0 Fork 0

Files

T

volt 926f9a1c59 volt: pin the workqueue census to its source (Q135)

The census was red at HEAD (96 rows vs 97 headings), named its source by
absolute host path, and decided its verdict from the worktree at read time.
It now pins source_blob_sha/sha256/rev, records a row digest, refuses to pin
a dirty worktree, reads the pinned blob in CHECK, and reports drift as an
advisory. 9 selftest cells; the non-decay claim is measured on real commits.

2026-10-31 09:44:40 +00:00

7.2 KiB

Raw Blame History

Work queue census v2

Corrected, complete census of every numbered work-queue item in WORK-QUEUE.md, extracted for the Extract lane (data extraction and tables).

What this is

One row per ## Q<n> ... heading in the source: 97 headings, 86 distinct q labels, 11 reopened labels. Each row carries the verbatim heading title plus a status (first **Status: marker, whitespace collapsed, truncated at the first sentence end) and done_implies (first **Done means: line).

A record written in the bold-lead form (**Q135 — ...) is not a heading and therefore has no row. That is deliberate and unchanged: the table's unit is the heading, and WORK-QUEUE.md carries 93 bold-lead records that no heading parser can see. Counting those is a different artifact's job, not this one's.

Artifacts (in this directory)

File	Purpose
`workqueue-census.tsv`	Tab-separated table of all 97 rows (artifact of record).
`workqueue-census.md`	Markdown table of the same rows.
`extract_manifest.json`	Schema + counts + provenance + the source pin. `extracted_at_utc` is the measured run moment, not a constant.
`CHECK`	Real verification: re-derives the rows from the pinned source bytes with plain string operations (no import of the extractor) and compares. Python 3; exits 0 only if correct.
`extract_workqueue.py`	The extractor that produced the TSV/MD/manifest.

Provenance (Q135, 2026-10-31)

The manifest no longer names its source by absolute host path — that was the Q69/Q106/Q109 class, and it made the artifact grade whatever tree the host happened to hold. It records:

Field	What it is
`source`	`WORK-QUEUE.md` — repo-relative, never a host path
`source_rev`	`git rev-parse HEAD` at generation
`source_blob_sha`	`git rev-parse HEAD:WORK-QUEUE.md` — the pinned bytes
`source_sha256`	sha256 of the bytes actually read
`source_lines`	line count of those bytes
`source_matches_head_blob`	whether the pin was taken from a clean worktree
`row_digest`	sha256 of the emitted TSV data rows

The pin is honest or the extractor refuses. If the worktree's WORK-QUEUE.md differs from the HEAD blob, extract_workqueue.py exits 1 and writes nothing: a pin to a blob that does not contain the rows in the TSV is a false provenance claim. --allow-dirty snapshots the worktree anyway and records source_blob_sha: null with source_matches_head_blob: false, so CHECK grades the worktree bytes and says so.

Verification

CHECK is a Python 3 program, not a shell script. Run it with the interpreter itself (the file is executable, so ./CHECK works too):

python3 CHECK
python3 CHECK --now=2026-10-31T00:00:00Z    # also grade stamp recency
python3 CHECK --selftest                    # prove every leg can fail

It reads the source from the blob the manifest pins (git cat-file blob), not from the worktree file, re-derives the expected rows with string operations (independent implementation from extract_workqueue.py), then compares qid + title against the committed TSV, recomputes the manifest's counts and row digest, grades the provenance and the extraction timestamp, and checks for delimiter corruption. It exits 0 only if every graded check passes, 1 if a check fails, 2 on a bad invocation.

A declared pin that git cannot read is a fault, never a fallback. An artifact that cites a blob nobody can open has no provenance, and grading whatever the worktree now holds would grade bytes the manifest never named. (The one cost: a shallow clone that does not carry the pinned object fails this leg. Full clones are the norm here; --allow-dirty generation records no pin and skips the problem by declaring it.)

The timestamp leg does not read the wall clock. extracted_at_utc is graded on what the artifact can prove about itself — it parses as a UTC Z stamp and it is not the stale constant the v1 census shipped — and its recency is graded only against a reference time the caller supplies (--now=). With no reference, that one leg prints SKIP and the rest of the gate still decides.

Drift is reported, not graded. When the worktree's heading count differs from the pinned source's, CHECK prints ADVISORY source-moved worktree=<n> pinned=<m> and still exits 0. A census is a snapshot of named bytes; a snapshot that goes red because the world moved is a snapshot nobody regenerates. Regenerate to move the snapshot forward:

python3 extract_workqueue.py        # refuses on a dirty source, by design

Why a new census

The earlier 2026-10-28-workqueue-census/ failed its own contract:

Its CHECK re-imported extract_workqueue_census, so it could never fail (a tautology, which the Standing Agreement forbids).
Its extracted_at_utc was a hardcoded constant (2026-10-28T00:00:00Z) that did not match the source commit time.

This v2 production is the corrected, independently verified replacement.

v2's own corrections

2026-10-28 (Q122). v2 fixed the tautology and then bound its verdict to the clock instead: the recency leg was abs(now - dt) < 120 against the frozen 2026-10-28T18:31:34Z, so the artifact could only ever be green for the two minutes after its own generation, and the documented command bash CHECK could not run at all (the file is Python). Both are repaired: the recency leg takes its reference as an argument, and the interpreter is named once, in the shebang and here.

2026-10-31 (Q135). Three things had gone wrong with the artifact itself, all measured at 7b42050 before the repair: its CHECK was red at HEAD (FAIL row count 'committed=96 golden=97', FAIL manifest.rows 96 vs 97, FAIL manifest.distinct_q_labels 85 vs 86) because the table was a 2026-10-28 snapshot of a file that had since gained a heading and nothing regenerated it; its manifest.source was the absolute host path /root/troupe-standup/WORK-QUEUE.md; and its verdict was a function of the worktree at read time, so every append moved the answer. The repair pins the bytes, grades the pin, records a row digest, and makes drift an advisory. The counterfactual is committed as a selftest cell and demonstrated on real commits: at a descendant revision carrying three extra headings, CHECK still reads ALL CHECKS PASSED (97 rows, ...) rc 0 plus the advisory.

Evidence

Source: WORK-QUEUE.md at the repo root (resolved from this directory: HERE/../../..), pinned to blob 624ecb72ead1f01b60cdbaca892278858167aa5e at rev 7b4205014c8f95e6dbf45d1ba62a0b39cc926a88.
Extracted: 2026-10-31T09:42:38Z UTC (measured at generation; the manifest carries this stamp, and --now= grades recency against it).
Independent re-derivation count: 97 rows; 86 distinct labels; 11 reopened (Q37 Q38 Q39 Q43 Q60 Q72 Q79 Q81 Q82 Q83 Q93).
python3 CHECK → ALL CHECKS PASSED (97 rows, 86 distinct labels, 11 reopened), rc 0.
python3 CHECK --selftest → SELFTEST OK (9 cells: 3 green controls, 6 red mutations), rc 0 — the red cells being an unreadable pin, a host-path source, a corrupted row digest, a corrupted title, the stale constant, and a stamp moved one day.
python3 extract_workqueue.py on an uncommitted WORK-QUEUE.md → rc 1, REFUSED: the worktree's WORK-QUEUE.md is not the HEAD blob, TSV untouched.

7.2 KiB Raw Blame History