docs/TOOLS.md drifted on two counts (ten legs, missing open-set row); tool_map.py --write now renders 23 tools / 11 gate legs. open_set.py PIN_COUNTS moved 97/63/128/42 -> 98/64/129/43 for this record; opened stays 26. Full gate 11/11 at the committed tree.
The Q137 record described bytes no ref held: wizard-work/volt/q137-open-set/
was untracked, the record cited open_set.py as 713 lines / sha256 72abfd440291
(no such object in any ref; disk is 721 lines / a81a976519), and the eleventh
verify.py leg was uncommitted. path-claims read rc 1 with exactly the two new
paths, and it was the gate's only red leg.
Landing: open_set.py, CHECK-q137, REPORT.md, the queue addendum, the
re-rendered index, tools/verify.py's open-set leg.
After: CHECK-q137 4/4 rc 0; verify.py --selftest 59/59; verify.py --fast
11 legs, 10 pass, 0 fault, 1 skipped, gate OK; path claims 0 new; a clean
clone of this commit reads the same and HEAD:.../open_set.py sha256 equals
the digest the addendum states.
wizard-work/forge had 39 committed verify_*.py and no CHECK; tools/verify.py
names the lane zero times. verifier_gate.py runs them, keeps one row per file
bound to the git blob the rc was measured against, and grades that ledger in
under a second. First full run at 7b42050: PASS 21 (18 of them PASS* -- they
read an absolute host root), FAIL 18, all named with causes.
Five verifiers in this lane clean up with rmtree(os.path.dirname(tmp)), i.e.
they delete $TMPDIR itself; each file now runs under its own sandbox so the
harness cannot be measured instead of the lane.
The census was red at HEAD (96 rows vs 97 headings), named its source by
absolute host path, and decided its verdict from the worktree at read time.
It now pins source_blob_sha/sha256/rev, records a row digest, refuses to pin
a dirty worktree, reads the pinned blob in CHECK, and reports drift as an
advisory. 9 selftest cells; the non-decay claim is measured on real commits.
The monitor's retry (3 attempts, 2 s apart) had no reader: CHECK-q115 grades the
carry path and its harness replaces get_folder with a stub, so a repair that
retried once or never would have read the same. q118_verify.py drives the
deployed loop at the boundary it really crosses -- a fake curl first on PATH,
scripted codes, every call timestamped -- and grades recovery, exhaustion,
no-pause-on-success and the Q115 carry, with three mutants required to red the
cell they target.
Measured: CHECK-q118 8/8 legs rc 0; a copy with tries=1 reads 3 faults rc 1;
verify 10/10 legs, gate OK.
Two test cells opened with sys.path.insert(0, /root/.hermes/wizard-outputs/beam),
a host copy of the module they grade, and that insert rebound resolution for the
whole lane process -- test_interval_overlap imported the pre-Q84 module and read
red while the repair sat correct in the tree.
Each cell now binds Path(__file__).resolve().parent and asserts the import
landed there. New instrument: q133_verify.py behind CHECK-q133 (5 legs) and
q133_oracle.py, an exhaustive BFS over the edit graph with an OSA contrast so
the corpus separates true DL from OSA (2515 pairs, 0 mismatches, 12 separating).
verify.py: 10 legs, 10 pass, 0 fault. beam/CHECK: 595 tests, 0 failures.
marker + .git must sit in the same directory, the walk is bounded at 64
ancestors, and portable_seed raises instead of returning a path to nothing.
Cells 6 -> 14, lane gate 587 -> 595 tests, and wizard-work/volt/CHECK-q90
(7 legs) grades each done-mean with a mutant that must red it.
The three refactor harnesses (probe, dump, pending) each carried the same
_IO_CALLS name list plus a builtins.open spy. Measured at bb4a85e in a clean
clone: Path(__file__).read_text(), os.open(__file__, O_RDONLY), io.open(__file__)
and with Path(__file__).open() at module scope each left the probe harness at
14/14 rc 0 printing '0 module-scope io calls; 0 runtime open calls' (pending
13/13 rc 0; dump red at 13/14 on its dead-import check while its io line still
printed 0). The name-list walk resolves Path(p).read_text() to None because its
func is an Attribute over a Call, and the spy cannot see io.open/pathlib.
Now: wizard-work/forge/import_io_detector.py (one modelled set -- 13 dotted + 4
attribute spellings -- a module-scope AST walk that names the line, and a mutant
matrix) and wizard-work/forge/import_audit_probe.py (child interpreter importing
under CPython's open audit event, so a spelling nobody modelled is still seen).
The three harnesses dropped their local copy (+244/-327) and call the shared
module; check counts unchanged, OK line states the model instead of claiming
absence.
