The umbrella system becomes the pipeline's change-propagation mechanism (original intent restored, now enforced):
config/umbrellas.json — the impact map: 8 umbrellas, all 104 modules mapped exactly once (91 src/rune + 13 shared/ harness), real canaries, acyclic depends_on DAG.
scripts/umbrella_impact.py — CI gate: PR diff → affected umbrellas → propagation verdict. Unmapped surfaces fail ("the map travels with the change"); changes to umbrellas with dependents require either dependent files in the PR or an explicit Propagation:/Propagation-waived: statement in the body. Wired into the unit-tests job (merge-base diff).
Canary selection subcommand (canaries) ready for targeted fast-gate CI selection.
Three henxels statements enforce the map itself: bidirectional completeness (umbrella_manifest_is_complete — the answer to "what updates the map": nothing auto-guesses; the gate makes omission impossible, assignment is a human-visible diff), canary existence (umbrella_canaries_exist), DAG acyclicity (umbrella_dag_acyclic).
Contract tests: map completeness (bidirectional), canary existence + CI registration, DAG acyclicity, propagation logic on synthetic diffs, unmapped-surface flagging, dependent-canary selection.
Deliberate design choice (Nick's question: "something that updates the map?")
No auto-updater: umbrella assignment is a judgment call automation would guess wrong. Instead the gate makes omission structurally impossible (unmapped module = CI failure) while keeping every assignment a reviewed diff. The map cannot silently drift, and it cannot silently lie.
## Summary
- The umbrella system becomes the pipeline's change-propagation mechanism (original intent restored, now enforced):
- `config/umbrellas.json` — the impact map: 8 umbrellas, all 104 modules mapped exactly once (91 src/rune + 13 shared/ harness), real canaries, acyclic depends_on DAG.
- `scripts/umbrella_impact.py` — CI gate: PR diff → affected umbrellas → propagation verdict. Unmapped surfaces fail ("the map travels with the change"); changes to umbrellas with dependents require either dependent files in the PR or an explicit `Propagation:`/`Propagation-waived:` statement in the body. Wired into the unit-tests job (merge-base diff).
- Canary selection subcommand (`canaries`) ready for targeted fast-gate CI selection.
- Three henxels statements enforce the map itself: bidirectional completeness (`umbrella_manifest_is_complete` — the answer to "what updates the map": nothing auto-guesses; the gate makes omission impossible, assignment is a human-visible diff), canary existence (`umbrella_canaries_exist`), DAG acyclicity (`umbrella_dag_acyclic`).
## Verification
- 610+84 green; ratchet PASS; ruff clean; henxels --all holds (digest synced); ci.yml parses.
- Contract tests: map completeness (bidirectional), canary existence + CI registration, DAG acyclicity, propagation logic on synthetic diffs, unmapped-surface flagging, dependent-canary selection.
## Deliberate design choice (Nick's question: "something that updates the map?")
No auto-updater: umbrella assignment is a judgment call automation would guess wrong. Instead the gate makes omission structurally impossible (unmapped module = CI failure) while keeping every assignment a reviewed diff. The map cannot silently drift, and it cannot silently lie.
scripts/capture_failure.py: one command turns a raw failure payload into a
sanitised fixture under tests/fixtures/production/<class>/<id>/ plus a
manifest.json entry carrying the payload's sha256 (tamper-evidence for the
generated regression tests). Redaction reuses #122's filer patterns (query
creds, DSN userinfo, bearer, assignments) — copied with attribution because
the filer module ships on the failure-auto-filing branch; parity is pinned
on the filer's own test literals. After redaction an independent residual
scan aborts the capture loudly (exit 3, nothing persisted) when a
credential-shaped span survives — over-redaction is a shape witness, a
leaked fixture is an incident.
capture_failure.py now generates tests/test_production_fixtures.py (template
embedded, written once — manifest-driven parametrization means regeneration
would be churn). One regression test per manifest fixture asserts the
system's CURRENT handling of the historical payload: sha256 tamper-evidence
(a payload edited without re-running capture fails), sanitiser idempotence,
metadata shape, and per-class checker dispatch — the recorded payload must
be CAUGHT by its class's checker so a recurrence fails CI. First checker:
env-case-mismatch (#192's CONVERGED casing defect), mirroring the boolean
env-export guard from the #192 discharge.
Seeds the pipeline with the REAL #192 CONVERGED case-mismatch payload: the
safety-net convergence step exported Python-cased True/False from
json.load while the steps compared env.CONVERGED == 'false' — both
conditionals unreachable (discharged on the release-safety-net branch,
public in PR #211's diff). Captured via the pipeline itself
(--class env-case-mismatch --source ci, 0 redactions — the payload is
already public and credential-free). The generated regression test asserts
the boolean-export checker still FLAGS the recorded payload
(checker_expectation: flags), so a recurrence of the class fails CI.
Manifest gains checker_expectation: capture records whether the class's
checker raises on the payload ('flags' — the raise IS the recurrence alarm)
or must stay quiet ('passes'); the generated tests enforce the recorded
expectation, so a checker that stops catching its recorded defect rots the
suite red.
Docs: bugfix-contract §10 gains the operational capture step + explicit
trivial-bug exemption list; README dev section points at the pipeline;
tests/fixtures/production/README.md documents the flow.
