Skip to content

fix(queen,ci): verify Corona evidence and repair fork validation - #1363

Merged
gHashTag merged 4 commits into
gHashTag:mainfrom
dmitrii-f-t27:codex/corona-gds-proof
Oct 4, 2026
Merged

gHashTag merged 4 commits into
gHashTag:mainfrom
dmitrii-f-t27:codex/corona-gds-proof

Conversation

@dmitrii-f-t27

@dmitrii-f-t27 dmitrii-f-t27 commented Oct 4, 2026 •

Copy link
Copy Markdown
Contributor

Description

Closing Corona #1 still leaves its cell at T27 proof needed until accepted native evidence is observed. This PR supplies the public proof adapter, pins both CI and GDS workflow contents, and repairs the site CI dependencies that prevented a fork contribution from completing validation.

Brain health previously passed17/17 probes and then failed on a read-only fork comment, skipping later tests. Optional writes now require a writable same-repository PR; every actual test phase remains required. Documentation follows the real pinned T-JEPA migration and resolves links against tracked source and built Docusaurus routes. Confirmed missing/400404410 targets still fail; unavailable external access is reported as unconfirmed.

Related Issue

Closes #1360. Refs #810 (the fork/docs portion; this does not close all scheduled CI debt). Replaces #1361 while preserving its ancestry. Depends on Corona PR13, which maintainergHashTag merged at436836250754cffd7d24bb671524f7edf869ee1e. Accepted-main CI/GDS and layout publication are verified; a separate formal approval on Corona13 is not recorded.

Specification Link

Changes Made

The Corona adapter requires supported issue closure, immutable source/native seal/vector/consumer/Makefile and CI/GDS hash pins, plus successful canonical push runs at the current default-branch SHA. Reopen, failed refresh/rate limit and tampering remove proof.

New specs generate the CI policies and conformance tables. Fork writes are guarded without suppressing build/unit/integration/stress/CLI execution. T-JEPA source and documentation must match an immutable training revision. CommonMark/GFM checking includes bare URL autolinks and excludes code examples, uses actual built routes and uploads each HTTP observation. Repaired source references retain explicit historical gaps; placeholder citations are not presented as research evidence.

Golden Chain and Testing

Spec first, native generation/seals and real consumers passed. New CI specs execute5 generated Zig tests on verified Zig0.15.2 LinuxARM64 and82 vectors with negative controls. Actual Brain execution passed51+48+52 unit,151 integration and261 stress tests, plus17/17 health probes. Website proof passed37 HTTP cases and16 vectors. Docsite builds; the719-document audit found0 definite broken targets after328 public probes, retaining209unconfirmed observations in canonicalCI. Existing TypeScript/anchor limitations and the failed macOS SDK build remain in the report below.

Review and Deployment Notes

All eight required current-head workflows completedSUCCESS, including every Brain phase and the GFM documentation gate. A real independent approval and green latest-head CI are required for merge. No privileged fork execution or secret change is introduced; the health threshold remains80 and required missing/cancelled/skipped Brain phases fail. Unconfirmed external URLs are not described as alive.

After an approved site merge, publish website+docsite together, then verify the apex and separate appQUEEN_REF source pin, live proof links/cell and a specific Corona award. Nothing here claims a deployed gold cell or payment. Reproduction and proof boundaries.

