{ "shard_id": "FV-PROPFLOOR-SHARD-B22-1", "spec_anchor": "FV-PBT-FLOOR-BUILD-SPEC.md §2/§3/§4", "population_definition": "all kernels in shard FV-PROPFLOOR-SHARD-B22-1, enumerated below by kernel id and spec digest", "human_sign_off": { "status": "PENDING", "name": null, "date": null }, "independence_sentence": "Each item listed was reviewed and attested independently; the single signature is a mechanical convenience over the enumerated digests, not a bulk review.", "per_item_basis_of_review": "Every row ran the same two mechanical checks unconditionally: (1) the fixture-oracle gate — compute() output diffed against the kernel's own existing golden fixtures before any property was trusted, and (2) run-proptests.mjs green (process exit 0, 358/358 across the full tree post-merge). FIX-2 CARRY correction: the WU row's float-sensitivity labels were verified against each kernel's actual source, NOT inherited from the triage table, and THREE of the ten were reclassified after direct inspection. art-374 (test_nav_error_materiality) and art-388 (convert_tempo_fee_amm) were labeled float:yes in the WU row but both compute exclusively in BigInt fixed-point (art-374's toFixed/mulFixed/divFixed SCALE_EXP=8 convention; art-388's parseBig integer arithmetic) — reclassified float:no, with forced categorical/boundary cases substituted for ULP forcing (art-388's boundary set additionally covers the BigInt-to-Number precision-loss edge for pool_utilization_bps at amounts beyond Number.MAX_SAFE_INTEGER). Conversely, art-401 (validate_form5500_schedules) was labeled float:no in the WU row but its Schedule H cross-schedule tie (expected_ending = +(beginning+net_income-distributions).toFixed(2), tolerance 0.01) is a raw IEEE754 float sum/difference under an EPS-relative tolerance comparison — the identical shape already treated as float-sensitive for art-319 in an earlier shard — reclassified float:yes and given full ULP-boundary forcing (half-cent 0.1+0.2-style sums, the exact 0.01 tolerance boundary, large-magnitude cancellation). The two kernels confirmed float-sensitive as labeled (art-391 compute_canton_traffic_cost, art-392 compute_canton_app_reward_estimate) both perform raw float division/multiplication (usd_traffic_cost/cc_usd_price; confirmed_envelope_bytes/round_total_envelope_bytes) and carry full ULP forcing (zero/negative-zero denominators, denormal-range products, x/y*y!==x rounding artifacts, MAX_SAFE_INTEGER envelopes). The five remaining kernels (art-380, art-390, art-393, art-398, art-404) are float:no as labeled — art-380/art-393/art-398 are pure categorical/small-integer-score kernels with no fractional arithmetic; art-390 is a SHA-256 hash-integrity check (async compute(), awaited throughout this harness); art-404 confines its float exposure to the dollars-to-cents Math.round(dollars*100) boundary, with all downstream tie-out arithmetic running on the resulting integer cents — its boundary set covers half-cent inputs and classic non-exact-double conversions (0.1*100) at that boundary. Net result: 3 of 10 kernels carry ULP-boundary forcing (art-391, art-392, art-401), not the WU row's originally-named 4 (art-374, art-388, art-391, art-392) — the corrected set is documented per-item below.", "items": [ { "kernel_id": "art-374-test-nav-error-materiality", "class": "B", "float_sensitive": false, "float_sensitive_wu_label": true, "ulp_forcing_present": false, "ulp_forcing_note": "WU row labeled float:yes; RECLASSIFIED float:no on direct inspection — every money computation is BigInt fixed-point (SCALE_EXP=8 toFixed/mulFixed/divFixed), the only Number() call (affected_period.days) is an unused passthrough. Forced CATEGORICAL boundary cases (exact half-cent/percent threshold ties, structural-error zero-denominator, 9-digit precision truncation, non-numeric-string fallback) used instead of ULP