eawf 0.6.8__tar.gz → 0.7.0.dev1__tar.gz

eawf-0.7.0.dev1/.ea/artifacts/audits/2026-09-07-A-P31-backlog-reconciliation.md

@@ -0,0 +1,57 @@
+# P31 backlog reconciliation audit
+
+## Summary
+
+Sixty backlog rows stood open at the close of phase P31. A read-only investigation verified each against the tree at branch `feature/eawf-v0.7` rather than against wave descriptions. Fourteen rows are satisfied by code that ships on this branch and passes its own tests, so they can be closed. Four are covered by a planned P32 wave, three of them only partially. Forty-two are orphaned: no planned wave covers them and nothing in the roadmap references them.
+
+The dominant finding is not any individual row. It is that **the backlog and the roadmap are separate structures in the same state file with no linkage between them**, so delivering what a row asks for does not close the row. P32's thirty-one waves were authored from the P31 incident rows and the epoch-2 migration specification; the backlog was never consulted. The two ledgers have never met.
+
+## Attribution
+
+Of the fourteen closeable rows, exactly one is a P31 achievement:
+
+- **B120** — the Linux sandbox TMPDIR pin and the bubblewrap mask fix, delivered by P31-W16 and gated by the `linux-jail` CI job that wave added.
+
+The other thirteen were satisfied by earlier phases and left open:
+
+| Row | Satisfied by |
+|---|---|
+| B001 | `[P00-W01]` — the ubuntu matrix has been in CI since the bootstrap phase |
+| B009 | `[P13-W02]`, 2026-05-11 — the commit subject names the row it closes |
+| B002 | `[P30-I19-W07]` — P31-W42 added only the console-suppression flag |
+| B057, B058 | P14-W04 / P14-W05 |
+| B062 | `[P28-I03-W09]` |
+| B071 | `[P27-I05-W33]` |
+| B094 | `[P30-I26-W03]` |
+| B095 | `[P29-I12-W02]` |
+| B097 | P29-I12-W07 |
+| B117 | 2026-07-23 |
+| B124 | 2026-08-11 |
+| B133 | v0.6.5 hotfix |
+
+B009 is the clearest case: its own commit subject reads `test: end-to-end golden scenarios (B009)` and the row stayed open for four months.
+
+## Why the debt accumulates
+
+`eawf backlog close` requires a resolution, a resolving commit, and an audit id referencing a complete audit. That is a sound evidence chain, and it is also why rows persist: landing the fix costs one commit, while recording the closure costs an audit. The friction is structural rather than a lapse of diligence, and it will keep producing this drift until closing is cheaper or until wave close reconciles the rows it satisfies.
+
+## Verified security finding
+
+Backlog row **B121** is accurate and its exposure widened during this phase. `_check_command_exit_zero` builds its child environment as the full parent environment and passes it to the subprocess without calling either `validate_gate_argv` or `build_child_env`, though both already exist in the tree. The argv reaches that call from `CheckSpec.args`, shape-validated only, and the `/audit` skill constructs its `CheckSpec` from a free-form agent-supplied argument. P31 did not introduce this, but it widened the reach: the out-of-process close child added by P31-W10 routes through the same runner.
+
+Recorded as incident INC-P31-12 and scheduled as P32-W32. Backlog row B049 duplicates it with a weaker framing and should be dropped rather than worked.
+
+## References
+
+| Ref | Location | What it establishes |
+|---|---|---|
+| R1 | `src/eawf/runtime/sandbox/env_scrub.py:68` | the pinned TMPDIR split that satisfies B120 |
+| R2 | `src/eawf/runtime/sandbox/jail.py:381` | the entry-type branch for bubblewrap masks |
+| R3 | `.github/workflows/ci.yaml:166` | the `linux-jail` job executing the real-bwrap tests |
+| R4 | `tests/golden/surfaces/cli/test_scenarios.py:81` | the three golden scenarios that satisfy B009 |
+| R5 | `src/eawf/workflow/audit_dsl/registry.py:685` | the unscrubbed child environment behind B121 |
+| R6 | `src/eawf/runtime/daemon/gate_execution.py:478` | the close path that reaches that runner |
+
+## Provenance
+
+Compiled 2026-09-07 at the close of P31-I01 on branch `feature/eawf-v0.7`. Every closeable verdict was verified against the working tree; the attribution column was derived from `git log` on the satisfying commits. No row was proposed for closure on the strength of a wave description alone.

eawf-0.7.0.dev1/.ea/artifacts/audits/2026-09-07-A-P31-closeout.md

@@ -0,0 +1,47 @@
+# P31 closeout audit
+
+## Summary
+
+Phase P31 delivered the 0.7.0.dev1 stabilization floor across fifty waves in one iter. Every wave is closed with a pinned commit that is an ancestor of the phase head. The suite stands at 16,070 passing with a single local-only failure that skips in continuous integration. The strict prose gate, the snapshot pairing gate, mypy and the dependency check are all clean.
+
+This phase was executed by harness-dispatched worktree agents rather than by the daemon's own dispatch engine, so no wave carries a captured runtime and every close records an explained runtime waiver. Verification was therefore held outside the close gate: each wave's declared gates were re-run on the integrated branch head before its close, and a fresh-context auditor independently re-ran a sample plus every unique gate argv in the phase.
+
+## What did not land
+
+Two criteria closed unmet, both disclosed in their wave outcomes rather than waived.
+
+**W26 CR-01** required the 0.7.0.dev1 checkpoint to reach APPROVED after a preflight where all eight dev1 gates pass. It did not. Three required readiness signals cannot be satisfied before the merge: ancestry passes only once the head is an ancestor of the publishing branch, the artifact and dependency signals read receipts only the release workflow produces, and the credentials signal has no producer anywhere in the phase. **No Release record was persisted**, so the checkpoint named in the wave title was not cut. The wave did land the version bump and the changelog section, which moved two required signals from failing to passing.
+
+**W25 CR-02** required the full suite to exit zero. It does not, for the single environmental reason above.
+
+Both gaps are scheduled: P32-W23 adds the credentials producer, and P32-W24 cuts the checkpoint to APPROVED on merged main, with P32-W01 now depending on W24. Before this phase, P32-W01 had no dependencies and opened by moving a Release record from APPROVED to PUBLISHING that did not exist.
