Primitive composition: finite results

Status: engineering-only evidence; no native caller adoption or alpha acceptance credit. The initial source was 979f0d3f975fdd7788d8ef2756e71c9841854b4c; successor composition at 02f5b6c4de90584a91fa3e26fd1045cd5b6d4380 is recorded below. These results combine isolated Rust kernels, generated finite controls, and one local captured inspect string. They do not authenticate a producer or establish end-to-end product behavior.

Scope and execution

Runs used the mounted DATA drive and the existing python3 tools/resource_group.py containment. Rust microbenchmarks used Rust 1.99.0, edition 2021, opt-level=3, one codegen unit, overflow checks and debug assertions enabled, and debuginfo disabled. The recorded host was fedora-blade, Linux x86_64, Intel Core i7-10750H (6 cores / 12 threads). Kernel timings exclude input construction, parsing, I/O, and compilation unless specified otherwise.

The finite run commands were:

Run	Command shape	Result
primitives-separated-coverage-01 and -02	Hash-pinned bash results/primitive-composition-01/run-separated-coverage-{01,02}.sh; each compiles pinned extracted Rust tests with rustc --edition=2021 --test -C opt-level=3 -C codegen-units=1 -C overflow-checks=yes -C debug-assertions=yes -C debuginfo=0, runs controls, then paired ignored warm-benchmark tests.	Both exits 0. Two-pass: 21 registered controls; single-pass: 22 controls. The single-pass analysis also exited 0.
primitives-raw-artifact-controls-01	cargo test --manifest-path /run/media/kmosoti/data/FabricO11y/scratch/verification-primitives-01/Cargo.toml --offline --locked -p xtask --lib preflight::files::tests:: -- --nocapture for raw artifact controls.	Exit 0, 11 tests.
primitives-raw-artifact-integration-01	cargo test --manifest-path /run/media/kmosoti/data/FabricO11y/scratch/verification-primitives-01/Cargo.toml --offline --locked -p xtask --test preflight -- --nocapture for unchanged integration controls.	Exit 0, 12 tests.
primitives-raw-budget-mutant-01	cargo test --manifest-path /run/media/kmosoti/data/FabricO11y/scratch/verification-primitives-01/Cargo.toml --locked -p xtask --lib preflight::files::tests::raw_and_json_bodies_share_the_caller_selected_materialization_budget -- --exact --nocapture against the deliberate aggregate-budget mutant.	Exit 101, one expected failing test.
primitives-raw-restored-controls-01	The raw controls command above against the restored implementation.	Exit 0, 11 tests.
primitives-prefix-refinement-01	Hash-check, compile, and run pinned quiescent_prefix_04.rs with rustc --edition=2021 --test -C opt-level=3 -C codegen-units=1 -C overflow-checks=yes -C debug-assertions=yes -C debuginfo=0.	Exit 0, 17 tests.
primitives-prefix-api-01	Hash-check, compile, and run pinned quiescent_prefix_05.rs with the same Rust test profile.	Exit 0, 18 tests.
primitives-ack-experiment-02	Hash-check, compile, and run pinned exact_ack_join_03.rs with the same Rust test profile, then run --ignored --exact tests::warm_benchmark_required_sizes --nocapture.	Exit 0; 10 tests and benchmark completed.
primitives-inspection-baseline-01 / primitives-inspection-comparison-01	Compile and run the pinned decoder, then the paired fixture harness using the same Rust test profile; the comparison command verifies decoder, harness, and fixture SHA-256 pins before running new::tests:: and the paired benchmark.	Both exits 0; 5 baseline controls and 7 comparison controls.

The source revisions and raw logs are retained in the primitive-composition-01 and service-query-query-gap-01 result directories. The commands were contained; receipts report their owned units stopped.

Findings

The ACK experiment compares a hash-based reference with an ordered streaming join. A subsequent composition experiment compares separate byte/context checking with the earlier fused context checker. Its first candidate made two traversals and had a median of 1,632,141 ns versus 1,096,975 ns for the baseline, a 48.8% regression. It was inside the registered 50% screen but was not selected. The single-pass refinement measured 1,126,818 ns versus 1,116,036 ns baseline, a 0.97% regression, and was retained for adapter controls. It uses O(sources + events) traversal and constant auxiliary join state rather than a parallel ACK vector. These are fixed-host kernel measurements, not a universal ranking or end-to-end speed claim.

