core-labs/core
core-labs/core
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

feat(config,specs,tests): PR-5 — the flag register, profiles as units, and the daemon's missing fourth flag (R-3 + R-4)

Browse source 
Rank 3 on the docket. RuntimeConfig carries 32 boolean fields and nothing in
the repository stated that set, distinguished a capability flag from a posture
flag from a deployment knob, or recorded what evidence would flip any of them.
Two independent counts of the same set differed by eleven — the assessment said
"seventeen capability flags," N-7 measured 28 default-off plus 4 default-on —
and neither was wrong about what it looked at. They counted different things
because nothing declared what the set was.

R-3 (ruled A — incomplete flag set). accrue_realized_knowledge joins
CONTINUOUS_LIFE_CONFIG_FLAGS. Step D consolidates the realized facts Step B
writes, and the daemon forced the consumer without the producer: a continuous
life consolidating an empty set, which the mastery framework calls "garbage at
high speed." It shipped that way for six weeks.

The decisive evidence was in the code, not the documents. BOTH flags' comment
blocks in core/config.py already described the corrected profile —
accrue_realized_knowledge says "the production L10 process enables it alongside
persist_session_state", consolidate_determinations says "...alongside
accrue_realized_knowledge + persist_session_state". Three records (two
docstrings and the 07-25 verification doc) agreed with each other and disagreed
with four lines of code. Dormancy was a coherent ruling and would have cost
correcting three records that were RIGHT about the design; incompleteness cost
one line.

So the planned "N-6 docstring correction" deliverable DISSOLVED rather than
shipping: adding the flag made both docstrings true. Recorded explicitly,
because a PR that quietly ships less than it promised is the same divergence
class this arc exists to close.

R-4 (ruled A) — docs/specs/flag_register.md. All 32 booleans with class,
governing ADR or an honest "none", recorded rationale, and what evidence would
flip it. The classification is the load-bearing half and is stated as a
taxonomy rather than a label:
  CAPABILITY — what CORE can do; engineering may flip it on named evidence
  POSTURE    — what CORE serves or refuses AS TRUE; the wrong=0 boundary,
               ruling-only
  DEPLOYMENT — cost, lifecycle, process shape; per-deployment
estimation_enabled and composed_surface are both "= False" and are not the same
kind of thing. Nothing said so before.

Profiles are declared as the UNIT of decision (R-4's mechanism): one-shot/eval
and continuous-life. The absence of a SERVING profile is stated deliberately —
the four POSTURE serving flags each ride their own license, and grouping them
before the ledger is sealed would license by association, the outcome R-8
exists to prevent.

tests/test_flag_register.py, on the gate. BIDIRECTIONAL, because either
direction alone would have passed through both failures it exists to prevent:
a flag added to config.py and not registered fails; a register row outliving
its flag fails. The counts the register's prose states (32 / 4 ON) are pinned,
since a stale count is how this register came to be needed. Four sabotages
observed red — new unregistered flag, deleted row, orphaned row, and a flag
silently flipped ON, the last caught by two independent pins.

THREE FINDINGS THE ITEM DID NOT ANTICIPATE, all from measuring rather than
reading.

1. Accumulated permissiveness, not just hesitancy. Of the four default-ON
   flags, ONE has a governing ADR (deduction_serving_enabled / ADR-0256) and
   TWO have no recorded reason of any kind — allow_cross_language_recall and
   use_salience carry no comment block, no ADR, no criterion. In an
   architecture built on earned licenses, two permanently-on capability flags
   with no recorded decision is G-8's question inverted. Registered and
   deliberately NOT fixed: writing a rationale after the fact would invent a
   decision nobody made, which is worse than recording the absence.

2. A hollow gate inside the governance pin itself.
   test_default_on_flag_is_not_governed_by_a_proposed_adr is parameterized over
   (default-ON flag x cited ADR), so the three uncited ON flags contribute ZERO
   cases — it covered exactly one flag. Its non-vacuity guard asserted only
   that SOME flag cites an ADR, which default-off flags satisfy in abundance.
   One reformatted comment away from zero coverage with everything green: the
   failure state indistinguishable from the success state, inside the module
   written to prevent exactly that. Guard tightened to require a non-empty
   parametrization, and observed red by stripping ADR-0256's citation.

3. The daemon's own tests ran on no gate. R-3 changes what the always-on
   process does every beat, and tests/test_l10_always_on_daemon.py was in no
   curated suite — so this behaviour change would have shipped guarded solely
   by tests no gate invokes, which is the hollow-gate pattern landing on the
   exact file covering the change. Promoted to smoke WITH the change it guards.
   Measured +9.4s, +4.3% of smoke — paid deliberately, not estimated. Removed
   from full_only_baseline.txt in the same edit (both-directions ratchet; the
   baseline shrank 747 -> 746).

Red before green throughout: the assertion cfg.accrue_realized_knowledge is
True was added to the daemon test and OBSERVED FAILING before the flag existed.

H-8(c) closed by AMENDING the correction note rather than deleting it, and the
amendment is the more useful artifact. PR-1's note said the 07-25 document's
claim was false; R-3 then made that claim TRUE, so the correction note itself
went stale — in the direction nobody guards, a correction made wrong by its own
subject being fixed. Both notes now carry the commit window they apply to. A
dated correction survives its subject changing; an undated "this is false" does
not.

Also delivered, from the 2026-07-28 external-assessment triage: §5, the
declared-table index. Eight single-source-of-truth tables and the pin that makes
each true. A reader's aid, explicitly NOT a central contracts.toml — that would
add a fifth copy needing agreement with four generators and put four different
authorities in one merge surface.

Handed forward to PR-11: the 5000-beat soak recorded in
evals/l10_always_on/contract.md (2026-07-19) predates this change and therefore
describes a configuration that NO LONGER SHIPS. PR-11's re-run is the first soak
of the corrected profile, and Step B feeding Step D is exactly what a long
horizon stresses.

Closes G-6, G-8, H-6, H-8(c), H-8(d) — and H-8 in full. Wave 4's F-6 half-gate
is lifted; the Track C half is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
This commit is contained in:
Claude 2026-07-28 06:47:21 +00:00
parent b823d85d28
commit 6c67e88df1
No known key found for this signature in database
13 changed files with 498 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
chat/always_on_daemon.py
View file

@ -38,11 +38,27 @@ from engine_state import EngineStateStore
LOCK_FILENAME = "always_on.lock"
# The continuous-life config: persist the lived field/vault across reboot (Shape B+),
# learn from determined facts each beat (Step D), and REFUSE to resume a different-identity
# checkpoint (the load-time identity guard). So a daemon restart is the SAME life or it
# stops — never a silent fork.
# The continuous-life config: ACCRUE knowledge from each turn (Step B), persist the lived
# field/vault across reboot (Shape B+), learn from determined facts each beat (Step D), and
# REFUSE to resume a different-identity checkpoint (the load-time identity guard). So a
# daemon restart is the SAME life or it stops — never a silent fork.
#
# ``accrue_realized_knowledge`` joined this set on 2026-07-28 (R-3, ruled A). It was absent,
# and its absence was the assessment's F-6: Step D consolidates realized facts back into the
# held self, and Step B is the ONLY turn-path writer of the facts Step D consolidates. A
# daemon forcing D without B is a continuous life that consolidates an empty set — capability
# machinery running over nothing, which the mastery framework calls "garbage at high speed."
#
# The ruling was between "incomplete flag set" and "intended dormancy," and the evidence for
# incompleteness was in the code rather than the documents: BOTH flags' comment blocks in
# core/config.py already described this exact profile — accrue_realized_knowledge says "the
# production L10 process enables it alongside persist_session_state," and
# consolidate_determinations says "...alongside accrue_realized_knowledge +
# persist_session_state." Two flags' own documentation asserted a production configuration
# the production configuration did not have. Adding the flag makes both true; dormancy would
# have required correcting two docstrings that were right about the intent.
CONTINUOUS_LIFE_CONFIG_FLAGS: dict[str, Any] = {
"accrue_realized_knowledge": True,
"persist_session_state": True,
"consolidate_determinations": True,
"strict_identity_continuity": True,