{
  "version": 1,
  "head_sha": "11bdfff3daa353c954299ad2fcdd38488ffdd137",
  "summary": "A closed Corona issue needs immutable native evidence before honey. Fork PRs now retain every Brain test while optional writes respect token permissions, and documentation references resolve against actual source and built routes.",
  "changes": [
    "Preserve the full public Corona proof adapter and pinned CI/GDS workflow acceptance from the previous commits; tampering, stale evidence, failed runs and reopen clear a positive result.",
    "Define the fork permission and strict six-phase Brain gate in corona_pr_gate.t27 first, generate68 vectors/policy and native seal, and execute real consumers and negative controls.",
    "Guard only cosmetic fork comments/labels. Keep all Brain build/unit/integration/stress/CLI requirements and the health80 threshold; any missing/cancelled/skipped phase rejects merge.",
    "Verify the real immutable moved T-JEPA source in trinity-training instead of requiring removed local model files or manufacturing stubs.",
    "Define docs_reference_gate.t27 first, generate14 HTTP vectors/policy/native seal, check CommonMark/GFM syntax and actual built routes, repair misplaced source links/DOIs/demo assets and identify unavailable historical sources honestly. The GFM follow-up fixes43 definite broken references against primary sources and distinguishes the TinyStories publisher dataset license from MIT code.",
    "Upload per-reference external observations; definite source/400404410 errors still fail, while access-denied/rate/network/server errors are explicitly unconfirmed and cannot support an all-links-verified claim."
  ],
  "tests": [
    {
      "command": "npm run check:queen-issue-proof",
      "status": "passed",
      "result": "2 spec tests, 19 assertions; 37 real-SHA-256 HTTP cases and 16 conformance vectors passed. Before the fix, the added changed-GDS test failed because the reader returned t27 instead of unknown.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/apps/website/qa/queen-issue-proof.mjs"
    },
    {
      "command": "t27c parse specs/queen/issue_proof.t27; t27c typecheck specs/queen/issue_proof.t27; t27c gen specs/queen/issue_proof.t27; zig test generated native output; t27c seal --verify specs/queen/issue_proof.t27",
      "status": "passed",
      "result": "Actually executed using the native db870cdf292272f373037fb40b607c4134f59474 compiler built by the Corona proof gate and Zig 0.16.0: parse/types/generation, both generated Zig tests and saved-seal verification passed; no force seal.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/apps/website/.trinity/seals/queen_queen_issue_proof.json"
    },
    {
      "command": "npm run check:queen-worlds; npm run check:queen-displays; npm run check:queen-continuous",
      "status": "passed",
      "result": "Public-only repository adapter, lifecycle/proof colors, stable placement, live observations and continuous-map contracts passed.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/apps/website/qa/queen-repository-worlds.mjs"
    },
    {
      "command": "npm run typecheck:ratchet",
      "status": "passed",
      "result": "179 errors across 26 files match the existing baseline; no file gained type errors. This is not a clean whole-project tsc.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/apps/website/scripts/typecheck-ratchet.mjs"
    },
    {
      "command": "npm run build:ci",
      "status": "passed",
      "result": "Production website build completed successfully; locally generated catalog timestamps were excluded from the source patch.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/apps/website/package.json"
    },
    {
      "command": "t27c parse/typecheck/gen specs/ci/{corona_pr_gate,docs_reference_gate}.t27; Zig0.15.2 test generated output; t27c seal --save/--verify",
      "status": "passed",
      "result": "Actual native compiler db870cdf292272f373037fb40b607c4134f59474 accepted both specs. All5 generated Zig tests ran in LinuxARM64 using verified official Zig0.15.2 and pinned Ubuntu24.04; both native seals match. No force seal. The changed documentation spec executed3 generated tests/17 assertions; its GFM_AUTOLINKS constant drives the production parser.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/specs/ci/docs_reference_gate.t27"
    },
    {
      "command": "node scripts/ci-gate-from-spec.mjs --check; node qa/ci-corona-pr-gate.mjs",
      "status": "passed",
      "result": "68 consumed vectors plus actual workflow fork-write guards and all six phase acceptance tests passed. A regression failed against the old fork-comment condition. Missing, failed, cancelled and skipped required phases still block.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/qa/ci-corona-pr-gate.mjs"