+
+## What the audit corrected
+
+An independent fresh-context audit contradicted this session's own account on several points, and each correction was verified before acceptance. Eight of the ten failures standing at audit time were introduced by this phase rather than inherited: a workflow reflow that outran the literal its test greps, a module split that moved a symbol without updating its test, and a renderer change whose goldens were never refreshed. The idle-surface ceiling had also been breached by this phase rather than drifting into it. All were repaired.
+
+The audit further found that fifty of the phase's recorded gate arguments no longer resolve, because a late wave collapsed the test tree beneath waves that had already closed. Every one passes once aimed at its new home, so the work is verified; the record is not re-runnable as written. No wave-level reopen verb exists to repair them in place, so a translation map was written instead and the repair is scheduled as P32-W25.
+
+## Verification integrity
+
+The store cannot reconstruct this phase's verification history. Nineteen close-attempt rows exist for fifty closed waves, and the five affordance-parity gates that were re-run persisted no receipt. Two gates are required and blocking yet cannot fail on any tree. Both facts are scheduled as P32-W26 rather than left implicit.
+
+## References
+
+| Ref | Location | What it establishes |
+|---|---|---|
+| R1 | `.ea/artifacts/audits/2026-09-07-A-P31-backlog-reconciliation.md` | the backlog reconciliation and its attribution |
+| R2 | `src/eawf/workflow/release/` | the release subsystem this phase built |
+| R3 | `src/eawf/runtime/daemon/methods/state.py` | the split facade, reduced from 5,286 lines to 1,392 |
+| R4 | `tools/idle_surface_report.py` | the corrected idle metric, counting call sites |
+| R5 | `.vale/styles/config/vocabularies/eawf/accept.txt` | the curated vocabulary, grown from 49 to 156 entries |
+
+## Provenance
+
+Compiled 2026-09-07 at the close of P31-I01 on branch `feature/eawf-v0.7`, from a fresh-context audit, an independent code review, and the session's own gate runs. Every claim of a passing gate was re-run on the integrated head. Claims the audit contradicted were re-verified before being recorded either way.
+
+## Scrub
+
+- status: clean
+- references: repo-relative
+- credentials, PII, machine-specific paths: none

eawf-0.7.0.dev1/.ea/artifacts/research/2026-09-03-v07-finalization-brief.md

@@ -0,0 +1,128 @@
+# v0.7 finalization: ratified decisions, repaired roadmap, next command
+
+> Status: research brief · Scope: the v0.7.0 proposal packet, the ten spikes under `.ea/local/spikes/`, the 2026-08-25 rules-delivery design, and the live roadmap · Baseline at start: checkout `ae04a5c1`, package `0.6.8`, state schema `1.19`, P31 ACTIVE with no iter open · Baseline at end: checkout `05f0394a` · Date: 2026-09-03
+
+## Summary
+
+The v0.7.0 packet was consistent as a specification but not executable as a plan: no P31 wave could close (78 criteria referenced gate ids that resolved to no `GateSpec`, and the daemon rejects that unconditionally), dev1 ended at APPROVED while dev2 opens only from BAKED, the effort ladder had no discriminating power, and none of the 2026-08-28 and 2026-09-03 spike findings or the 2026-08-25 rules-delivery design had reached the packet [1][2][3]. Eight read-only researchers audited the packet against the spikes and the design, verified every load-bearing claim at HEAD, designed the missing seam, drafted the dev2 plan and the dev3-to-stable outlines, and produced a decision register [4][5][6][7][8][9][10][11]. Four AskUserQuestion rounds then ratified sixteen decisions, every one on the long-term-correct option [12].
+
+The roadmap is repaired and the specifications are finalized. P31 carries 38 waves with 130 typed gates and zero dangling references (26 original, 8 seam, 4 repair; W36 closed against `231656bf`); P32 (0.7.0.dev2) is PLANNED and applied with 22 waves and 71 gates; P33 to P37 are PLANNED shells with their outlines attached; decisions D34 to D48 are recorded; the packet carries 1,168 requirement identifiers with the spike, rules and hygiene amendments folded in under AUTH-039 to AUTH-058 [13][14][15]. The next command is `/flow`, whose `/prep P31` step is a no-op on the already-active phase and proceeds to claims.
+
+## What was wrong, verified at HEAD
+
+| Finding | Evidence | Disposition |
+|---|---|---|
+| No P31 wave could close: `_validate_wave_close_gate_refs` runs on every `WAVE_CLOSE` regardless of `verify.enforce`; 78 of 80 criteria carried `gate_ids` resolving to no gate; the blanket `criteria_floor_waiver` tested reference presence, never resolution | `src/eawf/runtime/daemon/methods/state.py` validator chain; `src/eawf/workflow/lifecycle/_errors.py` floor; state census 78 dangling refs [4][6] | Repaired by spec sync (D34, D38); floor tightening scheduled as P31-W37 |
+| Eight criteria needed an `eawf` or `just` argv head the L0 allowlist rejected at `GateSpec` construction | `src/eawf/kernel/spec/promotion.py` allowlist; `src/eawf/kernel/spec/common.py` validator [6] | Widened as P31-W36 (`231656bf`), interim until the epoch-2 command-family contract (D34) |
+| dev1 ended at APPROVED; the train opens dev2 from BAKED; `ReleaseTrain` and `ReleaseReadiness` absent; ten publication tokens in zero waves; the 8-gate profile had no function to the 12-signal table; three gates had no producer; `phase-release.yaml`'s tag regex never matched `v0.7.0.dev1` | seam spike; `13-seam-waves-notes.md` [3][7] | Eight seam waves W27 to W31 and W33 to W35 appended to P31; publish-to-BAKED is P32-I01-W01 post-merge (D35, D37, D40) |
+| The XS..XL ladder spans 14x declared against 1.3x measured, non-monotonic, rho +0.048; fifteen size proxies separate nothing; MEAS-021's eight-times figure was the open-to-close clock | effort-size-proxy and measurement-reality spikes [3][5] | Ladder retired for a flat 0.8 EU per wave with dispersion (D36) |
+| 0 of 36 measurement producers exist; only 28 of 849 actuals carry a real price; codex sums reasoning tokens into output against MEAS-055 | measurement-reality spike; `src/eawf/observability/telemetry/sources/codex_session.py` [5][6] | W17 split into W17 and W34; W18 declares its 28-row sample and freezes threshold 0.20 (D41) |