17
core/cli_test.py
View file

@ -139,6 +139,23 @@ TEST_SUITES: dict[str, tuple[str, ...]] = {
# and sit in no curated suite, so they could not have caught it.
# Reads 30 small JSON files, <1s.
"tests/test_domain_pack_binding.py",
# R-3 / PR-5 — promoted 2026-07-28 WITH the change it guards. R-3 added
# accrue_realized_knowledge to CONTINUOUS_LIFE_CONFIG_FLAGS, which changes
# what the always-on daemon does on every beat; the only file covering that
# behaviour ran in no curated suite. Shipping a behaviour change to the
# continuous-life process guarded solely by tests no gate invokes is the
# hollow-gate pattern this arc exists to close. Measured cost: 16 tests,
# 9.4s — +4.3% on smoke, paid deliberately rather than estimated.
"tests/test_l10_always_on_daemon.py",
# PR-5 / G-8 / H-6 — docs/specs/flag_register.md must name exactly the
# RuntimeConfig booleans, in BOTH directions: a new flag cannot land
# unregistered, and a row cannot outlive its flag. A register nothing checks
# is a 33rd copy of the flag set that looks authoritative until it falls
# behind — which is precisely how CLAIMS.md (G-22) and DOMAIN_PACKS (G-23)
# drifted. Also pins the counts the register's prose states (32 / 4 ON), the
# ON surface being the only part where staleness is immediately dangerous.
# Four sabotages observed red. Pure file parsing, <1s.
"tests/test_flag_register.py",
# G-22 — CLAIMS.md is a PUBLISHED capability artifact, deterministically
# regenerable from the capability ledger + PINNED_SHAS. It published a
# superseded evidence digest for deduction_serve_v1 for two days after

18
docs/assessment/30-gap-register.md
View file

@ -64,6 +64,14 @@ Their dependency reasoning is still sound and is the ratchet's lasting contribut
The daemon forces `consolidate_determinations` but not `accrue_realized_knowledge`; the only turn-path writer of realized facts sits behind the unforced flag. As coded, the continuous life may consolidate an empty set. Incomplete flag set, or intended dormancy — **neither is documented**, and a prior verification doc asserts the opposite of the code (C-5).
**Evidence:** `CONTINUOUS_LIFE_CONFIG_FLAGS` (`chat/always_on_daemon.py:45-49`); `determine-phase` card gating table. · **Authority:** ruling (one flag + one sentence, or a documented dormancy rationale).
**CLOSED 2026-07-28 — R-3 ruled A (incomplete flag set), executed with PR-5.** `accrue_realized_knowledge` joined `CONTINUOUS_LIFE_CONFIG_FLAGS`; the daemon now forces the producer alongside the consumer. **The decisive evidence was in the code, not the documents:** *both* flags' own comment blocks in `core/config.py` already described the corrected profile — `accrue_realized_knowledge` says *"the production L10 process enables it alongside `persist_session_state`"* and `consolidate_determinations` says *"…alongside `accrue_realized_knowledge` + `persist_session_state`."* Three records (two docstrings and the 07-25 verification doc) agreed with each other and disagreed with four lines of code. Dormancy was a coherent ruling and would have cost correcting three records that were **right about the design**; incompleteness cost one line.
**The plan's "N-6 docstring correction" deliverable therefore dissolved rather than shipping** — adding the flag made both docstrings true. Recorded because a PR that quietly ships less than it promised is the same class of divergence this register exists to catch.
**Red before green:** the assertion `cfg.accrue_realized_knowledge is True` was added to `tests/test_l10_always_on_daemon.py` and **observed failing** before the flag was added. That file was in no curated suite, so the change would otherwise have shipped guarded only by tests no gate runs — it is now on the gate (measured +9.4s, +4.3% of smoke).
**Consequence for PR-11, and it is not incidental:** the 5000-beat soak recorded in `evals/l10_always_on/contract.md` (2026-07-19) ran *before* this change and therefore describes **a different configuration than the one that now ships.** PR-11's re-run is the first soak of the corrected profile, and Step B feeding Step D is exactly what a long horizon stresses.
---
## Tier B — Enforcement & instrument debt (capability exists; the guarantee doesn't)
@ -106,6 +114,16 @@ Pin 1 exists because the two gates have **already** drifted (see H-12): the loca
*(This entry originally said "seventeen." The verified count is 28 default-off. That two counts of the same set differ by eleven is itself the finding: nothing in the repository distinguishes a capability flag from a policy or deployment flag, which is exactly the classification the register must make.)*
**Evidence:** `core/config.py` at `ed06dd64` (32 `bool` fields, 28 `= False`, 4 `= True`); daemon trio (Phase 3). · **Authority:** documentation PR + per-flag evidence bars set by ruling (R-4).
**CLOSED 2026-07-28 — `docs/specs/flag_register.md`, with R-4's profile mechanism, enforced by `tests/test_flag_register.py` on the gate.** All 32 booleans registered with class, governing ADR, recorded rationale, and *what evidence would flip it*. The classification this entry called for is made explicitly and is the document's load-bearing half — **CAPABILITY** (what CORE can do), **POSTURE** (what CORE serves or refuses as true — the `wrong=0` boundary, ruling-only), **DEPLOYMENT** (cost and lifecycle). `estimation_enabled` and `composed_surface` are both `= False` and are not the same kind of thing; nothing in the repository said so before.
**The pin is bidirectional**, because one direction would have passed through both failures it exists to prevent: a flag added to `core/config.py` and not registered fails; a register row outliving its flag fails; and the counts the register's prose states (32 / 4 ON) are pinned, since a stale count is how this entry came to exist. **Four sabotages observed red**, one of them caught by two independent pins.
**Two findings the register produced that this entry did not anticipate.**
1. **Accumulated permissiveness, not just hesitancy.** Of the **four default-ON flags, one** has a governing ADR (`deduction_serving_enabled` / ADR-0256) and **two have no recorded reason of any kind** — `allow_cross_language_recall` and `use_salience` have no comment block, no ADR, no criterion. In an architecture built on earned licenses, two permanently-on capability flags with no recorded decision is this entry's question inverted. Registered, deliberately **not** fixed: writing a rationale after the fact would invent a decision nobody made.
2. **A hollow gate inside the governance pin.** `test_default_on_flag_is_not_governed_by_a_proposed_adr` is parameterized over *(default-ON flag × cited ADR)*, so the three uncited ON flags contribute **zero cases** — it covered exactly one flag — while its non-vacuity guard checked only that *some* flag cites an ADR, which default-*off* flags satisfy in abundance. One reformatted comment away from zero coverage with everything green. Guard tightened and **observed red** by stripping ADR-0256's citation.
*Also delivered here, from the 2026-07-28 external-assessment triage:* **§5, the declared-table index** — the eight single-source-of-truth tables in the repository and the pin that makes each true. A reader's aid, explicitly not a central `contracts.toml`, which would add a fifth copy needing agreement with four generators and put four authorities in one merge surface.
### G-9 · Enforcement pins unverified for three doctrine-level prohibitions
**Layer:** M1 / MG · **Leverage: 9**
(a) No verified failing pin for the no-approximate-recall law (would a cosine ranker actually fail a test?); (b) no pin that fails when a layer *bypasses* governance entirely (as distinct from governance working when called); (c) safety-pack non-swappability not verified as mechanically enforced. All three are law in `AGENTS.md`; law-enforced-by-review is weaker than law-enforced-by-test.

