. Its immutable effective bindings complete the satisfaction subject.
Recording satisfaction never starts, finishes or otherwise changes an Attempt.
Finishing an Attempt does not imply satisfaction.

A historical satisfaction is currently applicable only when its intent
fingerprint matches, dependencies are currently satisfied, its effective
input source/reference values match current approved bindings, its output
bindings match current declarations, and applicable cancellation does not
prevent its use. Historical spec and Attempt IDs are never rewritten.
An older revision number alone is not grounds for rejection. Returning to an
identical acceptance subject may restore historical applicability.

Owner approval governs spec adoption, policy/budget/envelope changes and
Program/WorkUnit abandonment independently of the delegated operational
allowlist. Delegates cannot authorize their own amendment or grant expansion.
Ordinary operations remain bounded; owner identity is not an execution-budget
bypass. Trusted satisfaction admission is distinct from worker authority.
K1 consumes prevalidated actor authority and does not implement credentials.

Record explicit WorkUnit cancellations as immutable decisions scoped to their
intent fingerprints. Rebuild current projection from complete history and the
current graph in topological order: applicable direct/inherited cancellation,
otherwise applicable satisfaction, otherwise applicable live Attempt,
otherwise ready when prerequisites and approved inputs exist, otherwise pending.
Choose the latest applicable satisfaction by aggregate record order.
Do not carry applicability from the immediately preceding WorkUnit state.

A material amendment appends a new spec revision and reprojects without deleting
history. A semantic reversion is a new revision but may restore older facts.
An amendment with identical canonical semantic content is a no-op, changing
neither revisions nor Attempts, budgets or projection. Equality includes budget
and authority values but excludes revision/parent metadata.

Preserve unaffected Attempts. Do not retarget immutable Attempt inputs.
Required withdrawal/cancellation of affected Attempts is a new legal decision,
not fabricated execution completion or proof of remote termination.
Terminal Attempts never reopen. Admission history is not reset by amendment.
Pause and exhausted admission limits do not prohibit lawful terminal observations.
Completion requires applicable satisfaction of every current obligation;
cancellation does not satisfy an obligation.

Pure synthetic tests must cover these contracts, including actionless states,
approved input provenance, independent satisfaction, semantic no-ops,
v1 -> v2 -> v1 applicability, cancellation reconstruction, transitive dependency
changes, unaffected branches and owner/delegate separation.

Existing K1 infrastructure exclusions and inward dependency boundaries remain
unchanged. No persistence, verification engine, policy DSL or external execution
is introduced.

