decode_envelope_strict chose the capabilities its early replicate refusal
reads by what the sink's registry holds alone. A candidate, companion-only
capability, record or derivation held at the sink could then decide that
refusal, though dispatch never takes one. The gate now reads only
capabilities codecs::is_dispatchable accepts and the sink advertises, so a
held candidate gives the reason an empty registry gives
(strict_gate_ignores_a_held_capability_it_cannot_dispatch).
A pinned decode builds its ONNX session from the verified bytes, but an
ONNX tensor can name another file for its data. Run locally against the
linked ONNX Runtime, a model loaded from memory read such a file from the
process's working directory, outside every pin. neural::onnx_external now
reads the model's protobuf for a tensor stored as external data (graph
initializers, attribute tensors and subgraphs, training graphs, local
functions) and the pinned decode refuses such a model with set_incomplete,
naming the file, before the runtime sees it. Bytes that do not parse are
refused too.
wai-neural-gates.yml adds the new tests to its exact lists and counts.
determinism-tiers.md scopes its forge-run statement to the job as it was
before the pin-aware tests were added; those have no recorded forge run.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
e0d16bc14c