forcing.", "kernel_digest": "sha256:ea70af686a6a7920e78cc9a8c561971099404d2b051fae1c6f6fcf613ab89e7a", "proptest_file_digest": "sha256:94f95c24afcc50a9a2be645c2422bba2f9b00ab473571d33246e186c07f0edcb", "proptest_file": "chaingraph/kernels/__proptests__/art-374-test-nav-error-materiality.proptest.mjs", "properties_tested": ["materiality_verdict_bounded_to_declared_enum", "reprocessing_need_exact_declared_policy_material", "error_amount_exact_fixed_point_subtraction"], "fixture_oracle_result": "PASS (12/12 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-380-build-ai-workpaper-record", "class": "B", "float_sensitive": false, "float_sensitive_wu_label": false, "ulp_forcing_present": false, "ulp_forcing_note": "stated float:no per the WU row, confirmed — no arithmetic anywhere in the kernel, every field is a string presence/format/enum check. Forced CATEGORICAL boundary cases (hex-length off-by-one, missing sha256: prefix, out-of-vocabulary determinism_class and reviewer_ha_role coercion, empty reviewer_statement fallback) used instead of ULP forcing.", "kernel_digest": "sha256:15049d4459f060c77f8ccefdcfff425170a1c8103384869b81c002b2f12602b1", "proptest_file_digest": "sha256:608a70ec65f3dc036a1a6bfa89ecb847e3a68a1cc7fd0b2674e3cae6a78bf74a", "proptest_file": "chaingraph/kernels/__proptests__/art-380-build-ai-workpaper-record.proptest.mjs", "properties_tested": ["all_valid_exact_and_of_checks_drives_flag_and_tool_identity", "ha_record_null_unless_valid_and_identity_supplied", "ha_role_coerces_to_reviewer_when_out_of_vocab"], "fixture_oracle_result": "PASS (4/4 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-388-tempo-fee-amm-converter", "class": "B", "float_sensitive": false, "float_sensitive_wu_label": true, "ulp_forcing_present": false, "ulp_forcing_note": "WU row labeled float:yes; RECLASSIFIED float:no on direct inspection — every amount is parsed to BigInt and all fee/conversion arithmetic is exact integer BigInt math; the sole Number() calls (pool_utilization_bps, max_pool_utilization_bps) are integer-domain conversions of already-truncated quotients/small bps values, never a raw float division. Forced CATEGORICAL/boundary cases (zero reserves, smallest-nonzero-unit fee floor, amounts beyond Number.MAX_SAFE_INTEGER exercising the BigInt-to-Number pool_utilization_bps conversion, malformed-string MALFORMED_INPUT) used instead of ULP forcing.", "kernel_digest": "sha256:2d03df3ee9d7450686eb4fb59512bb3e13c77915d6a1e96c27354725185e0ca2", "proptest_file_digest": "sha256:3f1de40797d06e48342d01ceab9e013f9e7817519405984fa4ec791720a131e4", "proptest_file": "chaingraph/kernels/__proptests__/art-388-tempo-fee-amm-converter.proptest.mjs", "properties_tested": ["validator_out_plus_lp_fee_equals_user_in_exact", "lp_fee_exact_30bps_floor_division", "conversion_ok_bounded_and_reason_consistent"], "fixture_oracle_result": "PASS (3/3 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-390-tip20-memo-commitment-validator", "class": "B", "float_sensitive": false, "float_sensitive_wu_label": false, "ulp_forcing_present": false, "ulp_forcing_note": "stated float:no per the WU row, confirmed — every check is a string-length/hex-regex test or a SHA-256 digest comparison, no arithmetic. compute() is ASYNC (real crypto.subtle.digest); this harness awaits every call. Forced CATEGORICAL boundary cases (memo length off-by-one both directions, 0x-prefix and uppercase normalization, empty-string payload treated as supplied, custom locator template substitution) used instead of ULP forcing.", "kernel_digest": "sha256:2e6765cb6fedbe96e56bc75b47196c2e7243c367d754267127df2711a012aee4", "proptest_file_digest": "sha256:2363305db991e0331725dd4ac3524ce684694d9d07ed7aed5510503ff69d95f8", "proptest_file": "chaingraph/kernels/__proptests__/art-390-tip20-memo-commitment-validator.proptest.mjs", "properties_tested": ["memo_hex_valid_exact_length_and_hex_regex", "payload_commitment_match_exact_sha256_comparison", "overall_valid_implies_memo_hex_valid"], "fixture_oracle_result": "PASS (4/4 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-391-compute-canton-traffic-cost", "class": "B", "float_sensitive": true, "float_sensitive_wu_label": true, "ulp_forcing_present": true, "ulp_forcing_note": "confirmed float-sensitive as labeled — usd_traffic_cost is a raw float multiplication (envelope_mb*effective_rate), cc_burned a raw float division (usd_traffic_cost/cc_usd_price). ULP forcing covers zero/negative-zero envelope and price, denormal-range products, Number.MIN_VALUE/MAX_SAFE_INTEGER envelopes, the classic 0.1*3 non-exact double, the 1/3*3 x/y*y!