## Goal Implement pure deterministic ProgramSpec, finite WorkUnit DAG, immutable Attempt inputs, legal commands, readiness, authority envelopes, budgets/policies, and spec amendments. ## Why Program truth and legal transitions must be proven without infrastructure or providers. ## Scope ### In scope Typed immutable domain values; DAG/readiness validation; lifecycle commands; expected-revision checks; amendment semantics; pure tests for valid/invalid graphs, missing inputs, cycles, stale revisions, illegal transitions, authority limits, and immutable effective inputs. ### Out of scope SQLite, external operations, runtime/workspace implementations, live adapters, CLI, verification execution, workflow language, REST/MCP/A2A, and migrations. ## Acceptance Criteria - [ ] A two-node dependent DAG can be constructed, activated, queried for readiness, and advanced only by legal commands. - [ ] Cycles, missing references/inputs, stale revisions, illegal transitions, and budget/authority violations produce deterministic domain errors. - [ ] Attempts have distinct immutable effective inputs; amendments create new revisions without rewriting prior decisions. - [ ] Pure tests require no filesystem, database, network, model, or adapter. - [ ] Core preserves `adapters -> ports -> core` and has no `set_state`/`force_status` bypass. ## Constraints - Owner approval is explicit; model text, comments, issues, and worker output cannot grant authority. - Preserve vocabulary/invariants in `docs/architecture/target.md`, ADR 0005, and ADR 0006. ## Links - Parent: issue #3 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/3 - Direct prerequisite: none; this is the first implementation issue. - Direct dependent: issue #5 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/5 - Architecture: `docs/architecture/target.md`, `docs/adr/0005-authority-and-acceptance.md`, `docs/adr/0006-context-and-outcomes.md` ## Domain Contract K1 is a pure present-fact domain model, not a future-path planner. A finite, structurally valid Program may have no currently executable autonomous action. Neither Program validity nor command admission requires hypothetical Attempts, satisfactions, amendments or a path to a terminal state. ProgramSpec must pin immutable objective, nonempty Program acceptance criteria, explicit pinned policy references, WorkUnit graph, approved initial input name/reference bindings, admission budget and delegated authority envelope. Each WorkUnit must pin a nonblank obligation/intended outcome, acceptance criteria and/or an explicit acceptance-policy reference, dependencies, required logical inputs and declared outputs. Policy references contain identity, version and digest. All owner-intent values participate in the full spec digest. Aggregate revision, ProgramSpec revision and full historical spec digest are distinct from semantic applicability. Define each WorkUnit intent fingerprint from Program identity/objective/criteria/policies, the complete definitions of that WorkUnit and its transitive predecessors, and approved initial bindings consumed by that closure. Exclude revision/parent metadata, unrelated WorkUnits, admission budgets and delegated authority from acceptance applicability. Each required logical input must resolve uniquely to an approved initial binding or a declared direct predecessor output. AttemptSpec pins the exact resolved references and their approval provenance. Reject missing, extra, foreign, arbitrary or non-applicable bindings. References remain opaque: K1 does not verify their contents. Satisfaction is an immutable trusted fact separate from Attempt lifecycle. It records historical spec identity, WorkUnit intent fingerprint, trusted issuer, authoritative record order, a source Attempt and declared output bindings. The source Attempt must already be FINISHED and match the recorded subject. Its immutable effective bindings complete the satisfaction subject. Recording satisfaction never starts, finishes or otherwise changes an Attempt. Finishing an Attempt does not imply satisfaction. A historical satisfaction is currently applicable only when its intent fingerprint matches, dependencies are currently satisfied, its effective input source/reference values match current approved bindings, its output bindings match current declarations, and applicable cancellation does not prevent its use. Historical spec and Attempt IDs are never rewritten. An older revision number alone is not grounds for rejection. Returning to an identical acceptance subject may restore historical applicability. Owner approval governs spec adoption, policy/budget/envelope changes and Program/WorkUnit abandonment independently of the delegated operational allowlist. Delegates cannot authorize their own amendment or grant expansion. Ordinary operations remain bounded; owner identity is not an execution-budget bypass. Trusted satisfaction admission is distinct from worker authority. K1 consumes prevalidated actor authority and does not implement credentials. Record explicit WorkUnit cancellations as immutable decisions scoped to their intent fingerprints. Rebuild current projection from complete history and the current graph in topological order: applicable direct/inherited cancellation, otherwise applicable satisfaction, otherwise applicable live Attempt, otherwise ready when prerequisites and approved inputs exist, otherwise pending. Choose the latest applicable satisfaction by aggregate record order. Do not carry applicability from the immediately preceding WorkUnit state. A material amendment appends a new spec revision and reprojects without deleting history. A semantic reversion is a new revision but may restore older facts. An amendment with identical canonical semantic content is a no-op, changing neither revisions nor Attempts, budgets or projection. Equality includes budget and authority values but excludes revision/parent metadata. Preserve unaffected Attempts. Do not retarget immutable Attempt inputs. Required withdrawal/cancellation of affected Attempts is a new legal decision, not fabricated execution completion or proof of remote termination. Terminal Attempts never reopen. Admission history is not reset by amendment. Pause and exhausted admission limits do not prohibit lawful terminal observations. Completion requires applicable satisfaction of every current obligation; cancellation does not satisfy an obligation. Pure synthetic tests must cover these contracts, including actionless states, approved input provenance, independent satisfaction, semantic no-ops, v1 -> v2 -> v1 applicability, cancellation reconstruction, transitive dependency changes, unaffected branches and owner/delegate separation. Existing K1 infrastructure exclusions and inward dependency boundaries remain unchanged. No persistence, verification engine, policy DSL or external execution is introduced.

