mori (森) — a governed shared memory layer for AI coding agents
← back to the frameworkSee dark version →
Receipt #6 · Measured 2026-06-25 · Corrected 2026-07-27

Code-graph moat — Measurement #1

A null result. On this corpus, with this compiler, nothing became enforceable machinery.

The Go/No-Go yield measurement the framework cites as receipt #6, published in full — including the correction that withdrew its headline figure a month after it was written.

This page is a fixed address. It does not move, and it is never silently edited: corrections are appended and dated, and a second measurement would be published separately rather than replacing this one. The paper points here, and a pointer that can be quietly rewritten is worth nothing.

Setup

16 realistic conventions (3 graph-shaped / 7 lint-import-file / 6 process-non-mechanizable — honest mix, NOT graph-stacked) × maker = Kimi-K2.7-code via Bifrost × target repo = ~/mori (real Python). Engine- validated. Tier by deterministic check_type ceiling (pre-live-red-team). ~/experiments/gateable/maker/.

Result

16 conventions → 9 emitted checks; 7 → not_a_rule (6 non-mechanizable correct; F1 __init__.py dropped). Distribution: REGEX_ABSENT 4, IMPORT_FORBIDDEN 3, REGEX_MATCH 1, GRAPH_CYCLE_DETECTED 1. - Graph-structural Tier-1 = 1/9 = 11% — BELOW the 15% Go/No-Go bar. - Over-proposing: 1/6 (P1 “use uv not pip” → a spurious REGEX_ABSENT).

Two findings deeper than the 11%

  1. Layer-boundary rules collapsed to Tier-2. “dream.py must not import main.py” (G1) and “main must not import memory_store” (G3) emitted as IMPORT_FORBIDDEN, not GRAPH_EDGE_FORBIDDEN. And the honest gut-punch: GRAPH_EDGE_FORBIDDEN is implemented with the SAME static AST as IMPORT_FORBIDDEN → same base64/importlib evasion → the red-team would downgrade it. It is Tier-2 dressed as Tier-1. Only GRAPH_CYCLE_DETECTED is genuinely structural (a topological fact across edges).
  2. The reviewer’s warning, confirmed empirically. True transformation-invariance needs the graph to resolve dynamic dispatch — which static AST (and GitNexus) fundamentally undercounts. Layer-edge rules on static imports are Tier-2. The genuinely un-bypassable structural class (cycle / file-exists / schema) is real but thin + infrequent.

Verdict

Code-graph does NOT earn primacy on this evidence. Honest product shape: a thin Tier-1 core (cycles, file-exists, schema conformance) + a Tier-2 advisory bulk (lint/import/convention — boundary-enforced, never blocking). More modest than “zero-trust un-bypassable engine for arbitrary canon.” This is the null the reviewer said to be ready for, delivered BEFORE building the cross-repo graph engine as “the product” — the measure-before-crown discipline paying out.

Caveats (not definitive)

n=16, one repo, one maker model, authored corpus, pre-live-red-team. 11% is directional. The structural finding (static graph-edge ≈ Tier-2) is implementation-robust regardless of n. Tuning the maker to prefer graph types would juice the fraction = rigging (the reviewer’s word) AND pointless (static graph-edge is Tier-2 anyway).

Next (to make it definitive, or to find the real Tier-1)

CORRECTION — 2026-07-27

Redaction note: a reviewer named in the original text is referred to here as “the reviewer”. That is the only wording changed in the body above; it alters no finding, and it is recorded here rather than left as a silent difference between this document and the version it was written as.

Appended, not rewritten: this is a dated receipt and the record of what was believed on 2026-06-25 is part of what it documents. Everything above stands as written; what follows is what re-verification against progress.jsonl and the check engine’s own results established a month later.

The headline figure counted a check that did not work. Of the 9 emitted checks, only 3 passed the engine’s two-sided validity test (pass on the clean repository and catch the violation fixture): I1, R3 and F2. Five were rejected as vacuous (G1, G2, G3, R1, R2) and one was skipped (P1). All three working checks carry tier_ceiling = 2.

G2 — the GRAPH_CYCLE_DETECTED check, the entire “1” in 16 → 9 → 1 — is one of the rejected five, recorded by the engine as valid=False (vacuous: does not pass on current good state). It fired on a clean repository. So the “Graph-structural Tier-1 = 1/9 = 11%” line above counts a non-working check, and the measured Tier-1 count on this corpus is zero. The surviving number is the compiler’s working-check yield: 3 of 16.

No adversary was ever run. There are no transformation or evasion attempts, and no outcomes, anywhere in the experiment record — checker.py implements the downgrade rule and a combat log, and was never executed into an artefact. The Next item above, “live red-team the 1 cycle check”, was never actioned. So tier_ceiling is a type-level upper bound on what a check could be, not a finding about what it survived — which makes every tier figure here a ceiling rather than a measurement.

What does not change. The concept is untouched: a topological graph cycle is plausibly transformation-invariant, and the argument in Finding 1 for why static-AST edge rules are not remains sound as analysis. What failed is the implementation this compiler emitted. Write “the compiler produced a vacuous implementation”, never “graph cycles aren’t enforceable”.

Direction of travel: the null gets stronger. “Code-graph does not earn primacy on this evidence” becomes “on this corpus, with this compiler, nothing became enforceable machinery at all.” The Verdict and Caveats above are unaffected except that the thin Tier-1 core was, here, empty.

The correct conclusion was reached the next day, and did not reach the paper. A session record dated 2026-06-26 — one day after this measurement — already said, in full:

Measurement #1 NULL: graph-Tier-1 = 11% (<15% bar). Then deterministic kill: ALL source-AST checks (regex/import/edge/CYCLE) share the base64/importlib evasion → Tier-2. /consult then killed the artifact-lockfile pivot too (12 evasions; intra-package invisible; lockfile=declaration-not-observation). HONEST CONCLUSION: no internal-architecture check is adversarially Tier-1; genuine Tier-1 = crypto/attestation only (hash/SBOM/provenance/registry/ secret-scan/file-exists).**

That covers the cycle explicitly, and it is quoted here in full rather than cited, so that a reader can check it without access to the notes it came from. It reached the correct answer twenty-four days before the framework paper published the wrong one. The two agree; that one was reasoned and this one is measured.

So the failure this correction documents is not that nobody checked. It is that the checking and the writing drew on different documents — which is a sharper indictment than ignorance, and the reason the paper’s own discipline says every figure comes from run manifests rather than from summaries.

Propagated to: the PBGF framework paper (Part 3 receipt, receipts table row 6, Part 6 dated correction) and gated’s CONFORMANCE.md (§1, §3, §4 Step 3).