chore(sync): establish protected PDD inventory denominator

[gltanaka]

Summary

Establishes the PDD protected inventory authority only. This is the first bootstrap tranche: no profiles, fingerprints, evidence, waivers, baselines, workflow activation, or verification claim are included.

Investigation

• Read the canonical manifest/decommission/ownership schemas and the pdd_cloud precedent: 39b78e487 / 57cf48246 (expected registry) and be6ea76d2, 726e2ac35, 385e27b8e (ownership policy).
• Canonical exact-tree scan reconciles syntactic prompt files with architecture ownership: 631 syntactic prompt candidates become 466 PDD managed units under pdd/prompts; historical context, examples, fixtures, demos, and utilities are explicitly human-owned.
• Historical nested architecture fixtures are explicitly excluded-project; their prompt mappings are not silently treated as PDD product units.
• Ownership uses exact tracked paths only. There are no catch-all rules, so future paths are uncovered until reviewed.

TDD

Red commit 763bed6a1: pytest -q tests/test_sync_core_pdd_rollout_policy.py failed with missing protected expected-managed registry (1 failed, 1 passed).

Green after protected data: pytest -q tests/test_sync_core_pdd_rollout_policy.py passes (2 passed). The test validates registry/policy schemas, unique nonzero exact identities, complete tracked-path accounting, no waiver/profile/trust files, representative path coverage, and base/head candidate addition/removal denominator behavior.

Exact Inventory

• 466 expected-managed and currently managed units
• 3,010 tracked paths
• 656 managed candidate paths
• 2,354 explicit human-owned candidate paths
• 0 unaccounted and 0 manifest-invalid paths
• Two read-only canonical manifest runs produced the same digest: 67c37a835fd6ddae4f4dac0776ef9e41024fca2872a3ec23aa903dd423ec84ee

Remaining Rollout Debt

The canonical report is intentionally not activatable in this PR. Complete verification profiles, fingerprints/baselines, trusted evidence, and protected enforcement remain follow-up work. A read-only pdd sync certify --base-ref HEAD --head-ref HEAD diagnostic remains red before profile evaluation on an existing prompt include glob rejected by Python 3.12 (Invalid pattern: ** can only be an entire path component); this PR does not alter that production behavior.

Verification

• pytest -q tests/test_sync_core_pdd_rollout_policy.py
• Two read-only build_unit_manifest(..., base_ref=HEAD, head_ref=HEAD) diagnostics
• git diff --check origin/codex/issue-1932-verifiable-goal...HEAD

Rebased onto foundation head 8a8cf5137 and pushed with --force-with-lease.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[gltanaka]

Bootstrap Evidence

Red test before controls

pytest -q tests/test_sync_core_pdd_rollout_policy.py
FAILED tests/test_sync_core_pdd_rollout_policy.py::test_pdd_protected_inventory_is_complete_and_exact
AssertionError: missing protected expected-managed registry
1 failed, 1 passed

Green after controls and rebase

pytest -q tests/test_sync_core_pdd_rollout_policy.py
2 passed

Canonical read-only inventory runs: tracked=3010, managed_units=466, expected_managed=466, managed_paths=656, human_owned_paths=2354, unaccounted=0, invalid=0; both produced digest 67c37a835fd6ddae4f4dac0776ef9e41024fca2872a3ec23aa903dd423ec84ee.

No profiles, baselines, fingerprints, evidence, waivers, or enforcement activation are claimed here. The next tranche must supply complete profiles and trusted evidence; the report stays red.

The pdd sync certify read-only diagnostic currently stops on a pre-existing invalid include glob (** within a path component) before profile evaluation. This data-only PR does not alter that runtime behavior.

[gltanaka]

Rebased onto origin/codex/issue-1932-verifiable-goal at f78bad5. New head: 6868f80. Verified: pytest tests/test_sync_core_pdd_rollout_policy.py (2 passed); git diff --check passed. Worktree and pushed branch are clean.

[gltanaka]

Codex xhigh adversarial review — PR #1992 @ 6bc7d75

Verdict: MERGE
Findings: 0 total (0 P1, 0 P2)

MERGE — no findings.

