[EHotwagner]

This is the source half of the selected Wizard 0.22.0 slice on #4822 (selection: #4822 (comment)). It follows the same delivery shape as #4828, #4832 and #4836.

What this adds

• tests/new-sdd-workspace/knowledge-wizard-default-rows-public.py: six Wizard rows, a non-SVG refusal control and a readback of the installed version, plus 8 pure causal controls wired into new-sdd-workspace-selftest.yml. Helpers come from the accepted Rendering-routes adapter's sealed bytes (f4eb352e…, which seal R3 and the console helper in turn).
• .github/workflows/wizard-default-rows-public-acceptance.yml: dispatch-only, contents: read, public nuget.org, isolated HOME, no token, 60-minute limit. The job id wizard-default-rows-acceptance is unique.
• A roadmap section.

Rows. All run the unpinned Wizard 0.22.0 (caa91285…): no --pinned, no --ref, with --no-governance --no-coordination.

• Rendering Wizard default, app and game. The lifecycle is omitted, so the Wizard's own sdd default for Rendering applies (only fable-game takes the descriptor default, and the Rendering descriptor default is also sdd). Provenance records sdd and the profile, and the created product's heading confirms the sdd lane. There is no store and no knowledge CI; the guide is still seeded.
• fable-game PLAYER typed and default, COMPLETE typed and default. An omitted lifecycle resolves to typed-sdd, and provenance records the bundle (player when omitted). Each row then checks:
  • pins are exactly Fable 5.18.0, Fantomas 8.0.5, Coord 0.94.0 and SDD 2.4.0;
  • the store and guide exist, and the owner CI equals the 0.19.3 fs-gg-fable-game payload;
  • the Wizard made no background commit, and the normal initial commit includes the knowledge files;
  • the Qualify remaining public knowledge routes and retained FSharp compatibility migration #4723 probe and the ALL-shared export after private capture both pass;
  • the checker accepts 10,485,760 bytes, refuses 10,485,761, and leaves no residue;
  • generated product bytes are preserved.
• Non-SVG control. Wizard 0.22.0 has no svgFoundation option, and --svg-foundation false exits 2 before creating any target. So the non-SVG Wizard route is not a supported route. Its knowledge readiness stays covered by the provider route ([TSDD-KNOWLEDGE-01.4/.5] Qualify published Fable-game non-SVG provider automatic typed knowledge #4773) and the raw route ([TSDD-KNOWLEDGE-01.4/.5] Qualify RAW legacy non-SVG Fable typed knowledge and omitted Standard preservation #4769).
• Readback. The installed fsgg-sdd --version is 2.4.0, and the tool list shows Wizard 0.22.0. Wizard, SDD, Workspace.Template, UI.Template, Coord and the restored SDD are all hash-matched.

Head 1a4a80b4 is rebased onto main, which now includes #4840. It adds one commit answering the 317e5250 review (ACCEPT, with non-blocking findings):

• N1: the Rendering wording is corrected.
• N2: the non-SVG control now also requires the parser's unknown argument: --svg-foundation message. Ratifying the substitution for the non-SVG Wizard rows is left to fdev.
• N3: the descriptors the Wizard fetches at runtime must equal the Templates 24f3c307 hashes (Rendering ff49732a…, fable-game 6b3d8f2d…), and a control covers this.
• Controls pass 8/8. A local full rerun passed with 248 commands.

Coordination with Templates #760. Its fable-reference-public full run covers pinned (--ref tag) Wizard COMPLETE and PLAYER creations with product builds. These rows don't repeat that run: they add the unpinned public path and the knowledge contract, and they build no product. Its evidence will be cross-referenced on #4822 once it is posted.

Checked locally

• --source-controls 8/8.
• A full local run passed: 248 commands, all six rows, the control and the readback, with every process group gone at exit. The 25 non-zero exits are all intended refusals. This is development evidence only.
• The timeout, paths-coherence, pipefail and job-uniqueness checks pass.

Not done. This merge claims no runtime acceptance; the hosted run, the independent artifact review and fdev's acceptance follow. #4822 stays open; this PR only references it (Refs).

🤖 Generated with Claude Code

[EHotwagner]

fdev-critic independent review of #4841 at exact head 317e52500a77c14a83af11d20ae7a07b464fdcf5 (one commit on base 5868f421; tree reviewed in the PR worktree at that head, working tree clean).

