feat(operad+kernel): WF21 causes ValidateCausalAcyclic + round-15 ceremony

[MSD21091969]

Round-15 ceremony validator extension

Companion to ffs0 round-15 v3.14 → v3.15 ontology bump (held on wolfram/r15-ontology-v3-15-bump). Promotes 4 grammar_fragments through WF20 ceremony:

Fragment	Substrate change	Validator extension
v314-2-clock-type	clock S2 node-type with cardinality/embedding/frame/density/cycle_period	none beyond schema enums (loader.go handles via ontology.json)
v314-3-wf21-causes	WF21 causes/caused-by rewrite_category	ValidateCausalAcyclic (this PR)
v314-4-substrate-property	substrate enum + substrate_anchor_urn on channel + knowledge_item	none beyond schema (immutable + kernel-authority enforced via existing PropertySpec)
v314-6-channel-kind-video	channel.kind enum extended with video + audio	none

Only WF21 needs new code; the other three are data-driven via the loader.

ValidateCausalAcyclic

When a new LINK src --causes--> tgt is proposed, walk forward from tgt through existing WF21 causes-edges. If src is reached, reject — the new edge would close a cycle.

Rules:

1. Non-WF21 LINKs pass through (no acyclicity constraint).
2. Non-LINK rewrites (UNLINK, ADD, MUTATE) pass through.
3. Self-LINK (src == tgt) is a 1-cycle — rejected immediately.
4. BFS forward from tgt through outgoing edges where RewriteCategory=WF21 and SrcPort="causes" (true causes-direction; reverse caused-by side ignored to avoid over-detection).

Hooked into both runtime.Apply (single-envelope path) and runtime.ApplyProgram (atomic-batch path; uses workingState so intra-batch causes-LINKs cannot close cycles even when individual envelopes pass against pre-batch state).

Doctrine anchors

• kb/research/spec/07-time-fabric.md §7.3.5 — WF21 lift path
• kb/research/spec/05-external-substrates.md §5.1.5 + §5.3.5 — transitional citation surface → caused-by LINK lift
• claim:wolfram.cross-kernel-reciprocity-as-m9-prefiguration (Z440 :8000 log_seq 385) — first pre-§M9 instance of HG-resident cross-kernel coherence

Tests

8 unit tests in internal/operad/validate_causal_acyclic_test.go:

• TestValidateCausalAcyclic_NonWF21LinkPasses — pass-through for other LINK categories
• TestValidateCausalAcyclic_NonLinkPasses — pass-through for ADD/MUTATE/UNLINK
• TestValidateCausalAcyclic_SelfLinkRejected — 1-cycle
• TestValidateCausalAcyclic_NoPathPasses — disjoint subgraphs
• TestValidateCausalAcyclic_DirectCycleRejected — 2-cycle
• TestValidateCausalAcyclic_TransitiveCycleRejected — 4-cycle through B→C→D→A
• TestValidateCausalAcyclic_DAGForkPasses — fork (B→C, B→D), new edge A→B passes
• TestValidateCausalAcyclic_NonCausesPortIgnored — defensive — only true causes-direction edges followed

All passing locally. Full go test ./... green.

Round-15 deploy sequence

1. Merge this PR
2. Rebuild kernel binary on Z440 + hp-laptop (go build)
3. Merge ffs0 wolfram/r15-ontology-v3-15-bump → main (ontology to v3.15.0)
4. Restart 5 kernels (4 Z440 + 1 hp-laptop) on new binary + new ontology
5. Verify /operad/node-types reports clock; /operad/rewrite-categories reports WF21; channel.kind enum includes video+audio
6. MUTATE grammar_fragment:v314-{2,3,4,6} proposed → promoted (atomic batch)
7. MUTATE promoted → merged
8. Phase 2 LINK lifts: 4 claim caused-by LINKs + N derivation consumes/produces lifts from stochastic_weights.anchors[]

Round-15 vehicle: ffs0#42

[Copilot]

Pull request overview

Extends operad/kernel validation to support the new WF21 causes/caused-by rewrite category by enforcing acyclicity for WF21 LINK rewrites, and integrates the check into both single-envelope and batch apply paths.

Changes:

• Added Registry.ValidateCausalAcyclic implementing a forward BFS to reject WF21 LINKs that would close a causes-cycle.
• Hooked WF21 acyclicity validation into Runtime.applyWithOptions and Runtime.ApplyProgram (working-state-aware for intra-batch detection).
• Added unit tests covering pass-through cases and cycle detection scenarios for WF21 causes edges.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
internal/operad/validate.go	Adds WF21 acyclicity validator using BFS over existing causes edges
internal/kernel/runtime.go	Calls new validator during LINK validation in both Apply and ApplyProgram
internal/operad/validate_causal_acyclic_test.go	Adds unit tests for WF21 acyclicity behavior

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This file repeatedly uses graph.RewriteCategory("WF21") literals. To match existing usage of typed WF constants (graph.WF18/WF19/etc.) and reduce typo risk, consider adding graph.WF21 and using it throughout these tests and the validator.

[Copilot]

ValidateCausalAcyclic iterates via state.RelationsBySrc[cur] directly. Per GraphState docs, indexes can be nil/uninitialized (e.g., state loaded from JSON without Rebuild), and read paths are expected to tolerate that. As written, a nil RelationsBySrc will make the BFS see no outgoing edges and may incorrectly allow a cycle. Prefer using the GraphState accessor (RelationsFrom) or falling back to scanning state.Relations when the index is nil.

[Copilot]

The BFS queue uses queue = queue[1:], which repeatedly reslices and can retain the underlying array, increasing allocations/GC for large traversals. Consider an index-based queue (head integer) or a simple ring buffer pattern to keep this validation cheaper on large graphs.

Suggested change

	for len(queue) > 0 {
	cur := queue[0]
	queue = queue[1:]
	head := 0
	for head < len(queue) {
	cur := queue[head]
	head++

[Copilot]

This introduces a raw rewrite-category literal graph.RewriteCategory("WF21"). Elsewhere the codebase consistently uses typed constants (e.g., graph.WF15/WF19) to avoid typos and keep refactors centralized. Consider adding graph.WF21 in internal/graph/relation.go and using that constant here (and in tests).

[Copilot]

The doc comment says this is called with the kernel read-lock held, but the current apply paths call registry LINK validations under rt.mu.Lock() (write-lock). To avoid misleading future callers, consider rewording to something like “called with the kernel lock held / state is consistent” rather than specifying a read-lock.

Suggested change

	// rewrites. Called with the kernel read-lock held (state is consistent), in
	// the same apply path as ValidateStrataLink.
	// rewrites. Called with the kernel lock held (state is consistent), in the
	// same apply path as ValidateStrataLink.

[Copilot]

The tests only exercise states built via graph.NewGraphState (indexes initialized). Since GraphState indexes can be nil after JSON load (until Rebuild), it would be good to add a test case where Relations is populated but RelationsBySrc is nil, to ensure ValidateCausalAcyclic still detects cycles (or to enforce the intended fallback behavior).