9 Commits

Include renames

Author	SHA1	Message	Date
TheRON	56e0570f10	roadmap: two principles, and the contradictions reading it turned up ... ROADMAP.md was described as a reference rather than a commitment -- something that documents intent and will eventually become a roadmap. The header now says so, and says that HANDOFF section 4 holds the actual order. Sections 1, 2, 3 and 7 are durable and still correct; section 4's sequence and section 5's production assumptions have drifted since 18 AUG. Principle 17: nothing approximate may write to anything reproducible. Principle 4 governs what is hashed; this governs what may reach the thing being hashed. A search index, a documentation system or a language model may read design records freely and may suggest anything to a person, but none may originate a parameter that lands in a record. The failure is silent and compounding -- if suggestions become records and records become the corpus, the corpus teaches itself its own guesses, and every record remains perfectly correct about what it was built from. Where a suggestion informed a build, the record's note field says so, being already excluded from both hashes. No new field is needed and the discipline is written down before there is anything to guard against. Principle 18: a contribution is admitted by the oracle, not parsed by the compiler. Author in whatever notation suits you, freeze the cases inside the pinned toolchain, port, and admit when the oracle passes byte-identically. This has happened twice, with both .scad generators -- it describes what was done rather than what is planned. Two consequences: no second geometry engine is ever kept in step with the first, and legacy/ holds the reference tier rather than superseded code. When someone asks for another input format, the answer is that notation never runs in production. A third principle was drafted and dropped -- that artifacts cross a service boundary and geometry does not. Section 4a's own rule is that use cases precede interface proliferation, and writing a principle about a kernel service boundary while the kernel is not a service is precisely that. It is a gate, not a principle, and the kernel can acquire one when it acquires a boundary. HANDOFF section 11 gains rows 12 through 16, all found by reading ROADMAP.md properly rather than grepping it. Section 5 names a production FQDN that the printed name contradicts. Section 5 says the production proxy is not on the WireGuard side, for a reason the DNAT at 1fdb115 removed. Section 4a says no use case crosses the Kane Fabric boundary and that neither project defines the interface -- membership-gated export is that use case, and IDENTITY-CONTRACT.md defines the identity half, while the siting interface 4a is actually about remains undefined and should stay so. ROADMAP section 4 and HANDOFF section 4 are different lists. And legacy/ is misnamed. None are resolved here. Two are CIVICVS's, two want the whole repository in view at once, one is cosmetic. Recorded so the reconciliation pass finds them written down rather than rediscovering them cold.	2026-09-12 10:07:04 -05:00
TheRON	c72036cbbb	docs: the ACL leaves the roadmap, and the development-name excuse is withdrawn ... Four documents brought into line with what landed at 54f0296 and ee3fedf. HANDOFF section 4 item 5 said the ACL was deliberately last. It is deleted, not deferred. Authorisation lives upstream at the last proxy hop, decided against a membership system this repository knows nothing about, so the compiler will never have a user table, a login form, a session, or a group name in any form -- including as a configuration value, which is how that leak arrives by the side door. An item left the roadmap rather than moving down it. Item 4 claimed persistence was the prerequisite for a library of saved designs and for access control. The second half has been false since the identity contract landed and was found by reading the anchor rather than recalling it. Corrected, and item 4 now states the position that follows: the filesystem is the first store, not a database. Design records are already plain text, already content-addressed by input_id, and already readable by someone with none of this software. A directory of them is a store with perfect provenance and no schema to migrate. SQL earns its way in when there is a query walking files cannot answer -- "every design by this author since March" is that query, and it arrives with membership, not before. "Acceptable for a development name" is withdrawn from HANDOFF section 4 and WORK-ORDER-004 section 3. The name is production, dev abbreviates Mechanical Compiler Developers, and it appears on printed material. The posture is unchanged -- world-reachable, unauthenticated, /m/ not yet gated, STL export will ship open -- but it is carried openly as open question 10 instead of excused. The phrase survived three documents and two earlier corrections because it was plausible and nobody challenged it, which