Repair Experiment 013 runtime context contract

Author: HiddenTrojan

research/EXPERIMENT_013_STATIC_RHT_Q468_PROTOCOL.md

@@ -1,24 +1,25 @@
 # Experiment 013: static RHT-Q468 packed-native adoption protocol
 
-> **Status: replacement-H0 candidate after a preserved pre-model authorization
-> failure; not yet re-preregistered.**
+> **Status: second replacement-H0 candidate after a preserved pre-model
+> sealed-smoke contract failure; not yet re-preregistered.**
 >
 > This replacement working copy becomes the next frozen Experiment 013
 > preregistration only when its exact bytes and dependencies are committed in a
 > clean source commit H0 and that H0 is bound before any further identity
-> resolution, policy fitting, protected materialization, model-weight loading,
-> or quality measurement. A dirty or unbound working copy is not a frozen
-> protocol.
+> resolution, model staging or loading, policy fitting, protected
+> materialization, or quality measurement. A dirty or unbound working copy is
+> not a frozen protocol.
 >
 > The amendment history is retained below, but its rules remain candidate rules
 > until that H0 binding. Prior identities, token spans, tokenizer-file hashes,
 > and content hashes remain preserved as superseded evidence under the disclosed
-> reuse rule; the replacement identity has not yet been resolved or promoted.
-> An identity candidate is not authorization to load model weights.
+> reuse rule; the next replacement identity has not yet been resolved or
+> promoted. An identity candidate is not authorization to stage or load model
+> weights.
 
 Protocol draft initiated: 2026-08-02
 
-Current replacement-H0 candidate amended: 2026-08-15
+Current second replacement-H0 candidate amended: 2026-08-15
 
 Pre-resolution audit amendment: 2026-08-02. The amendment corrects a
 cache-exposed-span off-by-one, binds the Stage-A calibration chain by exact
@@ -322,6 +323,62 @@ promotion-hash cascade may differ. Any inventory, byte, hash, version, or
 semantic-identity mismatch stops reuse and requires a separately preregistered
 fresh complete batch after the replacement H0.
 
+Fourteenth pre-resolution adapter-context amendment: 2026-08-15. Under source
+commit `85625a5c4e4d7c6d1b015c0f3cccffea5c3d71c3`, tag
+`experiment013-h0-85625a5`, and identity-only descendant
+`84edf4299e8a5b3af970f74f03abc099d3696904`, the identity-bound `stage-model`
+step published a local copy of the exact three-file pinned model. Its frozen
+identity file SHA-256 is
+`e401a3c18a002626da096ba6ba86aa5d297d16b5c8ab76711658ce730e5a5f77`.
+The first sealed `--fisher-h1-smoke` attempt then authenticated the sealed
+runtime, H0 source, the frozen identity bytes committed at H1, and all four
+bound manifest byte strings. It parsed and matched the public model-file
+metadata but failed deterministically
+while initializing `AdapterConstructionContext`: calibration-runner v3 supplied
+the inert absolute `git_executable` path that capture procedure v6 requires,
+while the authenticated calibration API's exact runtime-context key set omitted
+that key.
+
+The failed smoke did not reach reviewed-adapter loading or construction,
+calibration materialization, tokenizer, dataset, or RULER access, staged-model-
+root traversal or file hashing, model configuration or weight deserialization,
+CUDA or Fisher execution, or output-directory checking or publication. It
+created no smoke output or staging sibling and produced no smoke report,
+completion marker, score, policy, calibration binding, stability value, or
+quality result. The separately completed `stage-model` action did access and
+publish the model payload under H1; the failed smoke itself did not read that
+published model root. This is a downstream execution-contract defect, not an
+experimental result or infrastructure interruption. The H0, tag, H1, identity,
+and staged model root remain unchanged as superseded incident evidence and
+authorize no further official execution.
+
+Calibration-runner v4 aligns the authenticated API with capture v6's existing
+five-key runtime context. The API now accepts, validates, copies, and retains
+the absolute inert Git path while preserving exact-key rejection and recursive
+mapping immutability. Production `_official_main` and the regression share one
+context-construction helper; the regression loads the exact authenticated API
+and reviewed adapter and checks that construction creates none of its model,
+cache, RULER, or bytecode sentinel paths. A separate no-data boundary
+regression carries the same context through the real adapter into the
+manifest-bound capture module and stops before artifact decoding, Hub,
+tokenizer, or dataset access. No record selection, dataset revision, token
+span, Fisher boundary, quantization policy, metric, gate, model contract, or
+protected-stage rule changes.
+
+Runner revision advances from v3 to v4. Identity schema v5; capture and
+resolver procedure v6; adapter revision v2; RULER launcher v7, generation-
+manifest v2, and runtime-manifest v3; calibration runtime-manifest v4; source-
+manifest schema/profile v2; model-manifest v1; frozen-contract and model-
+staging-authorization stdout schemas v1; run-report v2; and Fisher-boundary and
+smoke-marker contracts v1 remain unchanged. A new clean H0, repository-source
+manifest, promoted calibration identity, H1, and identity-bound model
+publication are required. The exact authenticated RULER v7 batch, sealed
+runtime, public model metadata manifest, Parquet manifest, and shared Hub cache
+may be reused only after their existing byte, inventory, and semantic checks
+pass unchanged. The old H1 model root may be treated only as preserved incident
+evidence, not as the official model root for the next H1; a fresh no-overwrite
+root must be published by a newly authorized `stage-model` execution.
+
 ## Question
 
