Research: Contract C version compatibility and downgrade RC0

.github/workflows/contract-c-version-compat-rc0.yml

@@ -0,0 +1,94 @@
+name: Contract C Version Compatibility RC0
+
+on:
+  push:
+    branches:
+      - research/contract-c-version-compat-rc0-20260910
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  compatibility-pressure:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout research branch
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify exact predecessor and research-only mutation surface
+        shell: bash
+        run: |
+          set -euo pipefail
+          git merge-base --is-ancestor ad1ffbd7906a7cf34cce5afa906a5797cd4a14ff HEAD
+          test "$(git hash-object validators/contract_c.py)" = "9c75ccfbf2223578a8d1a7bf0c39673b394fbea4"
+          test "$(git hash-object schema/contract-c/1.0.0/schema.json)" = "b0369de9b5c156322d6787261bbc7658a3b33781"
+          git diff --quiet ad1ffbd7906a7cf34cce5afa906a5797cd4a14ff -- research/contract_c_non_deciding_shadow_rc0
+          changed="$(git diff --name-only ad1ffbd7906a7cf34cce5afa906a5797cd4a14ff...HEAD)"
+          printf '%s\n' "$changed"
+          if printf '%s\n' "$changed" | grep -Ev '^(research/contract_c_version_compat_rc0/|\.github/workflows/contract-c-version-compat-rc0\.yml$)' | grep -q .; then
+            echo 'mutation escaped preregistered version-compatibility research surface' >&2
+            exit 1
+          fi
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install exact repository dependencies
+        run: python -m pip install -e '.[dev]'
+
+      - name: Compile compatibility apparatus
+        run: python -m compileall -q research/contract_c_version_compat_rc0
+
+      - name: Execute preregistered downgrade and authority-selection pressure test
+        run: |
+          python -m research.contract_c_version_compat_rc0.evaluate \
+            --repo-root . \
+            --out build/contract-c-version-compat-rc0
+
+      - name: Verify terminal compatibility result
+        shell: bash
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+          data = json.loads(Path('build/contract-c-version-compat-rc0/EVALUATION.json').read_text())
+          assert data['research_disposition'] == 'SUPPORTED_PARALLEL_VERSIONING_AND_BREAKING_CHANGE_SIGNAL'
+          obs = data['observed_compatibility']
+          assert obs['released_1_0_accepts_released_1_0'] is True
+          assert obs['released_1_0_accepts_successor'] is False
+          assert obs['successor_accepts_successor'] is True
+          assert obs['existing_strict_1_0_consumer_breaks_on_successor'] is True
+          assert obs['safe_migration_pattern'] == 'parallel_exact_version_authority_no_downgrade'
+          assert data['semver_evidence']['project_governance_signal_if_later_promoted'] == 'MAJOR'
+          assert data['semver_evidence']['official_version_assigned'] is False
+          assert data['observed_compatibility']['validator_valid_semantic_laundering_downgrades']
+          assert data['interpretation']['translation_adapter_authorized'] is False
+          assert data['interpretation']['production_promotion_authorized'] is False
+          print(json.dumps({
+              'research_disposition': data['research_disposition'],
+              'validator_valid_semantic_laundering_downgrades': data['observed_compatibility']['validator_valid_semantic_laundering_downgrades'],
+              'semver_signal': data['semver_evidence']['project_governance_signal_if_later_promoted'],
+          }, sort_keys=True))
+          PY
+
+      - name: Re-run released Contract C regression
+        run: pytest -q tests/test_contract_c_v1.py tests/test_verify_contract_integrity.py
+
+      - name: Package compatibility evidence
+        shell: bash
+        run: |
+          set -euo pipefail
+          cp research/contract_c_version_compat_rc0/PREREGISTRATION.md build/contract-c-version-compat-rc0/
+          tar -czf contract-c-version-compat-rc0-${GITHUB_RUN_ID}.tar.gz -C build contract-c-version-compat-rc0
+
+      - name: Upload compatibility evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: contract-c-version-compat-rc0-${{ github.run_id }}
+          path: contract-c-version-compat-rc0-${{ github.run_id }}.tar.gz
+          if-no-files-found: error