Henxels: capture_failure.py required in scripts/; production fixtures
governed (manifest.json + README.md required); payload.json and
manifest.json travel together (changed_with both directions, verified to
bite on a payload-only staged change).
The hand-rolled allowlist in tui_validator.py drifted from rune_tui.py's
real imports: 'from __future__ import annotations' (8126f1c) and bare
'import rune' (44cba5c) were flagged as not-found — the canary printed
two known false-failures on every run. The hand list is the defect class
(it drifts by construction), so replace it with ruff-isort-style
declarative classification, stdlib-only (no new dependency):
- relative imports -> their own class, never flagged (ruff semantics)
- stdlib via sys.stdlib_module_names (covers __future__, a compiler
directive, not a runtime import)
- external: explicit 3-name set (textual, textual_autocomplete, rich) —
the only hand-maintained list left
- first-party: GENERATED from the src/rune/ listing plus the package
itself (_first_party_modules); sync-guarded by test
- scripts/ fallback kept; only 'unknown' is flagged
Tests written first (red: 10 failed incl. the headline zero-false-
failures assertion on the real rune_tui.py); regression guard pins
_first_party_modules to the directory listing. (#139)
The content-matched tolerance tuple in canary_native.py (added by #138 as
a stopgap for the drifted validator allowlist) is removed: with #139's
declarative classification in tui_validator.py there are no known
false-failures left to tolerate, and a residual shim would mask a
regression of this very class. Every TUI validator error now counts as
failed.
The I2 frozen test (test_canary_native_tolerance_is_content_matched) is
replaced by test_canary_native_has_no_false_failure_tolerance, which
fails if the tolerance tuple or its warning branch returns — red at HEAD
(tuple still present), green after this change. Red demonstration: with
the pre-#139 validator restored, the tolerance-free canary reports
'91 passed, 2 failed' (__future__ + rune) instead of silently warning.
plans/2026-09-05-structural-contract.md:241 assigned tolerance removal
to #139. (#139)
tui_validator.py and tests/test_tui_validator_imports.py fully
format-clean. canary_native.py: blank line added in the #139-edited
region only; the file carries pre-existing format drift (import blocks
at L19/L199 wanting blank lines) that predates #139 — reformatting
wholesale would add churn outside this issue's diff. (#139)
Red-first evidence, canary before/after, kill-test transcripts, suite
and ratchet results, deviations (pre-existing canary_native format
drift; system-python environment artifact; foreign-stash pop incident —
recovered, no data lost). (#139)
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
Blast radius at ab4dbf8: BLE001 455 / S110 117 over src/ shared/ scripts/
(T201 1625 measured, not enforced). Enforcement mirrors the pyright ratchet:
scripts/lint_ratchet.py + lint-baseline.json, wired as an append-only step in
the ci.yml lint job. Contract tests red->green in
tests/test_ci_lint_contract.py; debt ledger docs/silent-handler-debt.md.
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
Baseline {BLE001: 351, S110: 79} (was 455/117): 103 handlers in
memory_store.py, warm_router.py, curator.py, tool_executor.py now log
tracebacks via logger.debug(.., exc_info=True) or carry reasoned
# noqa: BLE001 (warm_router P0-06 record_failure paths). Ledger table
regenerated from the live tree; Completion Record appended to the plan.
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
🤖Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 **Headless spec gate (non-blocking, #204 first slice)**
Spec-gate agent produced no text output — check runner logs.
<details><summary>Deterministic floors still govern the merge</summary>
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.</details>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
config/umbrellas.json— the impact map: 8 umbrellas, all 104 modules mapped exactly once (91 src/rune + 13 shared/ harness), real canaries, acyclic depends_on DAG.scripts/umbrella_impact.py— CI gate: PR diff → affected umbrellas → propagation verdict. Unmapped surfaces fail ("the map travels with the change"); changes to umbrellas with dependents require either dependent files in the PR or an explicitPropagation:/Propagation-waived:statement in the body. Wired into the unit-tests job (merge-base diff).canaries) ready for targeted fast-gate CI selection.umbrella_manifest_is_complete— the answer to "what updates the map": nothing auto-guesses; the gate makes omission impossible, assignment is a human-visible diff), canary existence (umbrella_canaries_exist), DAG acyclicity (umbrella_dag_acyclic).Verification
Deliberate design choice (Nick's question: "something that updates the map?")
No auto-updater: umbrella assignment is a judgment call automation would guess wrong. Instead the gate makes omission structurally impossible (unmapped module = CI failure) while keeping every assignment a reviewed diff. The map cannot silently drift, and it cannot silently lie.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
Baseline {BLE001: 351, S110: 79} (was 455/117): 103 handlers in memory_store.py, warm_router.py, curator.py, tool_executor.py now log tracebacks via logger.debug(.., exc_info=True) or carry reasoned # noqa: BLE001 (warm_router P0-06 record_failure paths). Ledger table regenerated from the live tree; Completion Record appended to the plan.🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.
🤖 Headless spec gate (non-blocking, #204 first slice)
Spec-gate agent produced no text output — check runner logs.
Deterministic floors still govern the merge
This comment is advisory. Required checks (lint, tests, canaries, type-check, coverage, dependency lock, impact gate) remain the merge authority per docs/adversarial-review.md proportionality.