From 69d70cedf7fc242f8562317bf52633981d9fec14 Mon Sep 17 00:00:00 2001 From: ci Date: Fri, 28 Aug 2026 20:07:21 -0400 Subject: [PATCH 1/3] spec: make portable core line budget advisory --- work/portable-core-contracts/spec.md | 49 +++++++++++++++------------- 1 file changed, 26 insertions(+), 23 deletions(-) diff --git a/work/portable-core-contracts/spec.md b/work/portable-core-contracts/spec.md index 064f5bd..2cee27d 100644 --- a/work/portable-core-contracts/spec.md +++ b/work/portable-core-contracts/spec.md @@ -71,10 +71,14 @@ authority, or perform an external write. shapes, registries, manifest/profile/resolution relations, and request/result/status/evidence rules. It never resolves physical repositories, launches a process, reads a raw fixture, or evaluates policy. -- **R14 — credible delivery bound.** One jq source, one shell front door, - table-driven tests, docs, restore entries, and operator-owned CI wiring must fit - 400 normally formatted net lines. If the plan cannot prove that, return to G2; - no code-golf or size exception is accepted. +- **R14 — reviewable, evidence-backed delivery.** The plan estimates normally + formatted size and names cohesive review units for one jq source, one shell front + door, table-driven tests, docs, restore entries, and operator-owned CI wiring. Line + count is a reviewability signal, not a pass/fail gate. Complete behavior, complete + tests, CI, independent review, and the safety boundaries remain hard requirements. + If more than one PR is needed, the plan returns to the operator before code to + record exact slices and branches. Nothing public or live activates before the full + contract and integration proof are accepted. - **R15 — no live change.** This work does not activate a profile, extract a real adapter, regenerate `/yshifu`, alter an open session, or enable autonomous writes. The operator remains the only merge authority. @@ -543,25 +547,23 @@ model/tool availability, evidence replay/passing-role rules, source/base and oth stale selectors, generic escapes, and all three commands. They do not read Git, launch a process, or use a network. -Implementation budget: +Planning estimate from the first implementation preflight: -| `contracts.jq` area | Lines | +| Area | Normal-format working range | |---|---:| -| canonical/limit/exact-object helpers | 35 | -| primitive/ref/document shapes | 65 | -| capability/permission/profile relations | 45 | -| request/result/status/evidence relations | 60 | -| **jq subtotal** | **205** | - -| Other area | Lines | -|---|---:| -| shell wrapper | 30 | -| table-driven tests and tiny fixtures | 135 | -| README, restore manifest, CI wiring | 30 | -| **Total** | **400** | - -The plan rejects code golf, long generated lines, copied registries, or a second -parser. If ordinary formatting exceeds 400 lines, return to G2. +| `contracts.jq` | 380–755 | +| shell wrapper | 50–110 | +| readable fixtures and adversarial tests | 240–330 | +| docs, restore manifest, and CI wiring | 30–60 | +| **Likely total** | **about 800–1,100** | + +These numbers guide plan review; they do not waive or reject work. The plan explains +large differences from the range and chooses review units by responsibility, not by +an arbitrary line target. Code golf, generated long lines, copied registries, a +second parser, system-jq drift, reused production logic as the test oracle, or reduced +negative coverage are never valid ways to appear smaller. If one PR is no longer +cohesive and reviewable, stop before code and ask the operator to record an exact +multi-PR delivery shape; implementation cannot invent one mid-flight. ### Downstream handoffs and intent questions @@ -618,8 +620,9 @@ before any publisher can run. and human-gate boundaries before real use. 4. **Forge 2×2 is unresolved by design.** The existing adapter-test intent must wait or be separately rescoped; producer-only proof cannot be called its accepted 2×2. -5. **No implementation exception is accepted.** Strict parsing and the 400-line - bound cannot be met with a workaround; return to the artifact gate. +5. **Size never trades away proof.** The estimate may move, but strict parsing, + complete relations, readable code, adversarial tests, CI, and review do not. A + materially different delivery shape returns to the operator before code. 6. **CI is a constitution path.** Operator-driven work may edit it; unattended work must use `proposals/` and wait for application. 7. **This is user-directed high-risk design.** G2 accepts only this spec, not a plan, From ac48b3344ff8ecb0754cd50a25ad482ad30eccfb Mon Sep 17 00:00:00 2001 From: ci Date: Fri, 28 Aug 2026 20:13:54 -0400 Subject: [PATCH 2/3] spec: keep portable core in one implementation PR --- work/portable-core-contracts/spec.