kilo referenced this issue

2026-09-22 16:52:40 +00:00

[Kernel v0] First useful vertical slice #3

kilo referenced this issue

2026-09-22 16:52:40 +00:00

[K2A] Durable SQLite history and projections #5

kilo referenced this issue

2026-09-22 19:39:27 +00:00

[K1] Add deterministic domain and immutable intent #12

kilo commented

2026-09-22 19:39:41 +00:00

Author

Member

Implemented K1 on branch issue-4-domain-immutable-intent and opened PR #12: #12

Changed files:

src/creatidy_kernel/core/domain.py
src/creatidy_kernel/core/__init__.py
src/creatidy_kernel/ports/domain.py
tests/test_domain.py

Acceptance evidence:

immutable ProgramSpec/WorkUnit DAG validation rejects cycles, missing references/inputs, duplicate producers, and invalid values
legal command transitions cover activation/readiness, attempts, trusted/prevalidated WorkUnit satisfaction, cancellation, revision checks, authority, admission budgets, and amendments
AttemptSpec effective inputs remain frozen; amendments retain prior spec/attempt history and cancel active attempts pinned to superseded specs before rebuilding readiness
K1 contains no persistence, external/runtime adapters, K4 result/evidence/reviewer/verification/remediation semantics, usage/quota/reservation accounting, or Scarcity Router behavior

Checks passed:

make check (23 tests, formatting, Ruff, basedpyright, import-linter, secret scan, diff check)
make package-check (wheel/sdist metadata, rebuild, isolated install)

PR #12 is open against develop and awaiting independent review. Issue remains open; no merge was performed. Residual risk is limited to reviewer validation of the new public domain API and transition semantics.

Implemented K1 on branch `issue-4-domain-immutable-intent` and opened PR #12: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/12 Changed files: - `src/creatidy_kernel/core/domain.py` - `src/creatidy_kernel/core/__init__.py` - `src/creatidy_kernel/ports/domain.py` - `tests/test_domain.py` Acceptance evidence: - immutable ProgramSpec/WorkUnit DAG validation rejects cycles, missing references/inputs, duplicate producers, and invalid values - legal command transitions cover activation/readiness, attempts, trusted/prevalidated WorkUnit satisfaction, cancellation, revision checks, authority, admission budgets, and amendments - AttemptSpec effective inputs remain frozen; amendments retain prior spec/attempt history and cancel active attempts pinned to superseded specs before rebuilding readiness - K1 contains no persistence, external/runtime adapters, K4 result/evidence/reviewer/verification/remediation semantics, usage/quota/reservation accounting, or Scarcity Router behavior Checks passed: - `make check` (23 tests, formatting, Ruff, basedpyright, import-linter, secret scan, diff check) - `make package-check` (wheel/sdist metadata, rebuild, isolated install) PR #12 is open against `develop` and awaiting independent review. Issue remains open; no merge was performed. Residual risk is limited to reviewer validation of the new public domain API and transition semantics.

kilo commented

2026-09-22 22:03:28 +00:00

Author

Member

Remediated all three blocking findings on the existing PR #12 branch. New exact head: 027aa7e7ae89eb875b43cff5f5e3d198bf88f5a6.

Removed the persisted transition capability from Program; dataclasses.replace() cannot construct a valid arbitrary lifecycle snapshot. Internal transitions use a private validated builder, while public construction remains draft-only.
Removed overridable command action metadata. Dispatch accepts exact trusted command classes and each handler authorizes its literal command kind; forged subclasses are rejected.
Amendment rebuilds affected WorkUnit applicability across changed definitions and dependency descendants, preserves historical specs/attempt inputs/references, cancels superseded active attempts, reopens invalidated completed Programs, and completes an active Program when an amendment removes its last pending WorkUnit.

Added focused regressions for all blockers, including dataclasses.replace, forged command subclasses, removing the last pending WorkUnit, and predecessor changes invalidating downstream satisfaction. Validation passed: make check (27 tests) and make package-check.

