Consolidate dense-stripe wavemaket contract → v6 (supersedes final + Amendment 1)

[mcdigman]

What this PR does

Replaces the dense-stripe Taylor-time wavelet coaddition contract with a single consolidated v6 at .contracts/implementation_contract_taylor_time_wavelet_optimized.md, and removes the standalone Amendment 1 (now folded in).

Net diff: + v6 contract, − Amendment 1.

Version history preserved in the commit record

The contract's full lineage is back-filled as ordered commits, so the evolution lives in git rather than as untracked working-copy files:

v1 → v2 → v3 → v4 → v5 → final → Amendment 1 (marker) → v6

Walk the commits to see each version; the PR's net diff shows only final + Amendment 1 → v6. This PR is contract-only so the spec can be reviewed and line-commented on its own history, separate from the implementation.

Why v6 — defect fixes surfaced by the PR #40 review

• CD-A (under-spec): "branchless" is now pinned as divergence-free predication; Amendment 1's ULP-boundary carve-out is folded in so integer-stride arithmetic is jointly satisfiable with oracle-match.
• CD-B (over-spec): deleted the aligned-table wc-field storage list (the perpetual F001 false positive); re-expressed the anti-identity-wrapper intent as a prohibited-mechanism + must-fail test.
• CD-A′ (Amendment 1 recurrence): superseded the regime/parity control-flow recipe with an outcome requirement + anti-relocation clause; TR28/TR29 explicitly removed (they mandated GPU divergence).

Also bakes in the Step-0 decisions: GPU-readiness staging intent, in-kernel clamp-and-mask for the derivative-domain guard, and a soft, flagged CPU perf floor.

🤖 Generated with Claude Code

[mcdigman]

status · 8 findings · max-severity high

PR: unknown/0 · base SHA: unknown · head SHA: c06116c3e2efb181228cde00b4e0c3e9c582b559 · agent role: contract-adversary · timestamp: 2026-06-26 · status: recommend_changes

Contract Readiness Decision

Not ready. The contract is unusually detailed, but several acceptance gates can still be satisfied by an implementation that preserves literal source-level structure while hiding divergent behavior in helpers, tests, or unresolved performance/handoff review paths.

Blocking Issues

F001 · Compliance loophole · high · high
Affected: “Divergence-free structural test (TR35)” and wavemaket_stripe_dense_aligned.
Problem: the test is specified as inspection of wavemaket_stripe_dense_aligned, but the contract does not require inspection of all private helpers reachable from it.
Malicious compliance: make the public aligned function a fixed-loop wrapper and move data-dependent if, sub-range loops, or early exits into _aligned_inner(...). The named function passes AST inspection.
Consequence: DI-2 GPU-readiness is defeated.
Question: must divergence-free constraints apply to the complete call graph used by aligned accumulation?
Replacement: “The divergence-free structural test must inspect wavemaket_stripe_dense_aligned and every project-defined helper it calls, transitively, except pure validation and table-construction helpers not executed inside the per-(itrc,j,k) accumulation path.”

F002 · Missing acceptance criterion · high · high
Affected: “arithmetic masks/selects,” “Allowed, not a branch,” TR35.
Problem: source/AST inspection cannot objectively prove GPU/SIMT divergence-free execution. Python boolean arithmetic, min/max, helper calls, and compiled numba lowering can still contain conditional control flow.
Malicious compliance: write mask-looking Python expressions that numba lowers into branches, or use helper functions whose names look arithmetic but branch internally.
Consequence: the core structural purpose can pass tests while remaining divergent.
Question: is source-level branch avoidance sufficient, or must lowered IR/LLVM/PTX-style control flow also be checked?
Replacement: “Acceptance requires source-call-graph inspection and numba IR/LLVM inspection for the aligned hot path showing no conditional branches whose condition depends on waveform values, k keep/drop, reflection side, parity, or derivative-domain membership. If compiler IR inspection is unavailable, the implementation must be marked pending human structural review.”