The raw artifact controls preserve descriptor-owned reads and identity checks, require the caller’s smaller shared raw/JSON byte budget, and do not reopen cached bodies. The deliberate mutant ignored retained raw bytes during aggregate admission; its mixed JSON/raw budget assertion failed as intended (exit 101). Restored controls passed. This does not provide producer authenticity or a hostile privileged-writer guarantee.

The quiescent-prefix reducer passed its finite composite controls and API refinement. A retained counterexample showed that a commit of sequence 9 before pause could be incorrectly accepted with cutoff 3: the defective run exited 101 after 15 passes and one failure. The correction tracks the maximum observed pre-pause commit and refuses a lower cutoff. A separate earlier setup failure (exit 1, zero tests) was sibling test-helper visibility and is not causal RED evidence.

The exact ACK join’s 100,000-item warm samples were hash: 11,834,071 / 10,019,791 / 9,876,907 ns; stream: 1,123,232 / 1,211,122 / 1,119,939 ns. The stream used zero auxiliary collection entries at that size, versus 200,000 for the hash reference; its recorded source-order plus event comparisons were 199,999. The experiment excludes payload hashing, JSON, I/O, and real process validation. Its retained fixture is the Fedora 107–116 tail: the Rust projection refuses missing sequence 116, and the previously executed unchanged Python full-bundle replay independently rejects the retained bundle. The earlier retained Rust run exited 101 because one negative fixture expected a later ordering error even though a missing-source rejection occurred first; the two refusal cases were kept separate without changing the algorithm.

The inspection decoder comparison checked every field from the captured successful output before timing. At 100,000 iterations per sample over three alternating pairs, the old decoder samples were 65,422,084 / 61,070,402 / 61,616,977 ns (median 61,616,977 ns); the new decoder samples were 51,824,212 / 51,146,472 / 50,081,987 ns (median 51,146,472 ns). The new parser caps input at 4,096 bytes before tokenization, uses fixed field slots and an iterator rather than a token vector, and borrows the node identity. Health flags remain observable. This is one fixture benchmark, not producer attestation.

The extracted kernel controls ran against the actual module (22 tests, exit0). The integrated custody:: library controls ran 29 tests with exit0; cargo test -p xtask --test custody_cutoff ran 4 CLI tests with exit0. The four affected native capture/custody unittest modules ran 72 tests with exit0. Scoped Clippy initially exited101 on five lint diagnostics; the original sources remain archived, and corrected Clippy plus library controls exited 0. These controls exercise implementation boundaries; they are not independent producer attestation.

Native-capture boundary and retained independent evidence

The local f001 capture records native_journal_attestation: false; it targets node0/node0.conf and lacks the registered guest phase’s process-observation list and pinned inspection stdout artifacts. The host projection review therefore remains source-only and must refuse this capture. No missing times, sender fields, or phase observations are synthesized. The native caller still needs the full raw-journal/process binding and a matching guest capture before this cutoff adapter can replace duplicated host policy.

The Python custody, query, delivery, and rate oracles remain independent and unchanged. Generated Rust controls are supplemental; they do not replace those oracles. No result here qualifies the product or completes integration.

Counterexamples and run status

Meaningful failures remain preserved: the two-pass cost result above; the raw aggregate-budget mutant (exit 101); the commit-9/cutoff-3 prefix counterexample (exit 101); and the earlier exact-ACK fixture-ordering failure (exit 101). The malformed-setup and later correction records remain separately labeled, not recast as algorithm failures.

