fix(benchmark): harden radius-sweep provenance (#6643)

[ll7]

Summary

Harden the #6643 Gate 3 radius-sweep composer against substituted campaign provenance, ambiguous planner identity, and malformed or incomplete runtime diagnostics. This PR establishes implementation-integrity checks and fail-closed behavior only; it does not produce a Gate 3 scientific verdict.

Linked Issues

• Refs benchmark(6600 Gate 3): rank-stability analysis, durable evidence bundle, and verdict propagation #6643
• Refs benchmark(6600 Gate 2): SLURM production radius sweep (0.5/0.8/1.0 m) over 14 planners x 48 cells x seeds 111-140 #6642

Issue Relationship Mirror

• Parent issue: none
• Blocked by: none
• Blocking: none
• Relates to: none

Successor statement: this is a successor integrity slice and does not duplicate the already merged #6643 changes.

Stack / Dependency

• Final readiness validated origin/main 0e211ed4fe3c73c07f4f93b38ed952b50440e961; current origin/main is 56608cddbc64875482e6bfbcb80df38300681d45; ordinary CAS covers the current-main compare at merge time.
• No open prerequisite stack is declared.
• Safe to review independently: yes for code integrity; scientific Gate 3 admission remains blocked on external inputs.

What Changed

• Bind runner receipt seed, matrix path/blob digest, suite identity, simulator settings, and source/config identities to frozen campaign inputs.
• Pin the accepted benchmark(6600 Gate 2): SLURM production radius sweep (0.5/0.8/1.0 m) over 14 planners x 48 cells x seeds 111-140 #6642 source commit and Gate 1 receipt digest; reject substituted manifests, receipts, and case-variant digest ambiguity.
• Require explicitly pinned owner-approved family-feasibility rules; production rule authority remains unset and composition fails closed.
• Resolve planner identity from frozen Git blobs, preserve row-level planner-key provenance, and recursively retain only validated clean diagnostics.
• Add mutation/refusal regressions for provenance substitution, seed binding, planner identity, family-rule provenance, nested diagnostics, malformed fallback markers, and digest casing.

Research / Evidence Notes

• Target: code-level integrity and refusal behavior of radius-sweep composition.
• Comparator: deterministic committed-config fixtures and mutation/refusal tests; preserved campaign artifacts are not used to produce a result.
• Result: diagnostic-only. No radius-stability verdict, planner ranking, benchmark improvement, or paper-facing claim is established.

Validation / Proof

• Current head: 35a1120744baa736ce427a6f1f25034898f1fff4.
• Focused radius/provenance suite: 434 passed after the current-main refresh.
• Changed Python files pass locked Ruff check/format and git diff --check.
• Final readiness passed on this refreshed head; stamp: output/validation/pr_ready/fix-pr-9607-20260924.json (base SHA 0e211ed4fe3c73c07f4f93b38ed952b50440e961). Core and optional lanes, contract/follow-up/domain checks, CUDA preflight, and coverage completed; coverage goal warnings remain on three large files.
• Current-head hosted CI is terminal green: 37 successful checks and 3 intentional skips, with no failures. merge-if-ci-green remains the handoff state until the guarded merger performs its current-main compare-and-swap.

Risks / Blockers

• Original Gate 1 receipt bytes and checksum-bound owner-approved family-feasibility receipts are unavailable.
• Preserved hybrid rows lack authoritative planner-key provenance on 47/48 scenarios and remain ambiguous.
• No Gate 3 scientific verdict can be produced until those external inputs are recovered and separately reviewed.

Downstream Propagation

• Do not propagate a verdict to benchmark: quantify planner-ranking sensitivity to collision-envelope radius #6600 or analysis parent: simulator-fidelity sensitivity and validity-boundary decision #3207 until the original receipt identity and owner-approved family-feasibility inputs are available and the composer emits a valid bundle.
• This integrity repair leaves benchmark(6600 Gate 3): rank-stability analysis, durable evidence bundle, and verdict propagation #6643 and benchmark(6600 Gate 2): SLURM production radius sweep (0.5/0.8/1.0 m) over 14 planners x 48 cells x seeds 111-140 #6642 open and does not change their scientific status.

Follow-Up / Residual Scope

• Recover or explicitly resolve the original Gate 1 receipt bytes.
• Recover authoritative planner-key provenance or define a separately reviewed future campaign source pin.
• Obtain a durable owner-approved family-level feasibility rule and checksum-bound receipts for all three radius arms, then separately review any resulting Gate 3 verdict.