    },
    {
      "command": "node scripts/docs-gate-from-spec.mjs --check; node qa/docs-reference-gate.mjs",
      "status": "passed",
      "result": "14 HTTP vectors and real local HTTP/redirect fixtures, CommonMark/GFM bare URL parser, missing targets, path escapes and private-example regressions passed. A route catalog entry alone cannot establish a built target. These fixtures do not verify public URL availability.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/qa/docs-reference-gate.mjs"
    },
    {
      "command": "zig build -Dci=true; zig build test-basal-ganglia/test-reticular-formation/test-locus-coeruleus/test-brain/test-brain-stress -Dci=true --summary all; tri stress --health",
      "status": "passed",
      "result": "Actual Zig0.15.2 LinuxARM64 execution: buildPASS;51+48+52 unit tests,151 integration tests and261 stress tests passed (563 executions total);17/17 health probes passed,100/100. These local runs do not replace current-head GitHubAMD64 CI.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/.github/workflows/brain-ci.yml"
    },
    {
      "command": "Zig0.15.2 native macOS build -Dci=true",
      "status": "failed",
      "result": "The local macOS SDK linker failed on libSystem before any Brain assertion ran. The same source was subsequently built and tested using the verified Linux toolchain; a macOS Brain pass is not claimed.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/.github/workflows/brain-ci.yml"
    },
    {
      "command": "node scripts/docs-model-consistency.mjs --check <pinned-training-checkout>",
      "status": "passed",
      "result": "Actual checkout gHashTag/trinity-training@3e9648c1817a97c5f9b8c727b0f8e2291928eead contains both moved source files. Wrong revision, missing file and missing documentation reference are rejected. Model inference was not measured.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/scripts/docs-model-consistency.mjs"
    },
    {
      "command": "npm run build --prefix docs; node scripts/docs-reference-check.mjs --external --report work/docs-reference-report.json",
      "status": "passed",
      "result": "Actual local production build/audit passed. Canonical current-head GFM docs-check also completedSUCCESS:719documents,328unique public probes,1356verified records,0definitebroken and209UNKNOWN. Anchors not measured; access failures not promoted to alive. Downloaded artifact matches specSHA0117fc00bc1bf158cdf5be11571c4a65c10e7be51b6283e059500a94d4bc62e4 and preserves each status/time.",
      "evidence": "https://github.com/gHashTag/trinity/actions/runs/37213322616"
    },
    {
      "command": "YAML parser; node --check changed scripts; git diff --check",
      "status": "passed",
      "result": "All three changed workflow files parsed; changed scripts passed syntax checks and the source patch has no whitespace errors. Local review checked permission boundaries, generated-source freshness, required phase retention and repaired target semantics.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/commit/11bdfff3daa353c954299ad2fcdd38488ffdd137"
    },
    {
      "command": "Current-head GitHub Actions",
      "status": "passed",
      "result": "All eight required workflows completed SUCCESS at11bdfff3: Brain,docs,Website,CI,Codegen,format,Dev and mandatory report. All six required Brain phases actually ran. Optional fork writes were skipped with explicit explanation. Claude automation is skipped and supplies no approval.",
      "evidence": "https://github.com/gHashTag/trinity/actions/runs/37213322677"
    },
    {
      "command": "Independent approval, accepted merge, combined publication and live reward",
      "status": "not_run",
      "result": "Corona13 was merged by maintainergHashTag at436836250754cffd7d24bb671524f7edf869ee1e and issue12 closed. A separate formal approval is not recorded. Local accepted-source make t27-test again passed6Zigtests/1920Rustvectors/4source mutants/stale seal/alteredvector rejection; verify22/22 and bothRTL lints passed. Exact accepted-main workflows: CI=success; GDS=success. Site1363 independent approval/merge/publication, appQUEEN_REF release, live cell and specific award remain unverified.",
      "evidence": "https://github.com/gHashTag/tt-trinity-corona/pull/13"
    },
    {
      "command": "Actual candidate production reader in BrowserOS Neo against public GitHub API/rawsource",
      "status": "passed",
      "result": "Unmodified tracked production reader bundled from this head with the locked esbuild and executed in the browser. Closed supported Corona1/12 received immutable accepted4368362 spec/CI/GDS proof; unsupported999 and reopened1 remained unknown. This did not edit or publish the live UI.",
