feat(causal): Phases 1–5 — check/analyze/diff, evidence, expectations, observation, ledger

[imaimai17468]

Summary (issues #321, #322, #323, #360, #364)

Phases 1–5 of the review-only causal profile per docs/DESIGN-causal.md (stacked on PR #367; merge #367 first or merge this PR to get both).

FSL never proves real-world causality. Every causal output carries formal_result: "not_run" and do_not_assume; no output path attaches proved/verified to a claim; there is deliberately no causal verify (asserted by test).

What's included

Phase 1 (#321): check/analyze/diff

• Parser, typed model, SCC-condensed analyses (15 findings), projections (graph/timeline/traceability), diff, CLI fslc causal check|analyze|diff, LSP sniff, Worker waiver.

Phase 2 (#322): evidence overlay

• fsl-causal-evidence.v0 artifacts, lifecycle chains, deterministic per-claim causal_support, 16 evidence/measurement findings, --evidence/--lifecycle/--as-of CLI.

Phase 3 (#323): expectation lowering

• expectation compiler → leadsTo ... within ticks with pulse ghost for action triggers; fslc causal verify-expectations (causal-expectations.v0).

Phase 4 (#360): observation bridge

• fslc causal observe-expectations replays expectations against production JSONL logs using BoundedLivenessMonitor; generates fsl-causal-evidence.v0 artifacts with design: "observational", support: "inconclusive", assurance: "replay-observed".

Phase 5 (#364): portfolio ledger

• fslc causal ledger integrates claims, validation plans, evidence, and observations into a per-claim projection with 12 deterministic attention reasons (validation_plan_missing, current_evidence_missing, observation_not_directional_support, etc.).
• New fsl-causal-validation-plan.v0 schema for immutable plan artifacts with claim pins, design, scope, observation window, measurements, and opaque external refs.
• Plan lifecycle reuses fsl-causal-evidence-lifecycle.v0.
• Every claim appears regardless of plan/evidence; retired claims have no attention; output is byte-stable.

Not changed

rust/fsl-runtime, rust/fsl-solver*, rust/fsl-verifier, Public Kernel v1, src/fslc/ (frozen Python).

Evidence

• cargo fmt --check / workspace clippy -D warnings clean
• cargo test -p fslc-rust --test causal_cli — 33 tests ok (5 ledger + 5 observe + 23 existing)
• Pass/violated goldens for verify-expectations and observe-expectations
• Claim axes invariant: formal_assurance: "not_run" and causal_support hold across all verdicts
• Ledger determinism: byte-stable output on repeated runs
• Attention reasons fire correctly for missing plans, missing evidence, observation-only, etc.
• Schema inventory: 38

Closes #321
Closes #322
Closes #323
Closes #360
Closes #364

🤖 Generated with Claude Code

[imaimai17468]

Pushed three follow-up commits; this PR now covers Phase 2 (#322) as well as Phase 1 (#321), since the work stacks on the same branch:

1. fix(causal): v0 schemas aligned with the emitted envelope (fsl field required per convention; state node kind) — all dogfood outputs shape-validate.
2. test(wasm): causal models registered as reviewed-unsupported parity documents (Worker exposes only check/verify by standing policy; an unreviewed causal file still fails loudly).
3. feat(causal-evidence) (closes feat(causal-evidence): claim別support overlayとscope/freshness検査を追加する #322): fsl-causal-evidence.v0 artifact validation (closed vocabularies, claim ID + content-version pins, canonical-JSON sha256 digests, reserved observation object forcing observational+inconclusive), independent append-only fsl-causal-evidence-lifecycle.v0 digest chains, deterministic per-claim causal_support (version pin + subsumes scope + declared freshness + active lifecycle + window ≥ min lag; one lineage = one vote; staleness only vs explicit --as-of), the causal_evidence_graph projection, 16 evidence/measurement findings, 3 new schemas (inventory 34), digest-stamped example artifact + chain, docs/skills updates.

Invariant held by test in both phases: evidence never changes formal_assurance: "not_run" — causal_support and formal assurance stay orthogonal.

Evidence: workspace fmt/clippy/tests green (86/86 binaries); ./tools/check-native-integration.sh exit 0 (browser parity 351 cases) re-run after Phase 2.

Closes #321
Closes #322

[imaimai17468]

Pushed Phase 3 (#323) — causal expectation lowering — onto this branch:

• expectation declarations in the causal parser (trigger action alias.name or inline predicate alias { <kernel expr> }, response predicate, within N clock <name>, derived_from_claim; the legacy supports field name is a parse error).
• Fail-closed compiler (fsl-tools/src/causal_expectation.rs): unknown/foreign clocks, fractional tick conversion (within × ticks ÷ units must divide evenly — nothing rounded), unresolved references, and non-kernel targets all refuse. Action triggers lower to a one-step pulse ghost (set true by the trigger action, false by every other action) so the generated leadsTo ... within ticks means "within N ticks of the action firing" without touching guards or deadlock behavior — semantic equivalence with a hand-written pulse encoding is asserted by test.
• fslc causal verify-expectations model.fsl [--depth K] (causal-expectations.v0, schema inventory 35): verdict pass/violated with assurance: "bounded"; a violation of any pre-existing property is an error ("fix the spec first") so expectation verdicts never absorb baseline bugs.
• Central invariant, held by pass AND violated goldens (examples/causal/incident_response.fsl): the derived claim's formal_assurance stays "not_run" and causal_support is untouched — derived_from_claim is two-way traceability only. Claims themselves are never lowered; there is still no causal verify alias.
• Docs: LANGUAGE §17 (en/ja, site regenerated), skills rule ("never summarize an expectation verdict as the causal claim's status"), DESIGN-causal.md §14, CHANGELOG.

