Run artifact reference

Lifecycle and names

Each run is one new direct child of .runs/. The examples below use <run-id> for that directory, <unit-id> for a scheduled workload unit, and <case-id> for an official negative case. The number of units depends on the selected mode. The four official negative-case identities do not vary.

Run files are create-only. A failed run may retain a partial directory, but it is never resumed or repaired. A complete run is reconstructed once to publish results and again in check-only mode before the public command succeeds.

Canonical tree

.runs/<run-id>/
|-- raw.sha256
|-- results.sha256
|-- results/
|   |-- run-summary.json
|   |-- analysis.json
|   |-- output.json
|   `-- reproduction.json
|-- work/
|   |-- input-inventory.json
|   |-- runtime-manifest.json
|   |-- environment.json
|   |-- plan.json
|   |-- inputs/...
|   |-- build/
|   |   |-- classes/...
|   |   `-- fusion-fixture.jar
|   |-- pgid-registry.jsonl
|   `-- pgid-registry.jsonl.lock
|-- raw/
|   |-- build.json
|   |-- 00-build-process.json
|   |-- <unit-id>/
|   |   |-- schedule.json
|   |   |-- 01-extract-process.json
|   |   |-- static-snapshot.json
|   |   |-- static-snapshot.json.writer.json
|   |   |-- 02-prepare-process.json
|   |   |-- prepared.json
|   |   |-- prepared.json.writer.json
|   |   |-- 03-workload-process.json
|   |   |-- workload.json
|   |   |-- workload/...
|   |   |-- 04-complete-process.json
|   |   |-- hybrid-snapshot.json.gz
|   |   |-- result.json.gz
|   |   |-- result.json.writer.json
|   |   |-- 05-verify-process.json
|   |   `-- verification.json
|   `-- negative-cases/<case-id>/
|       |-- mutant.json.gz
|       |-- verification.json
|       `-- <case-id>-process.json
`-- logs/
    `-- per-stage standard-output and standard-error copies

The hybrid-snapshot writer receipt is nested in the completed result; there is no separate hybrid-snapshot.json.writer.json file.

Directory boundaries

Path	Purpose and binding
work/	Captured semantic inputs, executable environment, execution plan, process registry, and deterministic build output. It is not covered by one aggregate directory manifest; its material identities are cross-bound into raw and result records.
raw/	Stage evidence, process receipts, snapshots, workload streams, completed units, verification receipts, and official negative cases. raw.sha256 binds its exact file membership and bytes.
results/	Runner summary and analyzer-derived records. results.sha256 binds the exact four JSON files and their bytes.
logs/	Diagnostic copies of outer stage output. They are not semantic evidence and are not covered by raw.sha256 or results.sha256.
raw/<unit-id>/workload/	Raw baseline and traced workload streams and logs. Unlike top-level logs/, these files are part of raw.sha256.

Schemas and purposes

Path	Schema	Meaning
work/input-inventory.json	aquila-poc-input-inventory/v1	Exact declared semantic input membership, sizes, hashes, and aggregate binding.
work/runtime-manifest.json	aquila-poc-runtime-manifest/v2	Required and observed runtime posture plus Python and JDK executable identities.
work/environment.json	aquila-fusion-poc-environment/v2	Platform, source identity, command environment, limits, and runtime-manifest reference.
work/plan.json	aquila-fusion-poc-plan/v1	Fixed claim, mode, units, commands, oracle, safety limits, and bindings.
raw/build.json	aquila-fusion-build/v2	Deterministic JAR identity, source hashes, JDK observations, and inner javac receipt.
*-process.json	aquila-fusion-process-receipt/v5	Command identity, terminal status, caps, resource peaks, output, and descendant cleanup.
schedule.json	aquila-fusion-poc-schedule/v1	Unit scale, phase, ordinal, pair order, and execution mode.
static-snapshot.json	aquila-fusion-static-snapshot/v2	Extracted classes, direct calls, facts, provenance, and static size model.
static-snapshot.json.writer.json	aquila-fusion-static-publication/v3	Create-only publication, synchronization, reopen, size, hash, and timing receipt.
prepared.json	aquila-fusion-prepared/v2	Static base, candidate, pre-query result, policy, and execution binding.
prepared.json.writer.json	aquila-fusion-prepared-publication/v3	Prepared-artifact publication and binding receipt.
workload.json	aquila-fusion-workload-receipt/v2	Baseline and traced process identities, JDK observations, event hashes, and descriptive timing.
hybrid-snapshot.json.gz	aquila-fusion-hybrid-snapshot/v2	Persisted fused graph after exact reopen verification.
result.json.gz	aquila-fusion-completed-unit/v2	Completed unit and descriptive metrics; its nested semantic record uses aquila-fusion-result/v2.
result.json.writer.json	aquila-fusion-writer-receipt/v3	Publication binding for the original completed-result JSON.
verification.json	aquila-fusion-verification-receipt/v3	Pass or fail, exact failure labels, checked obligations, and independent javap census.
mutant.json.gz	aquila-fusion-completed-unit/v2	Deliberately wrong completed unit retained for an official negative case.
results/run-summary.json	aquila-fusion-poc-run-summary/v1	Runner terminal index of units, negative cases, source, plan, fixture, and retention metadata.
results/analysis.json	aquila-fusion-poc-analysis/v1	Detailed reconstruction, measurements, interpretation, provenance, limitations, and review status.
results/output.json	aquila-fusion-poc-output/v1	Compact public result for humans and automation.
results/reproduction.json	aquila-reproduction/v1	Reproduction metadata and artifact hashes; reviewer status remains pending.

