Sporewright substrate audit — 2026-06-04

Self-audit of the sporewright routing substrate (L0–L5 + consumers + docs) run while you were away. 70-agent adversarial sweep → 48 confirmed findings → applied the safe/substantive fixes (each test-guarded), flagged the judgement calls. All pushed.

Verdict

The substrate is fundamentally healthy. The engine (both cores) + consumers were green before and after; every "bug" found was either dormant (no live caller reached it) or a missing regression-guard for currently-correct behaviour. The one actively-firing defect was documentation drift — half the docs still called shipped primitives "unbuilt."

Fixed + pushed (submodule 7caf6a3, parent a3a3d9b5)

Cross-core parity (the decision-equivalence LAW, made airtight):

  • scmp used UTF-16 code-unit order in TS vs UTF-8 byte order in Rust → disagree for astral vs BMP ids. Now a code-point comparator (matches Rust). New shared golden 09_astral_tiebreak. Latent only because all live ids are ASCII — would have de-synced the first non-ASCII id.
  • applyJson was non-atomic in TS (a valid-value/malformed-weight cell landed the value; Rust dropped both) → now all-or-nothing, matching Rust's serde decode.
  • Added the 4 missing shared cross-core goldens the regression net was missing: median, corroborate, infinite-weight (proves an infinite weight is a no-op, not a gate), value-norm.

Safety / robustness:

  • λ overflow ceiling (MAX_LAMBDA = 1e300): a runaway price could hit +∞, which resolve skips — so a maximally-saturated option would have routed as FREE (the inversion of the intended shed). Clamped finite. (Constant is 1e300, not 1e12, so golden 06's ~1.1e16 stays pinned.)
  • write_usage now rejects a non-finite usage (writes nothing) — a budget value must not leak into the gate role.
  • Budget lost its derived Default (would have zero-inited step → 1e-6 vs 0.1, a 100,000× reaction-rate divergence from TS). available() is now a true read (was mutating the bucket). normalize_value falls back to identity on overflow instead of leaking NaN. New BadValueKind WriteError distinguishes a payload-kind mismatch from an unknown tier.

Orchestrator (the real forward risk):

  • OOM prune. route() wrote per-job priv:* gate cells to the long-lived tensor and never removed them → every distinct job_id leaked cells forever → OOM on the 256MB box (the server's whole purpose at volume). Added Tensor::clear_level_inst and prune the job slice after resolve. Also subsumes the stale-trust-gate re-route bug. Test pins bounded growth.
  • Retryability now decided on a structural Protest.class (threw vs returned-unavailable), not a brittle substring match on the human-readable detail.

Docs (12 corrections — the firing issue): the budget/price layer, reduce_sum, corroborate, the token-bucket, and the clock-free cell all SHIPPED — the docs called them aspirational/unbuilt. ROUTING-MODEL.md §6 + Story 1/8, MODEL.md §1/§6/§11, CONTRIBUTING (the shared golden corpus, not per-core units, is the cross-core guard) all corrected to the shipped reality.

Regression state

All 5 suites green, above the prior floor (counts up, nothing dropped): rust core 41 (+5) + 8 vector guards · TS sporewright 71 (+11) · TS router 102 · sporewright-server 8 (+1) · jobcache/ingest 83 (+2). Pushed submodule-first.

Left for YOUR decision (deliberately not touched)

  1. "Dead code" that is actually intentional seams — KeyStore (the host key/config seam CV is meant to implement), isTransientError (a documented "kept dead" reference), cascadeConfig (public thin-config entry point), seed_fleet (test shim). I won't delete designed extension points on my own judgement. Decide per item if you want them gone.
  2. Budget + normalize are built but wired into NO live consumer. This is expected — they're substrate primitives; driving them needs the orchestrator slow-tick loop, which is the M2 / cutover (#67) step you're holding. Not a regression. This is the single biggest "vision gap": the Lagrange machine exists and is proven by tests, but nothing in production drives it yet.
  3. reduce_sum double-counts if from_level == to_level on a reused feeder tensor. Harmless today (all live callers use distinct levels + a fresh per-window feeder). Minor; could add a guard.
  4. instantiate error paths have no cross-core golden (the config-vector harness is happy-path only). Lower priority.

#67 cutover files (crates/jobcache-device/Dockerfile, jobcache/ingest/deploy/kubernetes/deployment.yaml) left dirty/untouched — they belong to the held cutover.

kind: journal nodes:

  • sporewright-audit-2026-06-04 summary: "Working record of the Sporewright implementation audit on 2026-06-04." links: event:
    • sporewright-audit-event-2026-06-04 implementation:
    • sporewright-server
Source: wiki/content/working-memory/SPOREWRIGHT-AUDIT-2026-06-04.md