PR #12 remains open against develop; no merge was performed. Requesting a fresh independent review of the exact head above.

Remediated all three blocking findings on the existing PR #12 branch. New exact head: `027aa7e7ae89eb875b43cff5f5e3d198bf88f5a6`. - Removed the persisted transition capability from `Program`; `dataclasses.replace()` cannot construct a valid arbitrary lifecycle snapshot. Internal transitions use a private validated builder, while public construction remains draft-only. - Removed overridable command action metadata. Dispatch accepts exact trusted command classes and each handler authorizes its literal command kind; forged subclasses are rejected. - Amendment rebuilds affected WorkUnit applicability across changed definitions and dependency descendants, preserves historical specs/attempt inputs/references, cancels superseded active attempts, reopens invalidated completed Programs, and completes an active Program when an amendment removes its last pending WorkUnit. Added focused regressions for all blockers, including `dataclasses.replace`, forged command subclasses, removing the last pending WorkUnit, and predecessor changes invalidating downstream satisfaction. Validation passed: `make check` (27 tests) and `make package-check`. PR #12 remains open against `develop`; no merge was performed. Requesting a fresh independent review of the exact head above.

kilo commented

2026-09-22 23:03:27 +00:00

Author

Member

Owner-approved K1 boundary clarification for this remediation:

K1 must make invalid lifecycle/authority mutation impossible through the supported public domain API and ordinary Python construction, copying, and subclassing paths. K1 is not a security boundary against arbitrary malicious code already executing inside the trusted Kernel process via reflection, monkey-patching, object.__new__, memory modification, or equivalent interpreter-level attacks. Worker isolation against hostile code belongs to K3.

Owner-approved K1 boundary clarification for this remediation: > K1 must make invalid lifecycle/authority mutation impossible through the supported public domain API and ordinary Python construction, copying, and subclassing paths. K1 is not a security boundary against arbitrary malicious code already executing inside the trusted Kernel process via reflection, monkey-patching, `object.__new__`, memory modification, or equivalent interpreter-level attacks. Worker isolation against hostile code belongs to K3.

kilo commented

2026-09-22 23:20:20 +00:00

Author

Member

Remediated the fresh review blockers on existing PR #12. Exact pushed head: be3db0ba3a2516f564fb3eb3654aeae5d9f127d8.

Sealed supported ordinary copying/subclassing for Program and immutable semantic values; dataclasses.replace, copy/deepcopy, direct transition construction, and Program validation/authorization overrides cannot forge state.
Bound dispatch to exact command classes and retained literal domain authorization requirements.
Enforced active/paused control-path liveness under authority amendments; active Programs retain cancellation control or the amendment is rejected.
WorkUnit cancellation now propagates to dependency descendants, rejects inconsistent satisfied descendants, and closes the aggregate when no legal work remains.

Added focused regressions plus positive command/amendment paths. make check passed with 33 tests; make package-check passed. The owner-approved K1 trust-boundary clarification is recorded above. PR #12 remains open against develop; no merge performed. Requesting another fresh independent review of this exact head.

Remediated the fresh review blockers on existing PR #12. Exact pushed head: `be3db0ba3a2516f564fb3eb3654aeae5d9f127d8`. - Sealed supported ordinary copying/subclassing for Program and immutable semantic values; `dataclasses.replace`, copy/deepcopy, direct transition construction, and Program validation/authorization overrides cannot forge state. - Bound dispatch to exact command classes and retained literal domain authorization requirements. - Enforced active/paused control-path liveness under authority amendments; active Programs retain cancellation control or the amendment is rejected. - WorkUnit cancellation now propagates to dependency descendants, rejects inconsistent satisfied descendants, and closes the aggregate when no legal work remains. Added focused regressions plus positive command/amendment paths. `make check` passed with 33 tests; `make package-check` passed. The owner-approved K1 trust-boundary clarification is recorded above. PR #12 remains open against `develop`; no merge performed. Requesting another fresh independent review of this exact head.

kilo commented

2026-09-23 14:39:32 +00:00

Author

Member

Remediated the remaining finished-attempt lifecycle blocker on PR #12. Exact pushed head: c7468ade748126cee4baa6de939004fb032e9301.