Evidence: workspace fmt/clippy/tests green (86/86 binaries; causal CLI suite now 22 tests); ./tools/check-native-integration.sh exit 0 re-run after Phase 3.

Closes #321
Closes #322
Closes #323

[rizumita]

Ran a 4-pronged review (coupled-change, soundness, vacuity, and a design-conformance pass against docs/DESIGN-causal.md) against the PR worktree (commit f871c93). Summary — the core "never attach proved/verified to a causal claim" firewall holds everywhere I could exercise it (the observation-bridge evidence and the expectation-compiler output both correctly stay at not_run/inconclusive across generation and validation), and all causal-specific tests pass (causal_cli 28/28, fsl-tools 51/51, fsl-syntax 41/41, causal_docs_contract 2/2). But there's one concrete shipped bug and a few gaps worth a fast-follow before this leaves draft:

Bug: rust/fsl-tools/src/causal.rs's validate_loops (~1199-1208) has a doc comment stating unknown-lag edges should be included in the zero-lag-cycle check ("cannot prove a positive delay"), but the code does Lag::Unknown => false, excluding them. A cycle composed entirely of lag: unknown edges passes causal check without the causal_instantaneous_loop error the comment says it should get. No test exercises this case. Cheap, concrete fix.

Gaps (non-blocking, advisory-axis only):

• rust/fsl-lsp/src/index.rs's +4/-1 diff only suppresses a parser crash; it doesn't add causal/claim/variable/etc. to declaration_keyword/INDEX_KEYWORDS, so go-to-definition/hover/document-symbols don't work for causal blocks yet.
• formal_assurance:"not_run"/causal_support:"untested" are independently hardcoded string literals at 10+ call sites with no shared constructor/type enforcing them — correct everywhere today, but nothing structurally prevents a future site from typing something else.
• Claim-version/retired-lifecycle enforcement and evidence-side extra-dimension handling inherit the same gaps flagged in the #367 design review (both only affect the advisory causal_support axis, not the proved/verified firewall).
• Minor: the PR description's "15 causal-review findings" — I only observed 8 total findings across the 3 real causal-model examples; worth reconciling in the description.

Nothing here blocks the phase 1–4 architecture; recommend fixing the lag: unknown loop bug before this comes out of draft, and filing the LSP-index and claim-axis-typing gaps as fast-follow issues.

[imaimai17468]

@rizumita レビューありがとうございます。指摘3件すべて修正しました：

Bug: Lag::Unknown が零遅延サイクル検出から除外

validate_loops の Lag::Unknown => false を true に修正。コメントの記述（"unknown lag, which cannot prove a positive delay"）とコードを一致させました。unknown-lag のみで構成されるサイクルが causal_instantaneous_loop として拒否されることを検証するテストも追加。

f4bbc6a fix(causal): include unknown-lag edges in instantaneous loop detection

Gap: LSP index に causal キーワード未登録

declaration_keyword に causal（Namespace）、claim / expectation（Property）、variable（Variable）を追加。INDEX_KEYWORDS に timebase, horizon, scope, clock, feedback, evidence, polarity, lag, persists, basis, status, version, binds, observes, latent, proxy, cadence, trigger, response, derived_from_claim, uses を追加。

Gap: formal_assurance:"not_run" / causal_support:"untested" のハードコード

fsl-tools/src/causal_evidence.rs に FORMAL_ASSURANCE_NOT_RUN / CAUSAL_SUPPORT_UNTESTED 定数を追加し、causal_evidence.rs、causal_ledger_projection.rs、fslc/src/main.rs の10+箇所を定数参照に置換。

2ef9802 fix(causal): add LSP causal keywords and replace hardcoded axis literals with constants

---

このPRには Phase 4 (#360: observe-expectations) と Phase 5 (#364: portfolio ledger) も追加されています。fmt / clippy clean、causal_cli 33テスト pass。

[rizumita]

再レビュー済みです。content_changed_without_version_bump、retired claim の再活性化・再提案検出、片側だけの scope dimension の unassessable 判定が実装・schema・英日ドキュメントで整合しました。observation window と claim version の負例も生成 artifact を evidence overlay に再投入して除外を検出する形になっています。最新 main との競合および Claim 公開名衝突も解消され、ローカルの完全 native integration gate と GitHub CI 5件すべて成功を確認しました。

[rizumita]

最新 main (#411) の取り込み後も causal 契約修正と負例に影響がないことを再確認しました。承認を更新します。

The merge-base changed after approval.