Cleanup accounting was corrected on 2026-10-18: resource_group.py cleans its private TMPDIR, not binaries explicitly placed in shared FABRIC_SCRATCH_ROOT. The two guarded cleanup runs exited 0 and removed nine receipt-matched standalone binaries; the second also removed the successful empty run namespace and the newly installed documentation dependencies (135,944,246 bytes). Exact names, identities and digests remain in cleanup logs. Prior owned compiler caches 01/02 were removed; the explicitly owned target 03 cache remains controlled for the active implementation round. Historical failures, frozen packages and unrelated scratch remain preserved.

The full fast command was cargo xtask checks --profile fast --light-workers 2 --receipts DATA/results/primitive-composition-01/fast-receipts-03, with exact source 979f0d3, a private DATA build target and an explicitly owned runner-controls-primitives03 scratch namespace. All 20 checks completed with exit0; the resource receipt confirms whole-unit stop after 6m23s, about 2 GiB peak memory and zero swap. The existing light cohort used at most two workers; heavy jobs remained serial. Full guard log SHA-256: 8299f72115bfe1ef01008b1a651ac3de90c1bd4e5c1d3f5031d15a95815d27f8. Resource receipt SHA-256: 5514030d760e5d46a146de8964288425364e45920b7a4a788a096b2f4721aeee.

The preceding fast02 remains interrupted with exit 2: strict census encountered a removed shared scratch fixture and stopped the whole job. Its partial receipts are not success evidence. The correction used the census's existing test-owned retry namespace and explicit scratch binding; no storage guard, retry policy or resource limit was weakened. Documentation checking (bun tools/docs/check.mjs) exited 0; it declared 36 private/unavailable evidence references without claiming those links validated. The final repository documentation-only commit is d52b0aa; Rust/native implementation inputs remain those tested at 979f0d3. Native caller adoption and matching guest capture remain pending, and alpha acceptance remains owner-paused.

Captured-metadata composition at 02f5b6c

The Rust projection experiment used synthetic command, process-sample and journal metadata, with the same literal inspection body and actual public cutoff consumer. The first executable control exposed acceptance of a sample before the applied marker: baseline exited101, six tests passed and one failed. The one-predicate semantic correction passed all seven controls. A refinement removed sample/command/event interval and index collections and merged a fixed five-item lifecycle selection directly with the ordered journal. It also passed seven controls.

Both semantically correct prototypes ran under Rust1.99.0, edition2024, opt3, codegen1, overflow/debug assertions enabled and debug0. Before timing, each normalized JSON output was checked equal. The registered fixture added0/10/1000/4000 inert records to each command/sample/event stream; input construction was excluded. Each side ran100 projections per sample, with nine alternating paired samples at each size. At4000, median totals were1,137,975,674 ns for the indexed prototype and1,140,345,024 ns for the fixed-selection prototype: 0.208% slower, with no meaningful speed claim. The chosen benefit is the source-derived removal of auxiliary interval/index collections, not allocator bytes or measured RSS. Traversal remains linear; final trace/source/ACK output storage is separate from auxiliary selection state. This is neither native latency nor a universal optimum.

Separate producer effect controls exercised actual guest lifecycle methods with mocked effects. Current source reproduced missing pause before stop (exit1). The candidate's normal effect order passed, but three floating-point control-field substitutions were accepted (exit1). Adding explicit integer checks yielded four focused tests with exit0, including delayed application without repeated action and rejection of unrelated inspection errors. The corrected DATA-only producer candidate is not integrated; exact profile/witness/caller work remains pending.

A raw-journal experiment mutated six sender fields independently for Batch, configuration and delivery records. The old adapter missed twelve Batch/config substitutions while delivery refused correctly (exit1). Commit 58108e2 applies the existing full sender join to all three recognized record families; all74 affected native tests passed (exit0). It preserves event shapes and the independent custody/query/delivery/rate oracles.

The integrated Rust command accepts captured metadata version2 through the same owned plan reader, projects into the existing normalized version1 checker and rechecks identities. No Python projection draft was integrated. Eight integration tests passed, including actual CLI refusals for extra/missing fields, wrong candidate, a pre-marker sample, source digest mismatch and body substitution. An initial fixture borrow-lifetime compile failure and a subsequent Clippy argument-count failure remain preserved; neither is classified as a semantic RED. Reusing the already-bound sender removed the redundant arguments; scoped Clippy exited0 without suppressions.