==x artifact, and a NaN rate_usd_per_mb safeNum-fallback case.", "kernel_digest": "sha256:6784aa8d8ebe52de0d2ab52e2bb48d95559cd4796016eb7fd5388ca559b9d73b", "proptest_file_digest": "sha256:aa7187aaaffa057ba9e97c4304c40f9644e282748ef2a1124d5181ff62ca06c3", "proptest_file": "chaingraph/kernels/__proptests__/art-391-compute-canton-traffic-cost.proptest.mjs", "properties_tested": ["usd_traffic_cost_exact_r2_envelope_times_effective_rate", "cc_burned_bounded_and_exact_r6_division", "free_period_applies_exact_boundary_at_90_days", "ULP_boundary_forcing"], "fixture_oracle_result": "PASS (3/3 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-392-compute-canton-app-reward-estimate", "class": "B", "float_sensitive": true, "float_sensitive_wu_label": true, "ulp_forcing_present": true, "ulp_forcing_note": "confirmed float-sensitive as labeled — confirmed_share_of_traffic is a raw float division, cc_reward_estimate a raw float multiplication chain. ULP forcing covers zero/negative-zero confirmed bytes, confirmed exactly equal to round_total (share=1), round_total exactly zero (guarded div), denormal-range ratios, the classic 1/3 non-exact double, MAX_SAFE_INTEGER round_total, confirmed exceeding round_total (invalid but non-crashing), and pool_share out of the declared [0,1] range.", "kernel_digest": "sha256:a70be49eac55d78f34ee302aac5107512ea2f745d7ae0aeb0753644fac701c2f", "proptest_file_digest": "sha256:48d1668b52e39ebd893968cdd8142155cc87fdb9cb6444da1ed32a06a03c2384", "proptest_file": "chaingraph/kernels/__proptests__/art-392-compute-canton-app-reward-estimate.proptest.mjs", "properties_tested": ["confirmed_share_exact_r8_division", "reward_estimate_and_pool_cc_exact_raw_chain", "confirmed_share_bounded_0_to_1_when_confirmed_within_round_total", "ULP_boundary_forcing"], "fixture_oracle_result": "PASS (3/3 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-393-x402-v2-migration-linter", "class": "B", "float_sensitive": false, "float_sensitive_wu_label": false, "ulp_forcing_present": false, "ulp_forcing_note": "stated float:no per the WU row, confirmed — score is small-integer arithmetic (100-15*errors-4*warnings, clamped), version parsing degrades to null (never NaN) per the kernel's own X402LINT-FIX-1 comment. Forced CATEGORICAL boundary cases (all-v2/all-v1/mixed header combinations, body-based v1 delivery detection, single-vs-array accepts shape, CAIP-2 network-id regex boundary, unparseable protocol_version garbage string) used instead of ULP forcing.", "kernel_digest": "sha256:fdb16b08532bdd3b1513e88aa97cb133f64c2ea0d04d8b0556107a2d0e95caac", "proptest_file_digest": "sha256:6306ac36754718c8e38dcdeedb24f1941ec417be02227bffe65b8d4efc2e9458", "proptest_file": "chaingraph/kernels/__proptests__/art-393-x402-v2-migration-linter.proptest.mjs", "properties_tested": ["score_bounded_0_to_100", "score_exact_clamped_formula", "mixed_v1_v2_headers_always_infer_v1_and_flag_incomplete"], "fixture_oracle_result": "PASS (5/5 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-398-lint-metro2-record", "class": "B", "float_sensitive": false, "float_sensitive_wu_label": false, "ulp_forcing_present": false, "ulp_forcing_note": "stated float:no per the WU row, confirmed — score is small-integer arithmetic (100-20*errors-5*warnings, clamped) and the only other numeric path is integer day-count date arithmetic (Date.parse diff / MS_PER_DAY, Math.round), never a fractional-money or ratio computation. Forced CATEGORICAL/date-boundary cases (FCRA obsolescence exactly at 2735 days vs one day over, DOFD exactly equal to date_reported, DOFD after date_reported, current_balance exactly zero, unrecognized account-status/payment-rating codes) used instead of ULP