carlos / platform Public

census: overlay design-fleet-internal-engines (PROPOSED, #280)

The test-only internal/sim/engines package (#335 plan 1) adds a bash
mutation harness, mutate.sh, which the census pins whole as an external
read. Classify it as internal/sim/hostlife/mutate.sh is: legacy,
accepted-legacy, a test harness pinned by the conservative external
envelope, not production root authority. Executing identity: none at
runtime; a developer or CI running go test or the harness; no root, no
production binary. Pin the new internal/sim/engines envelope.

One frozen declaration is added, so the seal moves from 33a8ff46 to
d8290d2c; the previous seal is checked first. Marked
rev3=PROPOSED-design-fleet-internal-engines, to be asked of the census
owner on #280.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 3 days ago 26e3c7303fb98c9dc86e049988d48b972a259083 parent bb1bf40

3 files changed, +44 −1

docs/superpowers/notes/census-proposal-design-fleet-internal-engines.md +19 −0
internal/provision/plan14_root_reads_test.go +19 −1
internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv +6 −0

diff --git a/docs/superpowers/notes/census-proposal-design-fleet-internal-engines.md b/docs/superpowers/notes/census-proposal-design-fleet-internal-engines.md

new file mode 100644

index 000000000..42fdae3a5

--- /dev/null

+++ b/docs/superpowers/notes/census-proposal-design-fleet-internal-engines.md

@@ -0,0 +1,19 @@

+# Fleet-internal engines model: census proposal

+Status: PROPOSED-design-fleet-internal-engines, to be asked of the census owner on #280. This is a proposal for review, not an owner ruling.

+Branch: `design-fleet-internal-engines`, pinned at `bb1bf408` (main merged in). CI's only failure was `TestPlan14RootReadCensus` in `internal/provision`, with two discrepancies: the new `internal/sim/engines` source envelope and the unclassified `internal/sim/engines/mutate.sh:external` read.

+No production code changes on this branch. `internal/sim/engines` (amadan #335 plan 1) is a new package whose Go files are all `_test.go` files, which the census does not scan. Its one scanned file is the bash mutation harness `mutate.sh`, adapted from `internal/sim/hostlife/mutate.sh`. The scanner pins every `.sh` file whole as an external read.

+## Root-read entry

+- `internal/sim/engines/mutate.sh:external`. Executing identity: none at runtime. A developer or CI runs `go test` or the harness by hand, as their own user. No root, no production binary. The harness runs a prebuilt engines test binary once per rule with `ENGINESIM_MUTATE` set and writes logs only under `$TMPDIR/enginesim`. It never copies or edits source. Basis: classified as `internal/sim/hostlife/mutate.sh` is (`plan14-root-reads.tsv`, re-pinned in `plan14-root-reads-merge.tsv` under merge-ruling-2): a test harness pinned by the conservative external envelope, not production root authority. Proposed class: `legacy`, task: `accepted-legacy`. Sites: `file:external@0`. Digest: `e13dc977dabeaefddbdb3dfca68c04d531b282f6ea1b256d72c13a1caa365c46`. Frozen fingerprint: `f450a046d364d2d11eb9f81b709f597ff4cf8a2b48b2f4473cdee204ab5608d8`.

+## Source envelope

+- `internal/sim/engines` (new; `mutate.sh` alone): `41ab761e50cf9d98d1f2c51b472cf453085a80c506ab382914fe01ce930ae2fe`.

+## Seal

+The overlay `internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv` is loaded last, after claim-merge-main-4. It adds one frozen declaration, so the seal moves. The preceding seal, securelisten-337's, which every later overlay left standing, is checked first: `33a8ff46dd9fcf85664c42c42eaf01585af6c92806cb7830fa8f30fd0950c430`. The resulting seal is `d8290d2c4829bf4ac2e64c993b797e9e5d2db6435eff0869f1119094dc2a3c1e`.

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index e0524ad72..2c8ee7311 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1255,7 +1255,25 @@ func TestPlan14RootReadCensus(t *testing.T) {

if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-claim-merge-main-4.tsv"), &inv, true); err != nil {

t.Fatal(err)

}

- errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

+ // Census overlay design-fleet-internal-engines (amadan #335 plan 1: the

+ // test-only internal/sim/engines simulation package), loaded last.

+ // PROPOSED-design-fleet-internal-engines, to be asked of the census owner

+ // on #280 (docs/superpowers/notes/census-proposal-design-fleet-internal-engines.md).

+ // No production code changes. Its mutation harness mutate.sh is

+ // classified as internal/sim/hostlife/mutate.sh is: accepted legacy, a

+ // test harness pinned by the conservative external envelope, run by a

+ // developer or CI and never by root. The internal/sim/engines envelope is

+ // pinned. One frozen declaration is added, so the seal moves;

+ // securelisten-337's, which every later overlay left standing, is checked

+ // first.

+ if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ seal = "d8290d2c4829bf4ac2e64c993b797e9e5d2db6435eff0869f1119094dc2a3c1e"

+ errs :=append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

t.Fatalf("root read census: %d discrepancies\n%s", len(errs), strings.Join(errs, "\n"))

diff --git a/internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv b/internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv

new file mode 100644

index 000000000..d726d0357

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-design-fleet-internal-engines.tsv

@@ -0,0 +1,6 @@

+# Census overlay design-fleet-internal-engines (amadan #335 plan 1: the fleet-internal engines model, a test-only simulation package), loaded LAST, after claim-merge-main-4. PROPOSED-design-fleet-internal-engines, to be asked of the census owner on #280 (docs/superpowers/notes/census-proposal-design-fleet-internal-engines.md).

+# No production code changes. internal/sim/engines is new and every Go file in it is a _test.go file, which the census does not scan; its one scanned file is the bash mutation harness mutate.sh, which the scanner pins whole as an external file:external@0 read. It is classified as internal/sim/hostlife/mutate.sh is (plan14-root-reads.tsv, re-pinned in plan14-root-reads-merge.tsv under merge-ruling-2): legacy, accepted-legacy, a test harness pinned by the conservative external envelope, not production root authority. Executing identity: none at runtime; a developer or CI running go test or the harness, as their own user; no root and no production binary.

+# Pinned at branch commit bb1bf408 (main merged in). One frozen declaration is added, so the seal moves; claim-merge-main-4 leaves the securelisten-337 seal standing, and that seal is checked first. The new internal/sim/engines envelope (mutate.sh alone) is pinned.

+@legacy f450a046d364d2d11eb9f81b709f597ff4cf8a2b48b2f4473cdee204ab5608d8 internal/sim/engines/mutate.sh external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-design-fleet-internal-engines;identity=none at runtime: a developer or CI running go test or this harness by hand, as their own user; no root, no production binary;basis=engines mutation harness (test-only, internal/sim/engines; amadan #335 plan 1), adapted from internal/sim/hostlife/mutate.sh: it runs a prebuilt engines test binary once per rule with ENGINESIM_MUTATE set and writes logs only under $TMPDIR/enginesim; it never copies or edits source; pinned by the conservative external envelope, not production root authority file:external@0 e13dc977dabeaefddbdb3dfca68c04d531b282f6ea1b256d72c13a1caa365c46

+internal/sim/engines/mutate.sh external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-design-fleet-internal-engines;identity=none at runtime: a developer or CI running go test or this harness by hand, as their own user; no root, no production binary;basis=engines mutation harness (test-only, internal/sim/engines; amadan #335 plan 1), adapted from internal/sim/hostlife/mutate.sh: it runs a prebuilt engines test binary once per rule with ENGINESIM_MUTATE set and writes logs only under $TMPDIR/enginesim; it never copies or edits source; pinned by the conservative external envelope, not production root authority file:external@0 e13dc977dabeaefddbdb3dfca68c04d531b282f6ea1b256d72c13a1caa365c46

+@coverage internal/sim/engines 41ab761e50cf9d98d1f2c51b472cf453085a80c506ab382914fe01ce930ae2fe