v0.27.0 — the builder stops guessing and starts looking

[mmeyerlein]

The builder was a prefetch plus one model call. It is now a bounded, typed tool loop — with four eyes, one refine ear and no hand.

builder@1.1.0: the intake looks before it drafts. No cell in the template draws an edge onto /colony/mutations, and that is still a property of the files rather than a sentence in this text. What changed is that the composer can now ask before it writes:

• A typed tool vocabulary of four. librarian_search and catalogue_lookup read the builder's own corpus in-colony, over ordinary routing. graph_read and registry_read go to /colony/graph and /colony/registry. Each of the four answers a refusal this system already produces: a missing contract, an island, a template chosen by its name rather than by what it does.
• Six cells inside the hive. dispatch fans out by tool name; weave is the round table that fans in, rebuilds the thread and fires the next round; transcript is the store underneath it; lib and eyes translate the two families into tool results; unknown answers an unknown tool name with an ordinary tool_result instead of a dead letter.
• transcript: one row per turn of one build, with role one of five — user, assistant and tool are the loop itself, receipt is a refusal handed back by the submitter, and manifest is the binding row written when a digest is minted. fired is the compare-and-set guard that grants exactly one weave path permission to cross the re-entry edge.
• A repair lane. The contract gains the accepts route in_receipt: a refusal the submitter took at the door travels back to the composer that drew the draft, and naming the error_code is the whole of the lane. The repair budget is separate from the round budget and is derived rather than carried — it counts the receipt rows of the build's own slate, so nothing had to be added to the freshly released submit contract to make it work.
• Four limits, each in its own place: the round budget on the re-entry edge condition, the repair budget on the repair edge, the call budget in the dispatcher, and a round idle window for a fan-in whose result never arrives. The substrate's TTL is deliberately taken out of play on the re-entry edge, which is why these four have to carry.

Contract movement is accepts-only. emits and ports: [] are unchanged; a caller can do something it was never promised, which is a second digit.

An opaque tag echoes back from the graph and registry reads. GET /colony/graph and GET /colony/registry — and the same queries at the message door — accept a tag and return it unchanged. It filters nothing, and is therefore truncated to 64 characters rather than refused, the same treatment the /colony/ledger tag already had. The reason it was needed: a reply from /colony begins a fresh trace, so without an echoed token a caller with several reads in flight cannot tell the answers apart.

/colony/registry is drawable by a mutation. It becomes the third such read beside /colony/graph and /colony/ledger. This was not a convenience: an edge from inside meclaw-os onto /colony/registry was refused as scope_out_of_bounds, which made meclaw-os uninstantiable altogether. The line itself is unmoved — /colony/mutations, /colony/trace and /colony/dead_letters stay outside. The registry answer is colony bookkeeping over a colony's own cells, never message content, and strictly less than /colony/graph already hands out.

The scenario suite drives the loop without a model. The stub is scriptable: a per-case list of answers, the tool_calls wire shape, and a finish_reason per round. Two new cases exercise what the loop is for — an eye correcting an island before delivery, and a refusal repaired once and named on the second attempt — on a scaffold with real nodes for graph_read to find.

Fixed

• A refusal from the submitter no longer claims to answer a tool call. The receipt turn was rendered as a tool message answering no call, and the provider rejected the whole request with HTTP 400 — which cost the loop its repair round. It now travels as the plain user turn a result outside a tool round is allowed to be. In the same place: a receipt arrives on a foreign chain without context and can only be filed under iteration 0, so the rebuild now sorts receipt rows to the end of the thread.
• The composer's connectivity instruction contradicted the door. The briefing asked for an edge crossing the new unit's boundary "in the same manifest", but the only anchor a declaration names is the scope itself — and a scope is not an edge endpoint. A new endpoint block, derived from the validator, names the two legal spellings and separates the two cases the text had conflated.
• rounds_done measures what iter does not. iter keeps its meaning, but it is stamped with the value it finds, so it counts "looked twice", not "looked". The number now travels beside it, stamped on the two routes that really close a round.
• A code cell's child task sent reply before idle. A serial stream therefore got a different slot for its next job and woke a second interpreter. Not a flake — the sends are swapped.
• The repair lane was dead on arrival: the repair route was never emitted, so the refusal path never reached the composer again. Six existing tests were green because none of them asked whether it did. Fixed together with an off-by-one that swallowed the second repair.

What this release does not claim

The acceptance quota is missed, and it is reported as missed. Measured twice with n=4 against one model, before and after the follow-up fixes: "the composition lives" 0/4 both times, "it is what was ordered" 0/4 both times. What holds is "no silent death" 4/4 — every run said how it ended, a draft with a digest and a named refusal or a named error, never an empty manifest and never silence — and "the loop looked" 4/4 once the figure measured it. The bottleneck is manifest quality, above all the choice of template; the loop itself runs, is bounded and never goes quiet.

Three further limits are named in the changelog rather than hidden: a caller's own coordinates can lose a race against a /colony eye's fresh trace; the corrected receipt turn is pinned by three tests but was never exercised against a live provider, because no measured run reached a repair round; and one prompt-related refusal class moved in the wrong direction inside its own measurement noise, which is stated as a risk rather than as a finding.

Full detail in CHANGELOG.md. The workspace suite stands at 5681 tests.