PR 4a: Vocabulary<S>::is_fdr_dissem trait method (006 T111)#422
Conversation
…6 T111)
PR 4a of the 006-engine-rule-refactor — first piece of Phase 8 (User
Story 6, lattice projection laws). Adds one trait method to
`Vocabulary<S>` so the dissem-axis `SupersessionSet` join (landing in
PR 4b) can ask "is this token part of the §B.3.a FD&R chain?" without
each scheme re-implementing the closed-CVE set check.
The override on `CapcoScheme` iterates the existing private
`FDR_DOMINATORS` static slice (NOFORN / RELIDO / DISPLAY ONLY /
EYES / CAT_REL_TO any-LIST) so this method and the neighboring
`is_fdr_dominator` predicate (used by the RELIDO ConflictsWithFamily
constraint catalog) stay coupled to one source-of-truth. They do
*not* delegate to each other: `is_fdr_dominator` answers "is this
token an FD&R dominator OVER RELIDO" (RELIDO-vs-RELIDO is a
tautology) and excludes RELIDO; `is_fdr_dissem` answers "is this
token part of the FD&R set" and includes RELIDO. The bidirectional
value-pin test in `mod fdr_dissem_pin` makes the divergence
impossible to regress silently.
The default impl returns `false`; the doc comment explicitly names
the override-required footgun ("schemes with FD&R MUST override")
mirroring the same discipline as `MarkingScheme::iter_present_tokens`.
Pinned by a NoFdrScheme stub in `crates/scheme/tests/`.
Citations verified at point of implementation per Constitution VIII:
- §B.3.a p19 — canonical FD&R-set enumeration ("NOFORN, REL TO,
RELIDO, or DISPLAY ONLY"). The earlier draft cited §B.3 Table 2 p21
(the scenario-summary table) — corrected to the definitional
passage per capco-dissem-validator review.
- §H.8 p157 — EYES deprecation (2017-10-01) but legacy-input
recognized.
Scope is intentionally narrow:
- Trait method declaration in `marque-scheme`.
- CapcoScheme override in `marque-capco`.
- 6 pinning tests across 3 sites (in-crate unit + public-API
integration + default-impl stub).
- `pub(crate)` visibility uplift on `FDR_DOMINATORS` and
`capco_token_category` (per project memory
`pub_doc_hidden_is_still_public_api`: `pub(crate)` + unit tests
over `#[doc(hidden)] pub`).
Out of scope: PR 4b wires the consumer (per-category `Lattice` impls
on the dissem axis). Group A required-pair predicates (HCS-O / EXDIS
/ NODIS / SBU-NF / LES-NF require NOFORN) are already correctly
encoded — HCS-O via the SCI per-system catalog walker bridge, EXDIS
/ NODIS via the E038 Custom fold, SBU-NF / LES-NF via Pattern A
PageRewrites — and are deferred to PR 4c's broader Custom→Requires
catalog conversion under #307 Groups B + E.
Refs: spec 006 T111, #307 Group A discovery.
|
🤖 Hi @bashandbone, I've received your request, and I'm working on it now! You can track my progress in the logs. |
|
🤖 I'm sorry @bashandbone, but I was unable to process your request. Please see the logs for more details. |
There was a problem hiding this comment.
Pull request overview
Adds the Vocabulary<S>::is_fdr_dissem predicate surface so CAPCO and future lattice/closure consumers can identify FD&R dissemination-family membership through the scheme vocabulary API.
Changes:
- Adds a default
Vocabulary::is_fdr_dissemimplementation returningfalse. - Implements the CAPCO override by walking
FDR_DOMINATORS. - Adds default-impl, public CAPCO behavior, and in-crate source-of-truth pin tests.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
crates/scheme/src/vocabulary.rs |
Adds the new trait method and contract documentation. |
crates/scheme/tests/vocabulary_default_is_fdr_dissem.rs |
Pins the default constant-false implementation. |
crates/capco/src/scheme.rs |
Exposes capco_token_category and FDR_DOMINATORS within the crate for the override/tests. |
crates/capco/src/vocabulary.rs |
Implements CAPCO FD&R membership and adds in-crate pin tests. |
crates/capco/tests/fdr_dissem_predicate.rs |
Adds public API integration tests for accepted and rejected CAPCO tokens. |
Comments suppressed due to low confidence (1)
crates/capco/src/vocabulary.rs:1035
- This RELIDO rationale uses the same stale §B.3 Table 2 citation even though the canonical FD&R membership citation is §B.3.a p19. Please align this with the corrected citation used later in the comment block.
