bigmerge
c6ba0677f0
cycles/ one file per Ishikawa -> scientific method -> Six Sigma loop, named
for the DEFECT not the fix, carrying the commit record as written at
the time
findings/ what the cycles produced, cross-cut: live bugs, architecture answers,
and defects in my own measurement
The organising finding is that predictions which came back FALSE produced every
significant result. Eleven of sixty-one failed, and those eleven found: that the
arity table was not drifted but 40% incomplete; that the AST traversal is
irreducible and only rules and judgments move; that guards could refuse through
the seam after all; and that routing el_bin_lookup through the gate did NOT fix
the SIGSEGV, because the fallback strlen was the hazard -- a wrong fix I would
otherwise have shipped as verified.
One cycle was run without committing predictions first and had to be discarded
as rigged. It is kept, in full, as 18-async-half-expressible.md.
50 lines
2.0 KiB
Markdown
50 lines
2.0 KiB
Markdown
# policy inside the compiler
|
|
|
|
One `Ishikawa → scientific method → Six Sigma` loop. The record below is the
|
|
commit message as written at the time, before the outcome was known to anyone
|
|
reading this file.
|
|
|
|
## Record — `c2d9596`
|
|
|
|
```
|
|
EXPERIMENT: the capability tier becomes shipped policy plus a query
|
|
|
|
Capability differs from prohibits_outside in one way that matters: a utility
|
|
program cannot be trusted to declare its own restrictions, because it would
|
|
declare none. So the policy comes from OUTSIDE the program -- it ships with the
|
|
language as data, editable without a compiler release.
|
|
|
|
tools/check/capabilities.rel 18 names that were string literals in codegen
|
|
tools/check/capabilities.sh the query that decides
|
|
|
|
PREDICTIONS AND RESULTS
|
|
P1 codegen emits kind + call graph, drops the 4 name tests TRUE zero #errors
|
|
P2 the 18 literals become a data file TRUE
|
|
P3 the checker catches capability violations TRUE exit=1
|
|
P4 codegen drops ~76 lines TRUE 4963 -> 4881
|
|
P5 below the 4661 baseline FALSE ~+230
|
|
|
|
TWO DEFECTS THE HARNESS FOUND THAT READING WOULD NOT HAVE
|
|
|
|
1. Calls inside main became invisible. cg_fn returns early for main -- C
|
|
provides its own -- so hooking the recording there left every call in main
|
|
unrecorded: a blind spot exactly where a program does its work. The old
|
|
cap_check_call ran from cg_expr and did see main. Moved the recording to
|
|
cg_expr.
|
|
|
|
2. Caller attribution was stale. __cg_current_fn kept whatever cg_fn set last,
|
|
so a violation in main was reported against the previously emitted function.
|
|
The test still PASSED, because the violation was detected -- only the name
|
|
was wrong, and a diagnostic naming the wrong fn is worse than none. Fixed at
|
|
all three main-emission sites; the first patch missed two because the live
|
|
path is codegen_streaming.
|
|
|
|
98/98 native, 7/7 + 4/4 + 5/5 integration, fixpoint ok.
|
|
```
|
|
|
|
## Record — `29f78f9`
|
|
|
|
```
|
|
land capability-as-policy: eighteen literals become a data file
|
|
```
|