fix(#890): oracle-wiring gate — 69 unwired oracles → 145 wired / 7 manual / 0 undeclared

[avrabe]

#890 — fix the bug FACTORY, not the bugs

scripts/repro/*.py are synth's execution oracles. 69 of 150 were referenced by
no workflow — nothing ran them. v0.53 hand-wired three and the unwired count
still went up, because instances were fixed while the mechanism that produces
them was untouched.

The defect was never "69 broken gates". Many are legitimately manual — a pinned
vendor drop, real silicon, a toolchain CI does not install. The defect is that
nothing distinguished "manual by design" from "forgotten", so telling them apart
meant reading all 150 and reasoning about each — the audit that kept
rediscovering this one instance at a time.

What landed

	before	after
wired	82	145
manual (with a real reason)	—	7
unwired debt	—	0
undeclared / indistinguishable	70	0

1. A declared status per script — one # ci-status: header line:
   wired · manual (<category>) — reason · unwired — reason.
   Header, not a manifest: it lives in the file it describes, so it shows up in
   the diff of the PR that adds the script and cannot outlive its own file. The
   repo already reserves the central-ledger shape (claims.yaml) for claims with
   no natural home; a script's CI status has one.
2. A gate — scripts/oracle_wiring_check.py, run as a step of the
   already-required claim-check job. Fails on: wired with no workflow
   reference (the inert-gate case), manual/unwired referenced by a workflow,
   a missing/placeholder reason, an out-of-vocabulary manual category, and
   anything undeclared — so new oracles must choose. Also catches a workflow
   step pointing at a repro file that no longer exists.
3. A ratcheted, visible count — claims.yaml SYNTH-ORACLE-WIRING-890:
   wired ≥ 145 (a floor, so the surface can't be emptied by deleting
   harnesses), manual ≤ 7 (a ceiling on the escape hatch), unwired ≤ 0 (new
   debt is a red build, not a backlog entry). The gate also writes the counts and
   the debt list to $GITHUB_STEP_SUMMARY.
4. 63 oracles newly wired. Every one verified green locally against a freshly
   built synth first, using the compile line from its own documented Run: block.
   Four new sweep jobs (selector / memory / rv32 / wcet) + one step in the
   existing fact-spec job. All 62 sweep steps were then re-run extracted
   verbatim from ci.yml — 62/62 green.

What was not being gated

The six mem757_* red-first reconstructions of gale's wrong-segment miscompile
(#757). Every RV32 oracle for a regression gale found on real silicon — #220
callee-saved, #226 live-range clobber, #232 overflow-guard clobber, #317 i64
sign, #343 if-join. All four WCET soundness cross-checks — the only thing
that executes the fixtures and checks bound_cycles >= executed_instructions,
i.e. the evidence behind the sound-WCET claim. The #494 rem_u identity
differential behind the beat-clang headline.

The manual seven (each with a real reason)

wake_path (external-input: gale's gist, not in-tree) · size_attribution_390,
local_promotion_headroom, vcr_dec_001_join_alloc_measure,
spill_baseline_measure.sh (measurement: reports with no verdict; the first is
pinned by a cargo test that is the gate) · run204_unicorn,
i64_load_store_372 (scratch: print-only probes with stale hardcoded inputs).

Two defects this lane found in itself

• sret_decide_differential.py was a gate that could not fail — it printed
  MISMATCH <-- BUG and exited 0. Wiring it as-is would have added a vacuous
  gate. The verdict is now the exit status (mutating the -35 expectation to
  -34 → rc=1).
• The gate's own CI step was vacuous, and a mutation caught it.
  set -o pipefail without -e means the shell's status is its last
  command's — the inert-gate mutation greened the step while the gate printed
  FAIL and exited 1. Now set -euo pipefail explicitly (not leaning on
  Actions' default bash -e), and the verdict is re-derived from the JSON
  summary the gate wrote (total, wired, undeclared, wired_unreferenced,
  failures) instead of trusting exit 0.

Red-first evidence — in real CI, not just locally

A gate nobody has seen fire is indistinguishable from one that cannot — the #890
thesis, applied to #890. So both required mutations were run through GitHub on a
throwaway branch carrying only the mutations (PR #895, closed unmerged, branch
deleted). The real Claim Check job went red at the Oracle-wiring step
(run):

oracle wiring: 152 repro scripts — 145 wired, 6 manual, 0 unwired(debt), 1 UNDECLARED
FAIL scripts/repro/mem757_ptr_base_copy_differential.py: UNDECLARED — add a
     `# ci-status:` header line ... An oracle nothing runs must SAY so.
FAIL scripts/repro/wake_path_differential.py: declares `wired` but NO workflow
     references it — the gate is INERT ...
##[error]Process completed with exit code 1.

Red-first mutation evidence — the full matrix

Each run executes the step extracted verbatim from ci.yml (yaml.safe_load
→ the step's run: block → bash -e), so there is no drift between what was
proved and what CI runs. Full transcript in scripts/repro/ORACLE_WIRING.md.

mutation	step exit
baseline	0
M1 un-declare mem757_ptr_base_copy_differential.py	1 — UNDECLARED
M2 declare wired on wake_path (no reference at all)	1 — the gate is INERT
M3 delete a wired oracle's CI step (re-inert it)	1 — the gate is INERT
M4 make the gate's glob match nothing	1 — VACUOUS or DRIFTED ['total<100']
M5 demote a reference to a comment	1 — only in a COMMENT — prose does not run an oracle
M6 replace a manual reason with TODO	1 — needs a REAL reason
restored	0

M5 exists because the first version of this gate derived "referenced" from a raw
grep of the .yml — so a mention in a comment satisfied it. A gate satisfiable
by prose is the failure shape #890 rejects; references now come from the parsed
workflow (a step's run: body and its with:/env: values). No script changed
status (checked: zero of the 145 were wired by comment alone) — pure hardening.

Ratchet legs proved separately: flipping one wired script to manual fails both
count-min 145 and count-max 7.

Verification

cargo fmt --check 0 · cargo clippy --workspace --all-targets -D warnings 0 ·
cargo test --workspace 0 (130 suites) · frozen anchors 10/10 ·
claim_check 35/35 · oracle-wiring gate 0. No shipping code touched — .text
unchanged by construction.

Honest residual — a follow-up for repo admin

The gate is a required context (it lives inside Claim Check, one of main's
nine). The 63 newly-wired oracles are not: they run in four new
repro-sweep-* jobs, and main's branch protection has strict=false with only
those nine names. So a red sweep job will not block gh pr merge --auto — it has
to be read by eye until someone adds the four names to branch protection.

I deliberately did not change branch protection mid-release: a required context
whose name does not match a job that actually runs deadlocks every merge in
the repo. Filing it as the follow-up rather than doing it unilaterally.

Note for the coordinator

This gate is now active for the whole release: a lane that adds a
scripts/repro/*.py without a # ci-status: header will turn Claim Check
red. That is the intended forcing function; the failure message says exactly what
to add.

Generated docs (FEATURE_MATRIX.md, status.json) deliberately untouched — no
new status_fields were added, so nothing to regenerate (#805).

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!