+| The packet's steering surface (one committed root carrying every unscoped `must` rule) is incompatible with the ratified single generated policy projection; zero of ten measured repairs applied; `agents.extra_tools` shipped empty so the next plugin install strips Serena from six roles | rules-harness audit [8] | Packet amendments A1 to A15 applied; repair wave P31-W38 (D46) |
+| The shipped TUI's pane focus ring is invisible on all three themes (`$primary == $accent`) and `$muted` sits at 2.47:1 across 13,037 cells; the design pack's `stage.css` is an unbound colour oracle | colour-conformance spike; `src/eawf/surfaces/tui/theme.py` [6] | Oracle bound at dev3 (P33); XS fix now as P31-W39 (D47) |
+| dev3 to stable existed as prose; rc2 had no `REL` row; `PRX-050`/`PRX-064` circular; `LINT-038` reds on every merge; `REL-031` and `REL-032` name different windows | dev4-to-stable outline; decision register [10][11] | Shells P33 to P37 proposed; eleven hygiene fixes and seven defaults applied (D48) |
+
+## The ratified decisions
+
+| Decision | Ruling | Round |
+|---|---|---|
+| D34 | `eawf` and `just` admitted as gate argv heads (interim); the plan-time criteria floor must require every `gate_ids` entry to resolve | 1 |
+| D35 | Eight seam waves join P31-I01 before the test-tree collapse; publish-to-BAKED opens P32 post-merge | 1 |
+| D36 | Effort ladder retired: one constant of 0.8 EU per wave with dispersion; bucket labels are narrative only; no re-fit before 100 waves carry positive elapsed effort | 1 |
+| D37 | All three producerless dev1 gates get producers at dev1 (W30); `security_review` is the supply-chain vulnerability component of the `dependencies` row | 1 |
+| D38 | Minted gates use `scope: all` and `timeout_class: quick`; a repetition count is one looping test; residual halves live inside the named test; CI-only halves are cadence-ship gates | 2 |
+| D39 | REL-025 "explained" is the waiver event itself; `waiver_count` is a readiness field; a non-zero count blocks APPROVED until acknowledged | 2 |
+| D40 | A declared function binds each dev1 gate name to a readiness row, a row component or a proof command; required signals derive from `gates.required` plus the existing tree, ancestry and credential flags; `platform` computes at dev1 | 2 |
+| D41 | Turn-cost producer split (W17 record and provenance, W34 CLI and check); dev1 baseline over the 28 priced rows at threshold 0.20; codex rows excluded until MEAS-055 is settled | 2 |
+| D42 | REL-027: compact native tree with a separate legacy store; a legacy reference is a string on a native envelope, a legacy record an envelope in the legacy ledger | 3 |
+| D43 | DOM-018 is an enumerated deletion list bound to the DOM-015 allowlist; `archived` maps to CANCELLED; `priority` and `intent` take annotated defaults | 3 |
+| D44 | The workspace registry ships before importer apply mode; the packet's workspace verbs are canonical; the largest supported state is the live corpus frozen at band `thousands` | 3 |
+| D45 | P32 proposed now with 22 waves; dev2 gate profile is the dev1 eight plus `migration`, `hosted_gate_runner`, `schema_strictness`, `waiver_count`; REL-037 legs importer/dev2, cross-provider/dev3, daemon-RPC/dev3 | 3 |
+| D46 | The single generated policy projection design is adopted with packet amendments A1 to A15; the steering-surface migration rides dev4; P31-W38 repairs the symbol-tool plumbing now | 4 |
+| D47 | The `stage.css` chrome is the colour oracle bound at dev3 with every console route; P31-W39 fixes the focus ring and muted contrast now | 4 |
+| D48 | P33 to P37 proposed as PLANNED shells; eleven hygiene fixes and seven defaults applied to the packet | 4 |
+
+Also ratified in round 4: the allowlist repair rides a dedicated wave (W36) rather than a widened commit lint, and the floor tightening is its own wave (W37).
+
+## What changed in the repository
+
+| Commit | Subject | Content |
+|---|---|---|
+| `e82b6d99` | `[P31] state: activate iter P31-I01 and record decisions D34-D48` | iter activation; fourteen decisions |
+| `684566f5` | `[P31] state: append seam and repair waves W27-W39 and claim W36` | eight seam waves, four repair waves, W17/W18/W26 rewrites, W25/W26 dependency lists, W19 scope append |
+| `231656bf` | `[P31-I01-W36] fix: admit eawf and just as gate argv heads` | `DEFAULT_GATE_ARGV_ALLOWLIST` plus five pinning tests; a pre-existing pyright invariance defect fixed at the call site |
+| `192c755a` | `[P31] state: sync typed gates onto 38 waves and close W36` | 130 gate rows synced; W36 closed under an explained missing-runtime waiver with its integration revision adopted |
+| `05f0394a` | `[P31] state: propose and apply P32 and stage the P33-P37 shells` | P32 with 71 synced gates; D45; five shells |
+
+Spec bodies are not committed (D27 deprecated committed per-wave specs); they live under the gitignored finalization directory and were fed to `eawf spec sync` through `--spec-path` [13]. The plan file `2026-08-25-p31-dev1-roadmap-plan.yaml` in the packet directory is superseded by the live state; `eawf roadmap show --phase P31 --md` is authoritative.
+
+## The roadmap after this pass
+
+| Phase | Status | Waves | Gates | Checkpoint |
+|---|---|---:|---:|---|
+| P31 | active (iter P31-I01 active; W36 closed, 37 pending) | 38 | 130 | 0.7.0.dev1 to APPROVED |
+| P32 | planned, applied | 22 | 71 | 0.7.0.dev2 to BAKED (W01 bakes dev1 post-merge) |
+| P33 | planned shell | 0 | 0 | 0.7.0.dev3 native canary + console |
+| P34 | planned shell | 0 | 0 | 0.7.0.dev4 planning + steering surfaces |
+| P35 | planned shell | 0 | 0 | 0.7.0rc1 flag day |
+| P36 | planned shell | 0 | 0 | 0.7.0rc2 evidence |
+| P37 | planned shell | 0 | 0 | 0.7.0 stable |
+
+P31 at the flat rate is 30.4 EU over 38 waves (47.75 EU on the retired ladder, quoted only for comparison); its critical path is eight waves. P32 is 17.6 EU flat over 22 waves with a twelve-wave critical path. The outlines for P33 to P37 live in the finalization directory [10][11].