forcing.", "kernel_digest": "sha256:608cb6a37764d1dacf9fac00e70b7a86486cfe76f10dc6c83b8ab87a4de8d3e5", "proptest_file_digest": "sha256:92a3788afd01bc7a216e31d065246866dee9d7dadc906a4abf3a0c61910618c6", "proptest_file": "chaingraph/kernels/__proptests__/art-398-lint-metro2-record.proptest.mjs", "properties_tested": ["metro2_score_exact_clamped_formula", "compliant_exact_zero_errors", "delinquent_status_bounded_to_fixed_code_set_and_dofd_required"], "fixture_oracle_result": "PASS (3/3 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-401-validate-form5500-schedules", "class": "B", "float_sensitive": true, "float_sensitive_wu_label": false, "ulp_forcing_present": true, "ulp_forcing_note": "WU row labeled float:no; RECLASSIFIED float:yes on direct inspection — the Schedule H cross-schedule tie (expected_ending = +(beginning+net_income-distributions).toFixed(2), tolerance 0.01) is a raw float sum/difference under an EPS-relative tolerance comparison, the same shape treated as float-sensitive for art-319 in an earlier shard. ULP forcing covers the classic 0.1+0.2 non-exact double sum, the exact 0.01 tolerance boundary (tie) and one cent past it (no tie), all-zero and negative-zero Schedule H figures, and large-magnitude cancellation (1e15 + -1e15).", "kernel_digest": "sha256:69b7a4767ea76f50dcf221f85f8edb02f48c36b00cf3ec3419be9ad99e00b2f4", "proptest_file_digest": "sha256:3099e2465f6bd4ab2e33236e92d9bbcccb8f1eec5c7bbcdae40e5e796a646002", "proptest_file": "chaingraph/kernels/__proptests__/art-401-validate-form5500-schedules.proptest.mjs", "properties_tested": ["arithmetic_tie_exact_tolerance_only_for_large_plans", "h_vs_i_exclusive_and_matches_large_plan_threshold", "extended_deadline_never_before_normal_deadline", "ULP_boundary_forcing"], "fixture_oracle_result": "PASS (3/3 vectors)", "run_proptests_result": "PASS" }, { "kernel_id": "art-404-check-retail-installment-disclosures", "class": "B", "float_sensitive": false, "float_sensitive_wu_label": false, "ulp_forcing_present": false, "ulp_forcing_note": "stated float:no per the WU row, confirmed — every money value is converted to integer cents via Math.round(dollars*100) and all downstream tie-out arithmetic runs on those integers; float exposure is confined to the dollars-to-cents rounding boundary. Forced CATEGORICAL/rounding-tie boundary cases (classic non-exact double 0.1*100, half-cent input 19.995, exact tolerance boundary at 500 cents and one cent past it, tolerance_cents exactly zero, all-disclosed-absent, malformed schedule_digest provenance) used instead of ULP forcing.", "kernel_digest": "sha256:06ea130127d2c462fd7cf1f689399a8c38d577cfe49220ea12f30a71eacaf87e", "proptest_file_digest": "sha256:1a3f0eafcbbf304a7cf1880c5ff61985337dd216a6632a9a6a268926c6cde5e3", "proptest_file": "chaingraph/kernels/__proptests__/art-404-check-retail-installment-disclosures.proptest.mjs", "properties_tested": ["amount_financed_exact_cents_domain_identity", "finance_charge_exact_cents_domain_difference", "within_tolerance_exact_diff_cents_bounded_by_tolerance"], "fixture_oracle_result": "PASS (4/4 vectors)", "run_proptests_result": "PASS" } ], "ulp_forcing_summary": "3 of 10 kernels carry ULP-boundary forcing (art-391, art-392, art-401) — a CORRECTION of the WU row's originally-named set of 4 (art-374, art-388, art-391, art-392). FIX-2 CARRY verification against actual kernel source found art-374 and art-388 are BigInt fixed-point kernels with no float arithmetic (reclassified float:no), while art-401's Schedule H tie is a raw float EPS-tolerance comparison the WU row had missed (reclassified float:yes). The other 7 (art-380, art-390, art-393, art-398, art-404, plus the 2 reclassified-to-no) carry forced categorical/boundary cases per the spec's float:no exception path.", "run_proptests_aggregate": "10/10 shard files passed (node scripts/run-proptests.mjs — 358/358 across the full tree, no regression in prior shards)", "fv_floor_coverage": "all 10 shard kernels confirmed absent from check-fv-floor-coverage.mjs --list-unfloored (grepped by exact mcp_name); coverage gate reports 328/582 live kernels floored, clean ratchet" }