Notes

• Queried current metadata with gh: base codex/issue-1932-verifiable-goal @ 63d31004f3e9633d11683cf13e2573f9fb8a2d39, head codex/issue-1932-pdd-denominator @ 6bc7d7578461c234bfdd3a185d0d010cf634e445.
• Reviewed the full diff against the actual base branch, not main.
• Checked the surrounding sync-core manifest/verification/reporting code and the rollout tests. In the protected head/head state, build_unit_manifest reports 466 managed units, 466 expected-managed units, 0 invalid reasons, and 0 unaccounted tracked paths. This does not approve any broader global-sync success claim beyond this denominator/ownership bootstrap scope.

[gltanaka]

Codex xhigh adversarial re-review — PR #1992 @ 0b8547e

Verdict: DON'T MERGE
Findings: 1 total (1 P1, 0 P2)

P1 (blocking)

• [P1] PR head fails the repository pylint gate — tests/test_sync_core_pdd_rollout_policy.py:9
  The added test file is not lint-clean on this PR tip. A focused probe against the exact head file with pylint --from-stdin tests/test_sync_core_pdd_rollout_policy.py reports W0611: Unused import pytest at line 9 plus C0301: Line too long at lines 27, 64, 74, and 121. This repo's make lint target runs pylint pdd tests, so PR chore(sync): establish protected PDD inventory denominator #1992 cannot be considered merge-ready on its own even though the stacked child later formats this file.
  Suggested fix: Remove the unused pytest import and wrap the long lines in PR chore(sync): establish protected PDD inventory denominator #1992 itself; the cleanup shape already present in PR chore(sync): establish protected PDD verification profiles #1994 can be applied here without changing behavior.

P2 (non-blocking)

• None.

Notes

• Live refs checked immediately before posting: base codex/issue-1932-verifiable-goal @ 9bd278dec20482e4d8be66b2202a6a3a025f2e03, head codex/issue-1932-pdd-denominator @ 0b8547e01a96743bf2422151188c4cdafaf7267f.
• Latest prior xhigh review was clean at 6bc7d7578461c234bfdd3a185d0d010cf634e445; there were no prior findings requiring implementer resolution.
• Rechecked the rollout manifest behavior: post-merge/protected HEAD/HEAD state reports 466 expected-managed units, 466 managed units, 0 invalid reasons, and 0 unaccounted paths. The actual base/head path remains red because this is the bootstrap PR introducing the protected controls; I did not count that as a separate issue within the stated denominator-bootstrap scope.

[gltanaka]

Implementer response to Codex xhigh re-review

Re: #1992 (comment)

P1: PR head fails the repository pylint gate

Status: FIXING
Plan: Remove the unused pytest import and wrap the long lines in tests/test_sync_core_pdd_rollout_policy.py on #1992 itself, then run the repository pylint gate and the targeted rollout test before pushing evidence. No behavior change intended.

[gltanaka]

Implementer evidence after xhigh P1 fix

Review response posted first: #1992 (comment)

Commit pushed

• 1be1f066b test(sync): clean denominator rollout lint

Fix

Removed the unused pytest import and wrapped the long lines in tests/test_sync_core_pdd_rollout_policy.py. No behavior change.

Verification

pytest -q tests/test_sync_core_pdd_rollout_policy.py
# 2 passed, 1 warning

pylint tests/test_sync_core_pdd_rollout_policy.py
# Your code has been rated at 10.00/10

pylint --from-stdin tests/test_sync_core_pdd_rollout_policy.py < tests/test_sync_core_pdd_rollout_policy.py
# Your code has been rated at 10.00/10

git diff --check HEAD~1..HEAD
# passed

I also attempted the repository make lint target. It entered pylint pdd tests, emitted a large set of unrelated pre-existing diagnostics across historical pdd/ and tests/ files, and was interrupted after it continued running for more than ten minutes. The exact re-review failure surface on the added rollout test is now lint-clean at 10.00/10.

Pushed head: 1be1f066bb928bf3b9dac84484622db3aea17cfe. No merge performed.

[gltanaka]

Codex xhigh adversarial re-review round 3 — PR #1992 @ 03e7b19

Verdict: MERGE
Findings: 0 total (0 P1, 0 P2)

MERGE — no findings.

P1 (blocking)

• None.

P2 (non-blocking)

• None.

Prior findings verified

• Prior round-2 P1, "PR head fails the repository pylint gate," is resolved at the current head. Focused probe: git show 03e7b195...:tests/test_sync_core_pdd_rollout_policy.py | pylint --from-stdin tests/test_sync_core_pdd_rollout_policy.py returns 10.00/10. git diff --check b8f05dcd... 03e7b195... is clean.
• The earlier clean xhigh review had no findings to resolve; I rechecked the same denominator/ownership trust boundary against the live head.