+
+## Next command
+
+`/flow` — its `/research` step may cite this brief; its `/prep P31` step is an idempotent no-op on the ACTIVE phase and proceeds to claims. Before the first claim batch run `uv run eawf dispatch resume`; claim reactive or parallel-frontier waves with `--out-of-order` (W33 to W35 are numbered above W30 while earlier in the DAG). W37 to W39 are dispatchable on day one; W36 is closed.
+
+## Known limits
+
+- W36 was closed under a `--no-runtime` waiver because its executor ran inline with no captured runtime, so the close recorded 0 of 2 gate receipts; both gate commands were run directly afterwards and pass (7 and 4 tests). The waiver is counted and explained on the dev1 readiness receipt per D39.
+- Two seam gates may exceed the 60 s `quick` class at close (W30 double clean build, W26 preflight reruns); a `slow` override at sync is the remedy if they time out.
+- The measurement spike's MEAS-055 question (codex reasoning tokens summed into output) is settled only against a vendor rollout outside this repository; W17 marks codex rows and W18 excludes them until then.
+- Two agents read `security_review` differently (existing skill vs supply-chain component); the supply-chain reading was ratified (D37) and the packet says so.
+- The finalization directory holds the working artifacts of eight researchers and three executors; it is gitignored and is the provenance for every number in this brief.
+
+## References
+
+[1] `.ea/local/research/2026-09-02-v07-preflight-consistency.md` — the seven breaks, the eight decisions to sweep, the 2026-09-02 rulings.
+
+[2] `.ea/local/research/2026-08-04-v07-proposal/README.md` and files `00` to `90` — the packet, amended 2026-09-03 (AUTH-039 to AUTH-058, REL-040 to REL-044, DOM-041/043/044/045, PLAN-051, DEL-034 to DEL-036, RULE-127 to RULE-131, SKILL-041/042, SURF-174).
+
+[3] `.ea/local/spikes/2026-09-03-v07-spike-consolidated-report.md` — six spike verdicts and the eight decisions owed.
+
+[4] `.ea/local/research/2026-09-03-v07-finalization/12-p31-closability-repair.md` — the spec sync mechanism proven on a copy; `12-gate-mint.py`.
+
+[5] `.ea/local/research/2026-09-03-v07-finalization/11-spike-packet-amendment-audit.md` — 46 findings, 31 amendments, the 16-row binding table.
+
+[6] `.ea/local/research/2026-09-03-v07-finalization/16-claim-verification-at-head.md` — C1 to C15 verdicts at `ae04a5c1`.
+
+[7] `.ea/local/research/2026-09-03-v07-finalization/13-seam-waves-notes.md`, `13-seam-waves-final.yaml`, `13-seam-apply-commands.sh` — the seam design and its apply record.
+
+[8] `.ea/local/research/2026-09-03-v07-finalization/10-rules-harness-amendment-audit.md` — amendments A1 to A15 and the status of the ten repairs.
+
+[9] `.ea/local/research/2026-09-03-v07-finalization/14-p32-dev2-roadmap-plan-final.yaml`, `14-planning-notes.md` — the dev2 plan and its blocking decisions.
+
+[10] `.ea/local/research/2026-09-03-v07-finalization/14-p33-dev3-outline.md` — the dev3 cluster outline and console decisions.
+
+[11] `.ea/local/research/2026-09-03-v07-finalization/14-checkpoint-outline-p34-p37.md` — dev4 to stable outlines and eleven packet defects.
+
+[12] `.ea/local/research/2026-09-03-v07-finalization/15-decision-register.md` — the 46-row decision register the AskUserQuestion rounds were built from.
+
+[13] `.ea/local/research/2026-09-03-v07-finalization/specs/` and `minted/` — the spec bodies fed to `eawf spec sync`; `20-decisions.sh`, `21-shells.sh` — the recorded mutation scripts.
+
+[14] `.ea/state.json` at `05f0394a` — phases P31 to P37, decisions D34 to D48.
+
+[15] `.ea/local/research/2026-09-03-v07-finalization/13-repair-waves-w36-w39.yaml` — the four repair waves.
+
+## Provenance
+
+- kind: research
+- slug: 2026-09-03-v07-finalization-brief
+- method: eight read-only researcher and planner agents over disjoint scopes (Opus 5 and Fable 5.1), one docs-lookup agent, three executor agents (allowlist commit, two packet amendment passes), four AskUserQuestion rounds of four questions each, and direct daemon-backed state mutations by the lead
+- state mutations: iter activation, twelve roadmap wave additions, three rewrites, three dependency-list edits, one scope append, 60 spec syncs, one claim, one integration adoption, one close, one phase proposal with apply, five shell proposals, fifteen decisions
+- roadmap mutations: P31 26 to 38 waves; P32 proposed and applied; P33 to P37 proposed as shells
+
+## Scrub
+
+- status: clean
+- references: repo-relative only
+- credentials, PII, machine-specific paths, hostnames: none

eawf-0.7.0.dev1/.ea/artifacts/research/2026-09-04-dev1-config-defaults-benchmark.md

@@ -0,0 +1,86 @@
+# Dev1 configuration defaults: four measured, seven carried unmeasured
+
+> Status: benchmark artifact · Scope: the eleven numeric defaults of the v0.7 configuration contract · Method: measurement over repository state, agent-session records, CI release-run history, and one instrumented probe of the shipped heartbeat ticker · `verified_at_commit`: `2f523398` · Date: 2026-09-04
+
+## Summary
+
+The v0.7 configuration contract fixes eleven numeric defaults and holds each one as a *proposal* default until it is remeasured, with a recorded benchmark required before any of them changes [7]. Four of the eleven are read by a dev1 gate and are measured here; the other seven are read by no dev1 gate and are recorded as unmeasured at their proposal value rather than carried as though somebody had checked them.
+
+All four measured defaults hold. The release-train timeout of 1800 seconds sits above a measured p90 of 1123.0 seconds over 46 publication runs and above the slowest run observed, 1190.0 seconds [2][3][4]. The retry limit of 2 is the tightest value that would not have burned a release: of those same 46 runs, 41 finished on the first attempt, 3 needed a second and 2 needed a third, so a limit of 1 would have failed two publications outright. The runtime wall default of 2400 seconds is an order of magnitude above the p90 agent-session wall of 208.6 seconds [1]. The lost-grace default of 30 seconds is 2.0 refresh intervals of the shipped lock heartbeat, whose observed cadence has a p90 gap of 15.007 seconds [5], and it is half the 60-second staleness threshold the same runtime already enforces [6], so it tolerates exactly one missed beat.