 Can a calibration-frozen, static Q4/Q6/Q8 recurrent-state layout satisfy the
@@ -717,7 +774,7 @@ Before committing H1, the exact promoted identity bytes in their ignored,
 no-overwrite precommit location must pass `verify-frozen-identity-contract`.
 That read-only command authenticates H0 and its source manifest, loads the exact
 H0 resolver, and consumes the complete record inventory through calibration-
-runner v3's identity view. It accepts no H1, model manifest, Hub, cache, or
+runner v4's identity view. It accepts no H1, model manifest, Hub, cache, or
 output argument. Its non-persisted canonical JSON stdout document uses artifact
 kind `recurquant_experiment013_frozen_identity_contract_verification`, schema
 version one, and binds the H0/source contract, portable Git identity, all four

scripts/run_static_q468_calibration.py

@@ -56,7 +56,7 @@
 CANONICAL_ADAPTER_MODULE: Final = "recurquant.experiment013_qwen35_adapter"
 CANONICAL_ADAPTER_PATH: Final = "src/recurquant/experiment013_qwen35_adapter.py"
 
-RUNNER_REVISION: Final = "experiment-013-static-q468-calibration-runner-v3"
+RUNNER_REVISION: Final = "experiment-013-static-q468-calibration-runner-v4"
 FROZEN_IDENTITY_SCHEMA_VERSION: Final = 5
 FISHER_BOUNDARY_SCHEMA: Final = "recurquant.experiment013.fisher-boundary.v1"
 FISHER_BOUNDARY_NAMESPACE: Final = b"recurquant.experiment013.fisher-boundary.v1\0"
@@ -5486,6 +5486,43 @@ def _install_authenticated_recurquant_namespace(repository_root: Path) -> Module
     return package
 
