spec(bridge): #258 — executable own-bridge contract (Bridge.md + behavior matrix) - #297
Conversation
…behavior matrix)
The normative migration contract for the Rust own-bridge crate (P-022 step
6a): everything in ownlang/ownir.py that determines verdicts beyond the JSON
schema, written down as rules and inventoried against the test suite.
spec/Bridge.md — rules BR-*:
* BR-B1/B2 bridge/analysis ownership boundary: prepare-and-map only, no
verdict repair, explicit re-anchor exceptions.
* BR-D1-D4 validation: the strict door's ordered checklist; the tolerant
direct-check_facts door (skip-not-coerce); the deliberate `sig`
asymmetry; document order is semantic.
* BR-L1-L11 fact lowering: the single routing table (with the to_own/
to_module twin rule), handle identity from global counters,
identity fallbacks, subscriber regions, per-function lowering
order + synthesized return types, localmap + kill-on-rebind,
the four-condition cross-branch hoist + safety walk, optimistic
untrack vs top-level kill sites, call lowering (channel routing /
direct Call / fresh mint), vocabulary enforcement, line handling.
* BR-M1-M3 MOS orchestration around spec/Inference.md (which stays the
normative MOS layer), plus a function-to-INF-rule map for the port.
* BR-P1-P3 DI / effects / protocols input preparation.
* BR-V1-V9 verdict mapping: the pipeline order, the closed OWN033/034/035/
040/041 skip list, map-or-raise (IR5) through structured subjects,
the message-synthesis matrix as a parity surface, anchor policy,
severity/suppression, the dedup key, stable ordering, rendering.
* §6 the three parity-fixture layers for #259 (validation / normalized
lowered representation / normalized diagnostics) with regeneration
and zero-Python steady-state expectations; layer 2 has no Python
emitter yet and is #259's first deliverable.
spec/BridgeBehaviorMatrix.md — the completeness ledger: every checks-block
family in tests/test_ownir.py (all 200+, none omitted) mapped to the BR/IR/INF
rule it pins, its Python source, and its Rust fixture layer; suites beyond
test_ownir.py enumerated.
Ambiguities are issues, not TODOs: #294 (tolerant-door scope, unknown-kind
fallback, line coercion), #295 (positional identity fallbacks, evidence-blind
dedup, anchorless SARIF URIs), #296 (generated matrix cross-check). Guardrails
respected: no production code changed, no schema redesign, no new diagnostics.
Closes the deliverable of #258; independent review gates #259.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MdYFKUaygHz1T9H1qJ7BqK
|
Warning Review limit reached
Next review available in: 29 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…olerances Two normative wording fixes from #297 review: * BR-B1 was internally inconsistent: "nothing that changes which sites are found" contradicted BR-L1's routing, which legitimately admits, suppresses, and redirects sites (unresolved skip, self-subscribe drop, released-capture mitigation, returned_fresh provenance, token-vs-region path choice). Restated: the bridge does not independently solve for violations after routing; its only authority to admit/suppress/redirect is the CLOSED routing behavior of BR-L1 (+ the lowering-time admission rules BR-L6-L9) and the advisory side paths of BR-V1 — over admitted inputs the analyses own every verdict. * BR-D2's "skipped, never coerced" overclaimed: the same sentence then described DI field coercions. Restated as three distinct tolerances — malformed entries skipped whole; accepted entries subject to the existing field-specific coercions; line degrading via _as_int only on the paths that use it (OD-3) — so the tolerant door's contract matches what #294 is actually deciding. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MdYFKUaygHz1T9H1qJ7BqK
… main yet Codex review on #298 correctly flagged that spec/Bridge.md and spec/BridgeBehaviorMatrix.md are referenced as delivered but do not exist in this checkout — they live on PR #297 (the #258 deliverable, in independent review). Reworded the 6a status in both places to say the specs land with PR #297 and #259 starts only after that review gate, so the checklist stays truthful regardless of which PR merges first. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MdYFKUaygHz1T9H1qJ7BqK
|
Independent review verdict (recorded per #258 acceptance): APPROVED, no blocking findings — head Verified against the implementation:
Non-blocking wording nit (not worth a commit, noted for the record): BR-L7's safety condition says early exit "before the post-merge release"; the implementation also hoists the use-only case so the leak is correctly reported — "post-merge reference/discharge" would be the fully literal phrasing. The behavior matrix already lists the use-only case. Gate for #259 is satisfied once this merges; #259's first deliverable stays strictly the Layer 2 normalized-lowered-representation emitter + committed goldens + regeneration path. Generated by Claude Code |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2b8e82f29b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 2-step; effect re-run→mint; protocol opened→barrier). Steps with unknown lines | ||
| (`< 1`) are omitted; a slice shorter than 2 steps is dropped. |
There was a problem hiding this comment.