Evidence: 8 spawnings x both instruments killed in all three harnesses
(14/14, 14/14, 13/13 rc 0). Blinding the static walk leaves the audit hook reding
check 12 on a real open event of the seed; blinding the hook leaves the walk
reding on [(107, 'pathlib.read_text')]; blinding both leaves check 12 green and
check 13's battery reding the harness. _F = open / _F(DEFAULT_PATH) -- a spelling
no list names -- is caught by the hook alone.
Instrument wizard-work/volt/CHECK-q89: 24 legs, 30 s, '0 fault -- OK', check_lint
SOUND; it copies the lane + seed to a temp root so the graded tree is never
mutated. Fourth copy (verify_dump_seed_refactor.py) untouched at 16/16 and used
as an independent oracle: agrees 12/12. Q90's beam guard untouched.
verify.py --fast: 10 legs, 9 pass, 0 fault, 1 skipped, gate OK.
Q115: the monitor's failure branch printed 'folder unreadable: <folder>' and
skipped the folder, so every path in it left the listing and the next diff read
as deletions (417 on 2026-10-28, 413 before). Format v1.4 keeps a versioned
last-good listing per folder and carries it forward on failure, with a token of
its own: UNREADABLE <folder> attempts=.. last=.. carried=.. from=.., and
NO-BASELINE <folder> when there is nothing to carry.
Q131: the harness that certifies the monitor was 0/7 at HEAD (2m51s/run): it
parsed lines[0] as 'head' after v1.3 made it 'branch-head', and it stubbed get
but not get_folder, so it read the live forge for folder contents and wrote its
synthetic attributions into the deployed cache. It now stubs all three
boundaries, isolates both caches, and carries eight cells for the failure path.
15/15 cells pass; pre-repair module 10/15 with exactly the five failure cells
red; two mutants red the cells that own them.
Q105 pointed beam/CHECK at pytest; pytest is not installed on this
interpreter, so the gate exited 2 and ran zero cells. run_lane_tests.py
collects TestCase classes (TestLoader) and bare module-level def test_*()
(FunctionTestCase) itself, treats an unimportable module and a printed
FAIL transcript as faults, and exits 0/1/2. Four test files that imported
pytest now use beam_assert.raises/fail and unittest.mock; no cell dropped.
Measured: unittest discover 353 tests; runner 570 (353 + 217 bare);
bash wizard-work/beam/CHECK rc 0; test_run_lane_tests.py 10 cells OK;
7-mutant battery in scratch copies all as expected (HEAD CHECK rc 2,
broken bare rc 1, pytest import rc 1, failing TestCase rc 1, script FAIL
rc 1, empty lane rc 2, control rc 0).
Record: WORK-QUEUE.md Q128; report wizard-outputs/volt/2026-10-30-q128.md
Q80 (spark lane by authorship, unclaimed and taken). Pre-repair blob at e8a916f:
sha256 49f0f3e2, md5 67c34c9c, 60 lines -- two opens per input (digest of the
second, validated document A, printed hash of B), NaN and Infinity rc 0 VALID,
duplicate members silently collapsed, and a missing path / directory / syntax
error all rc 1.
Repaired: 185 lines, sha256 26cb270c. One read serves both halves
(Path.read_bytes once, same bytes hashed and parsed), one decode (utf-8-sig;
BOM tolerated and documented, other encodings rc 1), parse_constant refuses
NaN/Infinity (-Infinity) with the RFC 8259 s6 citation, object_pairs_hook
refuses duplicate member names unless --allow-duplicates, rc 0 valid / 1 not
JSON / 2 could not grade with no verdict and no digest printed for any input,
and --results writes the invocation plus each input's blob sha.
Cells: wizard-work/spark/test_json_sha256_validator.py (new), 15 cells,
sha256 0d2038ea -- "Ran 15 tests ... OK", rc 0. Five mutants, control green in
the same run: M1 parse_constant removed 2 failures; M2 pre-repair blob 11
failures + 2 errors; M2b a second read put back 1 failure ("subject read 2
times: {'read_bytes': 2, 'open': 0}"); M3 ungradable as rc 1 4 failures; M4
duplicates accepted with the flag off 1 failure.
Wiring: wizard-work/spark/CHECK leg 13. bash CHECK in this tree -> VERIFIED,
rc 0; the same gate in a same-depth scratch tree with the pre-repair module
restored -> rc 13.
Gate: python3 tools/verify.py --repo . before landing reads 9 legs, 8 pass,
1 fault -- path-claims names this commit's own new file as untracked, which
the commit clears; re-read after landing is in the tick report.