/// `is_fdr_dissem(TOK_RELIDO)`. RELIDO is unambiguously an FD&R
/// member per §B.3 Table 2, so this method iterates over the
/// full `FDR_DOMINATORS` slice directly.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| /// that defines the FD&R set itself per CAPCO-2016 §B.3 Table 2 | ||
| /// p21 — so this method and the slice stay in lock-step against | ||
| /// a single source-of-truth. Adding *any* entry to |
There was a problem hiding this comment.
Addressed in 6ba9138. Both line 1018 and line 1033 (now 1034) corrected to cite §B.3.a p19 as the canonical FD&R-set definition, with §B.3 Table 2 pp 21-22 acknowledged as the scenario-summary table per the same correction.
| "RELIDO is unambiguously an FD&R member per §B.3 Table 2 \ | ||
| p21. The override must not delegate through \ |
There was a problem hiding this comment.
Addressed in 6ba9138. Test assertion message corrected to cite §B.3.a p19.
| // `is_fdr_dominator` function each enumerate FD&R membership for | ||
| // distinct callers — they share the same conceptual source (CAPCO | ||
| // §B.3.a p19), but each function hard-codes its own `Token` arms | ||
| // rather than deriving from the other. Adding a `Token` entry here | ||
| // requires: | ||
| // 1. Updating `is_fdr_dominator`'s `matches!` arm if the new token | ||
| // should also be an FD&R dominator OVER RELIDO (the RELIDO- | ||
| // conflict-family role). |
There was a problem hiding this comment.
Addressed in 6ba9138. Reworded the maintenance note to make the distinction explicit: FDR_DOMINATORS enumerates FD&R set membership per §B.3.a p19; is_fdr_dominator enumerates dominators over RELIDO (deliberately excluding RELIDO itself for the conflict-family role). Added a pointer to the relido_admits_despite_is_fdr_dominator_excluding_it regression pin.
#422 Three Copilot review comments on PR 4a (#422), all citation-consistency issues in PR-4a-introduced code: 1. `crates/capco/src/vocabulary.rs:1018` (override doc comment) — cited "§B.3 Table 2 p21" as the FD&R-set definition; corrected to "§B.3.a p19" with Table 2 acknowledged as the scenario-summary table. 2. `crates/capco/src/vocabulary.rs:1034` (RELIDO rationale) — same stale citation; corrected to §B.3.a p19. 3. `crates/capco/src/vocabulary.rs:1753` (test assertion message) — same stale citation; corrected. 4. `crates/capco/src/scheme.rs:4235-4249` (FDR_DOMINATORS maintenance note) — said `FDR_DOMINATORS` and `is_fdr_dominator` "each enumerate FD&R membership" when they answer *different* questions: `FDR_DOMINATORS` enumerates set membership; `is_fdr_dominator` enumerates dominators OVER RELIDO (excludes RELIDO itself for the conflict-family role). Reworded to make the distinction explicit and added a pointer to the `relido_admits_despite_is_fdr_dominator_excluding_it` regression pin. All pre-existing `§B.3 Table 2 p21` citations elsewhere in `crates/capco/src/scheme.rs` (E054/E055/E057 catalog labels, etc.) are pre-existing infrastructure not introduced by PR 4a and remain out of scope for this review pass — Constitution VIII citation hygiene cleanup of the broader catalog is queued for a future PR. Tests pass + clippy clean. No behavioral changes.
| // - `FDR_DOMINATORS` (this slice) enumerates **FD&R-set | ||
| // membership** per §B.3.a p19 — the four canonical FD&R | ||
| // markings (NOFORN / REL TO / RELIDO / DISPLAY ONLY) plus the | ||
| // §H.8 p157 EYES legacy. `Vocabulary::is_fdr_dissem` walks |
There was a problem hiding this comment.
