bigmerge
c6ba0677f0
cycles/ one file per Ishikawa -> scientific method -> Six Sigma loop, named
for the DEFECT not the fix, carrying the commit record as written at
the time
findings/ what the cycles produced, cross-cut: live bugs, architecture answers,
and defects in my own measurement
The organising finding is that predictions which came back FALSE produced every
significant result. Eleven of sixty-one failed, and those eleven found: that the
arity table was not drifted but 40% incomplete; that the AST traversal is
irreducible and only rules and judgments move; that guards could refuse through
the seam after all; and that routing el_bin_lookup through the gate did NOT fix
the SIGSEGV, because the fallback strlen was the hazard -- a wrong fix I would
otherwise have shipped as verified.
One cycle was run without committing predictions first and had to be discarded
as rigged. It is kept, in full, as 18-async-half-expressible.md.
44 lines
1.6 KiB
Markdown
44 lines
1.6 KiB
Markdown
# a construct cannot refuse
|
|
|
|
One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
|
|
commit message as written at the time, before the outcome was known to anyone
|
|
reading this file.
|
|
|
|
## Record — `60737b0`
|
|
|
|
```
|
|
let a construct refuse, not only observe
|
|
|
|
@authenticate (6 uses), @authorize (3), @rate_limit (3) and @validate (2)
|
|
parsed, attached, and compiled to nothing. Fourteen applications that read as
|
|
protection and emitted no instruction — a function decorated @authenticate
|
|
compiled byte-identically to an undecorated one.
|
|
|
|
The missing capability was not authentication. It was that a construct could
|
|
observe a boundary but never refuse one. injects_at_entry discards the target's
|
|
result; there was no form in which a construct could say no.
|
|
|
|
@decorator("guards_at_entry", "my_auth")
|
|
fn authenticate() {}
|
|
|
|
@authenticate
|
|
@authorize
|
|
fn handler() -> String { ... }
|
|
|
|
emits, at entry:
|
|
|
|
{ el_val_t __g = my_auth(EL_STR("handler"), EL_STR("authenticate")); if (__g) return __g; }
|
|
{ el_val_t __g = my_roles(EL_STR("handler"), EL_STR("authorize")); if (__g) return __g; }
|
|
|
|
Guards precede injections because a refused call must not report a crossing,
|
|
and every guard runs where the topmost injecting construct wins — refusal is
|
|
not a role, so it does not follow the role convention.
|
|
|
|
The compiler still knows nothing about auth. The program points the construct
|
|
at its own function, which is where that decision belongs.
|
|
|
|
Verified: existing @manager/@accessor output byte-identical, compiler
|
|
self-hosts byte-identically, guards stack in declaration order and emit before
|
|
the beat. 94/94 native compiler tests pass.
|
|
```
|