volt
926f9a1c59
The census was red at HEAD (96 rows vs 97 headings), named its source by absolute host path, and decided its verdict from the worktree at read time. It now pins source_blob_sha/sha256/rev, records a row digest, refuses to pin a dirty worktree, reads the pinned blob in CHECK, and reports drift as an advisory. 9 selftest cells; the non-decay claim is measured on real commits.
142 lines
7.2 KiB
Markdown
142 lines
7.2 KiB
Markdown
# Work queue census v2
|
|
|
|
Corrected, complete census of every numbered work-queue item in
|
|
`WORK-QUEUE.md`, extracted for the **Extract** lane (data extraction and
|
|
tables).
|
|
|
|
## What this is
|
|
|
|
One row per `## Q<n> ...` heading in the source: 97 headings, 86 distinct q
|
|
labels, 11 reopened labels. Each row carries the verbatim heading title plus a
|
|
`status` (first `**Status:` marker, whitespace collapsed, truncated at the
|
|
first sentence end) and `done_implies` (first `**Done means:` line).
|
|
|
|
A record written in the bold-lead form (`**Q135 — ...`) is not a heading and
|
|
therefore has no row. That is deliberate and unchanged: the table's unit is the
|
|
heading, and `WORK-QUEUE.md` carries 93 bold-lead records that no heading
|
|
parser can see. Counting those is a different artifact's job, not this one's.
|
|
|
|
## Artifacts (in this directory)
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `workqueue-census.tsv` | Tab-separated table of all 97 rows (artifact of record). |
|
|
| `workqueue-census.md` | Markdown table of the same rows. |
|
|
| `extract_manifest.json` | Schema + counts + provenance + the source pin. `extracted_at_utc` is the measured run moment, not a constant. |
|
|
| `CHECK` | Real verification: re-derives the rows from the **pinned** source bytes with plain string operations (no import of the extractor) and compares. Python 3; exits 0 only if correct. |
|
|
| `extract_workqueue.py` | The extractor that produced the TSV/MD/manifest. |
|
|
|
|
## Provenance (Q135, 2026-10-31)
|
|
|
|
The manifest no longer names its source by absolute host path — that was the
|
|
Q69/Q106/Q109 class, and it made the artifact grade whatever tree the host
|
|
happened to hold. It records:
|
|
|
|
| Field | What it is |
|
|
|---|---|
|
|
| `source` | `WORK-QUEUE.md` — repo-relative, never a host path |
|
|
| `source_rev` | `git rev-parse HEAD` at generation |
|
|
| `source_blob_sha` | `git rev-parse HEAD:WORK-QUEUE.md` — the pinned bytes |
|
|
| `source_sha256` | sha256 of the bytes actually read |
|
|
| `source_lines` | line count of those bytes |
|
|
| `source_matches_head_blob` | whether the pin was taken from a clean worktree |
|
|
| `row_digest` | sha256 of the emitted TSV data rows |
|
|
|
|
The pin is honest or the extractor refuses. If the worktree's `WORK-QUEUE.md`
|
|
differs from the HEAD blob, `extract_workqueue.py` exits 1 and writes nothing:
|
|
a pin to a blob that does not contain the rows in the TSV is a false
|
|
provenance claim. `--allow-dirty` snapshots the worktree anyway and records
|
|
`source_blob_sha: null` with `source_matches_head_blob: false`, so `CHECK`
|
|
grades the worktree bytes and says so.
|
|
|
|
## Verification
|
|
|
|
`CHECK` is a Python 3 program, not a shell script. Run it with the interpreter
|
|
itself (the file is executable, so `./CHECK` works too):
|
|
|
|
python3 CHECK
|
|
python3 CHECK --now=2026-10-31T00:00:00Z # also grade stamp recency
|
|
python3 CHECK --selftest # prove every leg can fail
|
|
|
|
It reads the source from the blob the manifest pins (`git cat-file blob`), not
|
|
from the worktree file, re-derives the expected rows with string operations
|
|
(independent implementation from `extract_workqueue.py`), then compares qid +
|
|
title against the committed TSV, recomputes the manifest's counts and row
|
|
digest, grades the provenance and the extraction timestamp, and checks for
|
|
delimiter corruption. It exits 0 only if every graded check passes, 1 if a
|
|
check fails, 2 on a bad invocation.
|
|
|
|
**A declared pin that git cannot read is a fault, never a fallback.** An
|
|
artifact that cites a blob nobody can open has no provenance, and grading
|
|
whatever the worktree now holds would grade bytes the manifest never named.