13
docs/assessment/31-hindrance-audit.md
View file

@ -52,6 +52,9 @@ Ranked by leverage (cognitive/structural load removed ÷ effort), per the AGENTS
**Why it hinders:** flags that must be coherent *as a set* are owned nowhere as a set. `CONTINUOUS_LIFE_CONFIG_FLAGS` is the right pattern (a named, documented flag *profile*) applied to the wrong subset.
**Better home:** the flag-default register (G-8) with named profiles (one-shot / eval / continuous-life), each profile ruled as a unit.
**Authority:** ruling on the accrual flag + the register PR.
**RESOLVED 2026-07-28 (R-3 + R-4, PR-5) — relocated to its better home, exactly as specified.** `docs/specs/flag_register.md` §4 declares profiles as the unit of decision: **one-shot/eval** (the `RuntimeConfig()` defaults — and the register states *why* that is a real reason rather than hesitancy: a fresh runtime per invocation must not pay for resume, accrual, or snapshotting it does not use) and **continuous-life** (`CONTINUOUS_LIFE_CONFIG_FLAGS`, now the coherent four rather than the incoherent three). The misplaced responsibility this entry named — *"flags that must be coherent as a set are owned nowhere as a set"* — is discharged by making the set the declared unit.
*One profile is deliberately absent and the register says so:* there is **no serving profile**. The four POSTURE serving flags are ruled individually because each rides its own license, and grouping them before the ledger is sealed would license by association — which is the outcome R-8 exists to prevent.
## H-7 · The production ingest boundary lacks the trust contract its sibling has
**Verdict:** `strained` — the standard exists and stops one layer short · **Layers:** M2
@ -86,8 +89,14 @@ The surviving delta is **not a containment hole** — refusal is fail-closed and
**(e) CORRECTED.** `expand_relation_closure`'s docstring now states that termination is structural (monotone growth over a finite triple set) and that **no path-revisit check is performed and none should be** — one would refuse sound transitive derivations. It also records that `path` is the *witnessing* step rather than full ancestry, and that extending it would move `operator_invocation` and `trace_hash`, so it is deliberately not done.
**(c) and (d) remain open**, both on **R-3** (ruled A — incomplete flag set), and both land with PR-5: the 07-25 doc's correction note, and the two `core/config.py` docstrings corrected as `accrue_realized_knowledge` joins the daemon profile.
**Authority:** docs PRs + ruling signatures (R-12 — **discharged**; R-3 for the docstrings).
**(c) and (d) CLOSED 2026-07-28 by R-3's execution in PR-5 — and they closed the opposite way round from how this entry framed them.**
The entry assumed the *records* were wrong and would be corrected. They were not. Both `core/config.py` docstrings and the 07-25 verification doc described the **intended** profile accurately; the code was missing one flag. Adding `accrue_realized_knowledge` to `CONTINUOUS_LIFE_CONFIG_FLAGS` made all three statements true, so **(d) closed with zero docstring edits.** That is what "incomplete flag set" means as a ruling, and it is why R-3 A was correct: dormancy would have required correcting three records that were right about the design.
**(c) closed by amending the correction note rather than deleting it — and the amendment is the more useful artifact.** PR-1's note said the document's claim was false. R-3 then made that claim **true**, so the correction note itself went stale, in the direction nobody guards: *a correction made wrong by its own subject being fixed.* Both notes now carry the commit window they apply to. **A dated correction survives its subject changing; an undated "this is false" does not** — recorded in the document itself, since this entry is precisely about records that stop being true.
**H-8 is now fully discharged:** (a) and (b) by R-12, (c) and (d) by R-3/PR-5, (e) by the inductive-closure docstring correction.
**Authority:** docs PRs + ruling signatures (R-12 — **discharged**; R-3 — **discharged**).
## H-9 · Dead instruments still standing as if live
**Verdict:** `superseded-in-place` (unratified) · **Layers:** MV/governance

22
docs/assessment/50-execution-plan.md
View file

@ -9,9 +9,9 @@
|---|---|
| PR-0 ruling packet (#140) · PR-1 record amendments · R-10 discharged (#138 merged) · **R-12 — both ADR amendments + the §5 verdict banner + the §6 retirement amendment** | PR-2 — CR-1/CR-2 design briefs that do not yet exist (**not** a ruling) |
| **Track A — ADR-0252 §5 run to NO-GO**, criterion pre-registered, artifact + digest committed, **verdict ratified 2026-07-28** | PR-8 — a small ADR (H-3/G-20) · PR-10 — a refactor ADR (H-4) |
| PR-4 membership + reachability ratchets · PR-6 three doctrine pins · PR-7 M2 trust table · PR-9 count-the-swallow | PR-12 — an ADR **amendment** (R-13 authorizes it; the amendment is still owed) |
| PR-4 membership + reachability ratchets · PR-6 three doctrine pins · PR-7 M2 trust table · PR-9 count-the-swallow · **PR-5 the flag register (R-3+R-4)** | PR-12 — an ADR **amendment** (R-13 authorizes it; the amendment is still owed) |
| PR-3 + PR-3b (**R-7**, Wave 1) · H-13 (served-marker defect) · H-8e (closure docstring) · G-22 (main was red; `CLAIMS.md` stale) | Track B — the fabrication ADR (standing instruction, unchanged) |
| **Closed:** G-7, G-9, G-22, H-7, H-11, H-13, H-8a, H-8b, H-8e · **Answered:** G-1 · **Discharged:** H-10 · **Pinned:** G-23 | Track C — invention, deliberately last |
| **Closed:** G-6, G-7, G-8, G-9, G-15, G-22, H-6, H-7, H-8 (**all five instances**), H-11, H-13 · **Answered:** G-1 · **Discharged:** H-10 · **Pinned:** G-23 | Track C — invention, deliberately last |
**New this arc, not in the original assessment:** **N-8** (the §5 experiment had already returned GO twice, on unmerged branches, both unsound), **N-9** (the gate "drift" was a recorded decision — PR-4's pin 1 **withdrawn** rather than built, R-14 dissolved), **G-21** (the math reader decides **1.0%** of `holdout_dev/v1`), **G-22** (`main` was red before the arc, and `CLAIMS.md` published a superseded evidence digest for two days), **H-13**, **H-14**, **H-8e**.
@ -216,7 +216,7 @@ The packet's original order was by register number. That is the wrong axis: it i
|---|---|---|---|---|
| 1 | ~~**R-12**~~ | Two ratified-ADR record amendments — ADR-0146 (daemon) and ADR-0252 ("34 organs" footnote) — **plus** the §5 verdict banner and the §6 retirement-condition amendment, landed in the same edit | **S** | **EXECUTED 2026-07-28.** Zero-risk, changed no decision. Closed **H-8(a)** and **H-8(b)**, and discharged Track A's outstanding obligation. |
| 2 | ~~R-7~~ | ~~Register supersession~~ | — | **EXECUTED** — PR-3 + PR-3b, landed 2026-07-28. Listed so the order stays readable. |
| 3 | **R-3 + R-4** | PR-5 — the flag register (`docs/specs/flag_register.md`), all 32 `RuntimeConfig` booleans, profiles as units, the pin that forbids an unregistered flag, `accrue_realized_knowledge` added to the daemon profile, the two N-6 docstrings corrected | **M** | R-3 is a **hard gate on Wave 4**; nothing automates until it resolves. R-4 is the mechanism R-3's fix must land inside, so they are one PR. |
| 3 | ~~**R-3 + R-4**~~ | PR-5 — the flag register, all 32 booleans classified, profiles as units, the bidirectional pin, `accrue_realized_knowledge` into the daemon profile | **M** | **EXECUTED 2026-07-28.** Closed **G-6, G-8, H-6, H-8(c), H-8(d)** — and **H-8 in full**. The N-6 docstring correction **dissolved**: the docstrings were right and the code was incomplete. **Wave 4's hard gate is lifted.** |
| 4 | **R-9 + R-2** | PR-11 — the L10 soak to a committed artifact with a pinned `deterministic_digest`, the ruled cadence, and R-2's "now" paragraph written into the contract *before* the re-run | **M** | Proof of life. R-2 must land first inside the same PR or the soak answers a design question by accident (the packet's own reasoning for R-2). |
| 5 | **R-13** | PR-12 — distinct-evidence counting at the seal boundary + the honest re-count of 25 ratified bands, demotions applied, `test_volume_honesty.py` moved in the same PR | **L** | Needs an ADR **amendment** (0175/0263 lineage). R-13 authorizes the demotions; it does not write the amendment. Expect served capability to shrink — that is the mechanism working. |
| 6 | **R-8** | PR-14 — the outcome-mix rule, then seal `curriculum_serve_ledger.json`. Four bands qualify on sealing (N-5) | **M** | Depends on PR-12's counting basis. This is the entire throughput frontier, one ruling wide. |
@ -289,6 +289,20 @@ Promoted out of a parenthetical in PR-4, because a parenthetical is how fifteen
### PR-5 · The flag-default register · **M** · G-8/H-6
`docs/specs/flag_register.md`: all **28** default-off flags plus the 4 default-on — current default, deliberate-posture vs accumulated-hesitancy, **what evidence flips it**, and named profiles (one-shot / eval / continuous-life) per R-4. Declared in the table, not the call site (ADR-0263 Rule 5). A pin asserts the register lists exactly the flags `core/config.py` defines — so a new flag cannot land unregistered. Includes the F-6 accrual resolution from R-3 and the N-6 docstring correction.
**LANDED 2026-07-28.** `docs/specs/flag_register.md` + `tests/test_flag_register.py` on the gate. All 32 booleans carry a class (**CAPABILITY** / **POSTURE** / **DEPLOYMENT**), a governing ADR or an honest "none", and *what evidence would flip it*. The classification is the load-bearing half: `estimation_enabled` and `composed_surface` are both `= False` and are not the same kind of thing, and nothing in the repository said so before. R-4's profiles are declared as the **unit of decision** — one-shot/eval and continuous-life — with the deliberate absence of a *serving* profile stated, since grouping the four POSTURE serving flags before the ledger is sealed would license by association.
**Three findings the item did not anticipate, all from measuring rather than reading:**
1. **Accumulated permissiveness.** Of the four default-ON flags, **one** has a governing ADR; **two have no recorded reason of any kind** — `allow_cross_language_recall` and `use_salience` carry no comment block, no ADR, no criterion. Registered, deliberately not fixed: inventing a rationale after the fact would fabricate a decision nobody made. Owed: one line each from whoever knows.
2. **A hollow gate inside the governance pin.** `test_default_on_flag_is_not_governed_by_a_proposed_adr` is parameterized over *(ON flag × cited ADR)*, so the three uncited ON flags produce **zero cases** — it covered one flag — while its non-vacuity guard only required that *some* flag cite an ADR, which default-off flags satisfy abundantly. One reformatted comment from zero coverage, fully green. Tightened, **observed red**.
3. **The daemon's own tests ran on no gate.** R-3 changes what the always-on process does every beat, and `tests/test_l10_always_on_daemon.py` was in no curated suite. Promoted with the change it guards — measured **+9.4s, +4.3% of smoke**, paid deliberately rather than estimated.
**Verification:** the R-3 assertion observed **red** before the flag was added; **four sabotages** on the register pin observed red, one caught by two independent pins; the tightened governance guard observed red by stripping ADR-0256's citation.
**One deliverable dissolved rather than shipping, and it is recorded rather than quietly dropped:** "the N-6 docstring correction." Both `core/config.py` docstrings already described the corrected profile, so adding the flag made them **true**. The documents were right about the intent; the code was incomplete. That is what R-3 A means, and a PR that silently ships less than it promised is the divergence class this plan exists to close.
**Consequence handed forward to PR-11:** the 5000-beat soak recorded in `evals/l10_always_on/contract.md` (2026-07-19) predates this change and **describes a configuration that no longer ships**. PR-11's re-run is the first soak of the corrected profile.
**Plus one page this PR is the natural home for (from the 2026-07-28 triage, proposal 6).** The repository's governing pattern is *declared in the table, not the call site* (ADR-0263 Rule 5) and it is implemented in many places — `GROUNDING_SOURCES`, `DOMAIN_PACKS`, `TEST_SUITES`, `GATE_SUITES`, `CONTINUOUS_LIFE_CONFIG_FLAGS`, the quarantine/slow registries, `PINNED_SHAS`. **Nobody can currently enumerate them, or say what enforces each.** That is a one-page index in the flag register's own document — *table → where declared → what pin makes it true* — and explicitly **not** a `contracts.toml` that centralizes them into a fifth copy needing agreement with four generators. The index is a reader's aid; the tables stay where their authority lives.
### PR-6 · Failing pins for three doctrine-level prohibitions · **M** · G-9 — **LANDED 2026-07-28**
@ -394,7 +408,7 @@ Wave 0 (rulings) ──┬─→ Wave 1 (delete) ──→ Wave 2 (enforce) ─
Hard gates, non-negotiable:
- **Track B widening ⟸ Track A verdict.** Widening under the wrong paradigm is the most expensive possible mistake in this plan.
- **Track B fixes ⟸ the fabrication ADR.** Standing instruction; serving-path truth behavior is ratification territory.
- **Wave 4 ⟸ F-6 resolved (R-3) *and* Track C exists.** An always-on process consolidating an empty set is the mastery framework's "garbage at high speed," and CORE came within one flag of it.
- ~~**Wave 4 ⟸ F-6 resolved (R-3)**~~ **— half-lifted 2026-07-28.** F-6 is resolved: the daemon now forces the producer (Step B) alongside the consumer (Step D), so the always-on process no longer consolidates an empty set. CORE shipped within one flag of the mastery framework's "garbage at high speed" for six weeks, guarded by tests no gate ran. **Wave 4 still waits on Track C existing** — that half of the gate is untouched.
- **PR-14 ⟸ PR-12 and R-8.** A ledger built on the old counting basis would have to be rebuilt; a ledger sealed without the mix rule licenses four bands on non-commitments.
---

