[MaxGhenis]

Draft: waiting on independent review and CI. Follow-up to #566. Head 305b171b. OP1's adapters now take their person and tagged draws from DirectRNGStreams by default instead of the sealed ProjectionRNGRegistry. The projection is the same draw for draw; the direct class is cheaper. rng_streams="registry" keeps OP1's behavior from #566.

No sealed code changes. Against master 172f690f the branch changes nine files: open_population/harness.py, open_population/gates.py, tests/open_population/test_streams.py, the new tests/open_population/test_stream_injection.py, op1_report.md (new §6), op1_run_size.py, the new op1_run_size_injection.json, and the two tier files the recount sets (tests/tier_counts.json, tests/README-tiers.md). Engine, baselines, cola_track_a, track_b, gates.yaml, runs, scripts and tests/estimates are unchanged.

How it works

• The engine loop builds its registry itself (engine/loop.py:216–217), so the substitution lives in OP1's wrapper, _AdapterStreams (open_population/harness.py).
• At the first period it builds one DirectRNGStreams with the registry's draw index and horizon. Every slot of a period then receives one dataclasses.replace(context, rng_registry=<direct>); every other field is the loop's own object.
• All eight slots are bound. The positional generator each slot receives is the loop's, unchanged.
• _project, run_production and run_gate take rng_streams: Literal["registry", "direct"] = "direct". Any other value is refused before anything runs. OpenPopulationResult records the mode and the class that served the slots.
• Under the default, the sealed observer's refusal (below) is re-raised as IdOrStreamCollision naming rng_streams="registry", chained from the original. Only that exact plain ValueError is re-raised; every other error passes through unchanged.

Invariants

1. OP1's projection is identical whichever stream class serves the adapters' draws: every slice, every declared flow and the accounting history.
2. At every valid stream address the direct stream equals the registry's (seed, bit_generator.state and draws); at every bad address both refuse with the same exception type and message.
3. Within a run there is one direct instance and one context per period, and each slot's generator equals the loop's module generator for its period and module.
4. The two classes share the registry's public surface. Every sealed reader of a context's streams that the census finds and that runs on invented inputs gives exactly the same output from either class, and the one sealed type check refuses the direct class rather than diverging. The static scan, a heuristic with stated limits, finds no other check that tells the classes apart in the code it reads.

The guarantee is behavioural: invariant 2 at every address, the reader runs, and invariant 1 end to end. The scan is a heuristic beside them; §6 of the report states its limits as four classes (values made at run time, introspection of run-time values, files read as data, and code it does not read).

Tests

• test_stream_injection.py (new, 432 tests, unit tier):
  • end-to-end hash identity in both modes over sizes 1, 3 and 6 by draws 0, 3 and 17 at both 2027 and 2100 (18 configurations), plus 10 Hypothesis runs;
  • each sealed reader of a context's streams, run with both classes. A pinned census finds the 23 sealed places that use rng_registry, person_generator or composition_rngs_from_registry, each with the run that checks it or the reason none does. The ten runnable readers (mortality, SES mortality, earnings with three invented models, both claiming steps, di_aware_claiming, ASFR births, DI uniforms, the fertility capture and PeriodContext.person_generator) and composition_rngs_from_registry run on invented inputs with both classes, 12 Hypothesis examples each, and their outputs are compared exactly. Another test checks each reader's output depends on the draw index;
  • introspected public-surface parity, and no sealed attribute patched;
  • an AST scan of src/populace_dynamics/, a heuristic that tracks both classes. Specific checks name each kind of type check and each read of a place the catch-all trusts (__all__, docstrings, annotations, namespaces, source text, dynamic code, member introspection). Under them a catch-all reports every other use of either class, of an instance, of a module object that can reach one, and of their names as text once literal expressions are folded by a bounded folder;
  • 125 invented spellings, 123 of them also run on both classes to show each answers differently; 20 negatives; re-export tests; tests that messages carry only a path, a line and a kind;
  • accessor decorators trusted only on a property defined above them in the same class body (seven cases); literal code parsed five levels deep and reported as dynamic code past that (depths one to seven); seven working checks beside chains 3000 links long;
  • folder tests: 19 expressions past its limits, refused while holding under 1 MiB; nine limits checked at their edges; a source literal of any length kept as written; a 1 MiB budget per module, past which the scan stops with an error naming the module; one call to each of the 26 methods and 10 builtins it runs; and 300 Hypothesis expressions checked against Python;
  • a differential test and a Hypothesis property that pruning inert literal tables (done for speed) changes no scan result;
  • a binding test that compares every PeriodContext field except rng_registry with the loop's own context.
• test_streams.py: the generator comparisons also check bit_generator.state, so the existing exhaustive grid and Hypothesis tests check state too.
• The scan and the census skip, by path and before anything opens them, the two modules the project's data-access record keeps out of automated reads and the depletion-cut modules (bridge/depletion_cut*.py), so their input does not depend on who runs them. Tests pin the pattern and its three matches, and a fresh-interpreter test checks that no production or gate run imports any of them.