+
+The measured and unmeasured sets partition the eleven exactly. That partition is not left to review: the loader rejects any parse whose two sets are not disjoint and do not cover the contract keys [8], and the gate exercises both the real artifact and the rejection paths [9].
+
+## Measured defaults
+
+Sample size, p50 and p90 for the four defaults a dev1 gate reads. Timeout figures are wall seconds per run; the retry figure is a count of attempts; the grace figure is seconds between successive heartbeat writes.
+
+| Configuration key | Proposal default | Source | Sample size | p50 | p90 | Verdict |
+|---|---|---|---|---|---|---|
+| `release.target_timeout_seconds` | 1800 | wall seconds per publication run across the three release-train workflows [2][3][4] | 46 | 45.5 | 1123.0 | holds; p90 is 62 percent of the default and the slowest run seen, 1190.0 s, is 66 percent of it |
+| `release.target_retry_limit` | 2 | attempts needed per publication run across the same 46 runs [2][3][4] | 46 | 1.0 | 2.0 | holds exactly; 41 runs took 1 attempt, 3 took 2 and 2 took 3, so a limit of 1 would have burned two releases |
+| `runtime.default_wall_seconds` | 2400 | wall seconds of closed agent sessions recorded in repository state [1] | 12 | 40.2 | 208.6 | holds with wide headroom; p90 is 8.7 percent of the default and the longest session ran 625.3 s |
+| `runtime.lost_grace_seconds` | 30 | seconds between successive heartbeat writes of the shipped lock ticker under an instrumented hold [5] | 12 | 15.005 | 15.007 | holds; 30 s is 2.0 observed refresh intervals, one missed beat, against the 60 s staleness threshold already enforced [6] |
+
+Three caveats belong with these numbers rather than under them. The timeout sample is whole-run wall time, which is a wider quantity than the publication step it bounds, so it is a conservative upper bound rather than a tight one. The wall sample counts only the 12 agent sessions recorded as closed; 46 of the 68 session rows are stale, and their end timestamp records a daemon restart orphaning the session rather than the run ending, so including them would measure the restart and not the work [1]. The grace sample is a probe of the shipped ticker at its default cadence, not history, because no heartbeat history is retained; the cadence it measures is the constant the grace has to clear [5].
+
+## Unmeasured defaults
+
+The seven defaults no dev1 gate reads, carried at their proposal value. Each is a number the contract still asserts; none is a number this benchmark checked.
+
+| Configuration key | Proposal default | Status | Reason |
+|---|---|---|---|
+| `planning.max_revision_attempts` | 3 | unmeasured | bounds plan revision loops; no dev1 gate reads it and no revision-loop history is recorded to measure |
+| `runtime.global_capacity` | 8 | unmeasured | bounds concurrent dispatch; no dev1 gate reads it and dispatch concurrency is not exercised at dev1 |
+| `runtime.per_provider_capacity` | 4 | unmeasured | per-provider slice of the same concurrency bound; no dev1 gate reads it |
+| `runtime.max_task_attempts` | 3 | unmeasured | bounds task retries; no dev1 gate reads it and no task-attempt history is recorded |
+| `delivery.max_repair_tasks` | 2 | unmeasured | bounds repair tasks per integration boundary; no dev1 gate reads it |
+| `delivery.max_audit_cycles` | 2 | unmeasured | bounds audit cycles per integration boundary; no dev1 gate reads it |
+| `activity.query_page_size` | 100 | unmeasured | pages the activity query surface; no dev1 gate reads it and the surface carries no measured query load |
+
+## Packet annotation
+
+The configuration contract preamble in packet file 00 currently reads that exact numeric defaults remain proposal defaults until remeasured at dev1 and that changing them requires an amendment and a recorded benchmark [7]. The amendment this benchmark obliges is one added sentence, offered here verbatim so the packet edit is a transcription rather than a judgement:
+
+> Four of these defaults are read by a dev1 gate and were remeasured against this artifact: `release.target_timeout_seconds`, `release.target_retry_limit`, `runtime.default_wall_seconds` and `runtime.lost_grace_seconds`, each holding at its proposal value. The remaining seven are read by no dev1 gate and stay unmeasured proposal defaults; the obligation to remeasure them travels to the checkpoint whose gates first read them.
+
+The packet lives outside this wave's file scopes, so applying that sentence is a separate edit; the sentence is fixed here so that edit carries no discretion.
+
+## Method
+
+Release figures come from the run history of the three workflows that publish a release target: the tag-and-notes workflow [2], the package publication workflow [3] and the plugin publication workflow [4]. Every run each workflow has ever recorded was taken, with no filtering by conclusion, so failed and cancelled publications are in the sample; duration is the interval between a run starting and its final update, and attempts is the run's final attempt number. Wall figures come from the agent-session rows of repository state, restricted to sessions carrying both a start and an end timestamp and a closed status [1]. Grace figures come from holding the shipped lock for 185 seconds at the default refresh cadence and recording the interval between successive heartbeat writes [5]. The p50 is the median and the p90 the nearest-rank value throughout.
+
+## References
+
+[1] `.ea/state.json` — the `agent_sessions` rows: 68 sessions, 12 closed with both timestamps, 46 stale, 10 active.
+
+[2] `.github/workflows/phase-release.yaml` — the tag-and-notes publication workflow; 12 recorded runs.
+
+[3] `.github/workflows/release.yaml` — the package publication workflow; 18 recorded runs.
+
+[4] `.github/workflows/plugin-release.yaml` — the plugin publication workflow; 16 recorded runs.
+
+[5] `src/eawf/runtime/lock/portalock.py` — the heartbeat ticker and its 15-second default refresh cadence, the subject of the grace probe.
+
+[6] `src/eawf/runtime/lock/stale.py` — the 60-second staleness threshold the runtime already enforces against that cadence.
+
+[7] `.ea/local/research/2026-08-04-v07-proposal/00-authority-scope-and-decisions.md` — the configuration contract carrying the eleven numeric proposal defaults and the remeasurement obligation.
