Skip to content

feat(claw): claw/t27f -- the seal-gated T27F check on every .t27 pull request through the TRI CLAW App (Closes #10268) - #10283

Merged
gHashTag merged 3 commits into
masterfrom
claw-t27f-gate
Oct 18, 2026
Merged

feat(claw): claw/t27f -- the seal-gated T27F check on every .t27 pull request through the TRI CLAW App (Closes #10268)#10283
gHashTag merged 3 commits into
masterfrom
claw-t27f-gate

Conversation

@gHashTag

@gHashTag gHashTag commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

What

This PR rolls the T27F seal-gated check out to every gHashTag repository that holds .t27 specs. It goes through the existing TRI CLAW GitHub App (slug tri-claw, App id 5166765). No consumer repository gets a workflow file, and this repository gets none either: the job lives in an existing workflow.

  • The law, specs/claw/t27f_gate.t27, plus zig-only pins in t27f_gate_pins.t27.
    • Scope: the changed *.t27 files plus their direct importers.
    • Each spec is judged by t27c seal --verify, and the decision reuses hot.t27.
    • Outcomes: an unsealed spec is neutral. A stale, vacuous or unreadable seal is a failure. Malformed input fails closed.
    • The check-run is claw/t27f, with conclusion success, neutral or failure.
    • Each summary row carries the path, digest, nodes, edges, verdict and decision, plus a graph link https://t27.ai/t27f/graph/?src=<raw url>.
    • MODE_T27F is added to specs/claw/service.t27.
  • gen/c/claw/t27f_gate.c is the t27c gen-c lowering, force-added. A freshness step in spec-guards.yml regenerates both claw C files and diffs them.
  • A claw-t27f job in the existing .github/workflows/gate-topology.yml.
    • It runs on a new schedule (every 10 minutes) and on workflow_dispatch.
    • The existing gate-topology job gains if: github.event_name != 'schedule', so it does not run on the schedule.
    • The concurrency group now includes the event name, so a scheduled run cannot cancel a push run.
    • The job mints the App token from secret CLAW_APP_PRIVATE_KEY and variable CLAW_APP_ID, scoped to checks: write, pull_requests: read and contents: read only: the check-run, pr-files and spec-read rows of specs/claw/github_surface.t27 (spec(claw): github_surface -- every GitHub API surface, its .t27 value, the narrow token it mints (Closes #10277) #10280). It never mints an unscoped token. If either is absent, it writes a step-summary notice and exits 0.
    • It loops over every installation repository and every open pull request touching .t27. For each, it fetches the cosign-verified t27o-v0.1.0 t27c, makes a blobless sparse clone, runs the law, and posts one check-run on the head commit. A commit that already has a claw/t27f run is skipped.
    • The shell only moves bytes; every decision is the law's.
  • specs/claw/gates.t27: the gate-topology row's events gain schedule. The census is unchanged at 67 workflows: 62 blocking, 3 soft, 2 reporting. gen/c/claw/gates.c is regenerated in the same commit.
  • docs/claw/README.md gets a section with a 4-step owner checklist.
  • AGENTS.md section 8, TRI CLAW: the "In flight" paragraph and the App row are rewritten as pointers to what landed: the claw/t27f check, the spec, the job, and the open owner steps. The long form stays in docs/claw/README.md.
  • Seals: #10250 sealed the claw specs on master, so gates, gates_pins and service are resealed here, and t27f_gate and t27f_gate_pins get their first seals. Each one verifies as all hashes MATCH, with 0 failed and 0 vacuous tests.
  • Own-language offset: scripts/gen_w389.py is deleted. It is a spent wave generator with no runtime references. Foreign lines: +41 added, -57 removed. The dead tri mention count stays equal to MAX_DEAD_TRI (140).

Gate file disclosure

gate-topology.yml is a gate file. The owner approved this rollout in direct chat on 2026-10-18: "roll this out to all repositories and update the TRI CLAW GitHub App".

  • The private key is not in this diff and is never printed.
  • tools/bees/* is untouched.
  • An App manifest file was considered and dropped: it would be a second home for settings the owner changes by hand.