Fresh adversarial probes

• Live refs immediately before this review: base codex/issue-1932-verifiable-goal @ b8f05dcd93d3c18067facaedde7bbc81216c4c6e; head codex/issue-1932-pdd-denominator @ 03e7b195bd67dce84d85fc8a70027b2913088ca8.
• Full diff inspected against the actual base. Changed files are limited to .pdd/expected-managed.json, .pdd/sync-ownership.json, and tests/test_sync_core_pdd_rollout_policy.py; no pdd/ implementation files change.
• Structured-data probe: expected-managed has 466 rows and 466 unique identities; ownership has 2,354 unique exact-path rules, no glob patterns, all pointing at paths present in the head tree.
• Post-merge protected-state manifest probe, base_ref=head_ref=03e7b195...: 3,010 candidates, 466 managed units, 466 expected-managed units, 656 managed candidate paths, 2,354 human-owned paths, 0 invalid reasons, 0 unaccounted paths.
• Actual bootstrap base/head manifest remains red because the protected base does not yet contain the new ownership policy (invalid=2255, unaccounted=2179). I did not count that as a finding because this PR is explicitly the first protected-control bootstrap tranche and does not claim global-sync success before merge.
• Current PR checks reported by gh pr checks 1992: auto-heal pass / heal pass.

[gltanaka]

Codex xhigh adversarial re-review round 4 — PR #1992 @ ad804fa

Verdict: MERGE
Findings: 0 total (0 P1, 0 P2)

MERGE — no unresolved correctness, security, trust, liveness, or design findings found in this round.

P1 (blocking)

• None.

P2 (non-blocking)

• None.

Prior findings verified

• Prior round-2 P1, "PR head fails the repository pylint gate," remains resolved at the current head. python -m pylint tests/test_sync_core_pdd_rollout_policy.py and python -m pylint --from-stdin tests/test_sync_core_pdd_rollout_policy.py < tests/test_sync_core_pdd_rollout_policy.py both returned 10.00/10.
• The earlier xhigh clean reviews had no unresolved findings. I rechecked the same denominator/ownership trust boundary against the live head.

Fresh adversarial probes

• Live refs immediately before posting: base codex/issue-1932-verifiable-goal @ 87aea93087dc246c9224c2df4fd3b6fd8b102dcf; head codex/issue-1932-pdd-denominator @ ad804fa4dcc4ed9e61715c5f1581f849adb9b1d8; GitHub reports MERGEABLE.
• Full diff inspected against the actual base. Changed files are limited to .pdd/expected-managed.json, .pdd/sync-ownership.json, and tests/test_sync_core_pdd_rollout_policy.py; no pdd/ implementation files change.
• Hygiene: git diff --check 87aea930... ad804fa4... is clean. Targeted pytest at the exact head: python -m pytest -q tests/test_sync_core_pdd_rollout_policy.py -> 2 passed, 1 pre-existing Pandas warning.
• Structured data: expected-managed has 466 rows and 466 unique (prompt_path, language_id) identities. Ownership has 2,354 unique exact-path rules, all HUMAN_OWNED, with roles human-maintained=2349 and excluded-project=5.
• Post-merge protected-state manifest probe with base_ref=head_ref=ad804fa4...: 3,010 candidates, inventory MANAGED=656 / HUMAN_OWNED=2354, 466 managed units, 466 protected expected-managed units, 0 invalid reasons, 0 unaccounted tracked paths, digest 18503967b5e73ab9bddc9ccdeb552bf59001283dd88236213e5b75250ef8db97.
• Actual bootstrap base/head manifest remains red before merge because the protected base does not yet contain the new denominator/ownership policy (invalid=2255, unaccounted=2179). I do not count that as a finding for this first protected-control bootstrap tranche; the PR does not claim pre-merge global-sync success.
• Report-level read-only probe at ad804fa4... confirms no accidental global certification: ok=false, verification_profile_complete=0, trusted_current_evidence=0, trusted_in_sync=0.
• Current PR checks: auto-heal pass, heal pass.

