Green at 78 °F. Changed in the record, not the code.

Three changes, side by side

Each rebuild changed what its edit asked for, and nothing else

Three real changes to heat-engine's duramen record in the public graft-lab repository. Each was rebuilt blind from the edited record, and sent the same requests as a rebuild of the record before the edit. Every number below is from the stored runs and their signed records.

Each change was pushed to a branch of its own and rebuilt as a draft with Try a change in Specs. Change the record here does the same without a branch: Graft holds the edit (a change order).

A prose edit changed no answer at all. A rule change changed only answers its requirement names: each of the 194 is a request that sent a units other than "F". The flag edge moved 16 flags and the audit limits that go with them. In all three, the count of changes nobody asked for is 0.

Requests per diff differ because the probes come from each record: its examples, its breaking points and a sweep. The 78 °F change is compared with base rebuild q-4zFdlqCU-lLzTaaEy2fg; the other two with DgHyeHH8U--OK9lwfiAU_w, a second rebuild of the same unchanged record (d843e00, 215 of 215 cases, $0.31) whose own diff against the first found 0 changed paths in 1,628 requests.

1. Before

At 79 °F, the program says white

The record's flag table (requirement FL-001) said white below 80 °F and green from 80 °F up to 85 °F. Graft's base rebuild of that record passed every case.

2. The edit

One sentence of intent, twelve lines of record

The intent: green starts at 78 °F instead of 80 °F. Here is every line that changed, from git diff lab/heat..lab/heat-78 in the public graft-lab repository, grouped by what each part is for. Three files, 12 lines in, 12 out. Unchanged lines are trimmed.

    | flag | wet-bulb °F | label |-   | `white` | `w < 80` | `low` |-   | `green` | `80 ≤ w < 85` | `moderate` |+   | `white` | `w < 78` | `low` |+   | `green` | `78 ≤ w < 85` | `moderate` |    | `yellow` | `85 ≤ w < 88` | `high` |  table flagF    | wetBulbF | result.flag | result.flagDartLabel |-   | 79.99    | "white"     | "low"                |-   | 80       | "green"     | "moderate"           |+   | 77.99    | "white"     | "low"                |+   | 78       | "green"     | "moderate"           |    | 84.99    | "green"     | "moderate"           |    | 85       | "yellow"    | "high"               |

    `inputs` `{"wetBulbF": wetBulbF}`; `constants`-   `{"white_max":80,"green_max":85,"yellow_max":88,"red_max":90}`; `result_summary`+   `{"white_max":78,"green_max":85,"yellow_max":88,"red_max":90}`; `result_summary`  example flagF {"wetBulbF": 86.5}-   expect audit.constants = {"white_max": 80, "green_max": 85, "yellow_max": 88, "red_max": 90}+   expect audit.constants = {"white_max": 78, "green_max": 85, "yellow_max": 88, "red_max": 90}

  table flagC    | wetBulbC           | result.flag |-   | 26.66666666666666  | "white"     |+   | 26.66666666666666  | "green"     |    | 30                 | "yellow"    |  example flagC {"wetBulbC": 26.66666666666666}-   expect audit.result_summary = "wetBulbC=26.66666666666666 → wetBulbF=80.0000 → white"+   expect audit.result_summary = "wetBulbC=26.66666666666666 → wetBulbF=80.0000 → green"

id,source_ref,wet_bulb_f,expected_flag,expected_flag_dart_label,notes-fm-003-just-below-white-green,usmc-6200-1e,79.99,white,low,…-fm-004-at-white-green,usmc-6200-1e,80.00,green,moderate,… (≥ 80 is green).+fm-003-just-below-white-green,usmc-6200-1e,77.99,white,low,…+fm-004-at-white-green,usmc-6200-1e,78.00,green,moderate,… (≥ 78 is green).fm-005-just-above-white-green,usmc-6200-1e,80.01,green,moderate,…

const FLAG_CITE = 'USMC 6200.1E Table 3-1';-const BOUNDS = { white_max: 80, green_max: 85, yellow_max: 88, red_max: 90 };+const BOUNDS = { white_max: 78, green_max: 85, yellow_max: 88, red_max: 90 };const LABEL = { white: 'low', green: 'moderate', yellow: 'high', red: 'extreme', black: 'critical' };-const band = (w) => (w < 80 ? 'white' : w < 85 ? 'green' : w < 88 ? 'yellow' : w < 90 ? 'red' : 'black');+const band = (w) => (w < 78 ? 'white' : w < 85 ? 'green' : w < 88 ? 'yellow' : w < 90 ? 'red' : 'black');

3. The free check

A half-done edit is caught before anything is spent

First we checked an edit that changed the record but not the oracle. Graft ran duramen check and graded it thin: the examples now said green, the oracle still said white. Then the full edit, oracle included, graded strong. Neither check runs a model, and neither cost anything.

The edit is breaking (a reading of 79 °F was white and is now green), and the record still says 1.5.0-slice. A draft rebuild isn't held to the version; a change order is, and would wait for 2.0.0-slice (Change it in Graft).

4. The rebuild

Rebuilt blind from the edited record

Graft wrote a brief from the record, two builders that never saw the code wrote the program again, and a judge they can't reach tested each build. The first build passed, and waits as a draft.

