Set 8 Tools-Tail Primitives Bundle

Four copied tools run against fixed expectations

This bundle copies four small tools into the public system as their real bodies and runs each on a fixed input against a hard-coded expected value. This component copies four small tools into the public system as their real source bodies, then runs each one on a fixed input and checks the output against a hard-coded expected value. The four are an observer set diff, a JSON-patch interpreter, a ledger-id hash, and a shadow envelope parser.

Execution distinguishes working copies from stubs

It answers one question about copied code: does the copy still behave like the original, or has it quietly become a stub that only looks right? It exists to answer one question about copied code: does the copy still behave the way the original did, or has it quietly become a stub that only looks right? The check runs the copied body in process and compares the result field by field. If the copy were hollow, the comparison fails instead of passing with a green tick.

metadata-only records retain values and refusals

It emits a metadata-only record of which exercises passed, their small computed values, the rejected negative cases, and a fixed scope block, never the copied source text. It emits a metadata-only result record: which exercises passed, the small computed values they produced, the negative cases they rejected, and a fixed scope block. It does not copy the source text of the tools into that record.

Purpose

A digest match does not establish execution

A digest match proves bytes were copied but not that they still run, so a loose hash check would report success even when an import broke. A digest match proves that bytes were copied. It does not establish the copied bytes still run. When a tool moves from the private system into the public clone, a loose check would hash the file, see the hash match, and report success even if an import broke or a function returned the wrong shape. That is the failure this component is built to avoid.

Behavioural evidence, not a correctness claim

Rather than re-implementing the tools, it loads each copied module and calls the real functions for behavioural evidence, leaving open whether the answers mean anything. So it does not re-describe or re-implement the four tools. It loads each copied module from the manifest and calls the real functions, then asserts exact results. The evidence is behavioural: the code executed. It is not a claim that the answers mean anything about the world. Diffing two sets of observer rows is set arithmetic. Applying a JSON patch is interpreting an edit script. The gap between "the mechanism runs as copied" and "the answer is correct" stays open on purpose.

How it works

evaluate entry point and _load_copied_module

evaluate reads the manifest, checks mechanism rows, runs the four live exercises, and passes only when findings is empty; _load_copied_module imports each copied body by spec. evaluate is the entry point. It reads the probe manifest, checks each declared mechanism row through _mechanism_status, runs the four live exercises in RUNTIME_EXERCISES, and folds any missing mechanism, failed exercise, or blocked anchor into a findings list. The result is pass only when that list is empty. _load_copied_module does the loading: it resolves the target path from the source manifest, imports the file by spec, and runs it under a temporary sys.path so the copied module can find its own imports.

Observer diff in _exercise_observer_diff

_exercise_observer_diff checks the overlap, missed, and extra id sets, drops a malformed row without crashing, and confirms skipped never leaks into the serialised result. _exercise_observer_diff feeds three evidence rows (E1 lab, a row with no ledger_id, E3 lab) against two oracle rows (E1, E2). It checks overlap_ledger_ids == ["E1"], missed_ledger_ids == ["E2"], and extra_ledger_ids == ["E3"]. The malformed row is dropped rather than crashing the diff, and the exercise asserts the string skipped never appears in the serialised result, so a parse gap cannot leak through as silent data. Predictions split into matching == ["A"], divergent == ["B"], and missing_targets == ["C"].

Patch ops and refusal in _exercise_version_committer

_exercise_version_committer applies four _apply_op edits to a known document, then confirms traversing into a scalar raises VersionCommitterError rather than making a partial write. _exercise_version_committer applies four ops with _apply_op (set, merge, append, set) and checks the final document equals {"profile": {"name": "Microcosm", "meta": {"kind": "fixture"}}, "events": [{"id": "E1"}]}. It then tries to traverse into a scalar, set on /profile/name where profile is the string "scalar", and confirms this raises VersionCommitterError. The interesting property is the refusal: a malformed path is a controlled error, not a partial write.

Identity stability in _exercise_ledger_id

_exercise_ledger_id confirms a lane alias and its canonical name hash to the same P_ id, an unknown lane falls back to X_, and a missing identity field raises ValueError. _exercise_ledger_id checks identity stability. normalize_lane("poly") resolves to POLYMARKET, so generate_ledger_id("poly", record) and generate_ledger_id("POLYMARKET", record) return the same id, which starts with P_. An unknown lane falls back to an X_ prefix. A record missing the identity field its lane requires raises ValueError instead of hashing a blank.