+
+[8] `src/eawf/platform/artifacts/config_defaults_benchmark.py` — the loader that parses these two tables into typed rows and enforces the partition.
+
+[9] `tests/unit/platform/artifacts/test_dev1_config_defaults_benchmark.py` — the gate over this artifact and over the loader's rejection paths.
+
+## Provenance
+
+- kind: research
+- slug: 2026-09-04-dev1-config-defaults-benchmark
+- wave: P31-I01-W40
+- `verified_at_commit`: `2f523398`
+- method: CI run history over three release workflows, repository-state agent-session records, and one instrumented probe of the shipped heartbeat ticker; no state mutation was performed by this wave
+- p50 is the median; p90 is the nearest-rank value
+- gates: the two selections named in reference 9
+
+## Scrub
+
+- status: clean
+- references: repo-relative only
+- credentials, PII, machine-specific paths, hostnames: none

eawf-0.7.0.dev1/.ea/artifacts/research/2026-09-04-dev1-turn-cost-baseline.md

@@ -0,0 +1,175 @@
+# Dev1 turn cost: 25 completed units, verification a fifth of the spend
+
+> Status: baseline artifact · Scope: the first turn-cost measurement of this repository and the tolerance it is frozen under · Method: the completed-unit producer run over the priced rows of `state.actuals` · `verified_at_commit`: `7db9c303` · Date: 2026-09-04
+
+## Summary
+
+This is the first turn-cost measurement this repository has taken, and the regression tolerance it will be checked against was fixed at `0.20` before it was taken, not after [8][9]. Everything else here follows from one decision about the sample: the corpus is 25 completed units, and the artifact says so in the same breath as it reports the numbers, because a percentile stated without its sample invites the reading that it covers the whole project [9].
+
+Over those 25 units the median unit costs 3.007518 USD and the ninetieth-percentile unit costs 8.924265 USD; the median unit runs 346.67 seconds of agent runtime and the ninetieth-percentile unit runs 3157.581 seconds. The verification-cost question this measurement exists to answer has a number: 23.307666 USD of the 112.546178 USD spent across the corpus was verification-class work, or 20.71 percent, against 89.238512 USD of execution-class work. Two of the 25 units were verification runs and 23 were execution runs, so the split is carried by a small tail and should be read as a first observation rather than a rate.
+
+The sample is smaller than the row count of the collection it comes from, and every step of the narrowing is stated below rather than folded away. `state.actuals` holds 878 rows. 850 of them carry a cost of exactly zero along with no harness and no model, so they name no runtime/model tuple to be measured under and are not summable as zero either — an unpriced row and a zero-cost row are different facts [3]. Of the 28 rows that do carry a cost, three carry no agent role, and the producer refuses an unlabelled run rather than charging it to execution [4]. That leaves 25.
+
+The count of rows excluded for unsettled reasoning-token accounting is **zero, and it is zero for two independent reasons**. The exclusion set is empty: no supported runtime is listed in it today [5]. And the collection contains no row that could be listed — every harness value in `state.actuals` is either absent or `claude-code`, so there is no codex row anywhere in it to exclude. Reporting a nonzero exclusion here would be reporting a filter that never ran.
+
+## Sample
+
+Every narrowing between the collection and the corpus, with where it happened. The producer's own exclusion counters are all zero because each exclusion here happened at corpus selection, before the producer saw a row; the two columns are kept apart so a zero on the record is never mistaken for "nothing was dropped".
+
+| Bucket | Rows | Where it was dropped | Why |
+|---|---:|---|---|
+| `state.actuals` rows | 878 | — | the whole collection [1] |
+| carrying no cost | 850 | corpus selection | cost is exactly zero with no harness and no model, so the row declares no runtime/model tuple; never summed as zero [3] |
+| priced | 28 | — | `actual_cost_usd` greater than zero; harness `claude-code` throughout |
+| priced but unlabelled | 3 | corpus selection | the wave carries no `agent_role`, and an unlabelled run raises rather than landing in either cost sum [4]; these are also the only `claude-fable-5` rows |
+| **completed units measured** | **25** | — | closed waves on the single tuple `claude` / `claude-opus-4-8`, one run each |
+| excluded `reasoning_summand_unsettled` | 0 | — | the exclusion set is empty [5] and no codex row exists in the collection to populate it |
+
+The 25 units are 23 executor runs, one auditor run (`P30-I25-W29`) and one polisher run (`P30-I25-W38`). Auditor and polisher are the verification classes; executor is an execution class [4].
+
+The roster below is the corpus, named row by row, so the measurement can be re-run over exactly these rows rather than over whatever the collection holds later. The gate reads it and rebuilds the record from it [11].
+
+```json
+{
+  "fixture_id": "dev1-actuals-2026-09-04",
+  "runtime": "claude",
+  "model": "claude-opus-4-8",
+  "state_row_count": 878,
+  "priced_row_count": 28,
+  "unpriced_row_count": 850,
+  "unlabelled_priced_row_count": 3,
+  "reasoning_summand_unsettled_row_count": 0,
+  "unlabelled_priced_scope_ids": ["P30-I23-W28", "P30-I23-W45", "P30-I23-W46"],
+  "corpus_scope_ids": [
+    "P30-I25-W26", "P30-I25-W27", "P30-I25-W28", "P30-I25-W29", "P30-I25-W30",
+    "P30-I25-W31", "P30-I25-W32", "P30-I25-W33", "P30-I25-W35", "P30-I25-W36",
+    "P30-I25-W37", "P30-I25-W38", "P30-I25-W39", "P30-I25-W40", "P30-I25-W41",
+    "P30-I25-W42", "P30-I25-W43", "P30-I25-W44", "P30-I25-W45", "P30-I25-W46",
+    "P30-I25-W47", "P30-I25-W48", "P30-I25-W50", "P30-I25-W51", "P30-I25-W52"
+  ]
+}
+```
+
+## Record
+
+The measurement itself, as a `TurnCostRecord` [2]. The model forbids unknown fields, so this block cannot be extended by hand without the gate rejecting it, and it deliberately carries no combined cost total: a consumer that wants verification plus execution has to add the two and can never mistake one for the whole.