research/contract_c_version_compat_rc0/PREREGISTRATION.md

@@ -0,0 +1,96 @@
+# Contract C version compatibility RC0
+
+**Classification:** Draft Research Infrastructure / compatibility experiment. No canonical version assignment, no released Contract C mutation, no merge/release/tag/promotion, no Decision Engine production change, no Contract E or Authorization.
+
+## Exact base
+
+- predecessor Apparatus PR #85 receipt/head: `ad1ffbd7906a7cf34cce5afa906a5797cd4a14ff`
+- underlying released Apparatus base: `c3563cff66d2c85dcbf575c693056e2d8e4563d4`
+- released Contract C release commit: `5fe55f9ed5d0ee9f026ca1b077e9d70ce0487ea1`
+- released Contract C schema blob: `b0369de9b5c156322d6787261bbc7658a3b33781`
+- released Contract C validator blob: `9c75ccfbf2223578a8d1a7bf0c39673b394fbea4`
+- frozen successor research sentinel: `research-non-deciding-rc0`
+- frozen successor handoff SHA-256: `sha256:325962ebcdbf6af836bb6193a451524ccd40b4d10f2394ff9f703fbfce1ec1e3`
+- frozen successor handoff result-set: `result-set:4483272c4f6fbd9cb2362be7e3174bbd00aff3cf761d6c374897f3478818c9f0`
+- Decision Engine cross-repo consumer decisive run: `34530232915`
+- Decision Engine Draft Research PR: #67
+
+## Question
+
+What compatibility architecture is justified if the `non_deciding` contribution representation were ever promoted as a Contract C successor?
+
+Do not assign a SemVer number first. Determine what legitimate existing 1.0 consumers observe and whether any downgrade preserves semantics.
+
+## Competing architectures
+
+### A. Translation / downgrade compatibility
+
+A successor producer or adapter rewrites a successor artifact into released 1.0 syntax by one of:
+
+- `non_deciding -> support`;
+- `non_deciding -> counterevidence`;
+- dropping non-deciding contributions and repairing the basis/residual structure.
+
+This architecture is falsified if a translated artifact can pass released 1.0 validation while changing or erasing the successor's neutral evidence meaning, provenance, or causal multiplicity.
+
+### B. Parallel exact-version authority
+
+A consumer supports multiple contract profiles without translating semantic state. An independently supplied expected contract profile selects a pinned validator/authority. The artifact's own `contract_c_version` must match that external profile before semantic validation.
+
+This architecture is supported only if:
+
+- exact released 1.0 bytes validate unchanged under the released profile;
+- exact successor bytes validate unchanged under the successor research profile;
+- cross-profile substitution fails before semantic consumption;
+- no successor evidence is relabelled or dropped;
+- whole-object identity remains profile-specific.
+
+## Preregistered observations
+
+O1. Released 1.0 strict validator accepts the canonical released 1.0 fixture unchanged.
+
+O2. Released 1.0 strict validator rejects the exact successor handoff unchanged.
+
+O3. Successor shadow validator accepts the exact successor handoff unchanged.
+
+O4. Parallel exact-version dispatch accepts each artifact only under its externally expected profile and rejects profile/artifact version mismatch.
+
+## Downgrade falsifiers
+
+D1. Map every `non_deciding` contribution to `support`, change wire version to `1.0.0`, recompute immutable internal identity, and test released 1.0 validation.
+
+D2. Repeat with `counterevidence`.
+
+D3. Remove all non-deciding contributions, clear their basis, use an otherwise legal non-deciding causal form, change wire version to `1.0.0`, recompute identity, and test released validation.
+
+For any downgrade that validates, compare exact evidence references, contribution channels, basis membership and causal multiplicity against the frozen successor source. A validator-valid but semantically changed downgrade is evidence **against** translation compatibility, not evidence for it.
+
+D4. A safe downgrade function must refuse a successor object containing `non_deciding`; it must not guess a polarized channel or silently erase the evidence.
+
+## Authority-selection falsifiers
+
+A1. Successor artifact presented under the externally expected released-1.0 profile must fail even though its self-declared version requests successor semantics.
+
+A2. Released 1.0 artifact presented under the externally expected successor profile must fail rather than be silently upgraded/relabelled.
+
+A3. Caller/artifact metadata must not be able to change the pinned validator identity within a profile.
+
+A4. Rewriting an artifact to another version/profile necessarily changes canonical bytes/result identity/whole-object SHA and must fail against the original immutable digest.
+
+## Version-class decision rule
+
+Record only observed compatibility facts first.
+
+If a legitimate existing strict 1.0 consumer cannot consume the successor artifact and no lossless downgrade exists, record `BREAKING_FOR_EXISTING_STRICT_1_0_CONSUMERS`.
+
+Under the project's post-1.0 release governance, that observation is a **MAJOR-version signal if promotion is later authorized**, not an official version assignment in this research PR.
+
+If an actually lossless path allows old legitimate consumers to preserve the successor meaning, the breaking-change hypothesis is falsified.
+
+## Allowed dispositions
+
+- `SUPPORTED_PARALLEL_VERSIONING_AND_BREAKING_CHANGE_SIGNAL`
+- `SUPPORTED_LOSSLESS_BACKWARD_COMPATIBILITY`
+- `INCONCLUSIVE_VERSION_COMPATIBILITY_APPARATUS_INVALID`
+
+No outcome by itself authorizes a Contract C release.