22
docs/assessment/50-rulings.md
View file

@ -9,7 +9,23 @@
**Also ratified:** the ADR-0252 §5 **NO-GO** verdict.
**Execution order (corrected):** R-12 → R-7 → R-3+R-4 → R-9+R-2 → R-13 → R-8 → R-1/R-5/R-6/R-11.
**Executed so far:** R-7 (PR-3, PR-3b) · **R-12 (both ADR amendments + the §5 verdict banner + the §6 retirement-condition amendment)** — all landed 2026-07-28.
**Executed so far:** R-7 (PR-3, PR-3b) · **R-12** (both ADR amendments + the §5 verdict banner + the §6 retirement-condition amendment) · **R-3 + R-4** (PR-5 — the flag register, the profile mechanism, and the daemon's fourth flag) — all landed 2026-07-28.
---
### Standing delegation — 2026-07-28, granted by Shay, recorded here because an unrecorded grant is indistinguishable from an agent exceeding its authority
> *"If you think you might need me for a ruling, I instruct you to handle it based on the most masterful logic accordingly. No more pauses."*
**Scope.** The residual decisions inside the adopted docket — the sub-questions the twelve rulings left open, and any new question of the same size that arises while executing them. Concretely and by name: **R-8 C's entailed-capability floor `N`** (never specified when C was adopted); **R-11's second ruling** (option B ends in *re-ask*, not a decision); **PR-4b's gate-width choice**; **G-23's domain-membership question**; and the sequencing latitude to reorder the docket where evidence warrants.
**What the delegation does not do, and this matters more than what it does.**
1. **It does not lower the evidence bar — it raises it.** A ruling made under delegation has no second reader, so the reasoning must survive alone. Every delegated decision below is written with the options, the measured consequence of each, and the reason for the choice, in the same shape the packet used when the decider was someone else. A future reader must be able to *overturn* it, which means being able to reconstruct it.
2. **It does not extend to ratification.** ADR amendments that change a *decision*, the fabrication-fix behaviour (standing instruction), and anything that alters what CORE serves as true remain Shay's. The delegation covers rulings *inside* the plan, not the constitutional layer above it. R-12 was executed under an explicit prior ruling, not under this grant.
3. **It does not convert a hard question into a soft one.** Where the honest answer is *"the evidence does not decide this,"* the delegated ruling is to say so and pick the option that is reversible — not to manufacture confidence. `wrong=0` applies to rulings too.
**Every ruling made under this grant is marked `DELEGATED` with its date and reasoning**, so the record distinguishes what Shay decided from what I decided on his instruction. That distinction is the whole reason this section exists.
**Contract:** each ruling below is prepared so that answering it costs **one word**. The evidence is gathered, the options are enumerated, a recommendation is made with its reasoning, and the exact change that follows from each option is written out. Nothing here recommends reversing a ratified decision; R-12 amends two ADRs' *records* without touching either decision.
**How to rule:** reply with the item and your choice — e.g. `R-1 A · R-3 B · R-8 C`. Anything left unruled stays `PENDING` and blocks only the wave named in its **Blocks** line.
@ -64,7 +80,7 @@
## R-3 · The F-6 accrual flag — incomplete set, or intended dormancy?
**Status:** **RULED A** — 2026-07-28, Shay (explicit adoption) · *incomplete flag set — add `accrue_realized_knowledge` to the daemon profile* · **Register:** G-6 / H-6 · **Blocks:** Wave 4 (hard gate), PR-5.
**Status:** **RULED A — EXECUTED 2026-07-28 (PR-5)** · *incomplete flag set — `accrue_realized_knowledge` added to the daemon profile; assertion observed RED first; H-8(c)+(d) closed with **zero** docstring edits, because the docstrings were right and the code was incomplete* · **Register:** G-6 / H-6 · **Blocks:** Wave 4 (hard gate), PR-5.
**The question.** `CONTINUOUS_LIFE_CONFIG_FLAGS` (`chat/always_on_daemon.py:45-49`) forces `persist_session_state`, `consolidate_determinations`, `strict_identity_continuity` — and **not** `accrue_realized_knowledge`. The only turn-path writer of realized facts sits behind the unforced flag. **As coded, the continuous life may consolidate an empty set.**
@ -90,7 +106,7 @@ Two flags' documentation describes a production profile the production profile d
## R-4 · Flag profiles — one-shot / eval / continuous-life
**Status:** **RULED A** — 2026-07-28, Shay (explicit adoption) · *profiles + register + pin, 32 flags, incl. the `chain_depth` collapse candidate* · **Register:** G-8 / H-6 · **Blocks:** PR-5.
**Status:** **RULED A — EXECUTED 2026-07-28 (PR-5)** · *`docs/specs/flag_register.md`: 32 flags classified CAPABILITY/POSTURE/DEPLOYMENT, profiles declared as the unit of decision, bidirectional pin on the gate, four sabotages red* · **Register:** G-8 / H-6 · **Blocks:** PR-5.
**The question.** `RuntimeConfig` defines **32 boolean fields: 28 default `False`, 4 default `True`** (`allow_cross_language_recall`, `use_salience`, `discourse_planner`, `deduction_serving_enabled`). Three are daemon-forced. No document states the set, which defaults are deliberate posture versus accumulated hesitancy, or what evidence would flip each. *(The assessment said "seventeen"; the real number is 28 — N-7. Two counts of the same set differing by eleven is itself the finding: nothing in the repo distinguishes capability flags from policy flags.)*