Event JSONL files and the process registry are record streams, not single top-level schema documents. Supporting schema versions are explicit in each artifact; consumers must reject an unsupported version rather than infer a compatible shape.

Compact output

The stable public document is results/output.json. Its principal fields are:

Field	Interpretation
status	pass only after the complete public path and exact reconstruction succeed.
claim_outcome	supports applies only to the bounded claim in contract.md.
completed_units	Number of requested workload units accepted by the exact verifier.
negative_cases_rejected	Number of official deliberately wrong results rejected for their intended reasons.
all_semantic_units_passed	Whether every requested semantic unit passed.
authority	States explicitly that the POC claims no architectural decision and that its effect remains none.
semantic_observation	Fixed fact-layer and reconciliation counts for the bounded fixture.
descriptive_measurements	Host-dependent timing and resource observations; never an SLO or superiority claim.
source_identity	Semantic inventory, launcher/build boundary, and observed or caller-labeled revision metadata.
limitations	Explicit interpretation boundaries that travel with the result.

The four negative cases are acceptance evidence, not additional workload units. Test-only evidence probes and semantic mutants are exercised by ./poc.sh test and are not added to a normal retained run.

Deterministic retention

result.json, hybrid-snapshot.json, and official mutant JSON are compressed with deterministic gzip-9-mtime-0: gzip level 9 with a zero timestamp. The uncompressed files are removed only after an exact decode and byte-for-byte round trip. Decoded and retained sizes and hashes are recorded in the run summary or the owning receipt.

Do not decompress a retained file in place or replace it with recompressed bytes. Compression metadata and retained bytes are part of the raw manifest.

Integrity and authenticity

SHA-256 manifests and cross-file bindings detect stale, omitted, extra, or internally inconsistent artifacts relative to the retained run and current contract. The public checker also reconstructs results and validates current source inputs, execution boundaries, toolchain identities, runtime posture, process receipts, and semantic oracles.

These are integrity and correlation controls, not signatures. An actor who can replace the repository, launcher, and complete run can coherently recompute unkeyed hashes. The PoC has no signing service, remote attestation, external append-only store, or independent trust authority. A non-Git source revision can also be labeled caller-asserted-unverified or unavailable.

Do not describe a run as tamper-proof or independently authenticated. See the trust model in ../ARCHITECTURE.md and reporting guidance in ../SECURITY.md.

Inspection recipes

Use the public checker for the project-level verdict:

./poc.sh check --run-id review-01

Optional read-only inspection examples from the repository root are:

run=.runs/review-01

jq . "$run/results/output.json"
jq -r '.units[].unit_id' "$run/results/run-summary.json"
jq '.measurement.negative_cases' "$run/results/analysis.json"

jq '{
  terminal_status,
  returncode,
  timed_out,
  cap_trigger,
  reaped,
  containment_domain_empty,
  residual_processes,
  peaks
}' "$run/raw/<unit-id>/03-workload-process.json"

gzip -cd -- "$run/raw/<unit-id>/result.json.gz" | jq .

On a host with GNU sha256sum, the listed hashes can also be checked directly:

(cd "$run/raw" && sha256sum -c ../raw.sha256)
(cd "$run/results" && sha256sum -c ../results.sha256)

sha256sum -c checks only the listed rows. It does not enforce exact membership, cross-record semantics, the current execution context, or authenticity. The project-level verification command remains ./poc.sh check.

Sharing a run

Start with the smallest useful set:

• results/output.json;
• work/input-inventory.json;
• work/runtime-manifest.json;
• exact command, exit status, commit, Docker and Compose versions, and host operating system and architecture; and
• the smallest relevant standard-error log when reporting a failure.

Do not publish a complete .runs/ directory unless a reviewer requests it. Inspect every artifact and log for sensitive host or command information first. The CI workflow uploads only a compact reproduction subset and retains it for a bounded period.