is the same mechanism that produced the stale ingress paragraph. Section 0 gains the two new documents, with CONSUMER_INTERFACE_GATES.md marked read-before-proposing-an-integration: several tempting cross-project moves are recorded there specifically as things not to build yet, and a successor who finds them independently will be tempted to solve them. Also a note that deploy/ now holds the unit and the vhost as they actually run, and that the repository is the single source of truth -- read a container when you suspect drift, then fix the drift here rather than on the host. HANDOFF section 1 and PROCESS section 9 gain the same rule: pct exec runs no shell. A glob, redirect, pipe or && is expanded by the host shell against the host's filesystem and the container receives whatever literal survives, so an unwrapped glob reports "No such file or directory" and reads as a broken container. Third instance of this class after F-035 and F-036 -- each time the tool was invoked wrongly and the error named the wrong subject. Not filed as a new failure: it is the same finding as those two, and a third entry would record the instance rather than the pattern. STAGING-STATE records the deployment configuration as committed. The unit had been marked delivered at deploy/mechcomp.service on 11 SEP while existing only on the host.	2026-09-12 09:48:22 -05:00
TheRON	6ce8ece709	docs: F-037, the ingress corrections, and the priority order reversed ... HANDOFF section 4 said WORK-ORDER-004 was pending and that CIVICVS could not see any of this work. It was rewritten thirty-two minutes after 1fdb115 closed the ingress, in the same session, against the work order's old state rather than its new one -- so HEAD described a world where the thing you were already looking at did not exist. Section 11 row 7 carried the same staleness. Both corrected, and the correction says how it happened, because section 0 was added to prevent exactly this and did not. Three things 1fdb115 recorded as unsettled were never promoted into section 11 and are now rows 8 through 10: TLS renewal has never been observed to succeed for this name and is first due before 2026-12-10; the composer has no acceptance criteria of its own, only the path to it does; and the service is world-reachable and unauthenticated, which section 4 item 5 called a conscious decision to be made before publishing and which publishing has now made due. Priority items 1 and 2 reversed. The original case for authorship first was that records made before the field exists can never be attributed. That was too strong, and too strong because the field is excluded from both hashes: a record regenerated later keeps its input_id. What it does not keep is build_id, which covers Shapely and GEOS, and boolean results on near-degenerate geometry shift between GEOS releases -- the F-034 mechanism. Attribution is recoverable, not free. The residual argument stands and the field landed first at 48d5665. Recorded under item 2, because it is the first thing STL export runs into: length_view is not in COMMON_GROUPS, so the Full Length branch is unreachable from the composer and every export would silently be a 100 mm preview. The sweep must equal model_length_mm(p), already published as LENGTH_MM, or the record's VOLUME_MM3 and MASS_G describe a different object than the file beside them. Also split the roadmap's STL/STEP bullet: STEP needs the kernel, STL does not, and one line implying both was left behind by the section 5 correction. F-037: a tar stream rooted at "." re-owned the repository root. tar x ran as root and applied the "." entry's ownership to /var/www/mechcomp; the chown that followed named only src and tests. Everything below the root was correct, so 547 tests passed and only git noticed. Corrected by chown on one path, owner only, no -R. safe.directory was not added -- that is F-008 and would have masked this and every later instance. Two of F-037's three consequences are process defects of mine rather than facts about the environment. The verification step ran before the landing that destroyed it, so a git status ahead of the breaking step reads as a pass -- the F-027 pattern in a new place. And section 7 says record a failure before correcting it; I corrected first. Both recorded rather than quietly fixed. PROCESS section 3 gains two REQs, because the delivery path as documented produces F-037 every time: the chown must name the directory the files land in, and a tar transport must name its top-level directories rather than root at ".". pct push is simpler for a single file and cannot reproduce it at all. Section 8 gains the bytecode rule: PYTHONDONTWRITEBYTECODE=1 and clear __pycache__ between mutations. A stale .pyc masked a real defect once and every mutation result reported before that was optimistic by an unknown amount. A mutation surviving on stale bytecode is indistinguishable from one surviving on a weak test. Open question 11 is new and is CIVICVS's: ct-baseline.sh exits 0 with the F-037 condition present, so by section 9a the ownership of a service working tree is not part of the container standard. Whether it should be is a decision about host property covering three projects.	2026-09-12 04:53:24 -05:00