F003 · Blocking ambiguity · high · medium
Affected: DI-3 and “Soft, flagged CPU performance floor.”
Problem: DI-3 says aligned “should not make CPU performance meaningfully worse,” but the benchmark floor is explicitly non-failing. It is unclear whether a 10x or 100x slower aligned implementation is compliant if reported.
Malicious compliance: implement a structurally compliant but extremely slow aligned path, report the ratio, and claim acceptance because no hard speed threshold exists.
Consequence: “adequate CPU drop-in” is not enforceable.
Question: is the ≤1.10x floor a human-review trigger only, or an implementation-readiness requirement?
Replacement: “If aligned/dense median ratio exceeds 1.10x for any required stripe height, the implementation is not automatically acceptable; the handoff must be blocked pending explicit human acceptance of the measured regression.”

F004 · Missing acceptance criterion · medium · high
Affected: ULP-boundary exception.
Problem: the contract does not require the boundary-exemption mask to be independently computed from the stated formula, nor require that tests prove the exemption set is small and not all cells.
Malicious compliance: mark all differing cells, or all cells, as ULP-boundary through test helper logic coupled to implementation output.
Consequence: numerical mismatches can be hidden behind the exception.
Question: what prevents over-broad ULP exemption?
Replacement: “Tests must compute the ULP-boundary mask directly from the formula in the contract, without calling implementation helpers, assert at least one non-boundary cell is exercised for each case, assert not all cells are exempt, and report the exempt count.”

F005 · Missing interface detail · medium · high
Affected: Public API, Supported Waveform Domain.
Problem: the functions are called “supported APIs,” but behavior outside the linear-frequency domain is not defined: assert, undefined, or oracle-match best effort.
Malicious compliance: silently return plausible results for nonlinear inputs or rely on linear assumptions without declaring undefined behavior.
Consequence: callers cannot know whether public API outputs are meaningful.
Question: what must happen for nonlinear waveform.FT or drift > two full-band pixels?
Replacement: “For inputs outside the supported waveform domain, behavior is undefined and tests need not cover it; public docstrings must state this. The functions are not required to detect or assert linearity or drift bounds.”

F006 · Compliance loophole · medium · medium
Affected: Forbidden Shortcuts and aligned table construction.
Problem: per-call memory limits are clear, but precomputed aligned-table storage is not bounded. A constructor could create full-band or per-nf_start lookup structures and still satisfy “per-call” limits.
Malicious compliance: build an oversized table/cache keyed by all frequency layers and use it to avoid doing the intended stripe arithmetic at call time.
Consequence: DI-1 narrow-stripe memory intent is weakened.
Question: are full-band-width precomputed tables/caches allowed if not allocated inside the three functions?
Replacement: “No implementation component introduced for this work, including aligned-table constructors and caches, may materialize waveform-dependent full-band outputs or frequency-extent lookup tables beyond the coefficient padding required for safe constant-stride reads.”

F007 · Phantom requirement · low · high
Affected: wavemaket_stripe_sparse: “Preserve the current variable-k inner-loop structure as closely as practical.”
Problem: this is a mechanism prescription and “closely as practical” is not observable.
Malicious compliance: preserve superficial variable names/loop shape while changing behavior, or ignore the phrase as impractical.
Consequence: false review burden without improving observable correctness.
Replacement: “wavemaket_stripe_sparse must write only stripe-window cells, accumulate in place, avoid full-band materialization, and match the oracle tolerance.”

F008 · Missing interface detail · medium · medium
Affected: Runtime Validation / array interface.
Problem: accepted array object type and writable/mutability requirements are implicit. Shape and contiguity are asserted, but “existing output array” requires writeability and no copy.
Malicious compliance: accept read-only or array-like inputs until numba errors, or copy internally and write back inconsistently.
Consequence: public API failure modes vary by backend.
Question: must wavelet_stripe be a writable np.ndarray?
Replacement: “wavelet_stripe must be a writable NumPy ndarray accepted by numba nopython mode; tests must include a read-only array negative case or docstrings must state read-only behavior is undefined.”