|
|
(The one cost: a shallow clone that does not carry the pinned object fails
|
|
this leg. Full clones are the norm here; `--allow-dirty` generation records no
|
|
pin and skips the problem by declaring it.)
|
|
|
|
**The timestamp leg does not read the wall clock.** `extracted_at_utc` is
|
|
graded on what the artifact can prove about itself — it parses as a UTC `Z`
|
|
stamp and it is not the stale constant the v1 census shipped — and its
|
|
*recency* is graded only against a reference time the caller supplies
|
|
(`--now=`). With no reference, that one leg prints `SKIP` and the rest of the
|
|
gate still decides.
|
|
|
|
**Drift is reported, not graded.** When the worktree's heading count differs
|
|
from the pinned source's, `CHECK` prints
|
|
`ADVISORY source-moved worktree=<n> pinned=<m>` and still exits 0. A census is
|
|
a snapshot of named bytes; a snapshot that goes red because the world moved is
|
|
a snapshot nobody regenerates. Regenerate to move the snapshot forward:
|
|
|
|
python3 extract_workqueue.py # refuses on a dirty source, by design
|
|
|
|
## Why a new census
|
|
|
|
The earlier `2026-10-28-workqueue-census/` failed its own contract:
|
|
|
|
1. Its `CHECK` re-imported `extract_workqueue_census`, so it could never fail
|
|
(a tautology, which the Standing Agreement forbids).
|
|
2. Its `extracted_at_utc` was a hardcoded constant
|
|
(`2026-10-28T00:00:00Z`) that did not match the source commit time.
|
|
|
|
This v2 production is the corrected, independently verified replacement.
|
|
|
|
### v2's own corrections
|
|
|
|
**2026-10-28 (Q122).** v2 fixed the tautology and then bound its verdict to the
|
|
clock instead: the recency leg was `abs(now - dt) < 120` against the frozen
|
|
`2026-10-28T18:31:34Z`, so the artifact could only ever be green for the two
|
|
minutes after its own generation, and the documented command `bash CHECK`
|
|
could not run at all (the file is Python). Both are repaired: the recency leg
|
|
takes its reference as an argument, and the interpreter is named once, in the
|
|
shebang and here.
|
|
|
|
**2026-10-31 (Q135).** Three things had gone wrong with the artifact itself,
|
|
all measured at `7b42050` before the repair: its `CHECK` was **red at HEAD**
|
|
(`FAIL row count 'committed=96 golden=97'`, `FAIL manifest.rows 96 vs 97`,
|
|
`FAIL manifest.distinct_q_labels 85 vs 86`) because the table was a
|
|
2026-10-28 snapshot of a file that had since gained a heading and nothing
|
|
regenerated it; its `manifest.source` was the absolute host path
|
|
`/root/troupe-standup/WORK-QUEUE.md`; and its verdict was a function of the
|
|
worktree at read time, so every append moved the answer. The repair pins the
|
|
bytes, grades the pin, records a row digest, and makes drift an advisory. The
|
|
counterfactual is committed as a selftest cell and demonstrated on real
|
|
commits: at a descendant revision carrying three extra headings, `CHECK` still
|
|
reads `ALL CHECKS PASSED (97 rows, ...)` rc 0 plus the advisory.
|
|
|
|
## Evidence
|
|
|
|
- Source: `WORK-QUEUE.md` at the repo root (resolved from this directory:
|
|
`HERE/../../..`), pinned to blob `624ecb72ead1f01b60cdbaca892278858167aa5e`
|
|
at rev `7b4205014c8f95e6dbf45d1ba62a0b39cc926a88`.
|
|
- Extracted: `2026-10-31T09:42:38Z` UTC (measured at generation; the manifest
|
|
carries this stamp, and `--now=` grades recency against it).
|
|
- Independent re-derivation count: 97 rows; 86 distinct labels; 11 reopened
|
|
(`Q37 Q38 Q39 Q43 Q60 Q72 Q79 Q81 Q82 Q83 Q93`).
|
|
- `python3 CHECK` → `ALL CHECKS PASSED (97 rows, 86 distinct labels, 11
|
|
reopened)`, rc 0.
|
|
- `python3 CHECK --selftest` → `SELFTEST OK (9 cells: 3 green controls, 6 red
|
|
mutations)`, rc 0 — the red cells being an unreadable pin, a host-path
|
|
source, a corrupted row digest, a corrupted title, the stale constant, and a
|
|
stamp moved one day.
|
|
- `python3 extract_workqueue.py` on an uncommitted `WORK-QUEUE.md` → rc 1,
|
|
`REFUSED: the worktree's WORK-QUEUE.md is not the HEAD blob`, TSV untouched.
|