At exact source 02f5b6c4de90584a91fa3e26fd1045cd5b6d4380, cargo xtask checks --profile fast --light-workers 2 completed all20 checks with exit0. The documentation check then exited0 in the same resource group. Runtime was4m59s; peak memory530.8MiB, swap0; whole-unit stop was confirmed. Guard log SHA-256: 0c10a4f3e028d1b35673d13fe01cb3105495e61e0630ff5803d6a8167039a2b2; resource receipt SHA-256: 0a5d46e1160232247fed84c596756d67374472ff6f1e3ef5a2014e4f49958631. Exact commands, paired samples, failed sources and receipts remain on DATA. No package was rebuilt or refrozen, and no alpha acceptance case was executed or credited.

The subsequent owned archive/cleanup run exited0 and confirmed whole-unit stop. It rechecked documentation, verified the engineering Git bundle and copied the tested helper before removing target03 (6,038,070,698 apparent bytes), new documentation dependencies (135,944,246 bytes) and the empty owned run namespace. The preserved helper SHA-256 is 244e0ce0f88c99f95fa2bc243b09322a714f409af6194e0ffb801bb62d7049d7; source-bundle SHA-256 is 172f5bcf7b5808620e0d335bb249be438372951413c82f1767b5164dec467d15, requiring published base f001175ff4006e2f95294458ce36f4f089d3be7d. Bundle head 9b30a023 changes only current-state documentation after compiled source02f5b6c. The manifest and outer cleanup receipt remain on DATA. Native producer/profile/caller integration is the next admitted engineering work; alpha acceptance remains paused.

Owner stop checkpoint — 2026-10-18

Engineering branch milestone/verification-primitives is pushed at 31cf80923ed882b30822618280f5d70ca82fb431; docs/CURRENT.md contains the resume handoff. Alpha acceptance remains owner-paused. No release or acceptance credit.

The current static-profile oracle reached its expected semantic refusal in primitives-native-profile-baseline-01 (exit1). Candidate01's cached-view test first encountered an import setup failure (cached-view-red-01, exit1, not a semantic result). With the import environment corrected, cached-view-red-02 accepted the valid transition but failed to reject altered raw bytes hidden by a forged cached view (exit1). That draft is rejected and retained. Candidate02 reparses actual retained bytes and checks digest/size/original private metadata; its eight focused controls exited0. The independent oracle change is isolated in d81c26b0a19b305a1edddde11bf0d4d700271ee6; its default static rule and custody, source/SHA ACK, query, gap and reboot algorithms remain intact.

The producer now performs pause2/drain/stop/stopped-inspection/resume3 while the node remains stopped, and active3/pause4/resume5 across reboot. Operational waits are not native attestation. primitives-native-producer-integrated-01 ran86 controls, exit0; the distinct reboot effect controls ran in primitives-native-producer-reboot-02, exit0. Final primitives-stop-checks-cleanup-05 ran all87 affected controls and the Bun documentation checker, exit0. Log SHA256: 1ed4b5f87ec301fc9a262fa494df6e7f1175b9f4d5465aeed3474a5ce8832d63. Containment receipt SHA256: 4ae7baf86284a7d729f8eb8a61310389115c975e7961a6ac7e1b35866b22b1d7. The service stopped with no surviving project unit. Peak162.7MiB, swap0. Owned temporary documentation dependencies and the empty test scratch directory were identity-checked and removed. The previously archived helper/source bundle, failed drafts and frozen package evidence remain on DATA. The owner checkout's modified mutants.txt remains unchanged.

The full20-check fast result still belongs to 02f5b6c, not the later Python changes. Resume by implementing the explicitly pinned native caller bridge from its DATA-only plan, preserving original archive/body joins and helper outputs. No bridge candidate code or matching native capture ran. Replay the historical Fedora missing116-ACK refusal unchanged, run affected controls and the complete fast profile, then register and execute an engineering-only native capture. The queue is results/primitive-composition-01/queue.json on DATA. No optional exploration or alpha acceptance was started after the owner requested this stop.