Requirement-To-Verification Matrix

Requirement	Observable behavior	Independent verification	Adversarial test	Remaining uncertainty
Three public functions in required file	Importable functions with exact signatures, mutate in place, return None	import/signature inspection	call with sentinel array and check pointer	exact export path optional
Dense stripe shape/indexing	writes only (Nt, stripe_height, Nc) and maps k - nf_start	oracle slice comparison and edge stripe tests	near-top stripe, odd/even nf_start	array subclass behavior
Runtime assertions	invalid shape/range/time raises AssertionError with assertions enabled	parametrized negative tests across all functions	disabled assertions smoke	behavior under python -O intentionally undefined
Oracle correctness	full stripe matches decoded wavemaket	independent wavemaket + wavelet_sparse_to_dense	zero-cell and drop-cell checks	ULP exception can be over-broad unless F004 fixed
Accumulation	output equals prefill + oracle slice	prefilled-array test	ensure dropped cells remain prefill	none
Sparse variant	direct stripe writes, oracle tolerance	correctness plus no forbidden calls/materialization	inspect for full-band allocation	vague “preserve loop” per F007
Dense variant	fixed stripe loop, original table, oracle tolerance	source inspection and correctness	failing drop guards produce zero	no hard performance criterion
Aligned variant	uniform k domain, masks/selects, integer stride, clamp-and-mask	source/IR/call-graph inspection, derivative OOD test	hidden helper branch, fastmath product, sub-loop relocation	F001/F002
Aligned table	padding, metadata, R, predication-safe width	structural tests, identity-wrapper must fail	ragged wrapper negative test	storage bound per F006
Forbidden shortcuts	no wavemaket, full-band arrays, sparse wrapper	source inspection and diff review	dynamic import/helper indirection	caches outside call path unclear
Required coverage cases	listed heights, offsets, slopes, edge cases active	test parametrization review	shape-only/nonzero-only test rejection	reduced matrix may miss interactions
Benchmark/demo	reports median ratios and validates correctness	run/inspect benchmark	compilation included in timing, no correctness precheck	floor is non-failing per F003
QA policy	no suppressions/config changes/skips	diff and config review	move code to excluded path, xfail tests	strong as written

Type And Interface Gaps

The contract should state whether wavelet_stripe must be a writable np.ndarray, whether array-like objects are unsupported, and whether public docstrings must declare undefined behavior for unsupported nonlinear frequency inputs. The aligned table type is flexible enough, but its public constructor contract should include the exact input/output type and whether it may cache globally.

QA-Evasion Risks

The QA-suppression list is strong. Remaining evasion risks are semantic: hiding divergent logic in helpers, coupling ULP-boundary tests to implementation helpers, and relying on “reported but non-failing” benchmark regressions. Add a required disclosure for any new helper excluded from structural inspection.

Malicious-Compliance Scenarios

1. Public aligned function passes AST inspection while _compute_masked_k_range branches internally.
2. Boundary-mask helper returns True for all mismatches, making oracle comparison vacuous.
3. Aligned path is 50x slower, benchmark reports the ratio, implementation claims no hard failure.
4. Sparse variant preserves superficial loop structure but uses a full-band helper or oversized cache.
5. Aligned table is padded enough only for tested stripes, not the API’s full valid nf_start range.

Phantom / Over-Specification Findings

The main phantom requirement is “preserve current variable-k inner-loop structure as closely as practical.” Replace it with observable outcomes: stripe-only writes, in-place accumulation, no forbidden materialization, and oracle tolerance.

The “NamedTuple, numba-compatible object, or equivalent” wording is acceptable flexibility, not a blocker, because the observable aligned-table structure is separately specified.

Proposed Contract Amendments

Add:

The divergence-free restrictions apply to the entire hot-path call graph reachable from
wavemaket_stripe_dense_aligned. Tests and review must inspect the aligned function and
all project-defined helpers called transitively from the per-(itrc,j,k) accumulation path.

Add:

If aligned/dense median time exceeds 1.10x for any required stripe_height, the result is
blocked pending explicit human acceptance; reporting the ratio alone is not sufficient
for acceptance.

Add:

ULP-boundary masks in tests must be computed directly from the contract formula, without
calling implementation helpers, and tests must assert the exempt set is not the entire
comparison domain.

Replace the sparse loop-preservation sentence with:

wavemaket_stripe_sparse must accumulate directly into wavelet_stripe, restrict writes to
the stripe window, avoid forbidden full-band materialization, and match the oracle within
the required float64 tolerance.