Lab results (Railway, this diff on master)

  • The claw drift law reports "matrix is current". Its negative control (gate-topology hidden from the listing) flags it SPEC-ONLY.
  • The specs gates / gates_pins / service / t27f_gate / t27f_gate_pins pass 18 / 5 / 8 / 23 / 4, with 0 fail and 0 vacuous. t27f_gate is IMPLEMENTED, and its gen-c output has 0 unresolved.
  • Own-language check_all: pass, with no new foreign file. Foreign-line budget and shrink: pass. Both lefthook hooks passed on the commit.
  • check_pr_branch_filters.py (with its self-check) and the fpga-lint claim gate pass. The YAML parses with triggers pull_request / push / workflow_dispatch / schedule and jobs gate-topology / claw-t27f.
  • dupe_scan: no new duplicate body. Documented commands: 140 dead mentions, equal to the ceiling. ASCII: clean.
  • Before this move, the law ran end to end on real t27c output: sealed reuse, stale seal rebuild, unsealed missing. On a real consumer pull request, feat(specs): add GF512/GF1024 rule-derived rungs + align GF128 to closed-form tt-trinity-gamma#120, it gave neutral, with 13 unsealed rows and correct raw links.

Census

16 repositories hold 9849 .t27 files and 2600 seals.

Owner steps (until they are done, the job posts nothing)

  1. Give the App the checks: write permission at https://github.com/settings/apps/tri-claw.
  2. Accept the new permission on the gHashTag installation.
  3. Set secret CLAW_APP_PRIVATE_KEY in gHashTag/t27.
  4. Set variable CLAW_APP_ID = 5166765 in gHashTag/t27.

Closes #10268

🤖 Generated with Claude Code

gHashTag and others added 2 commits October 18, 2026 14:29
@gHashTag @claude
feat(claw): claw/t27f -- the seal-gated T27F check on every .t27 pull…
a769a7e 
… request through the TRI CLAW App (Closes #10268)

- specs/claw/t27f_gate.t27 (+ zig-only pins): scope = changed .t27 plus
  direct importers, judged by `t27c seal --verify`, decision reuses
  hot.t27; unsealed neutral, stale/vacuous/unreadable failure, malformed
  input fails closed. MODE_T27F in specs/claw/service.t27.
- gen/c/claw/t27f_gate.c: its gen-c lowering; spec-guards.yml now
  regenerates both claw C files and diffs them.
- gate-topology.yml: a claw-t27f job on a new 10-minute schedule and on
  workflow_dispatch; the existing job skips the schedule; concurrency
  keyed by event. The job mints the App token (secret
  CLAW_APP_PRIVATE_KEY, variable CLAW_APP_ID) and exits 0 with a notice
  when either is absent. It only fetches, runs the cosign-verified
  t27o-v0.1.0 t27c and posts what the law prints.
- specs/claw/gates.t27: gate-topology events gain schedule (67 workflows,
  62/3/2 unchanged); gen/c/claw/gates.c regenerated.
- docs/claw/README.md: the owner checklist. AGENTS.md section 8: pointers
  to what landed.
- Own-language offset: scripts/gen_w389.py deleted (spent generator, no
  runtime refs). MAX_DEAD_TRI unchanged at 140.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag @claude
seals(claw): reseal gates/gates_pins/service and seal t27f_gate/t27f_…
ea0ea6e 
…gate_pins after #10250 (Refs #10268)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag
gHashTag enabled auto-merge (squash) October 18, 2026 07:30
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-18 07:30:39 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 48
PRs with All Checks Green 2
READY 0
FAILING 48
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 48 + 0 + 0 = 48, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=0f8c66b9ed0e != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag @claude
fix(claw): mint the claw/t27f App token scoped to checks:write, pull_…
3c0d827 
…requests:read, contents:read (Refs #10268)

The App holds write on about 40 permissions across every gHashTag
installation; an unscoped token minted from a t27 branch would carry
secrets, workflows and administration write. The three scopes are the
check-run, pr-files and spec-read rows of specs/claw/github_surface.t27
(#10280).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 18, 2026
Merged
Merged
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-18 07:39:32 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 46
PRs with All Checks Green 4
READY 0
FAILING 46
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 46 + 0 + 0 = 46, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=0f8c66b9ed0e != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag merged commit 834f258 into master Oct 18, 2026
26 of 30 checks passed
@github-actions github-actions Bot mentioned this pull request Oct 18, 2026
Merged
This was referenced Oct 18, 2026
Closed
Closed
gHashTag added a commit that referenced this pull request Oct 18, 2026
@gHashTag @claude
census: re-bless gates quiet and gates shell after the claw-t27f job (C…
cf76a5c 
…loses #10303)

Master's cli-tri step "No census moved without saying so" has been red
since 834f258, because #10283 moved two pinned censuses without
re-blessing them. That was my miss. Re-blessed with `tri census pin
--bless` on the Railway lab, from master dc4ea95.