TheRON	a7162bc1d5	docs: assemblies are out of scope by design, and the priority order ... CIVICVS ruled on 11 SEP that the absence of an assembly layer is chosen, not unfinished. Positioning is field work. Parts made and shipped by different manufacturers have no knowledge of each other assembly tolerances, and interchangeable manufacture works because of that separation rather than in spite of it. Fit up is resolved on site against conditions no designer had. PRECISION.md section 7 now says so, and closes with read this as a boundary that was chosen, not a gap to be filled. Section 10 corrected. Its lock is on this document subject, not on the software roadmap, and it was misread that way once. Section 7 holds two kinds of entry: limits that may be lifted by work, and boundaries that were chosen and should not be. Without that distinction section 7 reads as a to do list. Section 7 also separates geometry interchange from machine instructions. An STL or STEP describes a shape; a toolpath describes what a machine should do. The first is in scope and planned, the second is not. The two sat one line apart with nothing saying they differ in kind. HANDOFF section 5 corrected: STL export needs no CAD kernel. A member here is prismatic by definition, so an STL is two triangulated caps and a quad strip. Verified in CT 100 that shapely constrained_delaunay_triangles handles a polygon with a hole correctly, area exact and no triangle inside the hole. That second check is the one that matters, because a triangulator that fills bores produces an STL which looks right in a slicer and prints solid where the conduit goes. STEP still needs the kernel. Priority order recorded with its reasoning so a successor can disagree with the argument rather than only the sequence. STL export first because it is the only item producing physical feedback. Then an authorship field in the design record, one field and a one way door. Then per member stock for the conduit core. Then persistence, which nothing has ever written despite MECHCOMP_DATA_DIR being declared since staging. Then ACL, last, because access control over nothing is machinery without a subject. A node is not an assembly. It is another artifact with declared interfaces and stays in scope. What is out of scope is positioning artifacts relative to one another. The project obligation is therefore to make each artifact interchangeable, which is what the stock descriptor and the design record already exist for.	2026-09-11 12:38:34 -05:00
TheRON	39a6b02c63	docs: HANDOFF corrected against the tree, and PROCESS.md put first ... A new section 0 gives the reading order with PROCESS.md at the top. The handoff never mentioned it. That is the root cause of three sets of instructions the operator could not execute in one session: an SSH to a host he does not reach that way, a LAN address behind a portless bridge, and a hosts file name that resolves on three machines. The access model is now stated rather than only defended. The settled decisions said questioning Webmin wasted a session but never recorded what the arrangement is, so it was questioned again. It now records that he works from Webmin on the hub and into the srv-b shell, and that dev.infra names and 10.20.0.x addresses are never to be given as browser URLs. The module table filed Geo and Member under primitives.py, where they have never been, and omitted records.py entirely. Two modules were read on the strength of it and neither held what it promised. Corrected, with the error named so it is not re-derived, plus rows for stock.py, design_record.py, svg.py and web/app.py. Sections 3 and 4 described a world with no application in it: main two commits back, 468 passing, the catalogue front end does not exist, deployment blocked on application code. Now 529 passing at a8081e1 with the composer live behind the proxy, and the next work named as per member stock, which is what the conduit core actually needs.	2026-09-11 07:05:59 -05:00
TheRON	6836ece4ff	tests: close F-034; bound the derived trio at 8 ULP of the oracle record ... The oracle records six significant figures, so the last digit of an area near 200 mm2 is worth 0.001 mm2. Every measured disagreement between port and reference is one, two or three units in that place. SECTION_AREA_MM2, VOLUME_MM3 and MASS_G are now bounded at 8 ULP of the expected value. Everything that positions material keeps the declared 1e-4 mm and remains exact in all 123 cases. Option 1 scope kept, derivation rejected on measurement. Max |dA|/P over the accepted set is 1.434e-05 mm, one seven-hundredth of the 0.01 mm criterion, so a perimeter x 0.01 bound would have run 1800 to 4500 times the worst real discrepancy and caught nothing. Perimeter also anti-correlates with the error. Suite 468 passed, 0 failed. The 30 expected failures are resolved, not suppressed. Mutation tested before landing: worst case uses 37.5 percent of its bound, 12 ULP offsets and 1e-4 relative scalings are caught in all 113 cases, 1e-6 and 1e-5 correctly are not. Adds docs/ACCEPTANCE.md as the specification. Adds F-036, the venv interpreter error, same class as F-035. Corrects the F-034 per-profile distribution to Three-Fin 10, Y 7, A Frame 6, Rectangle 5, T 1, Four-Fin 1, which sums to the stated 30.	2026-08-23 08:19:18 -05:00