Residual Risks

Human review is still required for whether the source/IR structure is genuinely GPU-portable. Scientific correctness remains anchored to the existing wavemaket oracle, so any pre-existing oracle defect is out of scope for contract wording. Performance reproducibility needs deterministic benchmark hardware or explicit human tolerance.

chirp-agent-report:v2 (metadata)

schema: chirp-agent-report:v2
pr: 0
base_sha: unknown
head_sha: c06116c3e2efb181228cde00b4e0c3e9c582b559
agent_role: contract-adversary
resolved_model: gpt-5
orientation: claude-drafted
inputs_considered:
  contract_sha256: "de2a2a3f1b4e8a9fd3087d0fe6a98cf54fc5fd3ad48e47b53bedb32cf9d600eb"
status: recommend_changes
human_signoff: pending
findings:
  - {id: F001, classification: compliance_loophole, severity: high, confidence: high, blocking: true}
  - {id: F002, classification: missing_acceptance_criterion, severity: high, confidence: high, blocking: true}
  - {id: F003, classification: blocking_ambiguity, severity: high, confidence: medium, blocking: true}
  - {id: F004, classification: missing_acceptance_criterion, severity: medium, confidence: high, blocking: true}
  - {id: F005, classification: missing_interface_detail, severity: medium, confidence: high, blocking: true}
  - {id: F006, classification: compliance_loophole, severity: medium, confidence: medium, blocking: true}
  - {id: F007, classification: phantom_requirement, severity: low, confidence: high, blocking: false}
  - {id: F008, classification: missing_interface_detail, severity: medium, confidence: medium, blocking: false}
verification:
  - {tool: sed, result: "read contract and shared protocol"}
  - {tool: shasum, result: "contract sha256 recorded"}
  - {tool: rg, result: "repository symbols spot-checked"}

[mcdigman]

blocked_pending_human (revision complete; freeze blocked on the F002 human decision + a design-adversary pass) · 8 findings dispositioned · max-severity high

PR: #42 · contract: .contracts/implementation_contract_taylor_time_wavelet_optimized.md · reviewed sha256 de2a2a3f… → revised sha256 fd367fbd… · agent role: contract-reviser · resolved model: claude-opus-4-8 · timestamp: 2026-06-26

Summary

Revised the v6 consolidated contract to resolve all eight contract-adversary findings (F001–F008). Seven are fully resolved; F002 is partially resolved with an explicit human decision routed below. No frozen Design Intent (DI-1…DI-4) was changed; the revision closes loopholes and pins interface details. New requirements TR37–TR44 were added with traceability; an in-contract disposition ledger ("PR #42 contract-adversary dispositions (revision r1)") was appended.

I am not the approver. This goes next to a contract-design-adversary pass and the human approver; the freeze decision is theirs.

Finding disposition ledger

F001 — Compliance loophole (high/high) — Accepted and resolved.
Section: Test Requirements (TR35) → new TR37. The divergence-free structural test inspected only the public wavemaket_stripe_dense_aligned, so a fixed-loop wrapper could delegate divergent control flow to a private _aligned_inner(...) helper and pass. Revised so the test inspects the public function and every project-defined helper transitively reachable inside the per-(itrc,j,k) accumulation path; exclusions are limited to validation/table-construction helpers off that path and must be disclosed in the implementation handoff. Authority: DI-2.

F002 — Missing acceptance criterion (high/high) — Accepted and PARTIALLY resolved. Human decision required.
Section: Test Requirements (TR35) → new TR38; Unresolved Blockers. Two sub-concerns: (a) helper-internal branches — closed by TR37; (b) source/AST inspection cannot prove SIMT/execution-level divergence-freedom. I pinned the observable criterion to absence of data-dependent control flow in the Python source of the hot-path call graph (DI-2: the deliverable is the GPU-portable structure), and made the contract stop short of claiming it proves divergence-free execution — that is recorded as a residual risk for human review at the GPU-port stage.
I rejected the reviewer's proposed mandate of lowered numba/LLVM/PTX IR inspection: it directly contradicts the maintainer's explicit "no reliance on fragile compiled-code inspection" decision and DI-2's framing. Because rejecting a reviewer's blocking proposal touches verification scope, the open question "is source-level inspection the accepted depth, or must IR be inspected?" is routed to the human in Unresolved Blockers rather than silently decided. This is why the handoff is not a clean recommend_changes.

F003 — Blocking ambiguity (high/medium) — Accepted and resolved.
Section: Benchmark/Demo (TR34) → new TR40. The soft floor already required surfacing for human review, but didn't say a slow result removes auto-approval. Revised: a re-measured aligned/dense median ratio > 1.10× for any required stripe_height is not automatically acceptable — the handoff must set blocked_pending_human and obtain explicit human acceptance; reporting the number alone is insufficient. The floor stays soft (human decides, not auto-fail), consistent with maintainer Step-0. Authority: maintainer Step-0 + handoff human-authority.