Domain-Aware Approval

• Required for this PR: yes - implementation integrity for benchmark evidence admission
• Domains reviewed: benchmark provenance, radius-sensitivity gate ordering, fail-closed diagnostics
• Status: approved
• Approver/review source or waiver: issue benchmark(6600 Gate 3): rank-stability analysis, durable evidence bundle, and verdict propagation #6643 maintainer approval for the narrowed implementation-integrity scope; no scientific Gate 3 admission is approved
• Validity checklist:
  • Target claim/hypothesis: composer accepts only provenance-bound radius inputs and refuses substitutions
  • Comparator or split/evidence validity: deterministic fixtures and mutation tests cover accepted/refusal boundaries
  • Fallback/degraded exclusions: unknown, malformed, fallback-shaped, and ambiguous inputs remain visible and fail closed
  • Claim boundary: no rank-stability, planner, benchmark, or dissertation claim
  • Implementation integrity: focused tests and final-readiness proof cover code behavior only

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: ll7/robot_sf_ll7/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 930738a2-8d5f-43f7-9c67-47f9f6b55d49

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 PR Contract Check Summary

Overall Status: 🟢 PASSED

Check	Status	Description
1. Closes-discipline	✅ PASSED	Demand Refs #N for epic issues and main-CI incidents
2. GitHub closing-keyword parity	✅ PASSED	Fail closed when GitHub closing references diverge from repository parsing
3. Closure declaration	✅ PASSED	Require Closes/Refs for title issues
4. State-refresh-only	✅ PASSED	Reject docs/context state updates
5. Evidence hygiene	✅ PASSED	Checks markers and provenance fields
6. Evidence writer usage	✅ PASSED	Require the shared marked writer path
7. Successor discipline	✅ PASSED	Require successor statement on multi-PR issues
8. Worker-lane label	⚪ None	Label PRs from cheap worker lane
9. Placeholder docstring ratchet	✅ PASSED	Reject NEW TODO/empty docstrings in added diff lines
10. Issue line/file budget	✅ PASSED	Enforce declared caps unless 'budget-override: ' is present

ℹ️ Info

• No worker-lane provenance detected.

---

This check is mechanized. Please resolve any blockers to pass CI.

[ll7]

review-claim: gate3-composer-fix @ 54e8e29 until 2026-09-22T14:53:21Z

[ll7]

review-claim: released @ 54e8e29

[ll7]

review-claim: gate3-composer-fix @ 4a93a21 until 2026-09-22T14:53:21Z

[ll7]

pr-metadata: reconciled @ b6b8ce3b30069eced69094f195ef0e7d9b5b8c4eb32a92bb72c82b77fe0957d5

[ll7]

review-claim: released @ 4a93a21

[ll7]

Exact-head independent review

• Exact base/current main: 258db56b527e93f664b2ef08e2fb6dc3eb9218e2.
• Exact head: 4a93a2139d3cccea80364477dd121a27016b84ee.
• Findings: none open; both prior evidence-integrity blockers are fixed.
• All five planner means are recomputed from admitted episodes at canonical four-decimal camera-ready precision, and independent mutations are rejected.
• Coordinated preflight/family config-digest replacement is rejected against frozen per-arm hashes; independent git show recomputation from campaign commit aabad2e2… matches all three bindings.
• Proof: 193 focused tests, the registered 99-test fast lane, Ruff/format, fast-lane routing, and current-main integration passed.
• The original Gate 1 receipt bytes and authoritative family-feasibility receipts remain mandatory blockers. No summary, verdict, ranking, or downstream scientific claim is fabricated.
• Hosted checks remain pending and the PR remains draft. This accepts the composer implementation at this exact head, not the blocked scientific execution or merge readiness.

single-account-review: accepted @ 4a93a21
gate-verdict: accepted @ 4a93a21
base-policy: ordinary-cas @ 4a93a21
pr-metadata: reconciled @ b6b8ce3b30069eced69094f195ef0e7d9b5b8c4eb32a92bb72c82b77fe0957d5

[ll7]

Exact-head review of d1bf33218ac32c985b3379aefde9548260377905 found two evidence-integrity gaps; this comment records the bounded fix-forward, not a scientific result.

• The episode loader trusts the run-directory planner identity without cross-checking planner identity fields embedded in the episode payload. Synthetic mismatches were accepted, so I’m adding strict identity binding and mutation tests.
• The family-feasibility receipt path compares authority/rule strings but does not independently bind family labels and status to source rows and their result digest. I’m strengthening that contract fail-closed. Production authority constants remain unset, and this work will not enable them, run Gate 2, or emit a family verdict.