7
docs/assessment/README.md
View file

@ -18,10 +18,13 @@ A read-only, evidence-bearing assessment of CORE's cognitive-cycle design versus
| [`31-hindrance-audit.md`](31-hindrance-audit.md) | 4 | Fourteen hindrances with fitness verdicts and better homes; **seventeen candidates examined and cleared** — five in Phase 4, six in the first 2026-07-28 external-assessment triage, six in the second (of which one, the pack/domain seam, survived as G-23) |
| [`40-assessment.md`](40-assessment.md) | 5 | The synthesis |
| [`50-execution-plan.md`](50-execution-plan.md) | 6 | **The execution plan** — five waves + five frontier tracks over every G/H entry, with the dependency gates and the risks. §0 carries **nine** corrections to the assessment found while sizing and executing it; **§2.1 carries the adopted ruling docket and its execution order** |
| [`50-rulings.md`](50-rulings.md) | 6 | **The ruling packet** — R-1…R-14, each with evidence, options, a recommendation, and the exact diff that follows from each choice. **RULED 2026-07-28: twelve adopted, R-10 and R-14 stricken, §5 NO-GO ratified.** Wave 0's deliverable, and Wave 0 is closed |
| [`50-rulings.md`](50-rulings.md) | 6 | **The ruling packet** — R-1…R-14, each with evidence, options, a recommendation, and the exact diff that follows from each choice. **RULED 2026-07-28: twelve adopted, R-10 and R-14 stricken, §5 NO-GO ratified.** Carries the **standing delegation** under which residual sub-questions are decided, and marks each ruling `EXECUTED` as it lands |
| [`../specs/flag_register.md`](../specs/flag_register.md) | — | **The flag register** (PR-5, R-3 + R-4) — all 32 `RuntimeConfig` booleans by class, governing ADR, and *what evidence flips it*; profiles as the unit of decision; §5 indexes every declared table in the repository and the pin that makes each true |
**Maintenance contract** (from §8 of the synthesis): a card whose `verified_at` falls behind a load-bearing arc is testimony, not evidence. Update cards when their subsystems move, or this directory becomes the next dead instrument it was built to replace.
**Execution status (2026-07-28, `d0bedfc1`).** Phases 0–6 produced the evidence; the arc that followed executed everything in it that needed no ruling, and **Wave 0 then closed**: twelve rulings adopted, two stricken, the §5 **NO-GO ratified**. Landed: Track A's §5 verdict (pre-registered), PR-4 (+ pin 3), PR-6, PR-7, PR-9, PR-1, PR-3 + PR-3b (Wave 1, per R-7), and three defect fixes (H-13, H-8e, G-22). Closed: **G-7, G-9, G-22, H-7, H-11, H-13**. Added: **N-8, N-9, G-21, G-22, H-13, H-14**. What remains is **owed work, not open questions** — see [`50-execution-plan.md`](50-execution-plan.md) §Status for the board and **§2.1 for the adopted docket and its execution order**.
**Execution status (2026-07-28).** Phases 0–6 produced the evidence; the arc that followed executed everything in it that needed no ruling, **Wave 0 closed** (twelve rulings adopted, two stricken, the §5 **NO-GO ratified**), and the docket then began executing in its corrected order. Landed: Track A's §5 verdict (pre-registered), PR-4 (+ pin 3), PR-6, PR-7, PR-9, PR-1, PR-3 + PR-3b (**R-7**), **R-12** (two ADR record amendments + the §5 verdict banner + the §6 retirement-condition amendment), **PR-5** (**R-3 + R-4** — the flag register, the profile mechanism, and the daemon's missing fourth flag), and four defect fixes (H-13, H-8e, G-22, G-23).
Closed: **G-6, G-7, G-8, G-9, G-15, G-22, H-6, H-7, H-8 (all five instances), H-11, H-13**. Added: **N-8, N-9, G-21, G-22, G-23, H-13, H-14**. **Wave 4's F-6 half-gate is lifted.** What remains is **owed work, not open questions** — see [`50-execution-plan.md`](50-execution-plan.md) §Status for the board and **§2.1 for the adopted docket and its execution order**.
**Standing note:** the PR #138 fabrication findings appear throughout as *measured & pinned, fix held for ADR + ratification* — recorded, never re-discovered, never fixed here, per explicit instruction.

13
docs/research/architecture-assessment-verification-2026-07-25.md
View file

@ -6,6 +6,19 @@
> **Not this document's fault alone:** `core/config.py`'s own docstrings for both flags make the same claim (recorded as H-8d in `docs/assessment/31-hindrance-audit.md`). Whether the flag set is incomplete or the dormancy is intended is ruling R-3 in `docs/assessment/50-rulings.md`; whichever way it goes, either one line of code or three records change.
>
> Everything else in this document was re-verified in the holistic assessment's Phases 2–3 and stands.
>
> ---
>
> **Second note — 2026-07-28: R-3 was ruled, and it made this document's original claim TRUE.**
> **The correction above is now itself out of date, and is kept rather than deleted because how it went out of date is the point.**
>
> R-3 (ruled **A — incomplete flag set**) added `accrue_realized_knowledge` to `CONTINUOUS_LIFE_CONFIG_FLAGS`. The production L10 process **does** now enable it, alongside `persist_session_state` and `consolidate_determinations`. So this document's sentence — *"is enabled by the production L10 process"* — is accurate as of `chat/always_on_daemon.py` at 2026-07-28, and the note above describing it as false is accurate only about the window `ed06dd64` … R-3.
>
> **What was actually wrong, restated precisely:** the document asserted a configuration that did not yet exist. It was describing the intended profile, and so were both of `core/config.py`'s docstrings (H-8d). Three records agreed with each other and disagreed with four lines of code — which is why R-3 resolved as *incomplete flag set* rather than *intended dormancy*. The dormancy reading would have required correcting three records that were right about the design.
>
> **Why this second note exists at all,** and it is the more useful lesson: a correction note is a record, and records go stale in both directions. This one was written to fix a claim, and was made wrong by that claim being fixed. **A dated correction that names the window it applies to survives its own subject changing; an undated "this is false" does not.** Both notes here now carry their commit range for that reason.
>
> F-6 is closed. The always-on life no longer consolidates an empty set — the daemon forces the producer (Step B) alongside the consumer (Step D). The 2026-07-19 soak result recorded in `evals/l10_always_on/contract.md` predates this change and therefore describes a **different configuration than the one that now ships**; re-running it under the corrected profile is PR-11.
# Independent verification of the Tier-S arc assessment (2026-07-25)