5. After

What changed, and what didn't

Graft sent the same 1,892 requests, one answer each, to the kept build of the base rebuild and to the new build, and explained every answer that differs against the record's edit. Read the first line first.

6. The receipt

A signed record you can check yourself

Every rebuild ends with a record signed by graftfork.com with Ed25519. This one names the draft branch, both builds and their verdicts, and the behaviour diff above.

node --input-type=module -e '
import { readFileSync } from "node:fs";
const e = JSON.parse(readFileSync("po1qEN54ReZWLwQmIakuqQ.json", "utf8"));
const { keys } = await (await fetch(
  "https://graftfork.com/.well-known/graft-record-key")).json();
const k = keys.find((x) => x.id === e.key);
const b64 = (s) => Buffer.from(s, "base64");
const pub = await crypto.subtle.importKey("raw", b64(k.public),
  "Ed25519", false, ["verify"]);
const ok = await crypto.subtle.verify("Ed25519", pub,
  b64(e.signature), new TextEncoder().encode(e.payload));
const r = JSON.parse(e.payload);
const b = r.behaviour;
console.log(ok ? "Valid (key " + k.id + "): " + r.run + ", " + r.outcome
  + ", suite " + r.suite.passed + "/" + r.suite.total + ", "
  + b.unexplained + " unexplained of " + b.requests : "NOT valid");'

Valid (key 4f153e80bf9364d7): po1qEN54ReZWLwQmIakuqQ, passed,
  suite 215/215, 0 unexplained of 1892

Valid: signed by graftfork.com (key 4f153e80bf9364d7).
Draft rebuild po1qEN54ReZWLwQmIakuqQ of branch lab/heat-78,
kept: github.com/craigm26/graft-lab
examples/heat-engine/heat.duramen to
examples/heat-engine/regen/impl/t06-ts (heat-engine 1.5.0-slice),
suite 215/215, 2 build(s). Against rebuild q-4zFdlqCU-lLzTaaEy2fg:
1892 requests, 6 part(s) of the answer changed, 0 change(s) the
record didn't ask for. Started by an agent (token tok_mc-qDIxvjkj5).

7. The honest part

You never touch the implementation. You do touch the oracle.

How rebuilds work · Change the software by changing the record · The diff on GitHub

Second change: a label rename

A prose edit, and not one answer changed

FL-003 was titled "Non-finite °F". We retitled it "Non-finite wet-bulb °F" and bumped the version. Nothing about what the program answers was meant to change, so nothing should.

-spec heat-engine 1.5.0-slice+spec heat-engine 1.5.1-slice  …-req FL-003 "Non-finite °F"+req FL-003 "Non-finite wet-bulb °F"

Compared with the kept build of the unchanged record, 0 paths changed in 1,760 requests, and 0 were unexplained. A retitled requirement is prose; the program it rebuilt answers the same.

Draft rebuild 8ijUl7wBOYkwN21ATgZHgA of commit 64cc436, finished 2026-11-01T06:07:33Z, against build 1 of DgHyeHH8U--OK9lwfiAU_w. Of the 1,500 hidden requests, the oracle itself couldn't answer 1 (a wetBulb request at 1.7976931348623157e+308 °C), and it doesn't count. Download the signed record; the check in step 6 prints Valid (key 4f153e80bf9364d7): 8ijUl7wBOYkwN21ATgZHgA, passed, suite 215/215, 0 unexplained of 1760.

Third change: a new rule

A new reject rule changed exactly what it says

A °C reading sent to flagF by mistake would be classified as °F. The new requirement FL-007 lets a caller say "units": "F", and refuses any other value with bad_request. Without units, flagF answers as before.

-spec heat-engine 1.5.0-slice+spec heat-engine 1.6.0-slice  op flagF-  input wetBulbF num+  input wetBulbF num, units? string  …+req FL-007 "Units"+  text+    `units` is optional. When present it MUST be `"F"`; any other value is a `bad_request` error, so a °C+    reading sent to `flagF` by mistake is refused instead of classified as °F. Without it, `flagF` reads+    `wetBulbF` as °F, as before.+  example flagF {"wetBulbF": 86, "units": "F"}+    expect result = {"flag": "yellow", "flagDartLabel": "high"}+  example flagF {"wetBulbF": 30, "units": "C"}+    expect error = "bad_request"

-  flagF: (i, c) => O.flagF(num(i, 'wetBulbF'), c),+  flagF: (i, c) => { if (has(i, 'units') && i.units !== 'F') throw new Bad(); return O.flagF(num(i, 'wetBulbF'), c); },

Compared with the kept build of the unchanged record, 194 answers changed and every one became bad_request: each was a request with a units other than "F", which the old program ignored. 0 changes nobody asked for. For example, flagF {"wetBulbF": 9007199254740992, "units": "/"} went from black, critical to bad_request.

Free check D1R2EvxTve06fvQyHClInw and draft rebuild 6wwJt3NhpaD7pa7INWuJpg, both of commit e0d21d0; the rebuild finished 2026-11-01T06:15:42Z, against build 1 of DgHyeHH8U--OK9lwfiAU_w. 15 paths changed: 7 in all 194 answers, 2 in 146, 6 in 48. Download the signed record; the check in step 6 prints Valid (key 4f153e80bf9364d7): 6wwJt3NhpaD7pa7INWuJpg, passed, suite 217/217, 0 unexplained of 1960.