h-dv/code-index

Watch

Fork 0

The bridge tier is the one resolver fan-out stage with no budget, and its exemption argument is untested #110

New issue

Closed

opened 2026-09-04 15:20:37 +02:00 by buildagent · 1 comment

buildagent commented

2026-09-04 15:20:37 +02:00

Member

Split out of #65, which shipped in v0.23.0 and is now closed. This is its acceptance item 7 — "dynamic resolver capabilities cannot bypass the same budgets" — and it is the one part that is a decision rather than an oversight. Filing it so the decision is graded instead of trusted.

The state

crates/indexer/src/resolve_budget.rs budgets five stages:

pub(crate) const ALL: &'static [Stage] = &[
    Stage::Tier3, Stage::Tier1rOrigin, Stage::Tier1rIdent,
    Stage::CsharpPartial, Stage::Tier1qScands,
];

The bridge tier (crates/indexer/src/index.rs:~6890) is not among them. Stage has no bridge variant, so a bridge fan-out cannot degrade-with-disclosure the way every other stage can — it either completes or it does not.

The argument for the exemption, which is real

It does not run at all unless a package declared a bridge and the project granted it. When it does run, its population is one component's refs of one kind × one language's symbols of one kind — bounded on both sides by construction, unlike the same-name cross products that made #65 quadratic.

That is a good argument. It is also entirely unexercised: no fixture drives a bridge at scale, and nothing asserts the bound the argument rests on.

Why it should not simply be left

#65 exists because a resolver stage nobody had bounded turned out to scale at N².⁰⁶ on a shape nobody had built a fixture for. The bridge tier is the one stage that is exempt on reasoning rather than measurement, and it is the stage that a third-party package can switch on. The exemption may well be correct — but "correct by argument, ungraded" is precisely the state #65's own budget doc warns about:

It does NOT force a call site or a corpus fixture — an earlier version of this doc claimed it did, and a Stage::Ghost with neither passed the whole suite.

Two ways to close it, either acceptable

Grade the bound. A fixture with a granted bridge over a deliberately hostile population, asserting the cardinality upper bound the argument claims. Then the exemption is a measurement and the comment can cite it.
Give it a Stage. Cheaper to reason about and uniform — every fan-out stage budgeted, no exceptions to remember — at the cost of a budget that will realistically never bind.

Option 1 is the honest one; option 2 is the one that survives a future where bridges get richer. Whoever takes it should say which and why, in the code.

Either way the exemption's reasoning belongs next to the code, not only in a closed issue, so the next reader does not have to reconstruct it.

Residual of #65. Feeds #41 (scale ceilings — bridge candidate fan-out has no fixture there either) and touches #77's bridge design.

Split out of #65, which shipped in v0.23.0 and is now closed. This is its acceptance item 7 — *"dynamic resolver capabilities cannot bypass the same budgets"* — and it is the one part that is **a decision rather than an oversight**. Filing it so the decision is graded instead of trusted. ## The state `crates/indexer/src/resolve_budget.rs` budgets five stages: ```rust pub(crate) const ALL: &'static [Stage] = &[ Stage::Tier3, Stage::Tier1rOrigin, Stage::Tier1rIdent, Stage::CsharpPartial, Stage::Tier1qScands, ]; ``` The bridge tier (`crates/indexer/src/index.rs:~6890`) is **not** among them. `Stage` has no bridge variant, so a bridge fan-out cannot degrade-with-disclosure the way every other stage can — it either completes or it does not. ## The argument for the exemption, which is real It does not run at all unless a package **declared** a bridge *and* the project **granted** it. When it does run, its population is one component's refs of one kind × one language's symbols of one kind — bounded on both sides by construction, unlike the same-name cross products that made #65 quadratic. That is a good argument. It is also **entirely unexercised**: no fixture drives a bridge at scale, and nothing asserts the bound the argument rests on. ## Why it should not simply be left #65 exists because a resolver stage nobody had bounded turned out to scale at N².⁰⁶ on a shape nobody had built a fixture for. The bridge tier is the one stage that is exempt on reasoning rather than measurement, and it is the stage that a *third-party package* can switch on. The exemption may well be correct — but "correct by argument, ungraded" is precisely the state #65's own budget doc warns about: > It does NOT force a call site or a corpus fixture — an earlier version of this doc claimed it did, and a `Stage::Ghost` with neither passed the whole suite. ## Two ways to close it, either acceptable 1. **Grade the bound.** A fixture with a granted bridge over a deliberately hostile population, asserting the cardinality upper bound the argument claims. Then the exemption is a measurement and the comment can cite it. 2. **Give it a `Stage`.** Cheaper to reason about and uniform — every fan-out stage budgeted, no exceptions to remember — at the cost of a budget that will realistically never bind. Option 1 is the honest one; option 2 is the one that survives a future where bridges get richer. Whoever takes it should say which and why, in the code. Either way the exemption's reasoning belongs **next to the code**, not only in a closed issue, so the next reader does not have to reconstruct it. ## Related Residual of #65. Feeds #41 (scale ceilings — bridge candidate fan-out has no fixture there either) and touches #77's bridge design.