Envelope parsing in _exercise_shadow

_exercise_shadow runs the copied parser over a written envelope directory and checks that well-formed rows parse while the malformed tuple is counted once as a comma_arity gap. _exercise_shadow writes a small envelope directory into a temporary path: miner tuples with one malformed entry, a spine line, and a prediction row. It calls the copied run and reads parse_stats. It checks hard_failure is false, that the well-formed miner, spine, and prediction rows parsed, and that the malformed tuple was counted once under comma_arity. The parser reports its own coverage hole rather than swallowing it.

flowchart TD manifest["Probe manifest + source module manifest"] load["_load_copied_module import copied body by spec"] exercises["Four live exercises diff | patch | ledger-id | shadow"] negatives["evaluate_negative_case one rejection per tool"] evaluate["evaluate collect findings"] record["metadata-only result record pass only if findings empty"] manifest --> load load --> exercises load --> negatives exercises --> evaluate negatives --> evaluate evaluate --> record

Negative cases

One rejecting path per tool

For each tool the component runs a rejecting path from EXPECTED_NEGATIVE_CASES, passing only when the tool refuses the bad input with the expected code. For each tool the component also runs the rejecting path, declared in EXPECTED_NEGATIVE_CASES and evaluated by evaluate_negative_case. A case passes only when the tool refuses the bad input with the expected code.

Malformed observer row dropped

A row with no ledger_id is dropped and the good oracle id lands in missed_ledger_ids, raising BATCH8_OBSERVER_DIFF_MALFORMED_ROW_SKIPPED. observer_diff_malformed_key_skipped: a row with no ledger_id is dropped, the good oracle id lands in missed_ledger_ids, code BATCH8_OBSERVER_DIFF_MALFORMED_ROW_SKIPPED.

Scalar traversal refused

Setting a path inside a scalar value raises VersionCommitterError rather than writing, recorded as BATCH8_VERSION_COMMITTER_SCALAR_TRAVERSAL_REFUSED. version_committer_scalar_traversal_refused: setting a path inside a scalar raises VersionCommitterError, code BATCH8_VERSION_COMMITTER_SCALAR_TRAVERSAL_REFUSED.

Missing identity field refused

A record with no identity field raises ValueError instead of hashing a blank, recorded as BATCH8_LEDGER_ID_MISSING_IDENTITY_REFUSED. ledger_id_missing_identity_refused: a record with no identity field raises ValueError, code BATCH8_LEDGER_ID_MISSING_IDENTITY_REFUSED.

Malformed tuple counted as gap

The malformed tuple is counted as a comma_arity coverage gap rather than swallowed, recorded as BATCH8_SHADOW_DSL_MALFORMED_TUPLE_COVERAGE_GAP. shadow_dsl_malformed_tuple_coverage_gap: the malformed tuple is counted as a comma_arity gap, code BATCH8_SHADOW_DSL_MALFORMED_TUPLE_COVERAGE_GAP.

Prior Art Grounding

The four tools follow standard patterns. Useful anchors:

• IETF RFC 6902, which defines JSON Patch operations such as add, remove, replace, move, copy, and test.
• IETF RFC 9162, where Certificate Transparency uses an append-only Merkle tree as an auditable log pattern.
• W3C PROV, for representing the provenance of derived artifacts and their generating activities.

Borrowed shapes, no correctness claim

The patch-op, identity-hash, append-only-log, and provenance shapes are borrowed, but the component runs only deterministic fixture exercises and claims nothing about correctness. The patch-operation, identity-hash, append-only-log, and provenance shapes are borrowed. This component keeps to deterministic fixture exercises over those shapes and claims nothing about correctness of the edits, ids, or predictions.

Validation Result record Path

Reader-verifiable commands, run from the microcosm-substrate/ public root:

What the three commands verify

The fixture command writes the result, the bundle command validates copied sources and digests, and the test checks mechanics and negative cases; a pass means the copied bodies produced exact values. The fixture command writes the bounded result and sign-off JSON. The bundle command validates the copied sources, manifest digests, the four exercises, the body-exclusion posture, and the scope fields. The focused test checks fixture mechanics, bundle validation, and the negative cases. A pass means the copied bodies ran and produced the exact expected values on the public fixture.