[aien-spark]

Closes #53 together with the Omega PR linked below (ADR 0003 section 9 row 33, J1).

What this adds

• crates/synapse-store/src/j1_corpus.rs (test only): writes and seals evidence/j1-codec-corpus/corpus.bin, one language-neutral file holding every base record and checkpoint content with its logical form, and every A1 malformed case with the outcome the Rust decoder gives. The Rust codec stays the specification by test; a port is judged against these outcomes.
• 48 bases: 28 accepted (record kinds 1 to 8, the fixture and revision-log checkpoints) and 20 hand-made refusals the mutation set cannot reach (reserved kinds 9 to 11, equal map keys in each checkpoint map, equal revision seqs, the repository id rules, an empty or wrong-kind revision section, projections out of order).
• 55,670 cases (every truncation, bit flip and false u32 length of each mutated base): Rust accepts 41,750 (each asserted canonical) and refuses 13,920.
• docs/J1_OMEGA_CODEC.md: scope, logical form, file format, reproduction, speed against the section 6.2 bound, limits.
• Two small visibility changes so the exporter can reuse A1 fixtures (pub(super) in a1_tests.rs, pub(crate) checkpoint content encode/decode in codec.rs).

Parity (Omega side)

aien-dev/omega-mv#531 (repo aien-dev/omega-mv). The Omega codec (src/synapse/syn_codec.osc, interpreter and native AArch64) gives 28/28 bases decode to the Rust logical form and encode to the Rust bytes, 55,670/55,670 cases give the Rust outcome (class, offset, field, embedded code), all 41,750 accepts re-encode byte identical. Five injected bugs are each caught.

Red / green

• Red: evidence/j1-codec-corpus/red-green/red.txt (the seal test with no sealed corpus fails).
• Green: green.txt. cargo test --workspace 329 passed, 0 failed, 1 ignored; clippy -D warnings and fmt clean. Crumb recompiled with the tool built from aien-architecture d0f0b95d.

Speed (SI units, section 6.2)

Omega native, one core: decode 0.0434 GB/s (23.0 ns per record byte), encode 0.0269 GB/s; fraction of the 273 GB/s memory bound 1.59e-4 and 9.85e-5 (calc:2ef7b34c, calc:a0366c9f).

Limits

• Scope, for the ADR 0003 J1: Omega port: binary codec #53 owner to accept out loud: the J1 corpus intentionally covers the record layer only (record payloads and checkpoint content). The frame layer (frame headers, CRC checksums, the SHA-256 chain and checkpoint roots) is out of scope and belongs to J3/J4.
• WAL kinds 9, 10, 11 (open PRs feat(b4): revision state machine Private..Canonical (ADR 0003 B4) (#28) #88, feat(git,store): H1 cut 2: persistent GitOid map, native import, export from the store (#48) #96, B5: DerivationAttestation for server-derived revisions (#29) #95) are refused today; adding one means bases, a flattener arm, the coverage set and a reseal here, and one dispatch arm on the Omega side.
• The Omega unit refuses inputs above 1,000,000 bytes (loop bound); encode applies no decoder caps, like the Rust encoder.

🤖 Generated with Claude Code

[aien-spark]

Independent review (session omega repo issues, reviewer did not author)

Verdict: good to merge (no blocking findings). Reviewed head 925e7987 together with aien-dev/omega-mv#531 (head a094a9d7).

What I checked in code

• The corpus is honest. Every outcome comes from the real Rust decoder: decide() calls decode_record / CheckpointState::decode_content. Every accepted case is asserted canonical (it re-encodes to its own input) before it is written.
• The seal works. j1_sealed_corpus_is_what_the_rust_codec_gives rebuilds the corpus and compares it byte for byte with the file and with CORPUS_SHA256, so the corpus cannot drift from the codec without the test failing.
• The mutation set matches A1. mutations() is the same code as a1_malformed_corpus.rs mutations(): every truncation, every bit flip, and a false u32 length (remaining + 1, cap + 1, u32::MAX) at every offset. It covers the six first-of-kind fixture records and the fixture checkpoint that A1 mutates, plus kinds 7 and 8 and the revision checkpoint, so it is a superset of A1.
• Coverage. Record kinds 1 to 8 are all present and all mutated, all 9 refusal kinds plus accept appear, and all field ids 0 to 15 appear. The coverage test enforces each of these.
• The anchor not being in the file is fine. decode_content only stores the anchor and never uses it in a refusal.
• The logical form (LF) flattener is a second reading of the field order, but it is cross-checked. An Omega codec that decodes bytes in byte order can only match the Rust LF if the flattener's order equals the codec's byte order.

Findings (none blocking)

1. Scope against the issue wording. docs/J1_OMEGA_CODEC.md section 1 leaves out the frame layer: the WAL frame header, CRC, SHA chain and the checkpoint header/state root. So the A1 frame-level cases are not in the corpus (header length field over cap, the non-resealed CRC-refused frames, checkpoint header flips); only the resealed cases that reach the codec are. Issue ADR 0003 J1: Omega port: binary codec #53 says "the A1 malformed-frame corpus is refused identically". The split is defensible, since the frame and WAL layer is J4. The issue owner should accept it explicitly. (The doc says "J3/J4"; J3 covers SHA-256 and Ed25519 only.)
2. Mutated accepts carry no Rust LF. build() writes only the outcome for cases. For the 41,750 accepted mutations, a port is checked only by decoding and re-encoding back to the input bytes, not against a Rust LF. This is acceptable because every one of the 28 bases is pinned with its LF, but it is weaker than "decodes to the Rust value" for those cases.
3. The red run is weak. evidence/j1-codec-corpus/red-green/red.txt: the red is the corpus file being missing, not a codec change being caught, and line 2 records that it was taken while the Spark quiet flag was held. I reasoned the stronger red rather than ran it: the test compares regenerated bytes, so any codec change that moves an outcome fails it.
4. Nit: the doc names aien-dev/omega; the repository is currently aien-dev/omega-mv (old URLs redirect).

Tests rerun (fresh clone, host only, nice -n 19, -j 4, quiet flag checked first)

• cargo test --locked --workspace: 329 passed, 0 failed, 1 ignored (43 suites), including both j1_corpus tests.
• evidence/j1-codec-corpus/corpus.bin is byte-identical to omega-mv#531 tests/synapse/j1-corpus/corpus.bin, sha256 b2aba356…db50b, which matches CORPUS_SHA256.
• Omega side: see the review on omega-mv#531. 55,670 of 55,670 cases match, and the 5 injected-bug controls reproduce.

Not checked

• The Spark pipeline verdict.
• clippy and fmt.
• A Rust-side red with an actual codec change (reasoned only).

🤖 Generated with Claude Code