The current-head focused suite passed 199 tests and current-main integration passed. One optional-import namespace test could not create its nested git worktree under the protected-review sandbox; it is recorded as an environment limitation, not a product pass/failure. The PR stays draft while the fixes are validated.

review-claim: gate3-composer-fix-forward @ d1bf332 until 2026-09-23T16:09:56Z

[ll7]

review-claim: gate3-malformed-diagnostics-fix @ ad23742 until 2026-09-24T05:30:27Z

[ll7]

review-claim: gate3-malformed-diagnostics-review @ 540082f until 2026-09-24T05:44:00Z

[ll7]

review-claim: released @ ad23742

[ll7]

review-claim: gate3-malformed-diagnostics-review @ 3fb8387 until 2026-09-24T05:55:00Z

[ll7]

review-claim: released @ 540082f

[ll7]

review-claim: gate3-malformed-diagnostics-fix @ 3fb8387 until 2026-09-24T05:55:00Z

[ll7]

review-claim: released @ 3fb8387

[ll7]

review-claim: gate3-malformed-diagnostics-review @ a28b253 until 2026-09-24T06:00:00Z

[ll7]

review-claim: released @ 3fb8387

[ll7]

review-claim: goal-pr-review-pr-9607-fix @ 830ab92 until 2026-09-24T22:19:47.688429Z

[ll7]

review-claim: released @ 830ab92

[ll7]

review-claim: goal-pr-review-pr-9607-fix @ 35a1120 until 2026-09-24T22:21:50.680241Z

[ll7]

Exact-head self-review

• Reviewed head: 35a1120744baa736ce427a6f1f25034898f1fff4.
• Final readiness validated current origin/main 0e211ed4fe3c73c07f4f93b38ed952b50440e961; ordinary CAS covers the current-main compare at merge time.
• Findings: no actionable implementation-integrity, security, or contract findings. Provenance substitution, ambiguous planner identity, malformed diagnostics, and missing family-rule authority fail closed as intended.
• Validation: 434 focused radius/provenance tests passed; final PR readiness passed on the current head with core/optional lanes, CUDA preflight, contracts, follow-up checks, and coverage completed. Coverage goal warnings remain on three large files.
• Scientific boundary: the original Gate 1 receipt, authoritative planner-key provenance, and owner-approved family-feasibility receipts remain unavailable. This review accepts only the code-integrity slice and does not admit a Gate 3 verdict.
• Hosted CI is the remaining external gate; no cancellation or rerun was performed.
• Single-account internal-review waiver applies because no independent review identity exists; it does not waive the scientific blockers, CI, or branch protection.

gate-verdict: accepted @ 35a1120
base-policy: ordinary-cas @ 35a1120
pr-metadata: reconciled @ d3473c49099aeea30d88c7759a637e8f45ffce62f1c83b6727d4540b278a9e9f

[ll7]

review-claim: released @ 35a1120

[ll7]

review-claim: codex-pr9607-metadata-reconcile-20260924 @ 35a1120 until 2026-09-24T23:50:08Z

[ll7]

Exact-head self-review

• Reviewed head: 35a1120744baa736ce427a6f1f25034898f1fff4.
• Final readiness validated origin/main 0e211ed4fe3c73c07f4f93b38ed952b50440e961; current origin/main is 56608cddbc64875482e6bfbcb80df38300681d45 and remains covered by the immediate guarded-merger compare-and-swap.
• Issue Relationship Mirror now explicitly records none for Parent, Blocked by, Blocking, and Relates to, matching issues #6643 and #6642's native state; the body also records the successor/non-duplication statement.
• Findings: no actionable implementation-integrity, security, contract, or relationship findings. Provenance substitution, ambiguous planner identity, malformed diagnostics, and missing family-rule authority fail closed as intended.
• Validation: 434 focused radius/provenance tests passed; final PR readiness passed on the current head with core/optional lanes, CUDA preflight, contracts, follow-up checks, and coverage completed. Coverage goal warnings remain on three large files.
• Scientific boundary: the original Gate 1 receipt, authoritative planner-key provenance, and owner-approved family-feasibility receipts remain unavailable. This review accepts only the code-integrity slice and does not admit a Gate 3 verdict.
• Hosted CI is terminal green: 37 successful checks and 3 intentional skips, with no failures.
• Single-account internal-review waiver applies because no independent review identity exists; it does not waive the scientific blockers, CI, or branch protection.

gate-verdict: accepted @ 35a1120
base-policy: ordinary-cas @ 35a1120
pr-metadata: reconciled @ 9dbaf749a6300e4774e02dd1ffbe2901257ca54562dc119cf6962f2ff3f239d0

[ll7]

review-claim: released @ 35a1120