164
docs/specs/flag_register.md Normal file
View file

@ -0,0 +1,164 @@
# The Flag Register
**Status:** live · **Authority:** R-3 and R-4 (`docs/assessment/50-rulings.md`, ruled 2026-07-28) · **Register:** G-8 / H-6
**Enforced by:** `tests/test_flag_register.py` — the table below and `core/config.py` must name exactly the same set, in both directions. A flag cannot land unregistered, and a register entry cannot outlive its flag.
`RuntimeConfig` is a single frozen dataclass carrying **32 boolean fields: 28 default `False`, 4 default `True`.** Until this document existed, nothing in the repository stated that set, distinguished a *capability* flag from a *posture* flag from a *deployment* knob, or recorded what evidence would flip any of them. Two independent counts of the same set differed by eleven (the assessment said "seventeen"; N-7 measured 28 default-off) — and that disagreement was itself the finding.
---
## 0. What this register is for
A default-off flag is one of two things, and they look identical in code:
- **deliberate posture** — the capability works, and shipping it dark is the correct decision until named evidence arrives;
- **accumulated hesitancy** — nobody turned it on, nobody decided not to, and the default is an artifact of the order things were built in.
The distinction cannot be recovered from `core/config.py`, because both are spelled `= False`. This register records which is which and, for every flag, **what would change the answer**. A flag whose "what flips it" column reads *"no criterion recorded"* is not a posture. It is an open question wearing a default.
**The classes** — declared here, applied in the tables, and the reason the tables are separate:
| Class | What flipping it changes | Who may flip it |
|---|---|---|
| **CAPABILITY** | what CORE *can do* — a cognitive ability comes online | engineering, on the named evidence |
| **POSTURE** | what CORE *serves or refuses* as true | **ruling** — this is the `wrong=0` boundary |
| **DEPLOYMENT** | cost, lifecycle, process shape — not capability, not truth | per-deployment; profiles below |
The classification is the load-bearing half. `estimation_enabled` and `composed_surface` are both `= False` and are not the same kind of thing: one widens a surface, the other decides whether CORE may serve an approximation as an answer.
---
## 1. The default-ON surface — four flags, and the register's sharpest finding
These four are live in every default `RuntimeConfig`. They are the only flags whose behaviour is *on* unless someone turns them off, so they carry the highest burden of justification — and three of the four carry the least.
| flag | class | governing ADR | recorded rationale | what would turn it OFF |
|---|---|---|---|---|
| `allow_cross_language_recall` | CAPABILITY | **none** | **none — no comment block in `core/config.py`** | *no criterion recorded* |
| `use_salience` | CAPABILITY | **none** | **none — no comment block in `core/config.py`** | *no criterion recorded* |
| `discourse_planner` | CAPABILITY | **none** | yes — builds a deterministic `DiscoursePlan`; BRIEF mode is byte-identical to single-clause output | evidence that multi-clause rendering degrades a served lane |
| `deduction_serving_enabled` | POSTURE | **ADR-0256** | yes — ROBDD entailment intercepts argument-shaped turns; 716/716 `wrong=0` | a `wrong>0` result on the sealed band, which revokes the license by construction |
**Finding (measured 2026-07-28).** Of the four flags that are ON in production, **one** has a governing ADR and **two have no recorded reason of any kind** — no ADR, no comment, no criterion. In an architecture whose entire posture is *earned* licenses and *refuse-don't-guess*, two permanently-on capability flags with no recorded decision is the mirror image of the hesitancy problem this register was built to find: **accumulated permissiveness**.
This is registered, not fixed. Writing a rationale for `allow_cross_language_recall` after the fact would be inventing a decision that was never made, which is worse than recording that it is missing. **Owed:** a one-line rationale-or-flip for each, from whoever knows why they are on. Until then their "what flips it" column stays honest.
**A second-order gap, closed with this register.** `tests/test_adr_status_governance.py::test_default_on_flag_is_not_governed_by_a_proposed_adr` is parameterized over *(default-on flag × cited ADR)*. Three of the four ON flags cite no ADR, so they generate **zero** cases — the pin covers exactly one flag. Its non-vacuity guard asserts that *some* flag cites an ADR, which stays green even if the parametrization drops to zero. That guard is tightened alongside this register.
---
## 2. POSTURE flags — the `wrong=0` boundary
Flipping any of these changes what CORE serves or refuses **as true**. None may be flipped by engineering judgement; each needs a ruling. All are default-off.
| flag | governing ADR | posture | what flips it |
|---|---|---|---|
| `estimation_enabled` | ADR-0175 / ADR-0206 | a converse query CORE would refuse may return a **DISCLOSED approximate** estimate, if the predicate-class holds a SERVE license at θ_SERVE=0.99 | a sealed reliability ledger granting the license — **deliberate posture, criterion named and unmet** |
| `curriculum_serving_enabled` | ADR-0262 | exam-shaped polar questions answered from the ratified domain-chain curriculum, read OPEN-world (an untaught relation is UNKNOWN, never "no") | **R-8's outcome-mix rule + a sealed earning ledger** (PR-14). Four bands qualify on sealing |
| `ask_serving_enabled` | ADR-0262 | ASK serving allowed | the same ledger; *no independent criterion recorded* |
| `verified_serving_enabled` | ADR-0262 | VERIFIED serving allowed | the same ledger; *no independent criterion recorded* |
| `identity_wave_gate` | ADR-0244 | a flagged identity score becomes a **typed refusal** rather than a score | **R-5's discrimination bar** — γ_id separates attack signal from benign traffic poorly on the current nominal axis frame. Deliberate posture, criterion now named |
| `identity_action_surface` | ADR-0246 | the fuller induced-action admit surface layered on the wave gate | **NOT AUTHORIZED for live activation.** Thresholds are uncertified placeholders; §6.3 shows it refuses benign and adversarial traffic alike. Requires certification, then R-5's bar |
| `strict_identity_continuity` | ADR-0157 | on reboot, a changed engine identity **refuses to start** instead of warn-and-flag | deployment choice for hard-continuity operators — **forced ON in the continuous-life profile** (§4) |
`ask_serving_enabled` and `verified_serving_enabled` are the two entries here with no independent criterion. They are ADR-0262 siblings of `curriculum_serving_enabled` and are presumed to ride its ledger; that presumption is recorded rather than asserted, because nothing in the repository states it.
---
## 3. CAPABILITY flags — default-off, and what each is waiting for
Every entry preserves byte-identity when off; that is the design and it is why they accumulated. Grouped by what they are actually waiting on.
### 3a · Waiting on a transition window that has not been closed
| flag | ADR | what flips it |
|---|---|---|
| `forward_graph_constraint` | 0046 / 0047 | closes Pillar 1→2→3 coupling on the live path. Off "during the transition window" — **the window's end is not recorded** |
| `unified_ingest` | 0090 | replaces the probe-then-commit path. Off preserves bit-identity — *no criterion recorded* |
| `realizer_grounded_authority` | 0088 | makes the realizer a real surface authority. Off yields `<pending>`/`...` on ungrounded graphs — *no criterion recorded* |
| `recognition_grounded_graph` | 0144 | articulation graph derived from the admitted `EpistemicNode` rather than intent classification — *no criterion recorded* |
These four are the register's clearest **accumulated hesitancy** cluster: each shipped complete, each is off "to preserve byte-identity," and none records what would end that preservation. Byte-identity is a migration tactic, not a destination.
### 3b · Surface-widening composers (each a strict superset of the last)
| flag | ADR | what flips it |
|---|---|---|
| `composed_surface` | 0062 | depth-1 follow-up chain |
| `transitive_surface` | 0083 | multi-hop; strict superset of 0062, byte-identical at `max_depth=0` |
| `gloss_aware_cause` | 0085 | gloss-first CAUSE surfaces |
| `thread_anaphora` | 0066 | deterministic backreference on pack/teaching-tier turns |
Deliberate posture as a group: each widens what CORE says without widening what it knows, so each needs an honesty check before it earns default-on. *No per-flag criterion recorded* — a shared one would suffice and is cheaper than four.
### 3c · The always-on life (Steps B and D, and the idle loop)
| flag | ADR | what flips it |
|---|---|---|
| `accrue_realized_knowledge` | — | **Step B.** The only turn-path writer of realized facts. **Forced ON in the continuous-life profile as of 2026-07-28 (R-3)** |
| `consolidate_determinations` | — | **Step D.** Consolidates soundly-derived determinations back into the held self. **Forced ON in the continuous-life profile** |
| `persist_session_state` | 0056 / 0151 | Shape B+ full lived-state resume. **DEPLOYMENT** — `O(turns)` snapshot cost; **forced ON in the continuous-life profile** |
| `vault_probe_discoveries` | 0021 / 0148 | session vault (T1) feeds discovery contemplation at `COHERENT` only |
| `vault_promotion_enabled` | 0021 / 0148 | SPECULATIVE → COHERENT crystallization at the turn boundary |
| `auto_contemplate` | 0056 / 0150 | contemplation over pending candidates at checkpoint |
| `auto_proposal_enabled` | 0056 / 0151 | `TeachingChainProposal`s from enriched candidates on load |
| `contemplate_frontier_during_idle` | 0080 | the always-on life mines its own frontier without a user turn; SPECULATIVE-only |
| `review_derived_close_proposals` | — | proposal-only artifacts from proof-gated derived facts; review-gated, no corpus mutation |
| `discourse_contemplation` | 0080 | plan-level contemplation pre-flight; read-only, SPECULATIVE-only |
**R-3's resolution, recorded at the point of change.** `accrue_realized_knowledge` was absent from `CONTINUOUS_LIFE_CONFIG_FLAGS` while `consolidate_determinations` was forced. Step D consolidates the facts Step B writes, so the daemon forced the consumer without the producer — *a continuous life consolidating an empty set*. Ruled **incomplete flag set**, not intended dormancy, because both flags' own comment blocks already described the corrected profile: `accrue_realized_knowledge` says *"the production L10 process enables it alongside `persist_session_state`"* and `consolidate_determinations` says *"...alongside `accrue_realized_knowledge` + `persist_session_state`."* **The documents were right about the intent and the code was incomplete.** Adding the flag made both statements true; the dormancy reading would have required correcting two docstrings that were correct.
### 3d · Undocumented
| flag | class | what flips it |
|---|---|---|
| `allow_cross_language_generation` | CAPABILITY | **no comment block, no ADR, no criterion** |
| `inner_loop_admissibility` | CAPABILITY | **no comment block, no ADR, no criterion** |
With `allow_cross_language_recall` and `use_salience` from §1, these are the **four flags in `RuntimeConfig` with no recorded rationale whatsoever** — two on, two off. They are listed rather than explained, deliberately.
### 3e · Deployment surfaces
| flag | class | what flips it |
|---|---|---|
| `review_pending_proposals` | DEPLOYMENT | read-only idle sub-pass surfacing a proposal summary; a deployment that wants the surface pays for the scan |
---
## 4. Profiles — flag sets ruled as units (R-4)
R-4's mechanism: **profiles are the unit of decision, not individual flags.** A profile is a named, forced set with a stated purpose; a deployment adopts a profile rather than assembling flags. `CONTINUOUS_LIFE_CONFIG_FLAGS` was the pattern; this generalises it.
| Profile | Declared at | Forces | Purpose |
|---|---|---|---|
| **one-shot / eval** | `RuntimeConfig()` defaults | nothing | a fresh runtime per invocation. Must not pay for resume, accrual, or snapshotting it does not use — this is why the defaults are what they are, and it is a real reason rather than hesitancy |
| **continuous-life** | `chat/always_on_daemon.py::CONTINUOUS_LIFE_CONFIG_FLAGS` | `accrue_realized_knowledge`, `persist_session_state`, `consolidate_determinations`, `strict_identity_continuity` | ONE continuous life: accrue each turn, consolidate each beat, survive reboot, and refuse to resume as a different identity. **Forced, not defaulted** — these are not optional knobs for this process shape |
**Not yet a profile, and honestly so:** there is no *serving* profile. The four POSTURE serving flags (`deduction`, `curriculum`, `ask`, `verified`) are ruled individually today because each rides its own license. Grouping them before the ledger is sealed would license by association, which is exactly what R-8 exists to prevent.
---
## 5. The declared-table index
The repository's governing pattern is **declared in the table, not the call site** (ADR-0263 Rule 5). It is implemented in many places and, until now, enumerated in none — so nobody could answer *"which single-source-of-truth tables exist, and what makes each one true?"*
This index is a reader's aid, deliberately **not** a central `contracts.toml`. Centralizing these into one file would add a fifth copy that must agree with four generators, and would place four different authorities in one merge surface. Each table stays where its authority lives.
| Declared table | Where | What makes it true |
|---|---|---|
| `RuntimeConfig` booleans | `core/config.py` | **this register** + `tests/test_flag_register.py` (both directions) |
| `CONTINUOUS_LIFE_CONFIG_FLAGS` | `chat/always_on_daemon.py` | `tests/test_l10_always_on_daemon.py` (on the gate as of 2026-07-28) |
| `GroundingSource` / `GROUNDING_SOURCES` | `core/epistemic_state.py` | closed `Literal` + runtime frozenset + build-time enum-coverage test under `workbench-ui/` |
| `DOMAIN_PACKS` / `DOMAIN_OPERATOR_CLAIMS` | `core/capability/domains.py` | `tests/test_domain_pack_binding.py` (both directions) + `domain_contract_predicates` P3 |
| `TEST_SUITES` | `core/cli_test.py` | `tests/test_suite_membership.py` + `tests/full_only_baseline.txt` |
| `GATE_SUITES` | `tests/test_suite_reachability.py` | verified against `scripts/hooks/pre-push` and `scripts/ci/local-ci.sh` |
| `QUARANTINE` / `SLOW_FILES` / `SLOW_TESTS` | `conftest.py` | `pytest_collection_modifyitems` (stamps markers; never skips) |
| `PINNED_SHAS` → `CLAIMS.md` | the capability ledger | `tests/test_claims_md_is_current.py` |
---
## 6. What this register does not claim
- It does not assert that any default is **wrong**. It asserts that for 20 of 32 flags nothing recorded says whether the default is a decision.
- It does not invent rationales. Four flags have none, and the register says so rather than supplying one after the fact — a fabricated justification is worse than a recorded absence, and this repository has a register full of evidence for that.
- It does not flip anything. R-3's one change (`accrue_realized_knowledge` into the continuous-life profile) was ruled before this document existed and is recorded here, not decided here.