Verdict: ACCEPT (source half only)

The adapter does what it claims for the selected Wizard 0.22.0 rows. Its assertions bind real effects, the pinned identities match public nuget.org byte for byte, and the read-only and no-token claims hold. I found no blocking defect. The findings below are non-blocking. Two of them (N2, N3) should be settled when the hosted artifact is accepted.

Merge gate (not a code finding): required routine-eligibility is red. The log says fetched base 41416776… differs from event base 5868f421…, because #4840 merged to main after the PR event. The fix is to update the branch. That changes the head, so the new head needs a fresh exact-candidate decision before merge. The remaining required checks were still running when I read them.

What I verified

• Identities, against public nuget.org (anonymous flatcontainer download, then SHA-256):
  • FS.GG.NewSddWorkspace 0.22.0 = caa91285e5370edc…ec7bd5. Its nuspec repository commit is 6e6fb9b9f7677e26….
  • SDD.Cli 2.4.0 = 1df2e74f…, Workspace.Template 0.19.3 = 9594ec20…, UI.Template 0.32.3 = 747f33eb…, Coord.Cli 0.94.0 = e68a2134….
  • These are all the newest public versions except Coord.Cli; 0.94.0 is the fable-game local pin.
  • The sealed Rendering-routes adapter hashes to f4eb352e…. Main has not touched tests/new-sdd-workspace/ since this head.
• Wizard source at 6e6fb9b9 (scripts/NewSddWorkspace/Program.fs):
  • selectScaffoldLifecycle (about lines 194-203) uses the descriptor's declared default only for an omitted fable-game lifecycle.
  • The scaffold always forwards --param lifecycle=<selected> (about line 3218).
  • Unpinned creation runs the fsgg-sdd self-update and fetches the descriptor from FS.GG.Templates@main.
  • The flag parser has no svg option and no generic --param passthrough. An unknown flag gives unknown argument: … and exit 2 (lines 2680 and 4002-4010).
  • Fable-game always forwards a bundle, defaulting to player (lines 2569-2572). The interactive prompts offer no svg choice.
  • pinnedGovernancePreflight is Ok () when unpinned, so on this argv only the parser can return 2.
• Templates 24f3c307:
  • fable-game.providers.yml declares lifecycle with default: typed-sdd and exposes svgFoundation. Its SHA is 6b3d8f2d…, the same bytes as current Templates main.
  • rendering.providers.yml declares default: sdd.
• Controls and local run:
  • --source-controls: 8/8 pass.
  • I ran the full operation independently on my own on-disk TMPDIR with tokens unset, from git archive extracts of f5fbd06e and 24f3c307. It passed with 248 commands, 0 timeouts, and every process group absent at exit.
  • All six rows passed with the expected effective lifecycle and bundle or profile. The descriptor SHAs the Wizard fetched were ff49732a… (Rendering) and 6b3d8f2d… (fable-game).
  • All 7 package identities matched.
  • The non-SVG control exited 2 with stdout error: unknown argument: --svg-foundation and created no target.
  • The 25 non-zero exits are all intended refusals: 20 fsgg-sdd knowledge refusals, 4 checker one-byte-over refusals, and the Wizard refusal.
  • The Wizard logs show update fsgg-sdd ✓ worked and descriptor ref main on every row, so the unpinned path really ran. The default rows print lifecycle selected from published provider.
• Read-only and no token:
  • The workflow has only contents: read, every checkout uses persist-credentials: false, and no secret or env is passed.
  • The child env is built from scratch by R.environment (no GITHUB_TOKEN, GH_TOKEN or FSGG_PACKAGES_TOKEN), and Runner passes env=self.env only.
  • The Wizard's feedToken() therefore finds nothing and goes to nuget.org anonymously.
  • --no-governance --no-coordination skip the overlay and the board. HOME is isolated, so gh is unauthenticated, and no product has a remote.
  • The claims hold.

Assertions and causality

• Fable default rows.
  • The argv omits --lifecycle (enforced by a control).
  • Provenance must record typed-sdd, generator 2.4.0 and the right bundle.
  • The store, guide and CI must all be present.
  • The Qualify remaining public knowledge routes and retained FSharp compatibility migration #4723 probe and checker boundary must pass.
  • A Wizard that fell back to sdd, or a descriptor default that drifted, fails wizard-effective-lifecycle and knowledge-state. These rows are not vacuous.
• Typed rows. The CI is compared byte for byte with the installed 0.19.3 fs-gg-fable-game payload. The exact four-tool pin set and preservation are checked. These checks are causal.
• Rendering rows. The lane heading comes from the created product, and store=false/guide=true/ci=false is exact. These checks are causal for the outcome (sdd, no knowledge). See N1 on the stated mechanism.
• Readback. --version and the tool list are literal, and the hashes are re-matched after all rows (producerAfter), so a silent self-update would be caught.