buildagent referenced this issue

2026-09-04 15:21:20 +02:00

gate: plugin conformance, hostile-runtime containment and production disclosure #80

buildagent referenced this issue

2026-09-06 09:44:21 +02:00

gate: plugin conformance, hostile-runtime containment and production disclosure #80

buildagent referenced this issue

2026-09-06 12:45:52 +02:00

The bridge tier is the one candidate fan-out with no budget: fill_bridge_cands full-scans (lang, kind) once per active bridge #164

buildagent commented

2026-09-06 12:46:29 +02:00

Author

Member

CLOSING — option 2 shipped, and the reasoning is next to the code as this issue required

Close-out lane. This is the same defect as #164, filed from the other side; both were fixed by the one change. Verified on master 552e3a2 in /tmp/cosi-lane-closeout with this repo's own tools.

This issue offered two acceptable closes. Option 2 — "give it a Stage" — is what shipped:

crates/indexer/src/resolve_budget.rs:129   Stage::Bridge
crates/indexer/src/resolve_budget.rs:154   Stage::ALL now has six members, Bridge among them
crates/indexer/src/resolve_budget.rs:172   key() -> "bridge"
crates/indexer/src/index.rs:2582           BRIDGE_WORK_BUDGET_DEFAULT = 50_000_000
                                           env CODE_INDEX_BRIDGE_WORK_BUDGET
crates/indexer/src/index.rs:7371           guard_measured_at() on the fill_bridge_cands path

So the quoted ALL in this issue's body is out of date: the bridge tier is no longer exempt, and it can now degrade-with-disclosure like every other stage (stage_budget.bridge.degraded, persisted and reported live through ResolveControl).

The requirement this issue made beyond the code change

Either way the exemption's reasoning belongs next to the code, not only in a closed issue.

Met. index.rs:2530-2582 carries the whole argument in place: the unit (SUM over active bridges of |symbols(dest_lang, dest_symbol_kind)|), why the rate to wall clock is deliberately not claimed (no repository we can measure has an active bridge, so the stage has never run long enough to time), why loose is the safe direction here specifically (a tight budget would cost exactly the cross-language edges a package was granted, which is the feature), and the explicit statement that the point of budgeting now is the disclosure, so it can later be tightened against real values instead of guessed at. The pre-#164 comment that said "NOT BUDGET-GUARDED, and that is a decision" was rewritten rather than deleted, so the reasoning that ended in the wrong place stays readable.

Gate

cargo test -p code-index-daemon --test xaml_package_e2e → EXIT=0, 14 passed / 0 failed, including the_bridge_tier_is_budgeted_and_names_itself_when_it_skips (crates/daemon/tests/xaml_package_e2e.rs:697), which spawns the daemon with CODE_INDEX_BRIDGE_WORK_BUDGET=0 through the production env channel and asserts no ref carries by 90, that bridge is in stage_budget.measured, and that the estimate equals |symbols(csharp,class)| + |symbols(csharp,method)|.

corpus_stage → EXIT=0, executed=7 unavailable=0 controls=14 (require=true) — a real corpus run, not the vacuous executed=0 shape.

What option 1 would still have given, and where it now lives

This issue's option 1 — grade the bound with a fixture over a deliberately hostile population — was not done, and that is the honest reading of what shipped. The xaml gate's equality is graded on a 10-symbol fixture, which proves the estimate counts the right relation and counts it once per bridge, but says nothing about behaviour at scale. That fixture is #41's, which this issue itself already routes it to ("bridge candidate fan-out has no fixture there either"), and #41 stays open.