FinishAttempt now changes the WorkUnit from ACTIVE to READY and clears active_attempt_id; FINISHED remains an immutable historical Attempt record and is not treated as acceptance.
A later Attempt can be admitted when authority and finite attempt budgets permit.
Trusted satisfaction accepts a FINISHED source Attempt from READY, preserving the existing K1/K4 boundary and advancing dependent DAG readiness.
Finished attempts can be followed by legal WorkUnit cancellation; descendant propagation and aggregate terminal behavior remain intact.
Budget exhaustion after a finished Attempt returns deterministic BudgetExceeded without mutating lifecycle state.

Added focused regressions and kept all prior construction, authority, amendment, cancellation, and immutable-state tests green. Validation passed: make check (35 tests) and make package-check.

PR #12 remains open against develop; no merge performed. Requesting a fresh independent review of this exact head.

Remediated the remaining finished-attempt lifecycle blocker on PR #12. Exact pushed head: `c7468ade748126cee4baa6de939004fb032e9301`. - `FinishAttempt` now changes the WorkUnit from `ACTIVE` to `READY` and clears `active_attempt_id`; `FINISHED` remains an immutable historical Attempt record and is not treated as acceptance. - A later Attempt can be admitted when authority and finite attempt budgets permit. - Trusted satisfaction accepts a `FINISHED` source Attempt from `READY`, preserving the existing K1/K4 boundary and advancing dependent DAG readiness. - Finished attempts can be followed by legal WorkUnit cancellation; descendant propagation and aggregate terminal behavior remain intact. - Budget exhaustion after a finished Attempt returns deterministic `BudgetExceeded` without mutating lifecycle state. Added focused regressions and kept all prior construction, authority, amendment, cancellation, and immutable-state tests green. Validation passed: `make check` (35 tests) and `make package-check`. PR #12 remains open against `develop`; no merge performed. Requesting a fresh independent review of this exact head.

kilo commented

2026-09-23 18:57:06 +00:00

Author

Member

Remediated both remaining PR #12 blockers. Exact pushed head: 2c96859d22d89afd8a65afb6e1be156496ab4966.

Central transition liveness now validates resulting DRAFT, PAUSED, and ACTIVE authority/state combinations. Nonterminal states retain amendment/cancel control; resume into an actionless ACTIVE state and paused amendments removing post-resume control are rejected. Positive paused amendment + resume + cancel remains covered.
Removed _copy_seal entirely. Semantic K1 values now use explicit one-time constructors with all dataclass fields init=False; dataclasses.replace rejects field rewrites before construction, private-seal reset attempts are unavailable, repeated __init__ calls fail before mutation, and copy/subclass payload overrides remain blocked.
Preserved explicit command transitions, amendments, retries, trusted satisfaction, cancellation, and immutable attempt/spec history.

Added focused regressions for paused/resume liveness, actionless transitions, _copy_seal reset attempts, repeated initialization, subclassing, and positive lifecycle paths. Validation passed: make check (39 tests) and make package-check.

PR #12 remains open against develop; no merge performed. Requesting fresh independent review of this exact head.

Remediated both remaining PR #12 blockers. Exact pushed head: `2c96859d22d89afd8a65afb6e1be156496ab4966`. - Central transition liveness now validates resulting `DRAFT`, `PAUSED`, and `ACTIVE` authority/state combinations. Nonterminal states retain amendment/cancel control; resume into an actionless ACTIVE state and paused amendments removing post-resume control are rejected. Positive paused amendment + resume + cancel remains covered. - Removed `_copy_seal` entirely. Semantic K1 values now use explicit one-time constructors with all dataclass fields `init=False`; `dataclasses.replace` rejects field rewrites before construction, private-seal reset attempts are unavailable, repeated `__init__` calls fail before mutation, and copy/subclass payload overrides remain blocked. - Preserved explicit command transitions, amendments, retries, trusted satisfaction, cancellation, and immutable attempt/spec history. Added focused regressions for paused/resume liveness, actionless transitions, `_copy_seal` reset attempts, repeated initialization, subclassing, and positive lifecycle paths. Validation passed: `make check` (39 tests) and `make package-check`. PR #12 remains open against `develop`; no merge performed. Requesting fresh independent review of this exact head.

kilo commented

2026-09-24 09:23:44 +00:00

Author

Member

Remediated all three fresh PR #12 blockers. Exact pushed head: 769a2f560086168678b4a5c3f41f5d2f29f20375.