Addressed in f4ddca4. Updated the FDR_DOMINATORS header comment block above to cite §B.3.a p19 as the authoritative enumeration, with §B.3 Table 2 pp 21-22 acknowledged as the derivative scenario-summary table. The file no longer contradicts itself between the header and the new maintenance contract.
| /// 3. The bidirectional definition site for the FD&R dominator | ||
| /// list — the static slice the constraint-evaluator's family | ||
| /// predicate `is_fdr_dominator` uses for the | ||
| /// [`crate::constraint::Constraint::ConflictsWithFamily`] | ||
| /// dispatch in `marque-capco`. |
There was a problem hiding this comment.
Addressed in f4ddca4. Rewrote the trait-doc bullet to make the distinction explicit: is_fdr_dissem is the FD&R-set-membership accessor (admits RELIDO per §B.3.a p19); is_fdr_dominator answers "dominator over RELIDO" for the conflict-family role (excludes RELIDO). Added the same do-not-delegate guidance the in-tree maintenance contract carries.
| /// single source-of-truth. Adding *any* entry to | ||
| /// `FDR_DOMINATORS` (whether a `TokenRef::Token` or a | ||
| /// `TokenRef::AnyInCategory`) automatically updates this method. |
There was a problem hiding this comment.
Addressed in f4ddca4. Reworded with the explicit two-path dual-update rule: TokenRef::Token entries automatically update this method (the iteration walks every entry); TokenRef::AnyInCategory(CAT_X) entries only admit tokens that capco_token_category routes to Some(CAT_X), so adding a new AnyInCategory entry requires a matching capco_token_category arm. The maintenance contract on FDR_DOMINATORS now carries the explicit dual-update rule too.
Three follow-up Copilot findings on the previous citation fixup: 1. `crates/capco/src/scheme.rs:4202` — the `FDR_DOMINATORS` header comment still called §B.3 Table 2 the authoritative enumeration AFTER my new maintenance note correctly cited §B.3.a p19. Updated the header to cite §B.3.a p19 (canonical) + §B.3 Table 2 pp 21-22 (derivative summary table) so the file no longer contradicts itself. 2. `crates/scheme/src/vocabulary.rs:343` — trait-level doc bullet #3 described `FDR_DOMINATORS` as the static slice `is_fdr_dominator` uses. After the maintenance contract reword, this is misleading. Rewrote bullet #3 to make the distinction explicit: `is_fdr_dissem` answers FD&R-set membership (admits RELIDO); `is_fdr_dominator` answers "dominator over RELIDO" for the conflict-family role (excludes RELIDO). Added the same "do not delegate" guidance the in-tree maintenance contract carries. 3. `crates/capco/src/vocabulary.rs:1024` — overstated `AnyInCategory` admission semantics. The override receives a single `TokenId` and routes through `capco_token_category` to hit category arms; adding a new `AnyInCategory(CAT_NEW)` to `FDR_DOMINATORS` only admits tokens that `capco_token_category` routes to `CAT_NEW`. Reworded with the explicit two-path dual-update rule (Token entries auto; AnyInCategory entries require a routing arm). All workspace tests pass; clippy clean. No behavioral changes.
Summary
First piece of Phase 8 (User Story 6, lattice projection laws) of the 006-engine-rule-refactor. Adds one trait method to
Vocabulary<S>so PR 4b's per-categoryLatticeimpls can ask "is this token part of the §B.3.a FD&R chain?" through the scheme surface instead of each consumer re-implementing the closed-CVE membership check.fn is_fdr_dissem(&self, token: &S::Token) -> boolwith defaultfalse; CapcoScheme override iteratesFDR_DOMINATORSPR 4 has been split into 4a / 4b / 4c sub-PRs after preflight discovery. This is 4a (small, foundational).