For DI paths where only one service in the path has a real registration line, the current Python bridge still keeps and renders a one-location codeFlows entry: _di_findings stores flow=di_path_steps(...), and ownlang.evidence.code_flow returns a flow for any non-empty surviving step list. This rule would make the Rust port drop those one-step flows, so SARIF parity diverges whenever later DI path hops lack locations.
Useful? React with 👍 / 👎.
| a matching `sig`, else the name-merge; (b) otherwise a **direct `Call`** is | ||
| emitted only when the callee has a summary or is a sink extern — an | ||
| unresolvable callee (BCL/extension method) is dropped: no effect, no claim, |
There was a problem hiding this comment.
For a unique first-party callee emitted as global::C.M, _mos_lookup can resolve the canonical C.M summary, but _lower_flow only emits the direct Call when mos.get(callee) exists under the raw call name; otherwise the call is dropped unless it went through overload/may channel routing or fresh-result minting. As written, a port could treat any canonical summary as directly resolvable and apply consume/borrow effects that Python currently misses, changing OWN001/OWN002 results for global-qualified unique calls.
Useful? React with 👍 / 👎.
The normative documents described the pre-slice-3 world. Recorded now: * spec/Bridge.md §6 Layer 2: #299 (Python emitter + fixture foundation), #300 (typed own-lowered surface/emitter, presence-aware metadata, per-document version gate), #301 (own-bridge constructs Layer 2 from facts and reproduces all 26 shared goldens byte-exact; golden is expected output only); tolerant_unknown_kind stays Python-only under #294 (the Rust bridge fails loud on an unknown kind instead of adopting the tolerant fallback); Layer 1, Layer 3, analysis wiring and #259 as a whole remain open. * spec/BridgeBehaviorMatrix.md: the Layer 2 summary paragraph updated to the same completed state. * tests/test_lowered_fixtures.py docstring: future tense ("will replay", "until the Rust emitter exists") moved to the present. * BR-L7 wording nit folded in (recorded on #297): condition (4) guards the post-merge reference/discharge, not only a release — the use-only hoist fixture is in the gate too. Docs-only; no Rust code, facts, manifest or golden changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MdYFKUaygHz1T9H1qJ7BqK
2 participants
Что и зачем
P-022 step 6a (#258): нормативный контракт всего verdict-determining поведения OwnIR bridge (
ownlang/ownir.py, 3273 строки) до начала реализации Rustown-bridge(#259). Новыйspec/Bridge.md(правила BR-B/D/L/M/P/V по пяти секциям issue: validation с «двумя дверями», fact lowering — единая routing table + twin-rule to_own/to_module, handle identity, kill-on-rebind, четырёхусловный branch hoist, untrack/kill-sites, call lowering; MOS-оркестрация вокруг существующегоspec/Inference.mdс картой функций→INF-правил; подготовка входов DI/effects/protocols; verdict mapping — закрытый skip-list, map-or-raise, матрица сообщений как parity-поверхность, анкеры, severity/suppression, dedup, ordering, rendering) + план трёх слоёв parity-фикстур с regeneration и zero-Python steady state.spec/BridgeBehaviorMatrix.md— ledger полноты: все check-familiestests/test_ownir.py(ни одно не пропущено) промаплены на правила, источники и требуемый Rust-слой. Ambiguities — не TODO, а issues: #294, #295, #296. Guardrails #258 соблюдены: production-код не менялся, schema не менялась, новых диагностик нет.Тип изменения
Как проверено
python tests/run_tests.py(зелёный — изменения только в spec/)ruff check .иmypytests/test_ownir.pyownlang/ownir.py(все 3273 строки) и inventory всехchecks += 1семействtest_ownir.pyСвязанные issue
Closes #258. Refs #250, #251, #259, #294, #295, #296.
Чеклист
spec/README.mdтаблица)Draft — review gate: по acceptance #258 независимое review спеки должно пройти до старта #259. Ключевые точки для review: BR-V2 (закрытый skip-list), BR-V4 (сообщения как нормативная поверхность), BR-L7 (hoist-условия), решения OD-1..OD-3 (#294) — они определяют, какую «дверь» реализует Rust.
🤖 Generated with Claude Code
https://claude.ai/code/session_01MdYFKUaygHz1T9H1qJ7BqK
Generated by Claude Code