 
+def _adapter_construction_context(
+    *,
+    calibration_api: ModuleType,
+    repository_root: Path,
+    model_root: Path,
+    cache_root: Path,
+    ruler_root: Path,
+    repository_source_manifest_bytes: bytes,
+    calibration_runtime_manifest_bytes: bytes,
+    model_file_manifest_bytes: bytes,
+    parquet_materialization_manifest_bytes: bytes,
+    runtime_context: SealedRuntimeContext,
+    interpreter_path: Path,
+) -> Any:
+    """Build the exact authenticated context consumed by the reviewed adapter."""
+
+    return calibration_api.AdapterConstructionContext(
+        repository_root=Path(repository_root),
+        model_root=Path(model_root),
+        cache_root=Path(cache_root),
+        ruler_root=Path(ruler_root),
+        execution_binding_artifacts={
+            "repository_source_manifest_bytes": bytes(repository_source_manifest_bytes),
+            "calibration_runtime_manifest_bytes": bytes(calibration_runtime_manifest_bytes),
+            "model_file_manifest_bytes": bytes(model_file_manifest_bytes),
+            "parquet_materialization_manifest_bytes": bytes(parquet_materialization_manifest_bytes),
+        },
+        runtime_authentication_context={
+            "base_runtime_root": runtime_context.base_runtime_root,
+            "git_executable": runtime_context.git_executable_path,
+            "staged_interpreter": Path(interpreter_path),
+            "package_runtime_roots": dict(runtime_context.package_roots),
+            "package_import_paths": dict(runtime_context.package_import_paths),
+        },
+    )
+
+
 def _load_adapter(
     specification: str,
     *,
@@ -5923,24 +5960,18 @@ def _official_main(
         raise CalibrationRunError("runtime authenticator returned a different manifest identity")
     model_manifest = parse_model_file_manifest(model_manifest_bytes)
     _model_contract_matches(identity, model_manifest)
-    context = _AUTHENTICATED_CALIBRATION_API.AdapterConstructionContext(
-        repository_root=Path(args.repository_root),
-        model_root=Path(args.model_root),
-        cache_root=Path(args.cache_root),
-        ruler_root=Path(args.ruler_root),
-        execution_binding_artifacts={
-            "repository_source_manifest_bytes": bytes(source_manifest_bytes),
-            "calibration_runtime_manifest_bytes": bytes(runtime_manifest_bytes),
-            "model_file_manifest_bytes": bytes(model_manifest_bytes),
-            "parquet_materialization_manifest_bytes": bytes(parquet_manifest_bytes),
-        },
-        runtime_authentication_context={
-            "base_runtime_root": runtime_context.base_runtime_root,
-            "git_executable": runtime_context.git_executable_path,
-            "staged_interpreter": Path(interpreter_path),
-            "package_runtime_roots": dict(runtime_context.package_roots),
-            "package_import_paths": dict(runtime_context.package_import_paths),
-        },
+    context = _adapter_construction_context(
+        calibration_api=_AUTHENTICATED_CALIBRATION_API,
+        repository_root=args.repository_root,
+        model_root=args.model_root,
+        cache_root=args.cache_root,
+        ruler_root=args.ruler_root,
+        repository_source_manifest_bytes=source_manifest_bytes,
+        calibration_runtime_manifest_bytes=runtime_manifest_bytes,
+        model_file_manifest_bytes=model_manifest_bytes,
+        parquet_materialization_manifest_bytes=parquet_manifest_bytes,
+        runtime_context=runtime_context,
+        interpreter_path=interpreter_path,
     )
     adapter = _load_adapter(
         args.adapter,

src/recurquant/experiment013_calibration_api.py

@@ -26,6 +26,7 @@
 RUNTIME_AUTHENTICATION_CONTEXT_KEYS = frozenset(
     {
         "base_runtime_root",
+        "git_executable",
         "package_import_paths",
         "package_runtime_roots",
         "staged_interpreter",
@@ -70,6 +71,7 @@ def _normalize_runtime_authentication_context(
     if not isinstance(value, Mapping) or set(value) != RUNTIME_AUTHENTICATION_CONTEXT_KEYS:
         raise ValueError("runtime_authentication_context keys differ from the frozen API")
     base_root = _absolute_inert_path(value["base_runtime_root"], name="base_runtime_root")
+    git_executable = _absolute_inert_path(value["git_executable"], name="git_executable")
     interpreter = _absolute_inert_path(
         value["staged_interpreter"],
         name="staged_interpreter",
@@ -96,6 +98,7 @@ def _normalize_runtime_authentication_context(
     return MappingProxyType(
         {
             "base_runtime_root": base_root,
+            "git_executable": git_executable,
             "package_import_paths": MappingProxyType(import_paths),
             "package_runtime_roots": MappingProxyType(package_roots),
             "staged_interpreter": interpreter,

tests/test_experiment013_calibration_api.py

@@ -7,6 +7,7 @@
 import pytest
 
 from recurquant.experiment013_calibration_api import (
+    RUNTIME_AUTHENTICATION_CONTEXT_KEYS,
     AdapterConstructionContext,
     AuthenticatedModelFiles,
     AuthenticatedSequence,
@@ -32,6 +33,7 @@ def binding_artifacts() -> dict[str, bytes]:
 def runtime_context() -> dict[str, object]:
     return {
         "base_runtime_root": ROOT / "runtime" / "base",
+        "git_executable": ROOT / "tools" / "git.exe",
         "staged_interpreter": ROOT / "runtime" / "base" / "python.exe",
         "package_runtime_roots": {"calibration": ROOT / "runtime" / "packages"},
         "package_import_paths": {"calibration": "Lib/site-packages"},
@@ -62,6 +64,10 @@ def test_context_copy_normalizes_exact_binding_bytes() -> None:
 
