Repository navigation
Prove the M0 legacy/canonical isolation boundary (REQ-MIGRATION-004) #41
Description
Goal
Provide bounded M0 evidence for REQ-MIGRATION-004: legacy and canonical runtime stocks remain separate, with no adapter/path sharing authoritative mutable stock or mirroring mutations bidirectionally.
Evidence
REQ-MIGRATION-003 is merged in PR #29. Current src/ contains only the TypeScript toolchain entry and four scaffolding areas; legacy C# remains in TradeCraftSimulation. REQ-MIGRATION-004 is FROZEN and depends only on REQ-MIGRATION-003. It has no coverage row/proving test yet. EXECUTION_ORDER requires completing MIGRATION-001..004 before the M0 Milestone Preview. The baseline pin is handled separately by #39 / #40; do not duplicate it. Issue #33 remains blocked on unchanged credentials and is not a dependency of this work.
Scope
One M0 architecture/invariant proof unit, not a new engine: inspect the actual production entry points and dependency boundaries, add a small focused automated isolation guard/test in src/ (and a test helper only if needed), document its exact M0 coverage and limits in docs/spec/MIGRATION_BOUNDARY.md or a narrow existing equivalent, and add a truthful REQ-MIGRATION-004 row to docs/spec/IMPLEMENTATION_STATUS.md. Keep current runtime behavior and existing scaffolding intact. Choose the smallest useful test that can demonstrate a real prohibited boundary crossing; do not claim future unimplemented systems have been proved correct.
Non-goals
No economics, new mutable WorldState, compatibility bridge, shared stock owner, bidirectional export, workflow/runbook/credential changes, broad lint framework, or Milestone Preview implementation. Do not freeze the canonical engine to remain empty forever; future M1 implementation must be possible within the isolated canonical runtime.
Acceptance criteria
- Record observed evidence for both runtime entry points and the absence of a shared authoritative stock write/bridge in the current M0 implementation.
- Add a named automated regression check for the actual isolation boundary, with a negative control proving the check rejects an intentionally introduced prohibited bridge/dependency (a contained test fixture is acceptable; never commit a live bridge).
- Explain precisely what the test enforces and what remains a review/invariant obligation in later milestones; no overclaim that a text marker alone proves all future behavior.
- No existing runtime behavior or invariant test is weakened; all existing tests remain green.
- Both runtime verification suites and all required current-head CI checks pass.
- Coverage row remains truthful before merge and references this Issue, the proving test and pending merge evidence.
Verification
Read the standard navigation files, then the exact Handoff/11 document and Non-negotiable migration rules anchor referenced by REQ-MIGRATION-004. Inspect only relevant runtime/config entry files to establish the boundary. Run the isolation test including its negative control, npm ci/typecheck/test/build and dotnet build/test Release. Hand off one scoped PR for independent ACCEPTOR review.
Activity
drevendev commentedon Sep 4, 2026
AUTHOR claim
docs/spec/MIGRATION_BOUNDARY.mddocumenting the boundary and its limits, plus a truthfulREQ-MIGRATION-004row indocs/spec/IMPLEMENTATION_STATUS.md. No economics, no new mutable WorldState, no workflow/credential changes.6063ed9, closing Issue Pin the expected 30-turn legacy baseline hash for REQ-MIGRATION-002 #39, with proving testThe_seed_7_thirty_turn_baseline_matches_the_frozen_expected_hash. Flipping that row fromIN_PROGRESStoIMPLEMENTED.claude/issue-41-migration-004-isolationdrevendev commentedon Sep 4, 2026
AUTHOR handoff
claude/issue-41-migration-004-isolationbfe896999a06365b355ec8c3857bca19e9887cadDecisions
(
src/diagnostics/isolationBoundary.ts) oversrc/**/*.tsandTradeCraftSimulation/**/*.cs, rather than an AST/module-resolution analysis —sufficient to catch a realistic M0 bridge (import path,
File.Read, namespacereference) given the two runtimes cannot share memory in-process; documented as a
known limit rather than claimed as complete, in
docs/spec/MIGRATION_BOUNDARY.md.match, since their fixtures/marker constants legitimately contain the forbidden text
as data. Flagged as the highest-risk review area in the PR body.
same PR (PR Pin the expected seed-7/30-turn legacy baseline hash (REQ-MIGRATION-002) #40 merged, closing Pin the expected 30-turn legacy baseline hash for REQ-MIGRATION-002 #39) rather than as a separate handoff, since it was
a small, mechanical row update alongside this Issue's own work.
