6.5 kB 59 lines
413b7bd7
Land the uncommitted tree: the cut campaign, the work under it, and the daemon's window
dawn
⋯
evidence/m3-gate-report.md
sourcerendered
download raw history
at main Markdown

M3 Gate Report: Production Honesty Boundaries #

Milestone: M3 — production callers, reachable branches, and failure readers Owner: m3-gate Date: 2026-09-11 Repository: /Users/dawn/proj/klbr Snapshot: uncommitted working tree at gate-run time; no commit or pushed snapshot is claimed here.

1. Executive Summary #

M3 did not primarily add features. It connected honesty claims to the whole production path: every claim now has a production caller, a branch that can actually be reached with production inputs, and a reader that exposes failure to the system or operator. The gates exercise the real daemon or Agent::run_turn path and bind their assertions to request bytes captured at a local TCP provider boundary.

The request gates cover causal prompt-prefix stability, route-scoped cache fields and usage absence, required-guidance overflow, and restart reconstruction after an unreported cache miss. The overflow path now refuses the provider request, persists a typed failure, and emits a client-visible error. The restart test constrains the cache adapter; it does not repair a cache-driven reset path, because no such reset path existed at M3 start.

The gate table's YES means source/helper and deterministic end-to-end evidence. Real-model authorship and later observed benefit remain NOT RUN for every item.

2. Gate Table #

item owner exact command exit code + pass/fail honesty label mutation receipt
U19 — causal request prefix survives reconnect and committed wake/helper evidence m3-compiler + m3-gate cargo test --locked -p klbr-daemon --test m3_request_gate u19_actual_request_prefix_survives_reconnect_and_causal_updates -- --nocapture 0; 1 passed, 0 failed YES Pending-tail push mutated to insert(0, ..); exit 101, panic m3_request_gate.rs:410: request 1 moved prior messages; restored.
U20 — cache profile is route-scoped; absent usage is distinct from reported zero; changed-route merge reaches wire m3-adapter + m3-gate cargo test --locked -p klbr-daemon --test m3_request_gate u20_actual_wire_is_profile_scoped_and_usage_keeps_absent_distinct_from_zero -- --nocapture and cargo test --locked -p klbr-daemon --test m3_request_gate u20_changed_route_merge_reaches_wire_without_inherited_cache_profile -- --nocapture 0; 1 passed, 0 failed for each YES Removed stream's apply_to_request; exit 101, panic m3_request_gate.rs:558: unsupported route emitted prompt_cache_key; restored.
U21 — required-guidance overflow refuses the request and reports the typed failure m3-compiler (core gate); m3-gate (daemon gate); m3-context (contract) cargo test --locked -p klbr-core --test m3_guidance_gate -- --nocapture (m3-compiler); cargo test --locked -p klbr-daemon --test m3_request_gate u21_required_guidance_overflow_stops_before_provider_request -- --nocapture (m3-gate) 0; 2 passed, 0 failed in core; 0; 1 passed, 0 failed in daemon YES Replaced the UnresolvedBudget bail with a no-op; exit 101 after 13.83s, Error: client did not receive required guidance budget error; restored.
U22 — reported cache miss preserves semantic history across daemon restart without fabricated turns m3-resilience + m3-gate cargo test --locked -p klbr-daemon --test m3_request_gate u22_provider_miss_replays_same_semantic_history_without_fabricated_turn -- --nocapture 0; 1 passed, 0 failed YES ctx.clear() mutation caused the exact prefix assertion at turn.rs:793 to fail; restored.

The complete owned gate binary was also run: cargo test --locked -p klbr-daemon --test m3_request_gate -- --nocapture — exit 0, 5 passed, 0 failed. Workspace compilation was checked with cargo check --workspace --locked --all-targets — exit 0.

3. Four Honesty Labels #

For U19–U22, source/helper implemented is YES and deterministic end-to-end execution is YES. Real-model authored evidence is NOT RUN; later observed benefit is NOT RUN. No gate claims either of those unmeasured properties.

4. NOT RUN #

The following are explicitly NOT RUN, and M3 makes no claim about them:

  • real-model-authored evidence;
  • later observed benefit or longitudinal improvement;
  • Linux/NixOS validation;
  • long-duration soak testing;
  • filesystem fault injection;
  • the (c) real-model-authored column and (d) later-observed-benefit column;
  • a clean full-workspace pass: NOT RUN / UNRESOLVED; the battery result is disclosed below.

The full workspace battery (cargo test --workspace --locked --no-fail-fast) was run twice: 615 passed across 40 suites, with ONE failing test, service_lifecycle::service_quiesce_preserves_waiting_deadline_and_resumes, failing with database is owned elsewhere or locking failed: WouldBlock from klbr-runtime/src/store.rs:220 (non-blocking File::try_lock). That suite passes 5/5 in isolation. The failure is under separate investigation; M3 does not claim it is green, and does not claim it is unrelated. No M3 gate item depends on it. No live provider measurement is claimed.

5. The Defects Found #

All six defects had the same species: an honest component whose honesty did not reach the system.

  1. ContextReceipt had no production caller. The component could describe request identity, but the daemon did not compile or persist it on the live path.
  2. GuidanceStatus::UnresolvedBudget had no daemon reader. The engine returned an honest signal that the caller ignored.
  3. Production passed usize::MAX as the guidance budget. The unresolved-budget branch was therefore unreachable. A guard that cannot fire is not a guard.
  4. Overflow logged and broke. The path did tracing::error! plus break, with no client error or durable turn-failure audience. That is silent truncation's twin.
  5. Gemini used unwrap_or(json!(0)). It fabricated a measured zero upstream of four layers that each preserved absence correctly.
  6. The U22 negative test used usize::MAX as its watermark. Its no-compaction assertion could not fail because compaction was impossible by construction. It now uses a finite watermark with context genuinely below it.

6. Limitations #

No commits were pushed. No live beads issue IDs are invented here. Rust tests were authored and run, but Linux/NixOS validation, long-duration validation, filesystem fault injection, real-model authorship, and later observed benefit were not run. M3 therefore does not claim them.