[gltanaka]

Codex xhigh adversarial re-review round 5 — PR #1992 @ fa52095

Verdict: MERGE
Findings: 0 total (0 P1, 0 P2)

MERGE — no unresolved correctness, security, trust-boundary, liveness, or design findings found in this round.

P1 (blocking)

• None.

P2 (non-blocking)

• None.

Prior findings verified

• Prior round-2 P1, "PR head fails the repository pylint gate," remains resolved. python -m pylint tests/test_sync_core_pdd_rollout_policy.py and python -m pylint --from-stdin tests/test_sync_core_pdd_rollout_policy.py < tests/test_sync_core_pdd_rollout_policy.py both returned 10.00/10 at the current head.
• Earlier clean reviews had no unresolved findings. I rechecked the same denominator/ownership trust boundary against the live head.

Fresh adversarial probes

• Live refs immediately before posting: base codex/issue-1932-verifiable-goal @ f1dca1995daf794f5d9889c9d640fc0c392ff698; head codex/issue-1932-pdd-denominator @ fa52095283fb51850816cc345a1e7419008c171d; GitHub reports MERGEABLE.
• Current GitHub check rollup reports all listed checks successful: auto-heal pass, heal pass.
• Full diff inspected against the actual base. Changed files are limited to .pdd/expected-managed.json, .pdd/sync-ownership.json, and tests/test_sync_core_pdd_rollout_policy.py; no pdd/ implementation files change. git diff --check f1dca199... fa520952... is clean.
• Targeted verification at the exact head: python -m pytest -q tests/test_sync_core_pdd_rollout_policy.py -> 2 passed, 1 pre-existing Pandas warning.
• Structured data: expected-managed has 466 rows and 466 unique identities. Ownership has 2,354 unique exact-path rules, all HUMAN_OWNED, roles human-maintained=2349 and excluded-project=5, no glob metacharacters, and 0 missing rule targets in the head tree.
• Post-merge protected-state manifest probe with base_ref=head_ref=fa520952...: 3,010 candidates, inventory MANAGED=656 / HUMAN_OWNED=2354, 466 managed units, 466 protected expected-managed units, 0 invalid reasons, 0 unaccounted tracked paths, digest c7222a1100e63180f2297e64d3bfc1273d496924d576ba2311193761c37a0c2d.
• Actual bootstrap base/head manifest remains red before merge because the protected base does not yet contain this denominator/ownership policy (invalid=2255, unaccounted=2179, expected=631). I do not count that as a finding for this first protected-control bootstrap tranche; the PR does not claim pre-merge global-sync success.
• Public entrypoint probe python -m pdd --no-core-dump certify --base-ref HEAD --head-ref HEAD --output /tmp/pdd-round5-pr1992-certify.json confirms no accidental global certification: ok=false, verification_profile_complete=0, trusted_current_evidence=0, trusted_in_sync=0.

[gltanaka]

Codex xhigh adversarial re-review round 6 — PR #1992 @ 2883eef

Verdict: MERGE
Findings: 0 total (0 P1, 0 P2)

MERGE — no unresolved correctness, security, trust-boundary, liveness, or design findings found in this round.

P1 (blocking)

• None.

P2 (non-blocking)

• None.

Prior findings verified

• Prior round-2 P1, "PR head fails the repository pylint gate," remains resolved at the current head. Focused probes at 2883eefd70e03db4b3ea3cb975311accf3a0261f: python -m pytest -q tests/test_sync_core_pdd_rollout_policy.py -> 2 passed, 1 pre-existing Pandas warning; direct pylint and pylint --from-stdin both returned 10.00/10; git diff --check d25f0fbc... 2883eefd... is clean.
• Earlier clean rounds had no unresolved findings. I rechecked the same protected-denominator and ownership boundary against the live head.