      "evidence": "https://github.com/dmitrii-f-t27/trinity/blob/11bdfff3daa353c954299ad2fcdd38488ffdd137/apps/website/src/lib/queenIssueProof.ts"
    },
    {
      "command": "Accepted Pages artifact versus actual public OAS bytes",
      "status": "passed",
      "result": "Canonical accepted-main Pages artifact11307851697 ZIPdigest matched. Actual published OAS returnedHTTP200,369583bytes and identicalSHA256eb1c6c189a86808084352667d8d57fcb02469d928c6e34ccf820659be1c1cd97; TinyTapeoutviewer loaded tt_um_trinity_corona. Canonical precheck/gate-level ZIPdigests also matched:12/12precheck,51/51gate-level tests,0errors/failures/skips; four actual KLayoutXMLs have0violation items. Layout publication is confirmed, not a physical chip, timing signoff or model inference.",
      "evidence": "https://github.com/gHashTag/tt-trinity-corona/actions/runs/37213478386"
    }
  ],
  "limitations": [
    "Every current-head engineering/report workflow completedSUCCESS. Actual independent site maintainer approval and accepted merge remain mandatory. Local review and skipped Claude automation are not approvals.",
    "The new documentation gate separates definite broken references from unavailable external observations. Its source-gate success does not mean all external URLs are reachable; anchors remain unmeasured. The JSON artifact preserves each status and timestamp.",
    "Native CI spec tests ran on LinuxARM64 with verified Zig0.15.2. Canonical current-head GitHubUbuntuAMD64 independently executed the required Brain phases. Native macOS failed at its SDK linker and remains unverified. Local563test count includes imported region tests, not unique definitions.",
    "Moved T-JEPA source presence is verified at an immutable revision. Rust historical backends are absent; neither model inference nor physical FPGA measurements are established here.",
    "There is no Makefile/t27-test target in this repository/frontend. The native parser/typechecker/generator, actually executed generated Zig tests, seals and conformance consumers were used. Corona separately passed make t27-test with1920 Rust vectors and negative controls.",
    "The frontend ratchet retains179 baseline TypeScript errors; docsite still has existing anchor warnings. No project-wide clean tsc or exhaustive anchor check is claimed.",
    "Only Corona issues1 and12 are supported by the adapter. Anonymous failures remain unknown. Positive public observations may be cached for one minute.",
    "Corona13 was accepted by maintainer merge, without a recorded separate formal GitHub approval. Accepted-main CI/GDS/viewer and site approval/merge/publication must be verified separately. The actual app UI is built by999-multibots-telegraf/apps/vibee-editor/Dockerfile from immutableQUEEN_REF; it does not update merely because Trinity or the apex changes. Neither live honey nor a task-specific award is established."
  ],
  "tags": [
    "Engineering",
    "Verification",
    "Security"
  ],
  "blog": {
    "title": "Fork CI must measure tests without writable credentials",
    "summary": "Actual Linux Brain tests passed563 executions while the previous fork workflow failed on a cosmetic comment; the repaired gate keeps execution mandatory and reports unavailable evidence explicitly.",
    "outline": [
      "A closed Corona issue remained unknown until its native evidence could be accepted, while the site PR could not complete Brain CI because a fork token was asked to comment. The docs checker also rewrote docsite routes to nonexistent GitHub paths and required a moved model locally.",
      "Two compiler-checked .t27 contracts now drive the fork permission matrix, six-phase acceptance and HTTP classification. Five actual generated native tests,82 new conformance vectors,563 Linux Brain test executions and17 health probes passed locally. Source links were repaired against files and built routes; unresolved HTTP access remains visible.",
      "Canonical current-head CI passed; the GFM artifact retains209UNKNOWN observations. Maintainer accepted Corona13 and its local accepted-source proof replay passed. Site human approval and publication of the pinned appUI remain separate requirements; no live honey or award is claimed."
    ],
    "reproduce": [
      "node scripts/ci-gate-from-spec.mjs --check",
      "node qa/ci-corona-pr-gate.mjs",
      "npm ci --prefix docs --ignore-scripts",
      "npm run build --prefix docs",
      "node scripts/docs-gate-from-spec.mjs --check",
      "node qa/docs-reference-gate.mjs",
      "node scripts/docs-reference-check.mjs --external --report work/docs-reference-report.json",
      "npm run check:queen-issue-proof --prefix apps/website"
    ]
  }
}