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/work/portable-core-contracts/spec.md b/work/portable-core-contracts/spec.md index 2cee27d..f066668 100644 --- a/work/portable-core-contracts/spec.md +++ b/work/portable-core-contracts/spec.md @@ -76,9 +76,11 @@ authority, or perform an external write. door, table-driven tests, docs, restore entries, and operator-owned CI wiring. Line count is a reviewability signal, not a pass/fail gate. Complete behavior, complete tests, CI, independent review, and the safety boundaries remain hard requirements. - If more than one PR is needed, the plan returns to the operator before code to - record exact slices and branches. Nothing public or live activates before the full - contract and integration proof are accepted. + Implementation remains one reviewable concern on the deterministic + `ystack/impl/portable-core-contracts` branch and PR. If that cannot stay coherent, + return to the artifact gate for separately accepted child intents before planning + or code. Nothing public or live activates before the full contract and integration + proof are accepted. - **R15 — no live change.** This work does not activate a profile, extract a real adapter, regenerate `/yshifu`, alter an open session, or enable autonomous writes. The operator remains the only merge authority. @@ -562,8 +564,9 @@ large differences from the range and chooses review units by responsibility, not an arbitrary line target. Code golf, generated long lines, copied registries, a second parser, system-jq drift, reused production logic as the test oracle, or reduced negative coverage are never valid ways to appear smaller. If one PR is no longer -cohesive and reviewable, stop before code and ask the operator to record an exact -multi-PR delivery shape; implementation cannot invent one mid-flight. +cohesive and reviewable, stop before code and return to the artifact gate for +separately accepted child scopes. A plan or operator comment cannot invent extra +implementation PRs for this intent. ### Downstream handoffs and intent questions From 117687c302c7a8370cc8049604cb27fbdcd2b861 Mon Sep 17 00:00:00 2001 From: ci Date: Fri, 28 Aug 2026 20:20:16 -0400 Subject: [PATCH 3/3] spec: record portable core review-size exception --- work/portable-core-contracts/spec.md | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/work/portable-core-contracts/spec.md b/work/portable-core-contracts/spec.md index f066668..f5b2186 100644 --- a/work/portable-core-contracts/spec.md +++ b/work/portable-core-contracts/spec.md @@ -77,10 +77,12 @@ authority, or perform an external write. count is a reviewability signal, not a pass/fail gate. Complete behavior, complete tests, CI, independent review, and the safety boundaries remain hard requirements. Implementation remains one reviewable concern on the deterministic - `ystack/impl/portable-core-contracts` branch and PR. If that cannot stay coherent, - return to the artifact gate for separately accepted child intents before planning - or code. Nothing public or live activates before the full contract and integration - proof are accepted. + `ystack/impl/portable-core-contracts` branch and PR. The operator accepts the + current estimate as an explicit exception to the repository's soft review-size + guide; line count alone does not require a split. The plan groups the one PR into + clear commits and review sections. Any actual concern or scope expansion returns + to the artifact gate. Nothing public or live activates before the full contract + and integration proof are accepted. - **R15 — no live change.** This work does not activate a profile, extract a real adapter, regenerate `/yshifu`, alter an open session, or enable autonomous writes. The operator remains the only merge authority. @@ -563,9 +565,10 @@ These numbers guide plan review; they do not waive or reject work. The plan expl large differences from the range and chooses review units by responsibility, not by an arbitrary line target. Code golf, generated long lines, copied registries, a second parser, system-jq drift, reused production logic as the test oracle, or reduced -negative coverage are never valid ways to appear smaller. If one PR is no longer -cohesive and reviewable, stop before code and return to the artifact gate for -separately accepted child scopes. A plan or operator comment cannot invent extra +negative coverage are never valid ways to appear smaller. This one-concern contract +keeps one implementation PR despite the estimate; commits and review passes separate +responsibilities without creating partial product releases. A newly discovered +concern or scope change returns to the artifact gate, and no plan may invent extra implementation PRs for this intent. ### Downstream handoffs and intent questions @@ -625,7 +628,8 @@ before any publisher can run. or be separately rescoped; producer-only proof cannot be called its accepted 2×2. 5. **Size never trades away proof.** The estimate may move, but strict parsing, complete relations, readable code, adversarial tests, CI, and review do not. A - materially different delivery shape returns to the operator before code. + materially different concern or scope returns to the artifact gate. The accepted + review-size exception changes no safety or proof requirement. 6. **CI is a constitution path.** Operator-driven work may edit it; unattended work must use `proposals/` and wait for application. 7. **This is user-directed high-risk design.** G2 accepts only this spec, not a plan,