The one sealed type check

The scan finds one: mortality_observer.py:381 refuses any context whose registry is not exactly a ProjectionRNGRegistry. It raises ValueError before drawing, so it fails loudly. An OP1 run that composes this observer must pass rng_streams="registry"; run_production's and run_gate's docstrings say so, and no entry point composes it. The scan's hits must equal this one pinned entry exactly, so a new, moved or removed check fails the test.

Measurement

On the host, the three stream modes give the same projection hash at 25, 100 and 400 people, the same hashes as #566. At 400 people the default takes 3.13 s, against 26.50 s with every draw on the registry and 17.60 s for OP1 as merged. Peak RSS is 192 to 203 MB in every mode.

Plan

• Build (Subfleet build lane).
• Host run-size measurement in three stream modes.
• Coordinator rulings applied (8634858c): keep the observer's loud refusal with a clearer OP1 error; full 2100 grid; depletion-cut exclusion.
• Host rerun at 8634858c: tests/open_population 346 passed and 1 strict xfail; the seven-path command 665 passed, 2 skipped and 1 strict xfail. Six mutants of the new code are killed.
• Review inject-r1 at 8634858c: REVISE. One major (static type checks the old scan missed) and three minor (a field mutant the binding test missed; an RSS figure; evidence wording).
• Fixes in 33e383b4: the two-layer scan, the field-by-field binding test and the report corrections. Host rerun: tests/open_population 437 passed and 1 strict xfail; the seven-path command 756 passed, 2 skipped and 1 strict xfail; the real-tree scan still finds exactly the one pinned check. Thirteen more mutants are killed.
• Review inject-r2 at 33e383b4: REVISE. One major (13 more static checks escaped the scan outside its stated limits), one minor (no bytes regression) and a nit.
• Fixes in 5a4fc14c: the scan tracks both classes and checks reads of the places it trusts; a bounded literal folder; bytes spellings. Following the coordinator's suggestion, the guarantee is now behavioural: the reader census and runs above, with the scan presented as a heuristic. Host rerun: tests/open_population 614 passed and 1 strict xfail; the seven-path command 933 passed, 2 skipped and 1 strict xfail; the real-tree scan still finds exactly the one pinned check, and all 38 of r2's checks give hits. 32 scan and folder mutants and three stream mutants are killed.
• Review inject-r3 at 5a4fc14c: APPROVE, with one minor finding (the folder's limits were stated without their scope) and two nits (accessor decorators trusted by name; nested literal code parsed five levels deep, unstated). It also noted that dropping partition from the folder failed no test and that long + chains raised RecursionError in the scan.
• Fixes in 56fa57ca: the folder's scope stated, with a 1 MiB per-module budget; accessors trusted only on a property above them; a dynamic-code hit past five levels; a call to each folder method and builtin; stack-based walks; four spellings a mutant sweep found unpinned.
• Tier-count slot: 619282e7 merges master 172f690f without conflicts (its tree is the one git merge-tree writes), and ec888be7 recounts. tests/open_population collects 457 more node ids than master (432 new, 25 in test_streams.py), all unit, so unit moves from 18,789 to 19,246 and the total to 25,816.
• Host rerun at ec888be7 (305b171b changes only the report): tests/open_population 694 passed and 1 strict xfail; the seven-path command 1,022 passed, 2 skipped and 1 strict xfail (master's Track B change adds nine); collection 695, all unit; the real-tree scan still finds exactly the one pinned check, and every module's folded values weigh under a sixty-fourth of the budget; all 38 of r2's checks give hits; the scan at 5a4fc14c and now agree on 155 of 163 invented sources, the eight differences being the intended accessor and depth cases, and on the real tree; 24 of 25 mutants of the r3 fixes are killed (the survivor makes a path that starts None., which no module has), and all three stream mutants.
• Delta review inject-r4 naming 305b171b (GPT-6.1 Sol), covering the r3 fixes, the merge and the recount.
• Green CI at 305b171b, the tier-policy test included.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Oct 26, 2026 9:39pm UTC