@dmitrii-f-t27

dmitrii-f-t27 commented Oct 4, 2026 •

Copy link
Copy Markdown
Contributor Author

Evidence and merge boundary for head 35e7ba7216d2b36303d4b57d135b584fb9202dcf:

  • Build & Test and Pre-commit are successful. Current-head work report is successful. Website and Codegen also completed SUCCESS on this head. The Website log actually executes2 spec tests/19 assertions,37 HTTP cases and16 conformance vectors. Local website and Docusaurus docsite production builds both passed; they remain candidate artifacts until accepted publication.
  • Documentation Consistency requires src/hslm/tjepa.zig, which is already absent from unchanged base 3cf399fcafdcfbc894684dcaf3722b60e1f9cd2f. This PR changes neither that workflow nor src/hslm. The preceding full-tree link run also failed on many unchanged local links and external403/DNS errors; Current-head LinkChecker completed FAILURE at2026-10-04T14:12:27Z. The downloaded log shows missing relative paths such as /github/workspace/docs/docs/api.md and external403/404 responses. The newly changed docs/QUEEN_CORONA_PROOF.md block checks2 links without errors; the referenced failing docs and docs-check workflow are unchanged from base. A successful Docusaurus build does not turn this failed whole-tree checker green.
  • Brain Health Check actually measured 17/17 probes,100.0/100,HEALTHY, then failed specifically at Comment Health on PR with HTTP403 Resource not accessible by integration. This fork's read-only GITHUB_TOKEN cannot post. The dependent Brain report/gate becomes red and later tests are skipped; those skipped tests are not claimed as passed. This source patch changes no Brain code/workflow. No secret/token permission was changed to evade the gate.
  • Update PR Status likewise fails at addLabelsToLabelable because the fork token cannot label the upstream PR. The unchanged workflow explicitly marks this cosmetic job continue-on-error; its workflow result is success, but the job is still red and is recorded as such.
  • Claude review is SKIPPED on this fork. Reviews are empty, and Corona PR13 is still unmerged. A skipped job or passing local review is not independent approval.

The local source-first/native/HTTP/conformance gates are in the PR report. Under the requested chain, merge remains blocked until CI is green, conflicts absent and actual review approval recorded. Then verify exact accepted-main CI/GDS, website+docsite publication and app Queen source, live proof links, and a specific reward receipt. None of those final outcomes is inferred from a local fixture.

Final live observation2026-10-04T14:12:48Z: Corona issue1 is closed, the app proof SHA is absent, and the supervisor says it has not been dispatched. No specific Corona reward receipt or accepted live honey is claimed. The current-head PR work report has been updated to distinguish executed checks, failed infrastructure/docs checks, unapproved merges and unpublished deployment.

@dmitrii-f-t27 dmitrii-f-t27 changed the title fix(queen): pin full Corona proof before marking issue honey fix(queen,ci): verify Corona evidence and repair fork validation Oct 4, 2026
@dmitrii-f-t27

dmitrii-f-t27 commented Oct 4, 2026 •

Copy link
Copy Markdown
Contributor Author

@gHashTag, please provide a genuine independent GitHub review of this PR at 11bdfff3daa353c954299ad2fcdd38488ffdd137.