CHECK: python3 wizard-work/spark/test_json_sha256_validator.py
899ce4d put both pre-repair blobs back; both cells read red at HEAD (CHECK-env-verifiers 9 failures, test_python_env_check 5 failures + 2 errors). Restored byte-identically from ebba640 and bda365c. New closed_artifact_guard.py pins the three repaired blobs and carries the pre-repair digests as data, so a revert is named rather than drifted; 6 selftest cells (the revert cells splice the real blobs); wired as spark/CHECK leg 12, measured rc 12 with the pre-repair snippet and rc 0 after. Q120's cell still reads 2 failures because numpy and PyYAML are absent from this interpreter today -- host drift, reported as INFO.
(a) import-resolve: 9 OUTSIDE_REPO faults -> 0 over 138 graded files. The eight
lanes' test files now insert str(Path(__file__).resolve().parent) and resolve
their data paths from __file__; test_hermes.py is rewritten as the host probe it
always was (skills root from HERMES_SKILLS_DIR/HERMES_HOME/~/.hermes/skills, rc 0
found / 77 SKIP / 1 FAIL) instead of binding a module that does not exist.
Falsified: poisoning the repo copy reds the rebound test (rc 1) and leaves HEAD's
host-bound copy green (rc 0), both restored.
(b) path-claims: 225 new -> 0. All 225 came from sol's untracked-file census; each
was measured (0 add-commits on any ref, present on disk untracked, listed verbatim
in the census) and is a NOT_ADDED row under a batch note. One CLEARED row dropped
(spark/lwc_counter.py, resurrected at 3e667eb after Q125 retired it).
Carried in, not authored here: tools/verify.py's ninth leg and the two-line Q98
record (Sentinel's Q98 artifact), so HEAD agrees with Q98's own text.
verify --repo .: 9 legs, 9 pass, 0 fault -- gate OK. Report:
/root/.hermes/wizard-outputs/volt/2026-10-30-q126.md
The census directory read red at HEAD for a reason the item does not name: the
extractor writes the TSV with csv.writer(delimiter='\t') (QUOTE_MINIMAL), and the
CHECK read it back with line.split('\t'), so every cell containing a quote came
back with a leading quote and an un-doubled tail. 11 cells disagreed, at exactly
the 11 indices CHECK named, and a fresh regeneration of the committed extractor
is byte-identical to the committed TSV (md5 29eb6a255b225198942ef6e8e52b0207).
check_workqueue_census.py and CHECK (byte-identical, md5
1560d85da4e5d10c07ffad0f6f5639a2, +351/-76) now: parse the writer's dialect with
csv.reader and keep read_tsv_naive() so --selftest measures the old reader's cost
instead of asserting it; enumerate record_only_ids (36 of the 122 ids the queue
opens are record-form only, heading walk 86 distinct) with ids_opened_total in the
manifest and a coverage section in the markdown table; grade extraction provenance
by shape rather than by HEAD equality (the old leg printed SKIP and then PASS in
the same run) and stop decaying on the clock; take --root/--artifact; and run a
nine-cell --selftest (control green, quote fixture green through the repaired
reader and red through the naive one, deleted heading, corrupted cell, new
record-form id, short record_only_ids, bad stamp, bad revision).
Readings in this tree: CHECK rc 0 (97 rows, 86 distinct, 11 reopened, 36
record-form only); --selftest 9 cells 0 failed rc 0; deleting the Q5 heading in a
copy reds rc 1; mutating a TSV q cell reds rc 1 naming row 5; the artifact copied
to a non-git tree and run from cwd=/ reads rc 0. Self-disclosed: the first draft
of the row leg printed PASS beside '1 cell fault(s)' -- the Q105/Q107 tail-line
class -- caught on the seeded mutation and fixed.
Also lands the Q119 DONE record, whose artifacts are the commit above.
snippet.py: check_tools() imports hermes_tools and requires callable(getattr(...));
--require is the negative-control hook; HERMES_HOME/HERMES_PROFILE/--home/--profile
resolve every path; rc 0/1/2. verify_hermes_setup.sh: HERE from $0, sibling
snippet.py graded, --home/--root/--profile, VERDICT line, rc 0/1/2.
New test_env_verifiers.py (14 black-box cells, stub hermes_tools on PYTHONPATH,
synthetic trees) and CHECK-env-verifiers. Pre-repair blobs: 9 cells red for
snippet.py, 6 for the shell script.