1
tests/full_only_baseline.txt
View file

@ -473,7 +473,6 @@ tests/test_issue_300_versor_margin.py
tests/test_kernel_facts.py
tests/test_kernel_no_new_legacy_derivation_surfaces.py
tests/test_l10_always_on.py
tests/test_l10_always_on_daemon.py
tests/test_l10_always_on_soak.py
tests/test_l10_arbitrary_interruption.py
tests/test_l10_continuity.py

29
tests/test_adr_status_governance.py
View file

@ -119,6 +119,35 @@ def test_config_flag_parse_is_not_vacuous() -> None:
cited for _, cited in flags.values()
), "no flag cites an ADR — the comment-block walker has drifted"
# PR-5, 2026-07-28 — the guard above was one citation away from being hollow.
# ``test_default_on_flag_is_not_governed_by_a_proposed_adr`` is parameterized over
# (default-ON flag x cited ADR), so a default-ON flag citing NO ADR contributes
# ZERO cases and is silently uncovered. Measured at the time this was added:
# of four default-ON flags, three cite nothing -- ``allow_cross_language_recall``,
# ``use_salience``, ``discourse_planner`` -- so the parametrization generated
# exactly ONE case, for ``deduction_serving_enabled`` (ADR-0256). The assertion
# above stayed green throughout, because default-*off* flags cite ADRs in
# abundance. If ADR-0256's citation were ever reformatted out of that comment
# block, the governance test would generate zero cases and every part of this
# module would still report success. That is the failure state looking identical
# to the success state, inside the module written to prevent exactly that.
#
# The three uncited ON flags are a real, recorded gap -- docs/specs/flag_register.md
# §1 -- and NOT something this pin should force a fake ADR reference to satisfy.
# So the assertion is the honest one: the parametrization must not be empty.
governed_on = [
(flag, adr)
for flag, (default, cited) in flags.items()
if default == "True"
for adr in cited
]
assert governed_on, (
"no default-ON flag cites an ADR, so "
"test_default_on_flag_is_not_governed_by_a_proposed_adr now generates zero "
"cases and passes vacuously. Either a citation was lost from a comment block "
"in core/config.py, or the ON surface changed — see docs/specs/flag_register.md §1"
)
@pytest.mark.parametrize(
("flag", "adr"),