Checks:
npm ci/typecheck/test/buildpassed;dotnet restore/build/testpassed (45/45, unchanged);
policy_guard.pyandscripts/testspassed. Full detailand evidence in the PR body.
Remaining gate: none for this Issue's scope — handed off for independent ACCEPTOR
review.
status:needs-reviewset, replacingstatus:in-progress.drevendev commentedon Sep 4, 2026
AUTHOR claim
excludingGuardModule(src/diagnostics/isolationBoundary.ts): substring matching onisolationBoundarylets any file whose path merely contains that text (e.g.src/domain/isolationBoundaryBridge.ts) silently escape the real-tree audit even when it contains a genuine prohibited cross-runtime reference. Fix: narrow the exclusion to exact, normalized repository-relative paths for the guard's own two files, and add a negative-control test that exercisesauditRepositoryIsolationBoundaryitself (not justfindCrossRuntimeReferences) with a similarly-named-but-distinct fixture proving the bypass is closed. Also correcting the secondary defect:docs/spec/MIGRATION_BOUNDARY.mdnamesbuild-and-testas the job that runsnpm test; per.github/workflows/ci.ymlthat's actually thetypescriptjob.claude/issue-41-migration-004-isolation(existing, continuing PR Prove the M0 legacy/canonical isolation boundary (REQ-MIGRATION-004) #43)fix(isolation-boundary): close exclusion-bypass in guard-module filter
drevendev commentedon Sep 4, 2026
AUTHOR handoff
claude/issue-41-migration-004-isolatione814eca5317d39d1c79d82fd90346262605a8290What changed since the review
excludingGuardModuleinsrc/diagnostics/isolationBoundary.tsnow matches anexact, normalized repository-relative path against the guard's own two files
(
diagnostics/isolationBoundary.ts,diagnostics/isolationBoundary.test.ts)instead of a substring match on
isolationBoundary, which previously let anysimilarly-named file (e.g.
src/domain/isolationBoundaryBridge.ts) escape thereal-tree audit even with a genuine prohibited reference.
auditRepositoryIsolationBoundary rejects a similarly-named-but-distinct file that the guard-module exclusion must not swallow, that builds such a fixture in atemporary directory and drives it through the real
auditRepositoryIsolationBoundarytraversal (not just the pure
findCrossRuntimeReferencesscan the original twonegative controls used) — this is the path the original bypass lived in.
docs/spec/MIGRATION_BOUNDARY.md: it namedbuild-and-testas the checkrunning
npm test; per.github/workflows/ci.ymlthat's thetypescriptjob.Expanded the doc to state the exclusion is exact-path and to name the new test.
REQ-MIGRATION-004row indocs/spec/IMPLEMENTATION_STATUS.mdtoreference PR Prove the M0 legacy/canonical isolation boundary (REQ-MIGRATION-004) #43 by number and the third negative-control test; status stays
IN_PROGRESS, unchanged, pending merge.Checks at
e814eca:npm ci/typecheck/test(11/11)/buildpassed;dotnet restore/build --configuration Release/test --configuration Releasepassed (45/45, unchanged);
python3 -m unittest discover -s scripts/testspassed(40/40);
python3 scripts/policy_guard.py --base origin/masterpassed (7 changedfiles). Full detail and evidence in the PR body.
Remaining gate: none for this Issue's scope — handed off again for independent
ACCEPTOR review. Setting
status:needs-review, replacingstatus:in-progress.Prove the M0 legacy/canonical isolation boundary (REQ-MIGRATION-004) (#…
drevendev commentedon Sep 4, 2026
Merged in PR #43, squash commit
33683dd4224cac869d2eac982f756ae8fdb6ea7f(tested revisione814eca5317d39d1c79d82fd90346262605a8290).Independently verified at that head:
npm ci/typecheck/test(6 files, 11 tests)/buildall passed;dotnet build --configuration Releaseanddotnet test --configuration Release(45/45) passed;policy_guard.pypassed over 7 changed files; all three required CI checks (build-and-test,policy-guard,typescript) green at this head. The exclusion-bypass defect from round 1 (bfe8969) is closed and covered by a new regression test that drives a similarly-named-but-distinct fixture through the realauditRepositoryIsolationBoundarytraversal — I ran it directly and confirmed it passes.Full verdict: #43 (comment)
Closing evidence and status label removed per
docs/zendev/ACCEPTOR_RUNBOOK.mdsection 4.Define AUTHOR's detection of comment-based ACCEPTOR change requests (#56