What moved, and why:

- gates shell, jobs 88 -> 89: #10283 added the claw-t27f job to
  gate-topology.yml.
- gates shell, run steps 314 -> 316 (runner-named 293 -> 295): the
  claw-t27f job's steps, as of #10299, which made the check-run POST plus
  one PATCH per further annotation batch.
- gates quiet, quiet-shape steps 32 -> 33, file-existence guards 9 -> 10,
  variable-in-path 6 -> 7, named-but-not-quiet 200 -> 204: the same job.s
  steps. No other workflow changed since the last bless, so every moved
  line comes from gate-topology.yml

No other workflow changed between the last bless (290ff17, #10172) and
dc4ea95. `tri census pin --gate` exits 0 after the re-bless.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag added a commit that referenced this pull request Oct 18, 2026
@gHashTag @claude
census: re-bless gates quiet and gates shell after the claw-t27f job (C…
9186816 
…loses #10303)

Master's cli-tri step "No census moved without saying so" has been red
since 834f258, because #10283 moved two pinned censuses without
re-blessing them. That was my miss. Re-blessed with `tri census pin
--bless` on the Railway lab, from master dc4ea95.

What moved, and why:

- gates shell, jobs 88 -> 89: #10283 added the claw-t27f job to
  gate-topology.yml.
- gates shell, run steps 314 -> 316 (runner-named 293 -> 295): the
  claw-t27f job's steps, as of #10299, which made the check-run POST plus
  one PATCH per further annotation batch.
- gates quiet, quiet-shape steps 32 -> 33, file-existence guards 9 -> 10,
  variable-in-path 6 -> 7, named-but-not-quiet 200 -> 204: the same job's
  steps. No other workflow changed since the last bless, so every moved
  line comes from gate-topology.yml.

No other workflow changed between the last bless (290ff17, #10172) and
dc4ea95. `tri census pin --gate` exits 0 after the re-bless.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 18, 2026
Merged
Closed
Closed
gHashTag added a commit that referenced this pull request Oct 18, 2026
@gHashTag @claude
census: re-bless gates quiet and gates shell after the claw-t27f job (C…
238b6a9 
…loses #10303) (#10304)

Master's cli-tri step "No census moved without saying so" has been red
since 834f258, because #10283 moved two pinned censuses without
re-blessing them. That was my miss. Re-blessed with `tri census pin
--bless` on the Railway lab, from master dc4ea95.

What moved, and why:

- gates shell, jobs 88 -> 89: #10283 added the claw-t27f job to
  gate-topology.yml.
- gates shell, run steps 314 -> 316 (runner-named 293 -> 295): the
  claw-t27f job's steps, as of #10299, which made the check-run POST plus
  one PATCH per further annotation batch.
- gates quiet, quiet-shape steps 32 -> 33, file-existence guards 9 -> 10,
  variable-in-path 6 -> 7, named-but-not-quiet 200 -> 204: the same job's
  steps. No other workflow changed since the last bless, so every moved
  line comes from gate-topology.yml.

No other workflow changed between the last bless (290ff17, #10172) and
dc4ea95. `tri census pin --gate` exits 0 after the re-bless.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 18, 2026
Closed
Merged
gHashTag added a commit that referenced this pull request Oct 18, 2026
@gHashTag @claude
dupe-ledger: bless the claw helper copies from #10283/#10286/#10287/#…
4414941 
…10288 (Closes #10311) (#10312)

duplicate-bodies has been red on master since the claw specs landed
without moving the ledger. Each new group and why it stays for now:

- buf_has, digit_byte, put_count, put_str (gates.t27 + sarif.t27,
  #10288): deliberate. sarif.t27 says so in its header: the writers are
  private in gates.t27 and sarif.t27 must lower alone under gen-c.
- bytes_eq 2 -> 3 (`same` in sarif_pins.t27, #10288): the test-only
  pins companion compares strings by .len, which gen-c cannot lower.
- str_eq (gates.t27 + suggest.t27, #10286) and has_prefix
  (service.t27 #10283, starts_with in preview.t27 #10287): same
  lower-alone constraint; sharing them into one claw helper module is
  a follow-up, not this commit.

The ledger is `python3 tools/dupe_scan.py --bless` output on master
238b6a9, run on the Railway lab; the gate exits 0 after it. Not
hand-edited.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

claw: roll the T27F seal-gated check out to every .t27 repository through the TRI CLAW App

1 participant

@gHashTag