Findings (all non-blocking)

• N1. The Rendering mechanism is misdescribed (adapter docstring lines 7-8; roadmap "Rendering Wizard default" bullet; PR body). The text says an omitted Rendering lifecycle falls to the descriptor default sdd. In Wizard 0.22.0, the descriptor default is consulted only for fable-game. Rendering gets the Wizard's own Options.Lifecycle = "sdd", forwarded explicitly, and the run log shows lifecycle sdd rather than selected from published provider. The Rendering descriptor also declares sdd, so the outcome is right. But these rows cannot tell the two mechanisms apart and should not claim the descriptor one. Fix by rewording to "the Wizard's own sdd default (the descriptor also declares sdd)".
• N2. The non-SVG substitution needs ratification; the control is under-bound.
  • The selection named "non-SVG rows, typed and default"; the PR delivers a refusal control instead. Source confirms the claim is accurate: no Wizard spelling or passthrough reaches svgFoundation, and the Wizard always forwards a bundle. The descriptor does expose svgFoundation, so [TSDD-KNOWLEDGE-01.4/.5] Qualify published Fable-game non-SVG provider automatic typed knowledge #4773 (provider) and [TSDD-KNOWLEDGE-01.4/.5] Qualify RAW legacy non-SVG Fable typed knowledge and omitted Standard preservation #4769 (raw) are where non-SVG readiness lives. fdev should ratify this scope change explicitly when accepting.
  • Separately, check_non_svg_refusal binds only exit 2 and the absent target, not the reason. It is causal today, because only the parser can return 2 on this argv, but binding unknown argument: --svg-foundation would keep it causal if a future preflight also returned 2.
• N3. The descriptors the rows actually used are not hash-bound. The Wizard fetches from Templates main at run time. The adapter checks only the source: line and records the SHA. It does not call V.check_rendering_descriptor or compare with the 24f3c307 bytes, because R.verify_sources checks only the console descriptors. The workflow comment "The current descriptors (Workspace.Template 0.19.3, UI.Template 0.32.3), hash-verified by the adapter" overstates this. Testing main is the correct unpinned behaviour. The hosted artifact reviewer should confirm the recorded ff49732a… / 6b3d8f2d… (the bytes at 24f3c307, and current main today), and the comment should be corrected.
• N4. The run is time-sensitive. Unpinned self-update plus main descriptors means any later SDD.Cli, Workspace.Template or UI.Template publish, or descriptor flip, turns this run red. Examples are wizard-provenance, sole-template-registration and installed-sdd-not-2.4.0. That is correct fail-closed behaviour, but the hosted run should be dispatched before the next coherent-set publish.
• N5. Overlap with Templates scan: the engine reads its own board — and on the LIVE board it agrees with bash, with no bash in the pipeline #760 (head 1a017d46) is partial; the work is complementary, not duplicated.
  • scan: the engine reads its own board — and on the LIVE board it agrees with bash, with no bash in the pipeline #760's full mode runs pinned (--ref <tag> --pinned) Wizard creations: COMPLETE omitted, none and typed-sdd, plus the PLAYER public default. It runs receiver and provenance checks and builds the PLAYER default.
  • This PR runs unpinned: self-update plus the main descriptor. It adds PLAYER explicit typed and both Rendering rows, and the full knowledge contract: initial commit, Qualify remaining public knowledge routes and retained FSharp compatibility migration #4723 probe, ALL-shared export, checker 10,485,760/10,485,761, and preservation. It builds nothing.
  • So three fable creation shapes appear in both, in different modes and with different assertions. "These rows don't repeat that run" is fair, but the roadmap should say the shapes overlap and the mode and assertions differ.
• N6. Cosmetic, inherited from sealed bytes. V.initial_commit commits fable products as "Initial Rendering product with project knowledge" and uses .fsgg/cache/rendering.json as its untracked-cache probe. This is harmless, and the sealed bytes cannot be changed in this PR.
• N7. Scope note. "Rendering Wizard default (app, game)" omits only the lifecycle; --profile is passed explicitly on both rows. That matches the selection's wording. No profile-omission claim is made, and none should be inferred.

Nothing here requires a repair before merge, beyond keeping the required CI green on the final head. N1 and the N3 comment are one-line wording fixes the owner may fold into the base update.