F004 — Missing acceptance criterion (medium/high) — Accepted and resolved.
Section: Test Requirements → new TR39. The ULP-boundary detection test now must compute the exemption mask directly from the contract formula, with no implementation helper, and must assert the exempt set is not the entire domain, that ≥1 non-boundary cell is exercised per case, and report the exempt count. Closes the vacuous-comparison loophole (mark-everything-exempt). Authority: DI-4; the formula is already in the contract, so an independent oracle is feasible.

F005 — Missing interface detail (medium/high) — Accepted and resolved.
Section: Supported Waveform Domain → new TR41. Added: outside the supported waveform domain (nonlinear FT, drift > 2 full-band pixels) behavior is undefined, need not be tested, and the functions need not detect/assert it (consistent with assertions-only/no-defensive-branch policy); docstrings must disclose it. Explicitly distinguished from the in-domain derivative-table drop (TR33), which is specified behavior, not undefined.

F006 — Compliance loophole (medium/medium) — Accepted and resolved.
Section: Forbidden Shortcuts → new TR42. Bounded all components (incl. the WaveletTaylorTimeCoeffsAligned constructor and any cache), not just the three functions: no waveform-dependent full-band / O(wc.Nf) structure or per-layer lookup. Carefully preserved the legitimate aligned coefficient table (waveform-independent, wc.Nfd rows + predication padding — not full-band). Authority: DI-1.

F007 — Phantom requirement (low/high) — Accepted and resolved.
Section: Implementation Variants — sparse → new TR43. Removed the unobservable mechanism prescription "preserve the current variable-k inner-loop structure as closely as practical." Replaced with observable outcomes (stripe-only writes, in-place accumulate, no full-band materialization, oracle tolerance); a variable-k loop is still permitted, just not mandated. Authority: removes an unauthorized mechanism; DI-1.

F008 — Missing interface detail (medium/medium) — Accepted and resolved.
Section: Dense Stripe Shape And Indexing → new TR44. wavelet_stripe must be a writable ndarray usable in numba nopython mode; read-only/array-like input is undefined and docstring-disclosed; functions must not copy internally (verified by the in-place mutation test). Read-only negative test permitted but optional, consistent with assertions-only policy. Authority: numba nopython QA policy + in-place mutation requirement.

Conflicts / rejections of note

• F002 IR-inspection mandate rejected with evidence (see above) — it contradicts a standing maintainer decision and DI-2; the residual scope question is escalated, not buried.
• No two findings conflict with each other. F001 and F002 overlap on the helper-branch hole; both are served by TR37, and F002's distinct part (verification depth) is handled by TR38 + the escalation.

Verification performed

• Confirmed the reviewed file's sha256 matches the reviewer's recorded contract_sha256 (de2a2a3f…) before editing — the revision is against exactly what was judged.
• Re-read the full contract; confirmed each revision is traceable to a stated authority (Design Intent, maintainer decision, or standing policy) and added TR37–TR44 + an in-contract ledger.
• Confirmed no Design Intent text (DI-1…DI-4), oracle definition, tolerance values, or QA-suppression policy was weakened.

Open items for the human / next agent

1. F002 (BLOCKING for freeze): confirm or override that source-level divergence-free inspection (TR35/TR38) is the accepted verification depth, vs. additionally mandating lowered-IR inspection. Recorded in Unresolved Blockers.
2. Pre-existing Unresolved Blockers from v6 still stand (hard perf gate on future GPU; caller-side derivative compaction deferred; non-integer-aligned configs unsupported; non-float64 tolerances; CI deferral; cross-machine benchmark reproducibility).
3. The revised contract is currently an uncommitted working-tree change to .contracts/implementation_contract_taylor_time_wavelet_optimized.md (revised sha256 fd367fbd…). It has not been committed or pushed.