One survivor recorded rather than hidden: dropping lang = ?1 from the estimate leaves the xaml gate green, because C# is the only language in that fixture holding a class or a method. The language filter is ungraded there; dropping it over-estimates, which is the safe direction, and grading it needs a bridge declared onto field.

Closing as a duplicate of #164, which carries the full measurement.

## CLOSING — option 2 shipped, and the reasoning is next to the code as this issue required Close-out lane. This is the same defect as **#164**, filed from the other side; both were fixed by the one change. Verified on master `552e3a2` in `/tmp/cosi-lane-closeout` with this repo's own tools. This issue offered two acceptable closes. **Option 2 — "give it a `Stage`" — is what shipped:** ``` crates/indexer/src/resolve_budget.rs:129 Stage::Bridge crates/indexer/src/resolve_budget.rs:154 Stage::ALL now has six members, Bridge among them crates/indexer/src/resolve_budget.rs:172 key() -> "bridge" crates/indexer/src/index.rs:2582 BRIDGE_WORK_BUDGET_DEFAULT = 50_000_000 env CODE_INDEX_BRIDGE_WORK_BUDGET crates/indexer/src/index.rs:7371 guard_measured_at() on the fill_bridge_cands path ``` So the quoted `ALL` in this issue's body is out of date: the bridge tier is no longer exempt, and it can now degrade-with-disclosure like every other stage (`stage_budget.bridge.degraded`, persisted and reported live through `ResolveControl`). ### The requirement this issue made beyond the code change > Either way the exemption's reasoning belongs **next to the code**, not only in a closed issue. Met. `index.rs:2530-2582` carries the whole argument in place: the unit (`SUM over active bridges of |symbols(dest_lang, dest_symbol_kind)|`), why the rate to wall clock is deliberately **not** claimed (no repository we can measure has an active bridge, so the stage has never run long enough to time), why loose is the safe direction here specifically (a tight budget would cost exactly the cross-language edges a package was granted, which is the feature), and the explicit statement that the point of budgeting now is the **disclosure**, so it can later be tightened against real values instead of guessed at. The pre-#164 comment that said *"NOT BUDGET-GUARDED, and that is a decision"* was rewritten rather than deleted, so the reasoning that ended in the wrong place stays readable. ### Gate `cargo test -p code-index-daemon --test xaml_package_e2e` → **EXIT=0**, 14 passed / 0 failed, including `the_bridge_tier_is_budgeted_and_names_itself_when_it_skips` (`crates/daemon/tests/xaml_package_e2e.rs:697`), which spawns the daemon with `CODE_INDEX_BRIDGE_WORK_BUDGET=0` through the production env channel and asserts no ref carries `by 90`, that `bridge` is in `stage_budget.measured`, and that the estimate **equals** `|symbols(csharp,class)| + |symbols(csharp,method)|`. `corpus_stage` → **EXIT=0**, `executed=7 unavailable=0 controls=14 (require=true)` — a real corpus run, not the vacuous `executed=0` shape. ### What option 1 would still have given, and where it now lives This issue's option 1 — *grade the bound with a fixture over a deliberately hostile population* — was **not** done, and that is the honest reading of what shipped. The xaml gate's equality is graded on a 10-symbol fixture, which proves the estimate counts the right relation and counts it once per bridge, but says nothing about behaviour at scale. That fixture is **#41**'s, which this issue itself already routes it to ("bridge candidate fan-out has no fixture there either"), and #41 stays open. One survivor recorded rather than hidden: dropping `lang = ?1` from the estimate leaves the xaml gate **green**, because C# is the only language in that fixture holding a `class` or a `method`. The language filter is ungraded there; dropping it over-estimates, which is the safe direction, and grading it needs a bridge declared onto `field`. Closing as a duplicate of #164, which carries the full measurement.

buildagent closed this issue

2026-09-06 12:46:32 +02:00

buildagent referenced this issue

2026-09-06 12:51:07 +02:00

gate: plugin conformance, hostile-runtime containment and production disclosure #80

buildagent referenced this issue

2026-09-06 12:51:28 +02:00

epic: runtime plugin architecture — dynamic grammar, extraction and resolution packages #75