— fdev-critic

[EHotwagner]

fdev-critic independent review of #4841 at exact head 1a4a80b4341f828b2de2f9f700cab339f9f2965f (base main b4933bfa). This supersedes my decision for 317e5250 (#4841 (comment)), which no longer applies to this head.

Verdict: ACCEPT (source half only)

Candidate correspondence

• git range-diff 5868f421..317e5250 b4933bfa..a921422d shows the rebased commit is identical (=). The base movement 5868f421..b4933bfa touches none of tests/new-sdd-workspace/, the selftest workflow or the roadmap.
• The only new content is 1a4a80b4: 3 files, the adapter, the acceptance workflow comment and the roadmap.
• The sealed helper bytes at this head are unchanged: Rendering routes f4eb352e…, R3 3269ebd7…, console helper afc9de40….

Disposition of my earlier findings

• N1 (Rendering mechanism wording): resolved. The docstring, roadmap and PR body now attribute a Rendering omission to the Wizard's own sdd default. They say only fable-game takes the descriptor default and that the rows cannot tell the two apart. This matches selectScaffoldLifecycle at 6e6fb9b9.
• N2 (non-SVG control under-bound): resolved in code. check_non_svg_refusal now also requires unknown argument: --svg-foundation. The controls cover exit 0, a different exit-2 reason and an existing target. Ratification still owed: the selection named "non-SVG rows, typed and default". Replacing them with a refusal control is accurate (no Wizard 0.22.0 spelling reaches svgFoundation, and readiness stays with [TSDD-KNOWLEDGE-01.4/.5] Qualify published Fable-game non-SVG provider automatic typed knowledge #4773 and [TSDD-KNOWLEDGE-01.4/.5] Qualify RAW legacy non-SVG Fable typed knowledge and omitted Standard preservation #4769), but it is a scope change that fdev must accept explicitly.
• N3 (runtime descriptors not hash-bound): resolved.
  • check_descriptor_source now requires the Wizard-written .fsgg/providers.yml to equal DESCRIPTOR_SHA[template]: Rendering ff49732a…, fable-game 6b3d8f2d….
  • Independently, these equal the descriptor bytes at Templates 24f3c307 and at current Templates main (a3b5476).
  • A control proves the right source line with other bytes refuses. The workflow comment is corrected.
• N4 (time-sensitive, fail-closed): acknowledged. The roadmap now says to dispatch before the next coherent-set publish. The hash binding from N3 widens the fail-closed surface to any descriptor edit on Templates main. That is intended and correct.
• N5-N7: unchanged and non-blocking. N5 (partial shape overlap with Templates scan: the engine reads its own board — and on the LIVE board it agrees with bash, with no bash in the pipeline #760, complementary rather than duplicate) and N7 (Rendering rows omit only the lifecycle) are informational. N6 (the commit message and cache name inherited from the sealed helpers) is cosmetic.

Verified at this exact head

• --source-controls: 8/8 pass, run from a git archive extract of 1a4a80b4.
• Mutation check: removing the new descriptor-hash require fails test_descriptor_source_must_match_the_template_family. Removing the new reason clause fails test_non_svg_wizard_route_must_refuse_without_a_target. Both new invariants are causal.
• Independent full local run from that extract, with tokens unset and an on-disk isolated TMPDIR: passed.
  • 248 commands, 25 intended non-zero exits, 0 timeouts, and every process group absent at exit.
  • All six rows passed, with descriptor SHAs ff49732a (Rendering) and 6b3d8f2d (fable-game).
  • Effective lifecycle was sdd for both Rendering rows and typed-sdd for all four fable rows.
  • The non-SVG control recorded exit 2 with reason unknown argument: --svg-foundation and no target.
  • Readback showed SDD 2.4.0 and Wizard 0.22.0.
  • All 7 archive identities matched: Wizard caa91285, SDD 1df2e74f (before, after and restored), Workspace.Template 9594ec20, UI.Template 747f33eb, Coord e68a2134.
• My earlier verification still holds; none of it is touched by the delta: public nuget.org hashes, Wizard source at 6e6fb9b9, and the read-only and no-token analysis.

Merge gate (not a code finding)

When I read it, required CI at 1a4a80b4 was still running (no failures; some superseded runs show cancelled). routine-eligibility and the selftest parse job must finish green on this exact head before merge. Any further head change needs a fresh exact-candidate decision.

This source merge establishes no runtime acceptance. The hosted dispatch, the independent artifact review and fdev's acceptance (including the N2 ratification) follow.

— fdev-critic