TheRON	52d00b588b	docs: record the F-034 decision in HANDOFF.md ... CIVICVS approved option 1 on 20 AUG: scale-aware bounds in test_oracle.py for SECTION_AREA_MM2, VOLUME_MM3 and MASS_G, derived from the 0.01 mm criterion and the section perimeter. Not implemented yet. Implementation, mutation testing and a green suite are one piece of work, not a partial landing. Section 4 item 2 is removed. The F-034 measurement rewrite in FAILURES.md landed in b255ebb, so listing it as a next step sends the next reader to redo work already done. FAILURES.md keeps status Open, which is correct until the change lands. Header commit line moved to b255ebb. Section 7 and the section 11 open-questions table now say decided rather than ready to decide.	2026-08-20 08:06:16 -05:00
TheRON	b255ebbab9	docs: handoff rewritten for the post-port state; F-034 measured ... HANDOFF.md rewritten in place, as it is meant to be. The port is complete, so the document now describes that state rather than the work leading to it. Most important change for whoever reads it next: the suite is 436 passed, 30 failed, and section 3 says plainly that the 30 are expected and a red `make test` is not a broken port. Without that line the next assistant spends its opening exchange rediscovering what is already known. Also added: the 0.01 mm accuracy criterion as a settled decision; that defaults are per-family and differ (ring_corner_radius_mm is 2.00 in 3x and 1.25 in 4x); that check declaration order is the reporting order; that params carries only a case's overrides; and pointers to PRECISION.md for what the compiler does not do. F-034 rewritten around measurement rather than estimate. The original Y evidence is preserved verbatim -- it was specific and hard-won. What is new: - the same mechanism at 90 degree ring corners, where the expression is exactly 12 rather than exactly 8. Rectangle: reference envelope 50 vertices, port 48. - which side is noisy, which was previously unstated and turns out to matter. Instrumented at %.17g the port prints half=45 raw=12 ceil=12 on every call. It lands on the integer deterministically; the reference does not. A guard cannot make the port match noise it does not have, so there is nothing left to try on this side. - the scale: 30 of 113 accepted cases, 83 exact, worst relative error 2.24e-05, confined to SECTION_AREA_MM2 and its two derivatives. - the physical magnitude: chord deviation is r*(1-cos 3.75deg), so 0.0027 mm at r=1.25 and 0.0043 mm at r=2.00. The two implementations differ from each other by at most ~0.4 um. Two orders inside the 0.01 mm criterion. - the constraint on any fix: the tolerance block is inside the hashed oracle document, so the change belongs in test_oracle.py. Status stays Open. The decision is CIVICVS's and has not been made.	2026-08-20 06:54:11 -05:00
TheRON	af196a26f5	docs: one canonical handoff, rewritten in place; F-035 ... Handoff documents were additive. HANDOFF-2026-08-19 opened by saying the 18 AUG document still applied in full and added to it. After ten sessions a new assistant would face ten documents to read in date order and diff mentally to work out what is currently true. That cost grows every session and none of it is necessary. docs/HANDOFF.md is now the only handoff, rewritten in place each session. It is state, not a log. The dated ones move to docs/archive/ and stop being required reading. It is standalone: everything still true from both is carried forward. Section 1 is invocation, stated as facts rather than demonstrated in examples. That is the other half of the problem. runuser appeared only inside example commands, so it could be learned by pattern matching but not by reading, which fails exactly when an assistant composes a command from scratch. That is what happened, and it is F-035: su cannot run as a nologin service user, both commands returned the same message before touching anything, and the output read as a broken repository when the tree was clean and the suite passed. The F-027 class again. Also stated as facts: bash tools/ not ./tools/, all repository operations as mechcomp, Gitea SSH on 42022, pct push then chown, explicit timeouts, journalctl not /var/log, systemd-run for long jobs, and assert the guest is running before interpreting any pct exec result. Not done: the same facts should be cross referenced from PROCESS.md. I no longer had that file in view and would not patch a document I cannot see.	2026-08-19 12:33:50 -05:00