All eight required current-head workflows completed SUCCESS. The strict six-phase Brain gate and health80 requirement remain intact; cosmetic fork writes supply no test evidence. Current Brain run: https://github.com/gHashTag/trinity/actions/runs/37213322677 . Website: https://github.com/gHashTag/trinity/actions/runs/37213322652 .

The dependency Corona PR13 was merged by you at 436836250754cffd7d24bb671524f7edf869ee1e; issue12 closed. Accepted-main CI and GDS completed SUCCESS. Its native proof artifact confirms6 actual Zig tests,1,920 executed Rust vectors and4 compiled source-mutant rejections, plus stale-seal/altered-vector controls. Accepted-source local replay also passed, with22/22 verification checks and bothRTL lints. A separate formal review on Corona13 was not recorded; I have not invented one.

The published layout loads tt_um_trinity_corona. Its actual public OAS bytes match the accepted Pages artifact:369,583bytes, SHA256 eb1c6c189a86808084352667d8d57fcb02469d928c6e34ccf820659be1c1cd97. This establishes layout publication, not a physical chip or model inference.

Accepted GDS result artifacts were independently downloaded and their ZIPdigests matched:12/12 precheck and51/51 gate-level tests,0failures/errors/skips; four actual KLayoutXMLs contain0violation items. This does not establish timing signoff.

Please review the immutable spec/seal/vector/consumer links in the PR body, particularly:

  • Issue binding and native/source/CI/GDS hashes;37 real HTTP cases and16 vectors exercise tampering, reopen, stale refresh and failure. The actual candidate production reader was separately run in the browser against real GitHub API/rawsource: closed supported1/12 received the accepted proof, unsupported999 and reopened1 stayed unknown. This did not modify the deployed UI.
  • Fork permission guards and strict Brain acceptance: missing, failed, cancelled or skipped required phases reject; no gate or health threshold was weakened.
  • CommonMark/GFM checking against actual built targets and real HTTP classifications. Canonical docs-check artifact records719documents/328public probes/0broken/209UNKNOWN. Anchors remain unmeasured; UNKNOWN does not mean verified. Three actual native docs tests/17assertions,14 vectors and regression fixtures passed; a genuine old-code regression exposed43 broken references that were repaired from primary sources or clearly identified as unavailable history.

If acceptable, please submit an actual approval; actionable review findings will be corrected. Merge still requires green latest-head CI, no conflicts and real approval. Combined website/docsite publication and the separate 999-multibots-telegraf/apps/vibee-editor/Dockerfile QUEEN_REF release remain subsequent steps. The current app still shows T27 proof needed; live honey and a task-specific award are not claimed.

@gHashTag
gHashTag merged commit 8afec86 into gHashTag:main Oct 4, 2026
31 checks passed
github-actions Bot added a commit that referenced this pull request Oct 4, 2026
fix(queen,ci): verify Corona evidence and repair fork validation (#1363)

* fix(queen): verify canonical Corona evidence before marking issue honey

* fix(queen): pin Corona GDS workflow proof (#1360)

* fix(ci): repair Corona fork gates and documentation targets (#1360)

* fix(docs): verify GFM autolinks and repair references (#1360)
@dmitrii-f-t27

Copy link
Copy Markdown
Contributor Author

Post-merge infrastructure observation at accepted main 8afec86: Auto-update Project Status run 37221455596 failed in issue-closed before updating issue #1360 because PROJECT_TOKEN returned HTTP 401. The workflow reads secrets.PROJECT_TOKEN; this is separate from the successful current-head product checks recorded before merge.

The owner has been asked through the agreed email channel to restore this token. No secret value was read, changed or posted here. Board release run 37221454976 did succeed and created app release #3614, so its AGENT_GH_TOKEN path is working. This comment does not turn the failed project-board job into a passing check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Queen: consume verified repository proof before marking a closed Corona cell as honey

2 participants