Removed the module token and generic _next constructor. State construction is scoped inside Program.apply(); only exact domain command dispatch selects transitions.
Replaced universal CANCEL_PROGRAM liveness with checks over the actual graph state and authorized legal paths, including WorkUnit cancellation, satisfaction, Attempt follow-ups, amendments, resume, and termination. A least-privilege one-node Program can progress via CANCEL_WORK_UNIT; invalid amendments, pauses, resumes, or Attempt admissions with no viable follow-up are rejected without granting authority.
Amendment reconciliation preserves unchanged cancelled nodes/branches, reevaluates changed nodes and dependency descendants, and preserves/invalidate satisfaction according to the existing K1 rules. Mixed terminal outcomes now close as cancelled.

Added focused regressions for direct force-status attempts, actionless states, least-privilege control, prepared-Attempt dead ends, cancelled-node preservation, affected-node reevaluation, and cancellation/satisfaction closure. Existing satisfaction/amendment paths remain covered.

Validation passed: make check (49 tests) and make package-check. PR #12 remains open against develop; no merge performed. Requesting fresh independent review of this exact head.

Remediated all three fresh PR #12 blockers. Exact pushed head: `769a2f560086168678b4a5c3f41f5d2f29f20375`. - Removed the module token and generic `_next` constructor. State construction is scoped inside `Program.apply()`; only exact domain command dispatch selects transitions. - Replaced universal `CANCEL_PROGRAM` liveness with checks over the actual graph state and authorized legal paths, including WorkUnit cancellation, satisfaction, Attempt follow-ups, amendments, resume, and termination. A least-privilege one-node Program can progress via `CANCEL_WORK_UNIT`; invalid amendments, pauses, resumes, or Attempt admissions with no viable follow-up are rejected without granting authority. - Amendment reconciliation preserves unchanged cancelled nodes/branches, reevaluates changed nodes and dependency descendants, and preserves/invalidate satisfaction according to the existing K1 rules. Mixed terminal outcomes now close as cancelled. Added focused regressions for direct force-status attempts, actionless states, least-privilege control, prepared-Attempt dead ends, cancelled-node preservation, affected-node reevaluation, and cancellation/satisfaction closure. Existing satisfaction/amendment paths remain covered. Validation passed: `make check` (49 tests) and `make package-check`. PR #12 remains open against `develop`; no merge performed. Requesting fresh independent review of this exact head.

kilo commented

2026-09-24 12:14:28 +00:00

Author

Member

Remediated both fresh PR #12 liveness findings on the existing branch. Exact pushed head: e75f79bb9955c2d9d6e08c68a483efdf06088f51.

Replaced the hand-coded liveness action-combination checks with finite reachability over a symbolic K1 state.
Program.apply() and reachability share _action_inapplicability for authority, lifecycle, DAG, input, budget, Attempt, and trusted-satisfaction applicability.
Both actual command application and reachability use _reach_successor as the canonical lifecycle reducer. Exploration uses symbolic attempt summaries/IDs and declared logical input availability; it does not create AttemptSpec/input references/TrustedSatisfaction payloads.
Added least-authority regressions for ACTIVATE -> PREPARE -> START -> FINISH -> READY -> CANCEL_WORK_UNIT without other authority, and ACTIVATE -> PREPARE -> SATISFY_WORK_UNIT without START. Tests also assert omitted actions remain unauthorized.

Validation passed: make check (51 tests) and make package-check. Previous K1 construction, authority, amendment, cancellation, immutability, and satisfaction regressions remain green. PR #12 remains open against develop; no merge performed. Requesting fresh independent review of this exact head.