+
+```json
+{
+  "execution_cost_usd": "89.238512",
+  "fixture_id": "dev1-actuals-2026-09-04",
+  "harness_revision": "turn-cost-1",
+  "model": "claude-opus-4-8",
+  "p50_cost_usd": "3.007518",
+  "p50_wall_clock_ms": 346670,
+  "p90_cost_usd": "8.924265",
+  "p90_wall_clock_ms": 3157581,
+  "reasoning_summand_unsettled": false,
+  "reasoning_summand_unsettled_run_count": 0,
+  "runtime": "claude",
+  "token_total": 35870107,
+  "unattributed_run_count": 0,
+  "unit_count": 25,
+  "unpriced_run_count": 0,
+  "verification_cost_usd": "23.307666"
+}
+```
+
+Three fields need a caveat rather than a footnote.
+
+`token_total` is a three-class total, not the four-class total the field is defined as. `state.actuals` records new tokens only — input plus output plus cache writes, with cache reads deliberately left out because a cache read tracks how deep into a session a wave sits rather than how much work it did [6]. The reads were still billed, so `p50_cost_usd`, `p90_cost_usd` and both cost sums include them; only the token figure is a floor.
+
+`p50_wall_clock_ms` and `p90_wall_clock_ms` are agent runtime, not elapsed calendar time. The state row records effort units on the api-duration basis, so the millisecond figure here is that effort reconstructed at the 30-minute-per-unit default [7]. A unit that waited an hour for review does not show that hour.
+
+Both cost sums are quantised to micro-USD before summing. The state row holds a binary float, and `10.079999999999984` is not a cost anybody incurred; rounding to the millionth of a dollar once, at the boundary, keeps every downstream percentile an exact `Decimal` and keeps a re-run byte-identical.
+
+## Threshold
+
+The tolerance was fixed at the packet default of `0.20` before this measurement was taken, and it is written here rather than passed at check time so the tolerance travels with the number it guards [2]. It is not derived from the spread observed above; deriving it would make every future result tolerable by construction, which is the failure `MEAS-034` exists to prevent [8][9].
+
+```json
+{
+  "fixture_id": "dev1-actuals-2026-09-04",
+  "harness_revision": "turn-cost-1",
+  "model": "claude-opus-4-8",
+  "p90_cost_usd": "8.924265",
+  "p90_wall_clock_ms": 3157581,
+  "runtime": "claude",
+  "threshold": "0.20"
+}
+```
+
+Checked against the record it was taken from, this baseline passes: no percentile rose, so neither can have crossed the tolerance [11]. The gate also inflates the record's p90 cost by 21 percent and asserts the comparison reds, so the tolerance is demonstrably able to fire rather than merely present [11].
+
+## Why the corpus is `state.actuals` and not the live command path
+
+`eawf bench turn-cost --fixture live` sources its corpus from the projected telemetry cache: it reads `telemetry_sessions` out of `.ea/telemetry.db` and joins those rows onto the closed waves in state [12]. That table holds zero rows in this repository, and the join therefore returns nothing to measure. Under `--check` that is a refusal and not a pass — a check that succeeds because there was nothing to measure is a false green — so the live path exits 1 before any comparison happens [13]. Driving the first baseline through it would have produced no baseline at all.
+
+The measured cost of agent work is nevertheless recorded, just in the other collection: the daemon writes a per-wave rollup of tokens and priced spend into `state.actuals` at wave close [1][6]. The producer takes its runs as an argument rather than fetching them, so the caller chooses the corpus [2]; this artifact exercises that seam directly with the `state.actuals` rows and the gate rebuilds the record the same way [11].
+
+That is a deliberate substitution and it has a cost worth naming. The baseline is stamped `dev1-actuals-2026-09-04` rather than `live`, and the comparability rule refuses to compare records across fixture ids [2], so a later `--fixture live` measurement will report `comparison_invalid` against this baseline rather than a phantom regression. That is the correct outcome: once telemetry rows exist they will describe a different quantity — per-session rows rather than per-wave rollups — and the live corpus deserves its own first measurement and its own frozen tolerance.
+
+## Proposal numeric defaults this measurement touches
+
+The configuration contract holds its numeric defaults as *proposal* defaults until a dev1 gate remeasures them [10][14]. This wave's producer reads the turn-cost block, and its record is the first evidence available against the runtime wall, the gate-tier budgets and the unit ceiling. Every row below carries the command that reproduces its measured value, so a reader can disagree by re-running rather than by argument. A row measured by the sibling configuration-defaults benchmark points at that artifact rather than restating its number [14].
+
+`unmeasured` is a status, not a failure: it means no dev1 gate reads the default, so nothing at this checkpoint produces a sample, and the obligation to remeasure travels to the checkpoint whose gates first read it.