 def test_context_normalizes_and_freezes_runtime_authentication_paths() -> None:
     source = runtime_context()
+    package_roots = source["package_runtime_roots"]
+    package_import_paths = source["package_import_paths"]
+    assert isinstance(package_roots, dict)
+    assert isinstance(package_import_paths, dict)
     context = AdapterConstructionContext(
         ROOT,
         ROOT,
@@ -70,18 +76,43 @@ def test_context_normalizes_and_freezes_runtime_authentication_paths() -> None:
         source,
         binding_artifacts(),
     )
+    source["git_executable"] = ROOT / "changed-git.exe"
     source["package_runtime_roots"] = {}
+    package_roots["calibration"] = ROOT / "changed-packages"
+    package_import_paths["calibration"] = "changed/site-packages"
+    assert set(context.runtime_authentication_context) == RUNTIME_AUTHENTICATION_CONTEXT_KEYS
     assert context.runtime_authentication_context["base_runtime_root"] == (
         ROOT / "runtime" / "base"
     )
+    assert context.runtime_authentication_context["git_executable"] == (ROOT / "tools" / "git.exe")
+    assert context.runtime_authentication_context["package_runtime_roots"] == {
+        "calibration": ROOT / "runtime" / "packages"
+    }
+    assert context.runtime_authentication_context["package_import_paths"] == {
+        "calibration": "Lib/site-packages"
+    }
     with pytest.raises(TypeError):
         context.runtime_authentication_context["new"] = ROOT  # type: ignore[index]
+    with pytest.raises(TypeError):
+        context.runtime_authentication_context["package_runtime_roots"]["new"] = ROOT  # type: ignore[index]
+    with pytest.raises(TypeError):
+        context.runtime_authentication_context["package_import_paths"]["new"] = "Lib"  # type: ignore[index]
 
     malformed = runtime_context()
     malformed["package_import_paths"] = {"calibration": "../site-packages"}
     with pytest.raises(ValueError, match="not canonical"):
         AdapterConstructionContext(ROOT, ROOT, ROOT, ROOT, malformed, binding_artifacts())
 
+    relative_git = runtime_context()
+    relative_git["git_executable"] = Path("git.exe")
+    with pytest.raises(ValueError, match="git_executable must be an absolute normalized Path"):
+        AdapterConstructionContext(ROOT, ROOT, ROOT, ROOT, relative_git, binding_artifacts())
+
+    missing_git = runtime_context()
+    missing_git.pop("git_executable")
+    with pytest.raises(ValueError, match="keys differ"):
+        AdapterConstructionContext(ROOT, ROOT, ROOT, ROOT, missing_git, binding_artifacts())
+
 
 def test_adapter_facing_values_have_one_stable_importable_identity() -> None:
     sequence = AuthenticatedSequence((1, 2), "a" * 64, "b" * 64, None, "c" * 64)

tests/test_experiment013_qwen35_adapter.py

@@ -37,6 +37,7 @@ def _context(tmp_path: Path) -> AdapterConstructionContext:
         ruler_root=tmp_path / "ruler-does-not-need-to-exist-at-construction",
         runtime_authentication_context={
             "base_runtime_root": tmp_path / "runtime" / "base",
+            "git_executable": tmp_path / "tools" / "git.exe",
             "staged_interpreter": tmp_path / "runtime" / "base" / "python.exe",
             "package_runtime_roots": {"calibration": tmp_path / "runtime" / "packages"},
             "package_import_paths": {"calibration": "Lib/site-packages"},
@@ -244,6 +245,7 @@ def materialize(
     assert materialization_references[0]() is None
     assert adapter._execution_binding_artifacts is None
     assert adapter._runtime_authentication_context is None
+    assert runtime_calls[0]["git_executable"] == (tmp_path / "tools" / "git.exe")
     assert runtime_calls[0]["staged_interpreter"] == (tmp_path / "runtime" / "base" / "python.exe")
     assert set(adapter._materialized_sequences or {}) == {_sha(index + 1) for index in range(160)}
     assert all(