The Derivation boundary
The Fact store records what happened, including vendor-supplied edit retention scores. It doesn’t persist Sediment’s derived Attribution, recomputed edit retention scores, final Fate, Reward, or Rollouts. Those interpretations belong to Derivations because they depend on policy. A bundle saves Derivation output as an immutable local artifact. It isn’t service state and doesn’t write results back to the Fact store. Deleting the bundle leaves the source evidence intact. Reproducing it requires the same Facts, quarantine state, mirror evidence, policy, and implementation. The pipeline keeps Derivation separate from cohort selection and export:A coherent input view
A run reads the configured organization through one read-only, repeatable-read PostgreSQL snapshot. It sees a consistent set of Facts and quarantine state while capture continues. Facts appended after the snapshot begins belong to a later run. The run also locks the relevant mirrors in sorted repository order. Fetches, renames, garbage collection, and removal can’t change their Git objects or notes while the run holds those locks. Sediment counts missing mirrors underskipped.
The manifest records the quarantine revision and mirror refs. Its as_of is the
latest visible source timestamp, not a generation time or a requested cohort
boundary. An empty organization has no as_of. Time comparisons use coordinated
universal time (UTC), including across daylight-saving changes.
One policy for both artifacts
The resolved policy includes every configured value and its defaults. One Attribution policy feeds both Attributed completions and Rollouts. One Session split assigns their training and evaluation partitions. The artifacts organize evidence differently:
Attribution explains the join between Inference calls and
commit files. A Developer decision must also match a unique Inference call in
the same organization and Session. Attributed completion assembly checks
ambiguity across organization evidence; Rollout assembly checks within each
Session.
The policy digest identifies the complete resolved configuration. Each
artifact’s Provenance records that digest, the quarantine revision, and its
implementation version. The manifest records the implementation versions for
the bundle. A policy change changes the digest; a behavior change requires an
implementation-version change. A version label doesn’t run a historical
implementation.
Train and evaluation isolation
Sediment hashes the Session identifier to assign each Session to training or evaluation. All rows from that Session stay in one partition across both artifacts. The defaulteval_fraction is 0.1; 0.0 disables the split.
This keeps one workflow’s shared message history out of the opposite partition.
It doesn’t isolate identities that span several Sessions:
The policy rejects
split.mode; it supports only eval_fraction. Stronger
holdouts depend on a versioned benchmark manifest and an export audit. A Session
split alone doesn’t support a claim about performance on unseen repositories,
prompts, or tasks.
Full Derivation before cohort selection
Sediment derives the complete organization inSEDIMENT_ORG_ID before applying
user or time filters. This preserves the evidence needed to detect ambiguous
joins. A small output cohort can still require organization-wide evidence.
An Attributed completion qualifies through its Inference call. Time selection
uses that call’s observation time, with an inclusive start and exclusive end.
A Rollout qualifies when at least one of its Inference calls falls within the
interval. Sediment retains the complete Rollout.
When the cohort specifies users, every Inference call user in a Rollout must
belong to that list. Sediment excludes and counts mixed-user Rollouts. Without a
user filter, all users in the organization remain eligible. Time bounds don’t
add an implicit user filter.
The canonical bundle
A successful run writes seven files:
The three identity and rename populations include evidence outside the selected
cohort. Each has an independent 50,000-row cap. An explicitly empty population
is valid; omitted evidence isn’t. The limits apply even when the output cohort
is small.
Validation and representation
Bundle version 4 declaresrecord_encoding: "sediment-record-json-v1".
Each JSON Lines (JSONL) row contains one record_json string holding the
canonical record. The outer row and manifest use strict JSON. The inner encoding
preserves empty values, null, unusual Unicode, and the declared Python numeric
extensions NaN, Infinity, and -Infinity. The
Lossless representation contract
defines these distinctions.
Files use deterministic row order and encoding. Counts and hashes cover their
exact bytes. Readers reject duplicate keys, trailing payload data, unknown
fields, and unsupported encodings. Bundle versions 1–3 require recomputation
from Facts.
The validator checks the complete bundle before writing, after reading, and
before bundle-based training. Its checks include:
- Inference call references, organization and Session identity, and unique Developer decision attachment.
- Complete Session calls, reconstructed Turn content, and Segment boundaries.
- Repository-qualified commit and CI evidence, source Push anchors, and
Session-to-commit observations through
as_of. - Session splits, Provenance, and consistent repeated Fact identities.
Diagnostic counts
The manifest separates three kinds of diagnostic:
Rollout continuity compares typed prior input and captured output. When that
comparison can’t prove continuity, the Turn starts a separate Segment. The
reasons are
prior_output_absent, input_history_changed, and
prior_output_not_replayed. Fragmentation preserves every Turn; it doesn’t
mean that Sediment dropped the evidence.
Bounded execution
Sediment keeps complete identity populations while processing content in complete dependency groups. Private file-backed storage lets it validate source relationships without holding every raw payload in memory together. Capacity failures stop the operation instead of truncating evidence. Bounded Derivation execution defines the storage and memory contract. Identity row limits don’t bound message bytes or database scan work.Separate projection
Derivation freezes the canonical artifacts before an export chooses a training objective. Bundle-based exports validate those artifacts, then apply one versioned Evidence recipe. Each recipe records the sources of labels, eligibility, and Reward. Direct preference optimization (DPO) defaults to human-explicit evidence. Supervised fine-tuning (SFT) defaults to curated human or edit-retention evidence. Outcome-derived recipes require explicit selection. The bundle also supports diff-shaped SFT (diff-SFT) and reinforcement learning from verifiable rewards (RLVR). Choose a training export maps these objectives to their evidence requirements.CI evidence and verdicts
A captured CI outcome records one provider run attempt and its evidence. Onlypassed and failed provide a binary verdict; neither proves code quality.
Exports recompute CI resolution from the immutable outcomes. Bundle row order
isn’t semantic attempt order.
CIResolutionPolicy groups attempts by provider run identity and orders them
by run_attempt. A null attempt sorts as 0 alongside numbered attempts. Capture
time, ingest order, URLs, and generated identifiers don’t determine that order.
A failure-then-pass retry resolves to pass with suspected-flake evidence and
default reliability 0.0.
Agreeing workflow lineages use their minimum reliability. Conflicting verdicts
produce no aggregate verdict and count ambiguous_workflow_verdicts.
Infrastructure errors and other non-verdicts carry no binary direction. The Fact
store never persists is_flake, code causality, or a resolved Reward.