Remediated both fresh PR #12 liveness findings on the existing branch. Exact pushed head: `e75f79bb9955c2d9d6e08c68a483efdf06088f51`. - Replaced the hand-coded liveness action-combination checks with finite reachability over a symbolic K1 state. - `Program.apply()` and reachability share `_action_inapplicability` for authority, lifecycle, DAG, input, budget, Attempt, and trusted-satisfaction applicability. - Both actual command application and reachability use `_reach_successor` as the canonical lifecycle reducer. Exploration uses symbolic attempt summaries/IDs and declared logical input availability; it does not create AttemptSpec/input references/TrustedSatisfaction payloads. - Added least-authority regressions for `ACTIVATE -> PREPARE -> START -> FINISH -> READY -> CANCEL_WORK_UNIT` without other authority, and `ACTIVATE -> PREPARE -> SATISFY_WORK_UNIT` without START. Tests also assert omitted actions remain unauthorized. Validation passed: `make check` (51 tests) and `make package-check`. Previous K1 construction, authority, amendment, cancellation, immutability, and satisfaction regressions remain green. PR #12 remains open against `develop`; no merge performed. Requesting fresh independent review of this exact head.

kilo commented

2026-09-24 15:36:13 +00:00

Author

Member

Remediated all five latest PR #12 blockers on the existing branch. Exact pushed head: 52fef6866da7859dde1d6777974346fae3d2c20f.

Amendment terminal reduction is based on the resulting WorkUnit set regardless of prior ACTIVE/PAUSED status. PAUSED amendments removing remaining satisfied or cancelled work now produce COMPLETED/CANCELLED without requiring extra cancellation authority.
Satisfaction now requires a genuinely FINISHED source Attempt. It never changes Attempt status or clears an active binding; Program invariants require active Attempts to remain bound to active WorkUnits.
Added immutable Program and WorkUnit acceptance criteria plus opaque versioned/digest PolicyReference values. They participate in ProgramSpec/WorkUnit digests and can be amended.
Satisfaction applicability compares the historical spec's complete owner-intent and relevant dependency-chain fingerprint with the amended spec. Historical records remain intact; program objective/criteria/policy changes invalidate globally, scoped definition/dependency changes invalidate affected nodes/descendants, and unrelated scoped work can retain applicable satisfaction.
Replaced Attempt-interleaving BFS with deterministic DAG-order capability analysis using the same command applicability predicate and lifecycle reducer as Program.apply. It follows at most one Attempt path per WorkUnit, does not fabricate input/proof values, and promptly rejects the eight-WorkUnit PREPARE/FAIL-only case.

Added regressions for both paused terminal amendments, truthful Attempt history, applicability ordering, digest/amendment pinning, WorkUnit-chain invalidation, and failure-only admission. Validation passed: make check (57 tests) and make package-check.

PR #12 remains open against develop; no merge performed. Requesting fresh independent review of this exact head.

Remediated all five latest PR #12 blockers on the existing branch. Exact pushed head: `52fef6866da7859dde1d6777974346fae3d2c20f`. - Amendment terminal reduction is based on the resulting WorkUnit set regardless of prior ACTIVE/PAUSED status. PAUSED amendments removing remaining satisfied or cancelled work now produce COMPLETED/CANCELLED without requiring extra cancellation authority. - Satisfaction now requires a genuinely FINISHED source Attempt. It never changes Attempt status or clears an active binding; Program invariants require active Attempts to remain bound to active WorkUnits. - Added immutable Program and WorkUnit acceptance criteria plus opaque versioned/digest `PolicyReference` values. They participate in ProgramSpec/WorkUnit digests and can be amended. - Satisfaction applicability compares the historical spec's complete owner-intent and relevant dependency-chain fingerprint with the amended spec. Historical records remain intact; program objective/criteria/policy changes invalidate globally, scoped definition/dependency changes invalidate affected nodes/descendants, and unrelated scoped work can retain applicable satisfaction. - Replaced Attempt-interleaving BFS with deterministic DAG-order capability analysis using the same command applicability predicate and lifecycle reducer as `Program.apply`. It follows at most one Attempt path per WorkUnit, does not fabricate input/proof values, and promptly rejects the eight-WorkUnit PREPARE/FAIL-only case. Added regressions for both paused terminal amendments, truthful Attempt history, applicability ordering, digest/amendment pinning, WorkUnit-chain invalidation, and failure-only admission. Validation passed: `make check` (57 tests) and `make package-check`. PR #12 remains open against `develop`; no merge performed. Requesting fresh independent review of this exact head.