research/contract_c_version_compat_rc0/RESULT.md

@@ -0,0 +1,89 @@
+# Contract C version compatibility RC0 — terminal research record
+
+**Classification:** Draft Research Infrastructure / compatibility pressure test. This record is evidence only. It does not amend Contract C, assign an official successor version, authorize a migration adapter, merge, release, tag, promote, or authorize production use.
+
+## Exact lineage
+
+- predecessor / qualified non-deciding shadow receipt: `ad1ffbd7906a7cf34cce5afa906a5797cd4a14ff`
+- exact compatibility base branch: `research/contract-c-version-compat-rc0-base-20260910`
+- tested implementation head: `a8ee05e758a7be97c567cdc95ff70db75814946d`
+- released Contract C validator blob held fixed: `9c75ccfbf2223578a8d1a7bf0c39673b394fbea4`
+- released Contract C 1.0 schema blob held fixed: `b0369de9b5c156322d6787261bbc7658a3b33781`
+- predecessor shadow research directory held byte-stable during the test
+
+## Question
+
+Can the qualified `non_deciding` representation be introduced through a safe compatibility/migration strategy without allowing semantic laundering into Contract C 1.0, and what version-class signal follows from observed consumer behavior under project governance?
+
+## Decisive execution
+
+- workflow run: `34530811489`
+- conclusion: `success`
+- research disposition: `SUPPORTED_PARALLEL_VERSIONING_AND_BREAKING_CHANGE_SIGNAL`
+- artifact: `10173394540`
+- artifact digest: `sha256:0080176223202f7c55bdedb602692429946518d04fa8c7fb52d6fbd62bc5f6eb`
+- tested head: `a8ee05e758a7be97c567cdc95ff70db75814946d`
+
+Released Contract C regression remained green: `17 passed, 8 skipped`.
+
+## Observed compatibility
+
+The preregistered matrix established:
+
+- released 1.0 validator accepts released 1.0;
+- released 1.0 validator rejects the qualified successor/shadow unchanged;
+- successor/shadow validator accepts the successor/shadow;
+- an existing strict 1.0 consumer therefore breaks on the successor bytes rather than silently accepting widened vocabulary;
+- the supported migration pattern in this cohort is `parallel_exact_version_authority_no_downgrade`.
+
+Validator selection in the tested architecture is controlled by an independently established expected contract profile. The artifact's own version metadata must agree with that profile; it does not select its own authority.
+
+## Downgrade attacks
+
+Three attempted successor -> 1.0 translations produced structurally validator-valid Contract C 1.0 objects while changing the qualified neutral-evidence semantics:
+
+1. `map_non_deciding_to_support`
+2. `map_non_deciding_to_counterevidence`
+3. `drop_non_deciding_and_repair_basis`
+
+These are **validator-valid semantic-laundering downgrades**. Acceptance by the 1.0 validator does not make the translation faithful: the adapter has already altered or erased the original neutral causal provenance before validation.
+
+Therefore a semantic downgrade adapter is not authorized by this experiment.
+
+## Version-class evidence
+
+Under the project release/version governance, version class follows demonstrated compatibility rather than edit size. In this cohort, existing strict 1.0 consumers cannot consume the successor unchanged. The experimental governance signal **if a successor were later promoted** is therefore `MAJOR`.
+
+No official Contract C successor version is assigned by this record. In particular, this record does not itself establish or authorize a `2.0.0` release.
+
+## Bounded inference
+
+The qualified `non_deciding` vocabulary can coexist safely with released 1.0 only when version authorities remain parallel and exact, with no semantic downgrade of successor artifacts into 1.0.
+
+This supports a breaking-change signal for the in-band Contract C successor candidate. It does **not** yet establish that an in-band Contract C successor is the smallest architecture that satisfies the CAL requirement.
+
+## Remaining discriminating alternative
+
+The strongest remaining alternative explanation is that neutral unresolved provenance and causal multiplicity do not need to widen Contract C at all. A separately immutable, Contract-C-bound companion receipt might preserve the additional CAL-attributable state while Contract C 1.0 remains unchanged.
+
+The next bounded experiment should therefore compare the in-band successor against the smallest richer sidecar capable of preserving:
+
+- exact Contract C 1.0 identity;
+- exact Contract-B evidence references;
+- all neutral unresolved causal contributors;
+- causal basis membership and multiplicity, including `independent_sufficient_alternatives`;
+- proposition/result binding;
+- no support/counterevidence reinterpretation;
+- fail-closed behavior on stale, substituted, deleted, duplicated, or reordered authority-relevant state where applicable.
+
+A sidecar that cannot preserve those properties is falsified. A sidecar that can preserve them without changing Contract C 1.0 would falsify the claim that a major Contract C wire revision is presently necessary.
+
+## Not established
+
+- canonical Contract C successor schema or version;
+- production migration strategy;
+- fresh independent reproduction;
+- arbitrary semantic-family sufficiency;
+- root / `all_of` CAL composition;
+- Contract E / operational authorization;
+- promotion or release readiness.

research/contract_c_version_compat_rc0/__init__.py

@@ -0,0 +1 @@
+"""Research-only Contract C version compatibility RC0."""