From 724bd91532b088c33d66ae26e8496cfbf5a842a0 Mon Sep 17 00:00:00 2001 From: xmap <16776958+xmap@users.noreply.github.com> Date: Tue, 18 Aug 2026 10:21:40 -0500 Subject: [PATCH] Stop SafetyEnvelopeVerdict claiming it survives export whole It does not. `_SCALAR_KEEP` maps `bool` to `keep:number`, which is what the docstring reasoned from, but `gen_record_dispositions.py`'s `_OVERRIDE_DISPOSITIONS` sends both `enclosure_permitted` and `beam_available` to `drop:text`, and `_dispositions.py` has carried that since. The override is deliberate and was itself a gate-review finding: a point-in-time reading of live PSS/interlock and beam-shutter state is the same class of fact `EnclosurePermitObserved.from_status` / `.to_status` already drop, and the two events had been getting opposite export treatment purely because one used `str` and the other `bool`. So the fields are `bool` for domain correctness, and the docstring's inference from that to "survives export and redaction whole" was inverted. The VO is present in the full, unredacted bundle and absent from the published one. Not cosmetic: a research session evaluating whether a witnessed Run should record a clearance flag read this docstring, cited it correctly, and drew a conclusion the disposition table contradicts. The corrected text names the override, states which bundle each way, and tells the next reader to check the override before restoring the claim. Comment-only; no behaviour changes. Co-Authored-By: Claude Opus 5 (1M context) --- apps/api/src/cora/run/aggregates/run/state.py | 23 ++++++++++++++----- 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/apps/api/src/cora/run/aggregates/run/state.py b/apps/api/src/cora/run/aggregates/run/state.py index a4316cb1c0f..e9ad2e890d2 100644 --- a/apps/api/src/cora/run/aggregates/run/state.py +++ b/apps/api/src/cora/run/aggregates/run/state.py @@ -338,12 +338,23 @@ class SafetyEnvelopeVerdict: """A recorded reading of the two live facility signals at a witnessed genesis: did the enclosure permit hold, was beam available. - Plain bools only, deliberately. The record exporter's disposition - generator drops bare `str` and `Any`; `keep:number` covers `bool`, so - this VO survives export and redaction whole. Naming WHICH enclosure or - WHICH shutter failed is not this VO's job: that detail goes to the log - line at the moment of the reading and stays reconstructible from the - Enclosure stream in the same exported bundle. + Plain bools only, deliberately: these are yes/no readings, and `bool` + is the honest domain type. That is NOT an export guarantee, and an + earlier version of this docstring wrongly claimed it was. `_SCALAR_KEEP` + does map `bool` to `keep:number`, but `gen_record_dispositions.py`'s + `_OVERRIDE_DISPOSITIONS` sends BOTH fields to `drop:text`, because a + point-in-time reading of live PSS/interlock and beam-shutter state is + the same class of fact `EnclosurePermitObserved.from_status` / + `.to_status` already drop. So this VO is present in the FULL, + unredacted bundle and ABSENT from the published one. Read that + override and its rationale before restoring any survives-export claim + here; the fields stay `bool` for domain correctness, not for their + disposition. + + Naming WHICH enclosure or WHICH shutter failed is not this VO's job: + that detail goes to the log line at the moment of the reading and + stays reconstructible from the Enclosure stream in the same exported + bundle. Clearance and Supply are deliberately absent. Per the roadmap's rule ("refuse on what CORA can fix, witness what CORA cannot"), those two