173
tests/test_flag_register.py Normal file
View file

@ -0,0 +1,173 @@
"""PR-5 / G-8 / H-6 — the flag register names exactly the flags that exist.
`RuntimeConfig` carries 32 boolean fields and, until `docs/specs/flag_register.md`,
nothing in the repository stated that set. Two independent counts of it differed by
eleven — the assessment said "seventeen capability flags," N-7 measured 28 default-off
plus 4 default-on — and neither count was wrong about what it looked at. They were
counting different things because nothing declared what the set *was*.
**Why a register needs a pin at all.** A document listing 32 flags is a 33rd copy of
the flag set, and a copy that nothing checks is exactly the artifact this arc keeps
finding: it looks like a source of truth right up until it silently falls behind the
thing it describes. `CLAIMS.md` published a superseded digest for two days that way
(G-22); `DOMAIN_PACKS` and the pack manifests drifted that way (G-23). A register
without this pin would be the third instance, shipped by the arc that catalogued the
first two.
So the check runs in **both directions**, which is the only version that means
anything:
* a flag added to ``core/config.py`` and not to the register **fails** — this is the
direction that stops the register decaying into a historical document;
* a register row whose flag no longer exists **fails** — this is the direction that
stops it accumulating entries nobody can act on.
Neither direction is the interesting one on its own. A one-directional version would
have passed happily through both of the failures it exists to prevent.
"""
from __future__ import annotations
import re
from pathlib import Path
_ROOT = Path(__file__).resolve().parents[1]
_CONFIG = _ROOT / "core" / "config.py"
_REGISTER = _ROOT / "docs" / "specs" / "flag_register.md"
#: ``name: bool = True|False`` in the ``RuntimeConfig`` dataclass body.
_FIELD_RE = re.compile(r"^\s*(?P<name>\w+)\s*:\s*bool\s*=\s*(?P<default>True|False)\b")
#: A register row whose FIRST cell is a lone backticked lower_snake_case name.
#: Lower-case is required on purpose: the declared-table index in §5 lists tables
#: (``TEST_SUITES``, ``GATE_SUITES``, ``CONTINUOUS_LIFE_CONFIG_FLAGS``) in the same
#: shape, and they are not `RuntimeConfig` flags. §5 is also cut off before parsing —
#: two guards, because a parser that silently over-matches would turn this pin into a
#: source of false failures, and a pin people learn to distrust is worse than none.
_ROW_RE = re.compile(r"^\|\s*`(?P<name>[a-z][a-z0-9_]*)`\s*\|", re.MULTILINE)
#: The section that stops being about individual flags.
_INDEX_HEADING = "## 5."
def _config_flags() -> dict[str, str]:
"""``flag -> "True"|"False"``, derived from the source. Never restated."""
out: dict[str, str] = {}
for line in _CONFIG.read_text(encoding="utf-8").splitlines():
match = _FIELD_RE.match(line)
if match:
out[match.group("name")] = match.group("default")
return out
def _register_text() -> str:
text = _REGISTER.read_text(encoding="utf-8")
cut = text.find(_INDEX_HEADING)
return text[:cut] if cut != -1 else text
def _register_flags() -> set[str]:
return {m.group("name") for m in _ROW_RE.finditer(_register_text())}
def test_the_register_exists() -> None:
assert _REGISTER.exists(), (
"docs/specs/flag_register.md is missing — G-8 reopens the moment it does"
)
def test_neither_parse_is_vacuous() -> None:
"""Guard both derivations before asserting anything about their relationship.
If either side parsed to an empty (or tiny) set, the equality assertions below
would pass on nothing and this module would go quietly blind. Silence reading as
success is the exact failure mode the register was written to expose, so it is
asserted here rather than assumed.
"""
config = _config_flags()
register = _register_flags()
assert len(config) >= 30, (
f"parsed only {len(config)} bool fields from core/config.py — the field "
"regex has drifted from the dataclass"
)
assert len(register) >= 30, (
f"parsed only {len(register)} flag rows from the register — the table "
"format changed and this pin can no longer read it"
)
assert any(d == "True" for d in config.values()), (
"no default-True flag parsed — the field regex has drifted"
)
assert _INDEX_HEADING in _REGISTER.read_text(encoding="utf-8"), (
"the declared-table index heading moved; the parser's cut-off is now wrong "
"and §5's table names would be read as flags"
)
def test_every_flag_is_registered() -> None:
"""A new flag cannot land unregistered.
This is the direction that keeps the register alive. If it fails on a flag you
just added: add a row with its class, its governing ADR (or an honest "none"),
and **what evidence would flip it**. The last column is the one that matters —
a flag whose criterion is unrecorded is an open question wearing a default.
"""
unregistered = sorted(set(_config_flags()) - _register_flags())
assert not unregistered, (
"these RuntimeConfig booleans are not in docs/specs/flag_register.md: "
f"{unregistered}"
)
def test_no_register_row_outlives_its_flag() -> None:
"""The other direction: a removed flag must leave the register.
Same discipline as the suite-membership, reachability and domain-pack ratchets.
A register that keeps rows it no longer needs stops being a measurement and
becomes a story about one.
"""
orphaned = sorted(_register_flags() - set(_config_flags()))
assert not orphaned, (
"the register describes flags that no longer exist in core/config.py: "
f"{orphaned}"
)
def test_the_recorded_shape_of_the_set_matches() -> None:
"""Pin the counts the register's prose states.
The register opens by asserting "32 boolean fields: 28 default False, 4 default
True." That sentence is the thing readers quote, so it is the thing most likely
to go stale — and a stale count is how this whole register came to be needed.
"""
config = _config_flags()
on = sorted(f for f, d in config.items() if d == "True")
assert len(config) == 32, (
f"RuntimeConfig now has {len(config)} boolean fields, not 32 — update the "
"register's opening paragraph and §1 in the same change"
)
assert len(on) == 4, (
f"the default-ON surface is now {len(on)} flags, not 4: {on}. §1 of the "
"register is a per-flag table of exactly this set and must be updated — it "
"carries the highest justification burden in the document"
)
def test_the_default_on_surface_is_named_in_the_register() -> None:
"""§1 tables the ON flags by name; each must actually be ON.
The ON surface is the only part of the register where being wrong is immediately
dangerous: a flag listed as ON that is off understates what ships, and a flag
that is ON but absent from §1 ships unjustified.
"""
on = {f for f, d in _config_flags().items() if d == "True"}
section = _register_text()
start = section.find("## 1.")
end = section.find("## 2.")
assert start != -1 and end != -1, "the register's §1/§2 headings moved"
named = {m.group("name") for m in _ROW_RE.finditer(section[start:end])}
missing = sorted(on - named)
overclaimed = sorted(named - on)
assert not missing, f"default-ON flags absent from the register's §1 table: {missing}"
assert not overclaimed, (
f"the register's §1 table names flags that are not default-ON: {overclaimed}"
)

11
tests/test_l10_always_on_daemon.py
View file

@ -74,11 +74,22 @@ def test_daemon_forces_the_continuous_life_config_helper() -> None:
persist_session_state=False,
consolidate_determinations=False,
strict_identity_continuity=False,
accrue_realized_knowledge=False,
)
cfg = continuous_life_config(base)
assert cfg.persist_session_state is True
assert cfg.consolidate_determinations is True
assert cfg.strict_identity_continuity is True
# R-3 (ruled A, 2026-07-28) — the fourth flag, and the reason the set was
# incomplete rather than deliberately dormant. Step D consolidates soundly
# derived determinations back into the held self; Step B is the ONLY
# turn-path writer of the realized facts Step D consolidates. Forcing D
# without B is a continuous life that consolidates an empty set, which is
# the mastery framework's "garbage at high speed" and the hard gate on
# Wave 4. Both flags' own docstrings in core/config.py already asserted
# this profile ("the production L10 process enables it alongside ..."):
# the documents were right about the intent and the code was incomplete.
assert cfg.accrue_realized_knowledge is True
def test_run_daemon_applies_the_forced_config_to_the_runtime(tmp_path, monkeypatch) -> None: