Set 6 Unsurfaced Primitives Bundle

Unsurfaced primitives are exercised from copied code

A scout found eleven small, load-bearing functions never shown publicly; this component copies them into the public clone and checks the copied bodies still behave as the prose claims. A scout found eleven small functions scattered across the wider system that were real and load-bearing but had never been shown as public evidence. This component copies those eleven into the public clone and checks that the copied bodies still behave the way the prose claims. It is the kind of code that quietly decides whether a bigger feature is correct: a finance unit-scale check, a clock that fires each market event once per session, a function that subtracts paused time from a recorded video offset.

Each primitive gets a positive and negative path

The check is by execution: each copied body runs on fixed synthetic input and is compared to its exact expected value, with a paired wrong input proving the guard. The check is by execution, not by description. For each primitive the component imports the copied body and runs it on a fixed public synthetic input, then compares the result against the exact value the real code should produce. Each primitive also carries one paired negative case, a deliberately wrong input that the code must reject or correct, so the result record shows both the working path and the guard.

Public fixtures do not become live authority

The result record holds only pass or fail and summary numbers, never copied source, transcripts, payloads, or market data, with every finding stamped body_in_receipt: false. What lands in the result record is the pass or fail of each exercise plus a few summary numbers. Copied source text, operator transcripts, model-output data, and live market data never enter it. Every finding is stamped body_in_receipt: false.

Purpose

Why a digest is not enough

A file hash proves only that bytes match, not that the logic is right, so this component closes the gap by running each copied body and asserting its output. Copying a function into a public bundle and checking its file hash proves only that the bytes match. It says nothing about whether the logic is right. A digest-only bundle is loose in exactly the place that matters: it can carry a body that no longer computes what its name says. This component closes that gap by running the copied body and asserting its output.

Eleven primitives, one uniform shape

The eleven primitives span ranking, distillation, handoff scoring, window merging, market graphs, finance assurance, status judgment, concurrency, clock scheduling, provider scoping, and demo remapping, each checked in the same shape. The eleven primitives span keyphrase ranking, schema-loose distillation, operator handoff scoring, observed-turn window merging, market situation graphs, finance numeric assurance, fail-closed status judgment, clone-local concurrency, market-clock scheduling, provider-recovery scoping, and demo-take temporal remapping. Each is checked in the same shape so a reader can see the working answer and the rejected answer side by side.

How it works

Two entrypoints, one shared driver

run and run_batch6_bundle both pass SPEC and the _evaluate and evaluate_negative_case callbacks to run_crown_jewel_organ, with the bundle entrypoint setting input_mode to read copied source. run and run_batch6_bundle both hand SPEC, the input directory, and two callbacks to run_crown_jewel_organ: _evaluate and evaluate_negative_case. The bundle entrypoint sets input_mode to the exported-bundle mode so the same evaluator reads copied source rather than the fixture manifest.

Manifest load and roster checks

_evaluate loads the probe manifest, keys the 26 copied modules by module_id, and confirms both EXPECTED_MODULE_IDS and the exact 11 EXPECTED_MECHANISMS are present. _evaluate runs the pipeline in order. It loads batch6_probe_manifest.json through _load_manifest, which rejects a non-JSON file with BATCH6_PROBE_MANIFEST_INVALID and a non-object with BATCH6_PROBE_MANIFEST_NOT_OBJECT. It resolves the copied modules with _module_rows, which reads the source-module manifest and keys each row by module_id. It confirms every id in EXPECTED_MODULE_IDS (26 rows) is present, then confirms the probe manifest names exactly the 11 mechanisms in EXPECTED_MECHANISMS, emitting BATCH6_MECHANISM_SET_MISMATCH on any missing or extra id.

Anchors gate the source exercise

_mechanism_status blocks any mechanism whose copied text is missing a module or required_anchor, and only when nothing is missing does _run_source_exercise import and run the real body. For each mechanism _mechanism_status reads the copied target text and checks that the module's required_anchors all appear in it. A missing module or a missing anchor sets that mechanism to blocked. Then, only if no expected module is missing, _run_source_exercise imports the real copied body and runs it.

Isolated import of copied bodies

_load_copied_module loads each file under a private name inside _temporary_sys_path and _temporary_import_namespaces, so copied bodies run from the bundle without colliding with the running package. _load_copied_module does the import. It resolves the target path, then loads the file under a private module name inside _temporary_sys_path and _temporary_import_namespaces, so the copied idea_microcosm, system, and tools bodies load from the bundle without colliding with the running package. The exercise calls the real function and compares the answer.