kilo commented

2026-09-24 18:53:52 +00:00

Author

Member

K1 model correction implemented in place on existing PR #12: #12

Exact pushed PR head: a2c9072ba31868822983c29341be3a426607689e against develop. The approved Domain Contract addendum is now in this issue body; no A0 architecture/ADR files changed.

Removed the hypothetical future-path planner, input-name-only admission, prior-projection-dependent amendment handling, revision-only satisfaction invalidation, and automatic lifecycle changes from satisfaction. Current K1 pins complete Program/WorkUnit intent and approved binding provenance, records independent trusted satisfactions and fingerprint-scoped cancellation decisions, reprojects from complete history, preserves unaffected Attempts, and treats semantic no-op amendments as unchanged. Explicit Program abandonment remains separate from WorkUnit cancellation.

Changed files: src/creatidy_kernel/core/domain.py, src/creatidy_kernel/core/__init__.py, tests/test_domain.py. Focused uv run --locked pytest tests/test_domain.py -q: 86 passed. At exact head, make check: passed with 101 total tests plus Ruff/basedpyright/import-linter/secret scan/diff check; make package-check: passed. Forgejo PR workflow #1919 succeeded for the same SHA.

An independent fresh read-only review at 53407da found three defects. They were remediated at a2c9072 with direct regressions for satisfaction/Attempt separation, cancellation reconstruction of an otherwise wholly cancelled graph, and historical satisfaction during a live retry; delayed inapplicable historical facts are also covered. A second independent fresh read-only review at a2c9072ba31868822983c29341be3a426607689e returned APPROVE, no blocking findings; it did not execute PR code or submit a Forgejo approval.

Issue #4 and PR #12 remain open. No merge, develop integration, main promotion or release was performed; no genuine Human Gate identified.

K1 model correction implemented in place on existing PR #12: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/12 Exact pushed PR head: `a2c9072ba31868822983c29341be3a426607689e` against `develop`. The approved `Domain Contract` addendum is now in this issue body; no A0 architecture/ADR files changed. Removed the hypothetical future-path planner, input-name-only admission, prior-projection-dependent amendment handling, revision-only satisfaction invalidation, and automatic lifecycle changes from satisfaction. Current K1 pins complete Program/WorkUnit intent and approved binding provenance, records independent trusted satisfactions and fingerprint-scoped cancellation decisions, reprojects from complete history, preserves unaffected Attempts, and treats semantic no-op amendments as unchanged. Explicit Program abandonment remains separate from WorkUnit cancellation. Changed files: `src/creatidy_kernel/core/domain.py`, `src/creatidy_kernel/core/__init__.py`, `tests/test_domain.py`. Focused `uv run --locked pytest tests/test_domain.py -q`: 86 passed. At exact head, `make check`: passed with 101 total tests plus Ruff/basedpyright/import-linter/secret scan/diff check; `make package-check`: passed. Forgejo PR workflow #1919 succeeded for the same SHA. An independent fresh read-only review at `53407da` found three defects. They were remediated at `a2c9072` with direct regressions for satisfaction/Attempt separation, cancellation reconstruction of an otherwise wholly cancelled graph, and historical satisfaction during a live retry; delayed inapplicable historical facts are also covered. A second independent fresh read-only review at `a2c9072ba31868822983c29341be3a426607689e` returned **APPROVE, no blocking findings**; it did not execute PR code or submit a Forgejo approval. Issue #4 and PR #12 remain open. No merge, `develop` integration, `main` promotion or release was performed; no genuine Human Gate identified.