+
+| Configuration key | Proposal default | Measured at dev1 | Sample | Re-runnable command | Verdict |
+|---|---|---|---:|---|---|
+| `measurement.turn_cost.regression_threshold` | 0.20 | 0.20, fixed before the measurement | 25 units | `uv run pytest tests/perf/test_dev1_baseline_artifact.py -k threshold_frozen` | held frozen by construction; deriving it from this spread is what `MEAS-034` forbids [9] |
+| `measurement.turn_cost.percentiles` | [50, 90] | both emitted, nearest-rank | 25 units | `uv run pytest tests/perf/test_dev1_baseline_artifact.py -k record_and_sample_sizes` | holds; nearest rank returns an observed value, so the percentiles are exact `Decimal` |
+| `measurement.turn_cost.unit` | completed_task | 25 completed units from 25 closed waves, one run each | 25 units | `uv run pytest tests/perf/test_dev1_baseline_artifact.py -k record_and_sample_sizes` | holds, but untested where it matters: no unit in this corpus carries more than one run, so the split-invariance the unit exists for is exercised only by the seeded fixture |
+| `runtime.default_wall_seconds` | 2400 | p90 per-unit agent runtime 3157.6 s; p50 346.7 s | 25 units | `uv run pytest tests/perf/test_dev1_baseline_artifact.py -k record_and_sample_sizes` | different quantity, reported not ruled: the default bounds one run, this figure aggregates a whole wave. The per-session quantity the default actually bounds measured 208.6 s at p90 and holds [14] |
+| `runtime.lost_grace_seconds` | 30 | 15.007 s p90 heartbeat gap | 12 gaps | `uv run pytest tests/unit/platform/artifacts/test_dev1_config_defaults_benchmark.py` | holds, measured by the sibling benchmark [14] |
+| `runtime.global_capacity` | 8 | unmeasured | — | none exists | no dev1 gate reads it and dispatch concurrency is not exercised at dev1 [14] |
+| `runtime.per_provider_capacity` | 4 | unmeasured | — | none exists | per-provider slice of the same unexercised bound [14] |
+| `runtime.max_task_attempts` | 3 | unmeasured | — | none exists | no task-attempt history is recorded to measure [14] |
+| `quality.gates.T0.deadline_seconds` | 30 | 0.62 s cold, 0.08 s warm, 0.08 s warm | 3 runs | `uv run pytest tests/perf/test_dev1_baseline_artifact.py` | holds for this wave's changed scope with three orders of magnitude of headroom; a whole-repository T0 selection is not measurable, see below |
+| `quality.gates.T1.deadline_seconds` | 180 | unmeasured | — | none exists | no invocation selects T1 by tier; see below |
+| `quality.gates.T2.deadline_seconds` | 600 | unmeasured | — | none exists | no invocation selects T2 by tier; see below |
+| `quality.unit_test_seconds_ceiling` | 0.5 | slowest added test 0.03 s call, 0.09 s including setup | 3 tests | `uv run pytest tests/perf/test_dev1_baseline_artifact.py --durations=0` | holds for the tests this wave adds; the ceiling is unmeasured across the existing suite because no budget artifact records per-test durations |
+
+The three tier budgets are unmeasurable at dev1 for a structural reason rather than a scheduling one. A tier budget is a claim about a tier, and measuring one requires an invocation that runs *that tier and only that tier*. No such invocation exists: the recipes that run tests select by path and by marker, not by declared tier, so timing any of them measures a directory rather than T1 or T2 [15]. There is also no budget artifact recording per-test durations, so the unit ceiling cannot be evaluated across the existing suite either — `tests/.budgets.json` is absent. Both gaps are the same missing deliverable, and until it lands a number recorded against these budgets would be a number about something else.
+
+The T0 figure above is honest about the same limit: it is a genuine changed-scope selection, but the changed scope is two files. It says the tier's budget is not at risk from this wave, and it does not say the repository's T0 selection fits in 30 seconds.
+
+## Method
+
+The corpus is every row of `state.actuals` whose `actual_cost_usd` is greater than zero and whose wave carries an `agent_role`, which is 25 rows on the single tuple `claude` / `claude-opus-4-8` [1]. Each row becomes one run of one completed unit: the wave supplies the role and the closed status, `elapsed_eu` supplies agent runtime at the 30-minute-per-unit api-duration default [7], `actual_tokens` supplies the three-class token figure [6], and `actual_cost_usd` supplies the cost quantised to micro-USD. Runs are handed to the producer, which groups them by closed wave, folds each unit, and takes nearest-rank percentiles over the per-unit aggregates rather than over individual runs [3].
+
+Rows are not filtered by date, by phase or by outcome; every priced, labelled row in the collection is in. The single-tuple restriction is the producer's own rule and not a choice made here: a percentile taken across models measures the model mix rather than the work, so a corpus spanning two tuples is refused [2]. The three rows that fall outside the tuple are also the three that carry no role, so the two restrictions happen to select the same 25 rows.
+
+The gate re-runs all of this. It parses the roster, the record and the baseline out of this file, rebuilds the record from the named state rows, and asserts the rebuilt record equals the recorded one field for field [11]. A baseline that agrees only with itself proves nothing; this one has to agree with a re-run.
+
+## References
+
+[1] `.ea/state.json` — the `actuals` collection: 878 rows, 28 with a non-zero `actual_cost_usd` and 850 without; every `harness` value is `claude-code` or absent.
+
+[2] `src/eawf/observability/bench/turn_cost.py` — the baseline model carrying its own threshold, the comparability refusal across fixture ids, and the single-tuple rule on a corpus.
+
+[3] `src/eawf/observability/telemetry/turn_cost.py` — the record model, the completed-unit producer that takes its runs injected, and the rule that an unpriced run is counted rather than summed as zero.
+
+[4] `src/eawf/observability/telemetry/cost_class.py` — the total role-to-cost-class map, and the refusal to attribute a run that carries no role.
+
+[5] `src/eawf/observability/telemetry/turn_cost.py` — `REASONING_UNSETTLED_RUNTIMES`, empty: every supported runtime reports reasoning tokens as a subset of output.
+
+[6] `src/eawf/workflow/lifecycle/wave.py` — the close-time runtime delta: `actual_tokens` excludes prompt-cache reads while `actual_cost_usd` bills them.
+
+[7] `src/eawf/observability/telemetry/join.py` — the 30-minute effort-unit default the api-duration basis converts against.
+
+[8] `.ea/local/research/2026-08-04-v07-proposal/00-authority-scope-and-decisions.md` — the ruling that the turn-cost producer is two deliverables and that its first baseline declares its sample and freezes its threshold before the second measurement.
+
+[9] `.ea/local/research/2026-08-04-v07-proposal/67-measurement-and-instrumentation.md` — the rule that the regression threshold is recorded before the second measurement is taken, and the `measurement.turn_cost` block carrying `regression_threshold: 0.20`.
+
+[10] `.ea/local/research/2026-08-04-v07-proposal/00-authority-scope-and-decisions.md` — the configuration contract preamble holding exact numeric defaults as proposal defaults until remeasured at dev1, and the `runtime` block of five defaults.
+
+[11] `tests/perf/test_dev1_baseline_artifact.py` — the gate over this artifact: it validates the embedded record, rebuilds it from the roster, asserts the frozen tolerance and the passing check, and asserts an inflated p90 reds.
+
+[12] `src/eawf/surfaces/cli/commands/bench.py` — the live corpus path, which reads `telemetry_sessions` out of the projected telemetry cache and joins them onto closed waves, and the `--check` branch that delegates to the comparison.
+
+[13] `src/eawf/surfaces/cli/commands/bench.py` — the empty-corpus branch: under `--check` an unmeasurable corpus is a refusal that exits 1, never a pass. The cache at `.ea/telemetry.db` holds zero `telemetry_sessions` rows.
+
+[14] `.ea/artifacts/research/2026-09-04-dev1-config-defaults-benchmark.md` — the sibling dev1 benchmark measuring four configuration defaults and recording seven as unmeasured.
+
+[15] `justfile` — the test recipes, which select by path and by marker rather than by declared tier.