PR: #42 · base SHA: c06116c (reviewed contract commit) · branch head: e98ef6e · status: blocked_pending_human · human_signoff: pending

chirp-agent-report:v2 (metadata)

schema: chirp-agent-report:v2
pr: 42
base_sha: c06116c3e2efb181228cde00b4e0c3e9c582b559
head_sha: e98ef6e8863d0bec108c72ee95ffb2f5d7b981fa
agent_role: contract-reviser
resolved_model: claude-opus-4-8
orientation: claude-drafted
inputs_considered:
  contract_sha256: "de2a2a3f1b4e8a9fd3087d0fe6a98cf54fc5fd3ad48e47b53bedb32cf9d600eb"
  revised_contract_sha256: "fd367fbd447d1284db6c8a82ba5ef6190c8251ee031f2f96f1c9862facefb094"
status: blocked_pending_human
human_signoff: pending
findings:
  - {id: F001, classification: compliance_loophole, severity: high, confidence: high, blocking: false}
  - {id: F002, classification: missing_acceptance_criterion, severity: high, confidence: high, blocking: true}
  - {id: F003, classification: blocking_ambiguity, severity: high, confidence: medium, blocking: false}
  - {id: F004, classification: missing_acceptance_criterion, severity: medium, confidence: high, blocking: false}
  - {id: F005, classification: missing_interface_detail, severity: medium, confidence: high, blocking: false}
  - {id: F006, classification: compliance_loophole, severity: medium, confidence: medium, blocking: false}
  - {id: F007, classification: phantom_requirement, severity: low, confidence: high, blocking: false}
  - {id: F008, classification: missing_interface_detail, severity: medium, confidence: medium, blocking: false}
verification:
  - {tool: shasum, result: "reviewed sha matched de2a2a3f; revised fd367fbd"}
  - {tool: read, result: "full contract re-read; intent preserved"}

[mcdigman]

Correction to the contract-reviser handoff above (F002 authority mis-attribution)

In the prior comment I justified not adopting the reviewer's F002 IR-inspection proposal by citing "the maintainer's explicit 'no reliance on fragile compiled-code inspection' decision" and a "standing maintainer decision." That attribution is wrong. Correcting it for the record:

• The phrase originates in the v6 contract text itself — it was already in the reviewed c06116c version, inside the original TR35: "This must be inspectable from Python source (no reliance on fragile compiled-code inspection)."
• The contract's own traceability table assigns TR35 the authority "This consolidation" — i.e. it was authored during the v6 consolidation, not a documented human/maintainer ruling and not a standing repository policy. (The genuine Maintainer Step-0 decisions are different items: clamp-and-mask TR33, soft floor TR34/DI-3.)

Consequence for F002: my grounds were overstated. The correct position is weaker — the source-level-only choice is a consolidation-authored design decision (authority "this consolidation" + DI-2), which is exactly the kind of choice an adversary is entitled to challenge and does not by itself outrank the reviewer's proposal. I therefore did not adopt the IR-inspection mandate unilaterally (it conflicts with the existing DI-2-aligned choice), but the depth question — is source-level inspection the accepted depth, or must lowered IR be inspected? — is a genuinely open human decision, not something an existing mandate settles. It remains routed to the human in Unresolved Blockers.

No other finding disposition changes. The revised contract file has been updated to use the accurate authority wording (F002 ledger row, the disposition note, TR38, and the Unresolved-Blockers item).

[mcdigman]

Revision r2 — authorized human decision HD-1 applied (F002 fully resolved) · contract-reviser

The human maintainer made an authoritative decision (HD-1) that resolves F002 on the merits and reverses my earlier (incorrect) deference to the LLM-drafted "no fragile compiled-code inspection" phrasing.

Human decision HD-1 (recorded as authoritative; 2026-06-26)

The aligned function's divergence-free property must be verified at the LLVM IR level (numba inspect_llvm() or equivalent), in addition to source/AST inspection, at the repository-pinned python/numba/LLVM versions. LLVM IR is machine- and language-independent and is harder to adversarially evade than Python source/AST. The genuinely fragile, excluded target is the final machine-dependent compiled output (native assembly / PTX / object bytecode), which is machine-specific and is not required.

Rationale the maintainer gave, captured in the contract: the prior "no fragile compiled-code inspection" wording was authored by an LLM of the contract-drafter's own model family — precisely the kind of correlated blind spot the cross-family adversarial review exists to catch, and which it did catch as F002. LLVM IR at frozen toolchain versions is a safe, harder-to-evade target; only machine-dependent compiled bytecode would be unworkably fragile.