Four exercises make the idea concrete.

demo_take_temporal_join removes paused seconds

demo_take_temporal_join feeds video_t_seconds a 120-second offset paused from 10s to 25s and asserts exactly 105.0, with an open-pause branch returning 15.0. demo_take_temporal_join calls video_t_seconds. It feeds a 120-second wall offset with one pause at 10s and resume at 25s and asserts the result is exactly 105.0, the 15 paused seconds removed. A second call with a pause that has not yet resumed checks the open-pause branch returns 15.0.

finance_numeric_assurance fails closed on bad numbers

build_finance_numeric_assurance recomputes declared numbers, so a usd_millions row with mismatched flow and an out-of-range probability turns display_state to blocked and fails closed. finance_numeric_assurance calls build_finance_numeric_assurance, which recomputes declared numbers instead of trusting them. The exercise hands it a flow row tagged usd_millions whose flow and flow_usd disagree by orders of magnitude, plus a probability declared as 70.2. The result record's display_state becomes blocked and its check_ids include stockgrid_flow_unit_scale_mismatch and probability_bounds. A mislabelled unit or an out-of-range probability fails closed.

operator_handoff_linkage scores capture against input

operator_handoff_linkage scores a TypeBCapture against a TypeAUserInput by containment and overlap, putting a related pair at or above 0.8 and an unrelated one below 0.3. operator_handoff_linkage calls score_pair on a TypeBCapture (an agent's earlier suggestion) against a TypeAUserInput (what the operator later typed), using containment, token overlap, and anchor matching. A related pair scores at or above the 0.8 floor with containment true; an unrelated "summarize the weather forecast" input scores below 0.3.

metabolism_market_clock enforces per-session idempotence

metabolism_market_clock sets due_fire_points to 15:31 UTC and fires the hourly points while suppressing the already-fired open event, enforcing once-per-session idempotence. metabolism_market_clock calls due_fire_points. It sets the clock to 15:31 UTC with the open event already fired earlier that day, then asserts the hourly points fire while the already-fired open event stays suppressed. The guard is idempotence: an event that fired once must not fire again in the same session.

The other seven checks in brief

The remaining seven follow the same shape, from rake_ranked_phrases and distill_diagnostic through market-graph, status-judgment, and _paths_overlap checks, each pairing a working answer with a rejected one. The other seven follow the same pattern. rake_ranked_phrases returns ranked phrases for real text and an empty list for stopword-only input. distill_diagnostic keeps assistant text and operator tail as separate roles with body_persisted false. merge_observed_turn_window appends a new observed tail and leaves a re-sent duplicate window unchanged. build_market_situation_graph with strict validate_market_situation_graph requires counterevidence_edges and a not-investment-advice guard on every situation. judge_status_request allows a transition with evidence, downgrades one missing it, blocks a forbidden upgrade, and blocks under a malformed policy. _paths_overlap reports a parent directory and a child path as overlapping and two siblings as not.

flowchart TD Probe["batch6_probe_manifest.json"] Manifest["source module manifest 26 copied bodies"] Load["_load_manifest / _module_rows"] Anchor["_mechanism_status module + anchor present?"] Exercise["_run_source_exercise import copied body, run it"] Neg["evaluate_negative_case one wrong input per mechanism"] Record["result record pass/fail + summary numbers body_in_receipt false"] Probe --> Load Manifest --> Load Load --> Anchor Anchor --> Exercise Exercise --> Neg Neg --> Record

Negative cases

One guarded case per mechanism

EXPECTED_NEGATIVE_CASES holds one case per mechanism, each routed through _observed_negative_case and passing only when the paired exercise passed and its guard fired. EXPECTED_NEGATIVE_CASES holds one case per mechanism, and evaluate_negative_case routes each through _observed_negative_case, which reads the matching runtime exercise output. A case only passes when the paired exercise passed and its guard fired. The eleven are: stopword_only_keyphrase_empty, schema_loose_voice_conflation, handoff_unrelated_below_floor, observed_turn_duplicate_rerender, market_situation_missing_counterevidence, finance_unit_scale_mismatch, status_policy_poisoned, concurrency_parent_child_conflict, market_clock_duplicate_fire_suppressed, provider_timeout_scope_narrow, and demo_take_pause_remap. Each carries a stable expected error code, for example BATCH6_FINANCE_UNIT_SCALE_MISMATCH_BLOCKED for the finance case.

Prior Art Grounding

Established provenance and policy patterns

The primitives draw on established patterns, borrowing provenance and policy-engine design for the market and status pieces and event-time-versus-record-time separation for the demo-take remap. The copied primitives draw on established patterns rather than novel theory. The market and status pieces borrow from provenance and policy-engine design; the demo-take remap follows the practice of keeping event time separate from record time.

• W3C PROV, for reconciling derived artifacts back to entities, activities, and responsible agents.
• Open Policy Agent, which separates policy evaluation from application code through a general-purpose engine.
• Martin Fowler's bitemporal history, as a prior pattern for preserving event time separately from record time.

Bounded to source-open public fixtures

The component keeps to source-open public fixtures and exposes no live operator memory, market data, provider state, or publishing-scope decision. The component keeps to source-open public fixtures and does not expose live operator memory, live market data, provider state, or publishing-scope decision.

Validation Result record Path

Run from the microcosm-substrate/ public root:

What a pass proves

A pass means all 26 modules carried their anchors, all 11 exercises returned expected values, all 11 negative cases fired their guard, and no record leaked a body or private state. A pass means all 26 copied modules carried their required anchors, all 11 source exercises returned the expected values, all 11 negative cases fired their guard, and no result record leaked a copied body or private state. The corpus and projection checks prove only that the generated instance for this module is fresh.