ADR-0040: Sealed Predecessor Translation Correspondence Roots

Status: accepted and implemented for the frozen 51-case predecessor boundary; R1-S8 was subsequently finite-accepted; Gate B performance remains open

Date: 2026-07-30

Historical scope: ADR-0042 later migrated the encoder-derived target and carrier identities without changing the predecessor Core↔SSA or SSA↔Machine IR translation relations sealed here.

Extends: ADR-0035, ADR-0036, and ADR-0039 without reinterpreting an accepted Residual Core, Core SSA, Machine IR, R1-S7a, or R1-S7b identity

Context

R1-S5 already sealed the three-engine Gate A relation and source-bound each Core SSA artifact to its Residual Core. R1-S6 source-bound each Machine IR artifact to its Core SSA and Residual Core. The frozen 51-case semantic comparisons across these two translation handoffs, however, existed only as test assertions. They did not have their own stage-separated record schemas and ordered aggregate roots that R1-S8 authority could carry.

R1-S8 must not jump from a Residual Core identity to a native target identity while treating the two intermediate semantic relations as implicit. Detached hash tuples are also insufficient: an attacker can recompute hashes over fabricated observations.

Decision

1. Two distinct evidence lines

NAUX defines two finite, ordered translation-correspondence protocols:

R1-S5  Residual Core ↔ source-bound Core SSA
R1-S6  source-bound Core SSA ↔ source-bound Machine IR

Both schema and policy versions are exactly 1.0.0. Their public, NUL-terminated domains are:

NAUX:core-ssa:r1-s5:translation-correspondence:record:v1\0
NAUX:core-ssa:r1-s5:translation-correspondence:results:v1\0
NAUX:machine-ir:r1-s6:translation-correspondence:record:v1\0
NAUX:machine-ir:r1-s6:translation-correspondence:results:v1\0

The domains are stage-separated from Gate A, artifact semantic identities, R1-S7a, and each other.

2. Exact finite corpus and observations

Each evidence line contains exactly 51 records in canonical Gate A order:

ordinals 0..45   BranchMix
ordinals 46..50  Bounds

Every record binds its ordinal, workload, class, canonical input hash, source and translated artifact identities, normalized outcomes, ordered effects, and record hash. Non-NaN F64 results preserve exact bits, including signed zero. All NaNs normalize to the one declared semantic NaN class. The Bounds outcome and effect order are exact.

The fixed correspondence limits bind:

total cases                     51
BranchMix cases                 46
Bounds cases                     5
max array elements per case     Gate A fixed cap
max total array elements        Gate A fixed cap
max effects per observation     Gate A fixed cap
steps per case                  Gate A residual-step cap
call depth                      Gate A call-depth cap
max total steps per engine      Gate A residual aggregate cap

Admission uses checked arithmetic and rejects any noncanonical limit, count, ordinal, manifest, identity, observation, nested record seal, or aggregate seal.

3. Regeneration, not detached resealing

Emission first replays each source binding, executes all 51 cases through both engines, checks the fixed limits, and seals the ordered result.

Verification validates the complete nested shape and then deterministically regenerates all 51 executions from the live source artifacts. Even a fabricated observation whose record and aggregate hashes have both been recomputed cannot mint the opaque verified correspondence view.

The accepted locked roots are:

R1-S5 Core↔SSA
18db0347094dfad000e7a6401cd1d989edd57f44bd0b31a9544d80f3803ba58b

R1-S6 SSA↔Machine IR
3cc7cbd876531ea6f88c56f50c851eb168ac76afe2d9a05ae6835687bf411205

4. R1-S8 inherited authority

The lighthouse package independently rebuilds the other workload package, emits both correspondence lines, and reverifies them before authority construction.

The R1-S8 inherited envelope now carries, in each corresponding stage:

• correspondence schema and policy versions;
• exact Gate A manifest hash;
• ordered correspondence result root;
• complete fixed correspondence limit vector;
• exact record count;
• selected and cross-profile source/target identities.

These additions increase the manual big-endian inherited-envelope encoding from 2,728 to exactly 2,984 bytes: 128 bytes for R1-S5 and 128 bytes for R1-S6. The envelope is embedded in the existing pre-acceptance R1-S8 artifact preimage. No Rust layout, native endian, debug text, serde, saturation, or host-width cast participates.

5. Claim boundary

These roots are finite translation validation over the frozen corpus. They do not prove equivalence for arbitrary inputs or programs. They do not complete R1-S8, Gate B, Gate C, Futamura P1, performance leadership, or seed sovereignty.

R1-S8 may describe them as canonical transitive carriers only because every consumer regenerates the complete leaf evidence from live predecessor artifacts. Copying the two root values without that replay grants no authority.

Consequences

• The R1-S8 artifact identity changes because its inherited preimage is now complete at both missing semantic handoffs.
• Authority construction and verification are intentionally more expensive: they replay the frozen predecessor corpus instead of trusting cached roots.
• Any future change to either protocol requires append-only schema/policy evolution, new domains, new locked vectors, and an explicit ADR.
• At this decision’s acceptance, the standalone ELF bytes were unchanged; only the authority-bound artifact and downstream R1-S8 execution identities changed. ADR-0042 later migrated the inherited target and ELF bytes together.