is_fdr_dissemtrait surface + tests.Latticeimpls + AEA §-amendment to2026-05-01-lattice-design.md+CapcoMarking::joinPageContext delegation deleted + property/cross-axis tests (T112–T117a).tests/corpus/lattice/regression fixtures +tests/corpus/prose-positive/+ Predicate coverage catalog: 39 CAPCO declarative constraints / canonicalizations surfaced from PR #303 #307 Groups B/C/E predicate catalog (T118–T119c) — this is where the SCI per-system Custom-row → properConstraint::Requiresconversion lands.T119b (Group A required-pair fixes) was rolled into PR 4c after the preflight survey found that all five Group A predicates are already encoded:
scheme.rs:6541-6601)scheme.rs:2502-2520)scheme.rs:1658-1751)#307 Group A's "HCS-O survives as a gap" framing is stale relative to PR 3b.E (#326) and PR 3c.B Commit 7.4 — those landed the proper coverage in transitional
Constraint::Customshape. PR 4c retires the transitional shape uniformly as part of Groups B + E.Implementation notes worth a reviewer's attention
Delegation strategy —
FDR_DOMINATORSdirect, notis_fdr_dominator. During implementation the value-pin test caught a load-bearing semantic difference betweenis_fdr_dissem(this PR's new predicate, "is this token an FD&R member") andis_fdr_dominator(existing, "is this token an FD&R dominator OVER RELIDO" — RELIDO-vs-RELIDO is a tautology in its RELIDO-conflict-family role). RELIDO IS unambiguously FD&R per §B.3.a p19, so the override iteratesFDR_DOMINATORSdirectly. A regression test (is_fdr_dissem_admits_canonical_dominators'sTOK_RELIDOarm) pins this and explains why a future "delegate to is_fdr_dominator" refactor would silently under-fire.Bidirectional pin.
mod fdr_dissem_pinincrates/capco/src/vocabulary.rswalksFDR_DOMINATORSforward (everyTokenentry →is_fdr_dissemreturnstrue) and a representative non-FD&R sentinel set backward (ORCON / IMCON / FOUO / …). A futureFDR_DOMINATORSextension that doesn't update the override will fail the test.pub(crate)visibility uplift onFDR_DOMINATORSandcapco_token_category. Per project memorypub_doc_hidden_is_still_public_api: preferpub(crate)+ unit tests over#[doc(hidden)] pub. No crate-boundary leak — both stay private tomarque-capco.Default impl is
falsewith explicit footgun documentation. A scheme that has an FD&R-style family but forgets to override silently returnsfalsefor every dominator, which would produce wrong banner roll-ups in PR 4b. The doc comment names this in MUST-language, mirroringMarkingScheme::iter_present_tokens' existing override-or-broken contract.Citation discipline
Per Constitution VIII, every §-citation in this PR has been verified against
crates/capco/docs/CAPCO-2016.mdat the point of implementation. Two iterations:§B.3 Table 2 p21for the FD&R-set definition.§B.3.a p19("NOFORN, REL TO, RELIDO, or DISPLAY ONLY"). All 11 PR-introduced sites corrected to§B.3.a p19.Two test-label page-number defects also corrected (caught by the same review):
NODIS §H.9 p172 → p174,RESTRICTED §H.1 p51 → §H.3 p56(TOK_RESTRICTED's consumer is the §H.3 p56 JOINT-conflicts-RESTRICTED rule, not a §H.1 entry — §H.1 has no standalone "RESTRICTED").Reviewer chain (before opening)
is_fdr_dominator), defaultfalse,#[inline]on the override, bidirectional value-pin test.is_fdr_dominator-vs-is_fdr_dissemsemantic divergence at value-pin time and switched delegation strategy mid-implementation. Documented the regression-pin rationale.TOK_REL_TO;FDR_DOMINATORScomment phrasing) + 3 LOW.mod fdr_dissem_pinheader described the override as delegating tois_fdr_dominatorafter the implementation switched to iteratingFDR_DOMINATORSdirectly). Fixed.§B.3 Table 2 p21 → §B.3.a p19,NODIS §H.9 p172 → p174,RESTRICTED §H.1 p51 → §H.3 p56). All fixed.Test plan
cargo build --workspace— cleancargo test --workspace --no-fail-fast— 0 failures across all suites (capco / scheme / engine / wasm / server / cli)cargo +stable clippy --workspace --all-targets -- -D warnings— cleancargo fmt --check— cleanRefs
specs/006-engine-rule-refactor/tasks.mdT111🤖 Generated with Claude Code