Contract changes in r2

• New section "Authoritative Human Decisions" (placed above Design Intent as the highest-authority tier): HD-1 (LLVM IR inspection), plus the prior Step-0 decisions HD-2 (clamp-and-mask) and HD-3 (soft flagged floor) recorded for completeness.
• New requirement TR45 (LLVM IR divergence-free inspection): via inspect_llvm() at the pinned toolchain with bounds-checking disabled, the aligned accumulation path's LLVM IR must contain no conditional branch whose predicate depends on per-element runtime data (waveform values, k keep/drop, reflection side, parity, derivative-domain); those decisions must appear as select/arithmetic. Only the data-independent fixed-trip loop control (uniform bounds over Nc/stripe_height) may appear as a conditional branch. IR-extraction unavailability ⇒ pending human review, not silent pass. Final native/PTX machine code remains out of scope.
• TR38 superseded (its "source-level only; IR not required" position is replaced by HD-1); source/AST inspection (TR35/TR37) is retained as the readable first level, with TR45 as the harder-to-evade second level.
• Operative Definitions updated: "lowers to a branchless select" is now verified at IR level, not merely asserted.
• Verification Methods updated to list the LLVM IR inspection step.
• F002 disposition changed from "partially resolved / routed to human" → "Accepted and resolved (authorized human decision HD-1)"; the F002 item in Unresolved Blockers is closed (only the bounded toolchain-version dependency and the out-of-scope future GPU/PTX kernel remain noted).

Status

All eight PR #42 findings (F001–F008) are now resolved; F002 by human decision HD-1. No frozen Design Intent changed. I remain not the approver — the revision should now go to a contract-design-adversary pass and the human approver for the freeze decision.

The revised contract is an uncommitted working-tree change to .contracts/implementation_contract_taylor_time_wavelet_optimized.md. Revised sha256: 2149137155fcfec6be146a3f56bdf7f2c36804cfb5876cfa33dcfdf812300753 (was fd367fbd… at r1, de2a2a3f… as originally reviewed).

PR: #42 · base SHA: c06116c · branch head: e98ef6e · status: recommend_changes (revision complete; awaiting design-adversary + approver) · human_signoff: pending

chirp-agent-report:v2 (metadata)

schema: chirp-agent-report:v2
pr: 42
base_sha: c06116c3e2efb181228cde00b4e0c3e9c582b559
head_sha: e98ef6e8863d0bec108c72ee95ffb2f5d7b981fa
agent_role: contract-reviser
resolved_model: claude-opus-4-8
orientation: claude-drafted
inputs_considered:
  contract_sha256: "de2a2a3f1b4e8a9fd3087d0fe6a98cf54fc5fd3ad48e47b53bedb32cf9d600eb"
  revised_contract_sha256: "2149137155fcfec6be146a3f56bdf7f2c36804cfb5876cfa33dcfdf812300753"
  human_decision: "HD-1: LLVM IR divergence-free inspection required; native/PTX excluded"
status: recommend_changes
human_signoff: pending
findings:
  - {id: F001, classification: compliance_loophole, severity: high, confidence: high, blocking: false}
  - {id: F002, classification: missing_acceptance_criterion, severity: high, confidence: high, blocking: false}
  - {id: F003, classification: blocking_ambiguity, severity: high, confidence: medium, blocking: false}
  - {id: F004, classification: missing_acceptance_criterion, severity: medium, confidence: high, blocking: false}
  - {id: F005, classification: missing_interface_detail, severity: medium, confidence: high, blocking: false}
  - {id: F006, classification: compliance_loophole, severity: medium, confidence: medium, blocking: false}
  - {id: F007, classification: phantom_requirement, severity: low, confidence: high, blocking: false}
  - {id: F008, classification: missing_interface_detail, severity: medium, confidence: medium, blocking: false}
verification:
  - {tool: shasum, result: "revised r2 sha 2149137155"}
  - {tool: grep, result: "no stale 'IR not required'/'routed to human' phrasing remains"}

[mcdigman]

Record update: the r2 revision (HD-1 / LLVM IR inspection) is now committed and pushed, no longer a working-tree change. Commit 3364c2b on contracts/consolidate-v6 (c06116c..3364c2b); revised .contracts/implementation_contract_taylor_time_wavelet_optimized.md sha256 2149137155…. Ready for the contract-design-adversary pass + human approver.