Fresh adversarial probes

• Live refs immediately before posting: base codex/issue-1932-verifiable-goal @ d25f0fbc927ae1c102e54093b6bd33d315a5a37b; head codex/issue-1932-pdd-denominator @ 2883eefd70e03db4b3ea3cb975311accf3a0261f; GitHub reports CLEAN.
• Full diff inspected against the actual base. Changed files are limited to .pdd/expected-managed.json, .pdd/sync-ownership.json, and tests/test_sync_core_pdd_rollout_policy.py; no pdd/ implementation files change.
• Structured data: expected-managed has schema 1, 466 rows, and 466 unique (prompt_path, language_id) identities across 14 languages. Ownership has 2,354 unique exact-path rules, all HUMAN_OWNED, roles human-maintained=2349 and excluded-project=5, no glob metacharacters, no duplicate patterns, and 0 missing rule targets in the head tree.
• Actual bootstrap base/head manifest remains red before merge because the protected base does not yet contain the denominator/ownership policy: 3,010 candidates, 631 managed units, 631 expected-managed units, 2,255 invalid reasons, 2,179 unaccounted tracked paths. I do not count that as a finding for this first protected-control bootstrap tranche; the PR does not claim pre-merge global-sync success.
• Post-merge protected-state manifest probe with base_ref=head_ref=2883eefd...: 3,010 candidates, inventory MANAGED=656 / HUMAN_OWNED=2354, 466 managed units, 466 protected expected-managed units, 0 invalid reasons, 0 unaccounted tracked paths, digest 9b614f331f68388d03b6eaa0e49a4537890c4f65a918bf178296ed64b0cce89c.
• Public entrypoint probe python -m pdd --no-core-dump certify --base-ref HEAD --head-ref HEAD --output /tmp/pdd-round6-pr1992-certify.json confirms no accidental global certification: ok=false, verification_profile_complete=0, trusted_current_evidence=0, trusted_in_sync=0, unaccounted_tracked_paths=0.
• Current CI/check inspection at the exact head: check-run API lists auto-heal success (https://github.com/promptdriven/pdd/runs/86532742376) and heal success (https://github.com/promptdriven/pdd/actions/runs/29148003347/job/86532736456). Legacy commit statuses are empty. The Unit Tests workflow is configured for PRs targeting main, while this stacked PR targets codex/issue-1932-verifiable-goal, so no unit-tests check is present in the current rollup.

[gltanaka]

Stack rebuild evidence — foundation 7fcd7ed

Rebuilt from the PR pre-rewrite merge-base by replaying the exact own-commit range in order. Push used an explicit force-with-lease. Post-push checks: clean worktree, HEAD equals origin head, merge-base equals the expected parent HEAD, scoped name diff inspected, git diff --check passed, and python -m compileall -q pdd passed.

Head: fcfbef8
Parent: 7fcd7ed
Own commits: 6; changed files: 3.
Rollout-policy tests: 1 passed, 1 failed. The failure identifies two new foundation files (descriptor_store.py and supervisor.py) absent from the frozen round-11 ownership inventory.

[gltanaka]

Implementer evidence for xhigh round-7 P1 #1

Fixes the protected-base ownership gap reported at #1994 (comment).

TDD commits

• b68a3f67d test(sync): cover profile candidate denominator boundary
• 47bdee944 fix(sync): protect foundation profile ownership
• 4975fc47a test(sync): stabilize protected base fixture

The red regression built a real protected-base/candidate-head Git boundary and failed with exactly:

unaccounted = {
  pdd/sync_core/descriptor_store.py,
  pdd/sync_core/supervisor.py,
  tests/test_sync_core_descriptor_store.py,
}

The protected-base .pdd/sync-ownership.json now contains exact HUMAN_OWNED / human-maintained / pdd-maintainers rows for all three paths. The candidate commit adds .pdd/verification-profiles.json, and the regression asserts both distinct refs plus protected ownership provenance for every foundation path.

Verification

pytest -q tests/test_sync_core_pdd_rollout_policy.py
3 passed, 1 warning

python -m pylint tests/test_sync_core_pdd_rollout_policy.py
10.00/10

python -m compileall -q pdd tests/test_sync_core_pdd_rollout_policy.py
passed

git diff --check origin/codex/issue-1932-verifiable-goal...HEAD
passed

Full protected-state denominator inventory at exact head:

candidates=3015
managed_units=466
expected_managed=466
inventory={HUMAN_OWNED: 2359, MANAGED: 656}
invalid=0
unaccounted=0
digest=caba191b7a809a3f811aa5c2d92e377c23b893d8ae1053ab90b1ba3198d1a9b5

REST/live-ref verification: PR #1992 is open and mergeable; base is codex/issue-1932-verifiable-goal @ d37fad07818a00b2f02648e15a091e67583cac82; local HEAD, origin head, and live PR head all equal 4975fc47a1bb7916bdfba1c3567ecdb5bc8a88dd. Worktree is clean. No descendant branch was rebased or pushed.