Trust + correctness hardening keystone - #24
Merged
Conversation
The 6 call/contract-path items from the 2026-06-02 reflection audit: unbiased hash-priority depth-cap reservoir, obs-order canonicalization, surface SkipCounts on --index + receipt, --max-read-len ingest enforcement, exit-4 breach test, CI memory-envelope gate. Cross-cutting guards deferred to a fast-follow (sort tie-break, @sq check, BSD/cgroup RSS, honesty pass, PR #23 merge). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
build_column now sorts observations by (allele, base_qual, mapq, reverse) before emitting, so the downstream order-sensitive f64 likelihood sum in germline.rs is order-independent and the VCF stays byte-identical regardless of the active set's internal order. Prerequisite for the depth-cap reservoir, which permutes the active set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… drops) Replaces leftmost-arrival truncation with a fixed-seed content-hash bounded reservoir + eviction: keep the max smallest-priority reads covering the cursor, evicting the greatest-priority resident when a smaller-priority read arrives. Selection is independent of read start position (and thus allele), so a deep het variant carried only by reads that start AT the variant survives instead of being silently dropped. Deterministic and bounded at max_depth. Reproduced-bug regression test included; the identical-reads cap test (ties -> no eviction) still holds. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ipt) Thread SkipCounts out of call_germline_region_streaming and call_germline_whole_genome (summed per contig via SkipCounts::accumulate). run_variants_index prints a summary when the cap engages or filters drop reads, and records over_max_depth + reads_skipped_total in the manifest so the receipt is honest about whether downsampling was load-bearing for the run. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ath) Under --enforce, a read whose seq.len() exceeds the declared --max-read-len aborts loudly (CoreError::ReadExceedsDeclaredLength) instead of silently voiding the predicted memory envelope. Non-enforced runs are unaffected (max_read_len None). Fixes the contradictory plan.rs doc comment and the stale --memory-budget-mb / --max-read-len CLI help text. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a post-run-only ROSALIND_FORCE_PEAK_RSS_BYTES seam (overrides the realized peak, never the pre-run baseline) to deterministically force predicted-fits-yet-realized-overruns, and asserts exit 4 + VIOLATED + VCF and receipt still written. The contract's most safety-critical branch was previously untested. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…efuse) Adds a contract gate to cli-e2e: build index -> sort -> variants --index --enforce at a generous budget (exit 0 + contract: OK), verify the receipt without re-running, then a 1 MiB budget (exit 3 refuse, no VCF). Makes 'the bounded contract is exercised in CI' literally true via deterministic exit codes (no RSS-noise flakiness; exit-4 is covered deterministically by the force-seam unit test). Validated locally against the bundled toy fixtures. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The 6 call/contract-path items from the 2026-06-02 reflection audit — making the shipped memory contract's correctness and trust guarantees actually hold and be tested.
max_depth. (Reproduced bug: a true 30:30 het → 0 calls under the old biased cap; regression test included.)build_columnemits observations sorted by(allele, base_qual, mapq, reverse), so the order-sensitive f64 QUAL/PL accumulation ingermline.rsis order-independent and the VCF stays byte-identical regardless of the active set's internal order (which the reservoir permutes).SkipCountsout of the streaming + whole-genome callers; print a stderr summary when the cap engages, and recordover_max_depth+reads_skipped_totalin the receipt.--max-read-lenenforcement — under--enforce, a read longer than the declared cap aborts loudly (CoreError::ReadExceedsDeclaredLength) instead of silently voiding the predicted envelope; fixes the contradictoryplan.rscomment and the stale--memory-budget-mb/--max-read-lenhelp text.ROSALIND_FORCE_PEAK_RSS_BYTESseam makes the "never a silent overrun" backstop testable: asserts exit 4 +VIOLATED+ output/receipt still written. (Previously zero coverage.)cli-e2enow exercises the boundedvariants --indexcontract: fits (exit 0 +contract: OK) →verify→ refuse (exit 3, no VCF). Validated locally against the bundled toy fixtures.Spec:
docs/superpowers/specs/2026-06-02-trust-correctness-hardening-keystone-design.md.Plan:
docs/superpowers/plans/2026-06-02-trust-correctness-hardening-keystone.md.Deferred to a fast-follow (out of scope here): sort k-way-merge tie-break,
@SQcontig-length cross-check, BSDru_maxrssunit fix + cgroup-awareness, the front-door honesty pass, and merging PR #23.Test plan
cargo testgreen (incl. new unbiased-cap, obs-order, skip-count accumulate, max-read-len abort, receipt-skip-counts, and exit-4 breach tests)cargo fmt --all -- --checkclean; 0 warnings (debug + release)🤖 Generated with Claude Code