The old check imported json, subprocess and datetime -- all stdlib -- so
its failure condition was unreachable, and its version-reporting helper
check_package was defined and never called. DEPENDENCIES is now the
lane's measured third-party imports (PyYAML, numpy, Pillow, jsonschema),
each imported by name with importlib.metadata version; missing -> rc 1,
broken -> rc 1, usage error -> rc 2. email_validator is not declared:
spark's own email_validator.py is a local stdlib-only module.
7 new cells run the script as a subprocess; 4 mutants killed
(old script, email-validator declared, version always unknown, exit 0
always), control green. Queue Q120 closed with the record appended and
docs/queue-index.md re-rendered in the same commit.
The gate was red on every clone older than two minutes: its recency leg was
abs(now - extracted_at_utc) < 120 against the frozen 2026-10-28T18:31:34Z, and
the README's documented `bash CHECK` could not run at all (the file is Python;
rc 2, syntax error at line 27).
- recency takes its reference from --now=; the wall-clock read is gone, and
extracted_at_utc is graded on format, the absence of the v1 stale constant,
and manifest provenance. No reference -> one SKIP line, gate still decides.
- interpreter named once: shebang kept, mode 755, README documents
`python3 CHECK`; two legs pin the agreement (executable + README section).
- --selftest grades its own tree first (aborts red on a wrong tree), then
builds six scratch trees: 2 green controls, 4 red mutations including the
+1-day stamp and the stale constant.
Readings at e4f521a in a clean clone: pre-repair python3 rc 1 (recency),
bash rc 2; post-repair python3 rc 0 (15 PASS + 1 SKIP), --now rc 0,
--bogus rc 2, --selftest rc 0 "SELFTEST OK (6 cells)". Independent
reproduction: wizard-outputs/volt/verify_q122.py, 15 PASS, rc 0.
Volt's Q123 escalated instead of deciding whether WIZARDS-TABLE.md gains the working
lanes or check-ins must be signed by a wizard handle. Ruled: lanes sign as themselves.
- WIZARDS-TABLE.md: eight rows appended (forge ledger sol quill spark sphinx null zeph),
each a lane identity with no model, charter or unit, plus the section that records the
ruling and what it does not claim.
- tools/checkin_baseline.tsv: the 2026-10-27-forge.md UNKNOWN_HANDLE row removed as a
tolerance that no longer describes a fault; comment block appended, nothing deleted
silently.
- Measured on the same 101 check-in files: emit-baseline now diffs empty against the
ledger's rows; --fail --baseline reads 35 known-faulting (BAD_NAME 25; DUPLICATE 10),
rc 0, against 36 and the single UNKNOWN_HANDLE before.
- Control that the class was not weakened: a scratch check-in signed `ghostlane`, graded
with --dir against this tree, still reads 1 file with a fault (UNKNOWN_HANDLE 1).
- tools/verify.py --repo .: 8 legs, 8 pass, gate: OK.
Closure record at the foot of WORK-QUEUE.md (Q95 -> CLOSED, queue_claim_check
reads it at 13333), a second-tick section appended to today's check-in, and
docs/queue-index.md re-rendered with the committed tools/queue_index.py.
Repo gate after the previous commit: 8 of 8 legs pass, rc 0.
- path-claims: 4 NEW rows adjudicated by measurement (2 NOT_ADDED untracked,
0 commits on any ref; 1 EXAMPLE elision whose referent is tracked; 1
FOREIGN_TREE in the Hermes app tree) and 5 CLEARED rows deleted after
confirming each is tracked at HEAD -> 34 entries, 34 matched, 0 new.
- checkin: 2026-10-27-forge.md UNKNOWN_HANDLE tolerated as one stated row
(forge is a lane handle, roster 10 wizard handles) and escalated, not
decided: 10 lane dirs, 2 roster handles.
- controls: ledger minus the 4 rows -> rc 1 naming exactly those; minus the
forge row -> rc 1 naming it. selftests 31/31 and 36/36. verify.py 8/8 pass.
Also lands the Q111 landed-count addendum left uncommitted at 7c36185 (its
2-line append and its index render were still in the worktree).
Repair: 960469d. Pre-fix cell + 11 ms scheduler gap -> rc 1, dt 0.03897-0.03912
(the observed 0.03909 at 7c36185 minus its 10.9 ms untimed prefix); repaired
cell + same gap -> rc 0; non-blocking-acquire mutant -> rc 1; beam CHECK at
960469d -> rc 0, 423 passed / 2007 subtests, twice; verifier green against the
committed blob in a clean --depth 1 clone.
Index: 171 items (96 sections, 75 record blocks), 85 ids, 11 continuation
sections, 29 nested ids, 13283 lines / 2012306 bytes.
Volt
volt
volt
ledger
volt
spark
zephyrus-sparkborn
pipe
Volt
timmy